home *** CD-ROM | disk | FTP | other *** search
Text File | 1999-03-24 | 141.6 KB | 3,277 lines
[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= ========================================================================== = <=-[ HWA.hax0r.news ]-=> = ========================================================================== [=HWA'99=] Number 8 Volume 1 1999 Feb 27th 99 ========================================================================== "I got the teenage depression, thats all i'm talkin about, if you dunno what i mean then you better look out, look out!" - Eddie & The Hotrods * This issue is a bit of a mess and i've missed some important news i'm running behind and playing catchup with the move to a weekly release schedule, i'm trying the best I can bear with me as we try and get our shit together. Only a mediocre zine is always at its best - Ed Synopsis -------- The purpose of this newsletter is to 'digest' current events of interest that affect the online underground and netizens in general. This includes coverage of general security issues, hacks, exploits, underground news and anything else I think is worthy of a look see. This list is NOT meant as a replacement for, nor to compete with, the likes of publications such as CuD or PHRACK or with news sites such as AntiOnline, the Hacker News Network (HNN) or mailing lists such as BUGTRAQ or ISN nor could any other 'digest' of this type do so. It *is* intended however, to compliment such material and provide a reference to those who follow the culture by keeping tabs on as many sources as possible and providing links to further info, its a labour of love and will be continued for as long as I feel like it, i'm not motivated by dollars or the illusion of fame, did you ever notice how the most famous/infamous hackers are the ones that get caught? there's a lot to be said for remaining just outside the circle... <g> @HWA =-----------------------------------------------------------------------= Welcome to HWA.hax0r.news ... #8 =-----------------------------------------------------------------------= "I dunno what i'm doing, but i'm damn good at it" - Seen on a button worn by `Ed'.. ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** *** *** *** please join to discuss or impart news on techno/phac scene *** *** stuff or just to hang out ... someone is usually around 24/7*** ******************************************************************* =-------------------------------------------------------------------------= Issue #8 big endian release, Feb 27th 1999 Empirical knowledge is power =--------------------------------------------------------------------------= inet.d THIS b1lly the llammah ________ ------- ___________________________________________________________ |\____\_/[ INDEX ]__________________________________________________________/| | | || | | Key Content || \|_________________________________________________________________________/ 00.0 .. COPYRIGHTS 00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC 00.2 .. SOURCES 00.3 .. THIS IS WHO WE ARE 00.4 .. WHAT'S IN A NAME? why `HWA.hax0r.news'? 00.5 .. THE HWA_FAQ V1.0 \__________________________________________________________________________/ 01.0 .. Greets 01.1 .. Last minute stuff, rumours, newsbytes 01.2 .. Mailbag 02.0 .. From the editor 02.1 .. Canc0n99/2k still on schedule ... 02.2 .. ShadowCon 99 02.3 .. Another gem from Phiregod 03.0 .. News from the UK by Qubik 03.1 .. Hackers Reportedly Seize British Military Satellite 04.0 .. Cracker makes off with $100K 04.1 .. SANS WEB BRIEFING ;WHAT THE HACKERS KNOW ABOUT YOUR SITE III; 05.0 .. Copyrights on security advisories? 06.0 .. Book review: "Top Secret Intranet", Fredrick Thomas Martin, 1999, 0-13-080898-9, 07.0 .. MCI Worldcom joins security force 08.0 .. New EFnet server? ex 'packet kiddie' 15 yr old sez sure, and why not? 09.0 .. DISA WEB RISK ASSESSMENT TEAM 10.0 .. Wanna try a ping -f at 10-Gbps from your home box? 11.0 .. Thieves Trick Crackers Into Attacking Networks 12.0 .. How Nokia Guards Against Crackers 13.0 .. BILL H.R 514 COULD BAN PERSONAL "ACTION" FREQUENCY MONITORING 14.0 .. Linux autofs overflow in 2.0.36+ 15.0 .. Linux RedHat sysklogd vulnerability 16.0 .. Microsoft Security Bulletin (MS99-007) Taskpads Scripting Vulnerability 17.0 .. Security risk with Computer Associates' (CA) ARCserveIT backup software EF.F .. Effluent: (misc shit that doesn't fit elsewhere, and humour etc) AD.S .. Post your site ads or etc here, if you can offer something in return thats tres cool, if not we'll consider ur ad anyways so send it in. H.W .. Hacked Websites www.l0pht.com and www.hackernews.com hacked?? A.0 .. APPENDICES A.1 .. PHACVW linx and references ____________________________________________________________________________ |\__________________________________________________________________________/| | | || | | pHEAR || | | || | | Do you phear the script kiddie? do you know him? check out this || | | HNN article .... http://www.hackernews.com/orig/buffero.html || | | || | | || \|_________________________________________________________________________|/ @HWA'99 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ). Important semi-legalese and license to redistribute: YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE APPRECIATED the current link is http://welcome.to/HWA.hax0r.news IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL ME PRIVATELY current email cruciphux@dok.org THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS: I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE AND REDISTRIBUTE/MIRROR. - EoD Although this file and all future issues are now copyright, some of the content holds its own copyright and these are printed and respected. News is news so i'll print any and all news but will quote sources when the source is known, if its good enough for CNN its good enough for me. And i'm doing it for free on my own time so pfffft. :) No monies are made or sought through the distribution of this material. If you have a problem or concern email me and we'll discuss it. cruciphux@dok.org Cruciphux [C*:.] 00.1 CONTACT INFORMATION AND MAIL DROP ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Has it occurred to anybody that "AOL for Dummies" is an extremely redundant name for a book? - unknown Wahoo, we now have a mail-drop, if you are outside of the U.S.A or Canada / North America (hell even if you are inside ..) and wish to send printed matter like newspaper clippings a subscription to your cool foreign hacking zine or photos, small non-explosive packages or sensitive information etc etc well, now you can. (w00t) please no more inflatable sheep or plastic dog droppings, or fake vomit thanks. Send all goodies to: HWA NEWS P.O BOX 44118 370 MAIN ST. NORTH BRAMPTON, ONTARIO CANADA L6V 4H5 WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are ~~~~~~~ reading this from some interesting places, make my day and get a mention in the zine, send in a postcard, I realize that some places it is cost prohibitive but if you have the time and money be a cool dude / gal and send a poor guy a postcard preferably one that has some scenery from your place of residence for my collection, I collect stamps too so you kill two birds with one stone by being cool and mailing in a postcard, return address not necessary, just a "hey dude being cool in Bahrain, take it easy" will do ... ;-) thanx. Ideas for interesting 'stuff' to send in apart from news: - Photo copies of old system manual front pages (optionally signed by you) ;-) - Photos of yourself, your mom, sister, dog and or cat in a NON compromising position plz I don't want pr0n. <g> - Picture postcards - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250 tapes with hack/security related archives, logs, irc logs etc on em. - audio or video cassettes of yourself/others etc of interesting phone fun or social engineering examples or transcripts thereof. If you still can't think of anything you're probably not that interesting a person after all so don't worry about it <BeG> Our current email: Submissions/zine gossip.....: hwa@press.usmc.net Private email to editor.....: cruciphux@dok.org Distribution/Website........: sas72@usa.net @HWA 00.2 Sources *** ~~~~~~~~~~~ Sources can be some, all, or none of the following (by no means complete nor listed in any degree of importance) Unless otherwise noted, like msgs from lists or news from other sites, articles and information is compiled and or sourced by Cruciphux no copyright claimed. HiR:Hackers Information Report... http://axon.jccc.net/hir/ News & I/O zine ................. http://www.antionline.com/ *News/Hacker site................. http://www.bikkel.com/~demoniz/ *DOWN!* News (New site unconfirmed).......http://cnewz98.hypermart.net/ Back Orifice/cDc..................http://www.cultdeadcow.com/ News site (HNN) .....,............http://www.hackernews.com/ Help Net Security.................http://net-security.org/ News,Advisories,++ ...............http://www.l0pht.com/ NewsTrolls (HNN)..................http://www.newstrolls.com/ News + Exploit archive ...........http://www.rootshell.com/beta/news.html CuD ..............................http://www.soci.niu.edu/~cudigest News site+........................http://www.zdnet.com/ +Various mailing lists and some newsgroups, such as ... +other sites available on the HNN affiliates page, please see http://www.hackernews.com/affiliates.html as they seem to be popping up rather frequently ... * Yes demoniz is now officially retired, if you go to that site though the Bikkel web board (as of this writing) is STILL ACTIVE, www.hwa-iwa.org will also be hosting a webboard as soon as that site comes online perhaps you can visit it and check us out if I can get some decent wwwboard code running I don't really want to write my own, another alternative being considered is a telnet bbs that will be semi-open to all, you will be kept posted. - cruciphux http://www.the-project.org/ .. IRC list/admin archives http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk alt.hackers.malicious alt.hackers alt.2600 BUGTRAQ ISN security mailing list ntbugtraq <+others> NEWS Agencies, News search engines etc: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.cnn.com/SEARCH/ http://www.foxnews.com/search/cgi-bin/search.cgi?query=cracker&days=0&wires=0&startwire=0 http://www.news.com/Searching/Results/1,18,1,00.html?querystr=cracker http://www.ottawacitizen.com/business/ http://search.yahoo.com.sg/search/news_sg?p=cracker http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=cracker http://www.zdnet.com/zdtv/cybercrime/ http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column) NOTE: See appendices for details on other links. Referenced news links ~~~~~~~~~~~~~~~~~~~~~ http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm http://freespeech.org/eua/ Electronic Underground Affiliation http://www.l0pht.com/cyberul.html http://www.hackernews.com/archive.html?122998.html http://ech0.cjb.net ech0 Security http://net-security.org Net Security ... Submissions/Hints/Tips/Etc ~~~~~~~~~~~~~~~~~~~~~~~~~~ "silly faggot, dix are for chix" - from irc ... by unknown ;-) All submissions that are `published' are printed with the credits you provide, if no response is received by a week or two it is assumed that you don't care wether the article/email is to be used in an issue or not and may be used at my discretion. Looking for: Good news sites that are not already listed here OR on the HNN affiliates page at http://www.hackernews.com/affiliates.html Magazines (complete or just the articles) of breaking sekurity or hacker activity in your region, this includes telephone phraud and any other technological use, abuse hole or cool thingy. ;-) cut em out and send it to the drop box. - Ed Mailing List Subscription Info (Far from complete) Feb 1999 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~ ISS Security mailing list faq : http://www.iss.net/iss/maillist.html THE MOST READ: BUGTRAQ - Subscription info ~~~~~~~~~~~~~~~~~~~~~~~~~~~ What is Bugtraq? Bugtraq is a full-disclosure UNIX security mailing list, (see the info file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to bugtraq, send mail to listserv@netspace.org containing the message body subscribe bugtraq. I've been archiving this list on the web since late 1993. It is searchable with glimpse and archived on-the-fly with hypermail. Searchable Hypermail Index; http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html About the Bugtraq mailing list ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following comes from Bugtraq's info file: This list is for *detailed* discussion of UNIX security holes: what they are, how to exploit, and what to do to fix them. This list is not intended to be about cracking systems or exploiting their vulnerabilities. It is about defining, recognizing, and preventing use of security holes and risks. Please refrain from posting one-line messages or messages that do not contain any substance that can relate to this list`s charter. I will allow certain informational posts regarding updates to security tools, documents, etc. But I will not tolerate any unnecessary or nonessential "noise" on this list. Please follow the below guidelines on what kind of information should be posted to the Bugtraq list: + Information on Unix related security holes/backdoors (past and present) + Exploit programs, scripts or detailed processes about the above + Patches, workarounds, fixes + Announcements, advisories or warnings + Ideas, future plans or current works dealing with Unix security + Information material regarding vendor contacts and procedures + Individual experiences in dealing with above vendors or security organizations + Incident advisories or informational reporting Any non-essential replies should not be directed to the list but to the originator of the message. Please do not "CC" the bugtraq reflector address if the response does not meet the above criteria. Remember: YOYOW. You own your own words. This means that you are responsible for the words that you post on this list and that reproduction of those words without your permission in any medium outside the distribution of this list may be challenged by you, the author. For questions or comments, please mail me: chasin@crimelab.com (Scott Chasin) BEST-OF-SECURITY Subscription Info. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ _/_/_/ _/_/ _/_/_/ _/ _/ _/ _/ _/ _/_/_/ _/ _/ _/_/ _/ _/ _/ _/ _/ _/_/_/ _/_/ _/_/_/ Best Of Security "echo subscribe|mail best-of-security-request@suburbia.net" or "echo subscribe|mail best-of-security-request-d@suburbia.net" (weekly digest) For those of you that just don't get the above, try sending a message to best-of-security-request@suburbia.net with a subject and body of subscribe and you will get added to the list (maybe, if the admin likes your email). Crypto-Gram ~~~~~~~~~~~ CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on cryptography and computer security. To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a blank message to crypto-gram-subscribe@chaparraltree.com.á To unsubscribe, visit http://www.counterpane.com/unsubform.html.á Back issues are available on http://www.counterpane.com. CRYPTO-GRAM is written by Bruce Schneier.á Schneier is president of Counterpane Systems, the author of "Applied Cryptography," and an inventor of the Blowfish, Twofish, and Yarrow algorithms.á He served on the board of the International Association for Cryptologic Research, EPIC, and VTW.á He is a frequent writer and lecturer on cryptography. CUD Computer Underground Digest ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This info directly from their latest ish: Computer underground Digestááá Suná 14 Feb, 1999áá Volume 11 : Issue 09 ááááá ááááááááááááááááááááá ISSNá 1004-042X áááááá Editor: Jim Thomas (cudigest@sun.soci.niu.edu) áááááá News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu) áááááá Archivist: Brendan Kehoe áááááá Poof Reader:áá Etaion Shrdlu, Jr. áááááá Shadow-Archivists: Dan Carosone / Paul Southworth ááááááááááááááááááááááááá Ralph Sims / Jyrki Kuoppala ááááááááááááááááááááááááá Ian Dickinson áááááá Cu Digest Homepage: http://www.soci.niu.edu/~cudigest [ISN] Security list ~~~~~~~~~~~~~~~~~~~ This is a low volume list with lots of informative articles, if I had my way i'd reproduce them ALL here, well almost all .... ;-) - Ed Subscribe: mail majordomo@repsec.com with "subscribe isn". @HWA 00.3 THIS IS WHO WE ARE ~~~~~~~~~~~~~~~~~~ 'A "thug" was once the name for a ritual strangler, and is taken from the Hindu word Thag... ' - Ed Some HWA members and Legacy staff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cruciphux@dok.org.........: currently active/editorial darkshadez@ThePentagon.com: currently active/man in black fprophet@dok.org..........: currently active/IRC+ man in black sas72@usa.net ............. currently active/IRC+ distribution vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black dicentra...(email withheld): IRC+ grrl in black Foreign Correspondants/affiliate members ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ATTENTION: All foreign correspondants please check in or be removed by next issue I need your current emails since contact info was recently lost in a HD mishap and i'm not carrying any deadweight. Plus we need more people sending in info, my apologies for not getting back to you if you sent in January I lost it, please resend. N0Portz ..........................: Australia Qubik ............................: United Kingdom system error .....................: Indonesia Wile (wile coyote) ...............: Japan/the East Ruffneck ........................: Netherlands/Holland And unofficially yet contributing too much to ignore ;) Spikeman .........................: World media Please send in your sites for inclusion here if you haven't already also if you want your emails listed send me a note ... - Ed http://www.genocide2600.com/~spikeman/ .. Spikeman's DoS and protection site Contributors to this issue: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ liquid phire......................: underground prose Qubik ............................: Hacking in Germany+ Spikeman .........................: daily news updates+ ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** ******************************************************************* :-p 1. We do NOT work for the government in any shape or form.Unless you count paying taxes ... in which case we work for the gov't in a BIG WAY. :-/ 2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news events its a good idea to check out issue #1 at least and possibly also the Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ... @HWA 00.4 Whats in a name? why HWA.hax0r.news?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Well what does HWA stand for? never mind if you ever find out I may have to get those hax0rs from 'Hackers' or the Pretorians after you. In case you couldn't figure it out hax0r is "new skewl" and although it is laughed at, shunned, or even pidgeon holed with those 'dumb leet (l33t?) dewds' <see article in issue #4> this is the state of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you up and comers, i'd highly recommend you get that book. Its almost like buying a clue. Anyway..on with the show .. - Editorial staff 00.5 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Also released in issue #3. (revised) check that issue for the faq it won't be reprinted unless changed in a big way with the exception of the following excerpt from the FAQ, included to assist first time readers: Some of the stuff related to personal useage and use in this zine are listed below: Some are very useful, others attempt to deny the any possible attempts at eschewing obfuscation by obsucuring their actual definitions. @HWA - see EoA ;-) != - Mathematical notation "is not equal to" or "does not equal" ASC(247) "wavey equals" sign means "almost equal" to. If written an =/= (equals sign with a slash thru it) also means !=, =< is Equal to or less than and => is equal to or greater than (etc, this aint fucking grade school, cripes, don't believe I just typed all that..) AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21) AOL - A great deal of people that got ripped off for net access by a huge clueless isp with sekurity that you can drive buses through, we're not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the least they could try leasing one?? *CC - 1 - Credit Card (as in phraud) 2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's CCC - Chaos Computer Club (Germany) *CON - Conference, a place hackers crackers and hax0rs among others go to swap ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk watch videos and seminars, get drunk, listen to speakers, and last but not least, get drunk. *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker speak he's the guy that breaks into systems and is often (but by no means always) a "script kiddie" see pheer 2 . An edible biscuit usually crappy tasting without a nice dip, I like jalapeno pepper dip or chives sour cream and onion, yum - Ed Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger Vanilla Ice is a wigger, The Beastie Boys and rappers speak using ebonics, speaking in a dark tongue ... being ereet, see pheer EoC - End of Commentary EoA - End of Article or more commonly @HWA EoF - End of file EoD - End of diatribe (AOL'ers: look it up) FUD - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt", usually in general media articles not high brow articles such as ours or other HNN affiliates ;) du0d - a small furry animal that scurries over keyboards causing people to type wierd crap on irc, hence when someone says something stupid or off topic 'du0d wtf are you talkin about' may be used. *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to define, I think it is best defined as pop culture's view on The Hacker ala movies such as well erhm "Hackers" and The Net etc... usually used by "real" hackers or crackers in a derogatory or slang humorous way, like 'hax0r me some coffee?' or can you hax0r some bread on the way to the table please?' 2 - A tool for cutting sheet metal. HHN - Maybe a bit confusing with HNN but we did spring to life around the same time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper noun means the hackernews site proper. k? k. ;& HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d MFI/MOI- Missing on/from IRC NFC - Depends on context: No Further Comment or No Fucking Comment NFR - Network Flight Recorder (Do a websearch) see 0wn3d NFW - No fuckin'way *0WN3D - You are cracked and owned by an elite entity see pheer *OFCS - Oh for christ's sakes PHACV - And variations of same <coff> Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare Alternates: H - hacking, hacktivist C - Cracking <software> C - Cracking <systems hacking> V - Virus W - Warfare <cyberwarfare usually as in Jihad> CT - Cyber Terrorism *PHEER - This is what you do when an ereet or elite person is in your presence see 0wn3d *RTFM - Read the fucking manual - not always applicable since some manuals are pure shit but if the answer you seek is indeed in the manual then you should have RTFM you dumb ass. TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0 TBA - To Be Arranged/To Be Announced also 2ba TFS - Tough fucking shit. *w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions from the underground masses. also "w00ten" <sic> 2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers) *wtf - what the fuck *ZEN - The state you reach when you *think* you know everything (but really don't) usually shortly after reaching the ZEN like state something will break that you just 'fixed' or tweaked. 01.0 Greets!?!?! yeah greets! w0w huh. - Ed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks to all in the community for their support and interest but i'd like to see more reader input, help me out here, whats good, what sucks etc, not that I guarantee i'll take any notice mind you, but send in your thoughts anyway. Shouts to: * Kevin Mitnick * demoniz * The l0pht crew * tattooman * Dicentra * Pyra * Vexxation * FProphet * TwistedP * NeMstah * the readers * mj * Kokey * ypwitch * kimmie * tsal * spikeman * YOU. * #leetchans ppl, you know who you are... * all the people who sent in cool emails and support * our new 'staff' members. kewl sites: + http://www.freshmeat.net/ + http://www.slashdot.org/ + http://www.l0pht.com/ + http://www.2600.com/ + http://hacknews.bikkel.com/ (http://www.bikkel.com/~demoniz/) + http://www.legions.org/ + http://www.genocide2600.com/ + http://www.genocide2600.com/~spikeman/ + http://www.genocide2600.com/~tattooman/ + http://www.hackernews.com/ (Went online same time we started issue 1!) @HWA 01.1 Last minute stuff, rumours and newsbytes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "What is popular isn't always right, and what is right isn't always popular..." - FProphet '99 +++ When was the last time you backed up your important data? ++ CRACKER SENTENCED TO 1 YEAR PRISON by deepcase, Wednesday 24th Feb 1999 on 3:42 pm ; via help net security Sean Trifero, a 21 year old cracker from Rhode Island, has been sentenced to 1 year prison and $32,650 payment for the damage he did to serval universities he hacked . Between 1996 and 1997 he broke into Harvard University and Amherst College. - Wired ++ CROATIAN TROJAN USER CAUGHT by BHZ, Wednesday 24th Feb 1999 on 12:31 pm ; via help net security Another trojan user caught by the police. This time Croatian police caught young "hacker", who used NetBus and Back orifice to enter remote computers, and to delete some files. He was spreading trojan servers over ICQ. Well stupid thing to do, cause HiNet, ISP in Croatia (strange but Croatia has only one major ISP), has been monitoring for 31337 port sweepers for couple of months. "Hacker" is juvenile, so no prison sentence for him. Original article was posted in Croatian daily newspaper Vecernji List. ++ Big Three Telecom Carriers Make Big Promises The Big Three carriers all said they have end-to-end services that integrate voice, data, and video traffic. But a closer look reveals AT&T, MCI WorldCom, and Sprint may be a little further from full rollouts than they're letting on. http://www.techweb.com/wire/story/TWB19990224S0009 ++ ALASKA ISPS CLAIM TELCO SNOW JOB (BUS. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/business/story/18082.html The Last Frontier's Net service providers are battling a telco that is offering free access and owns the link to the Lower 48. By Polly Sprenger. ++ WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are ~~~~~~~ reading this from some interesting places, make my day and get a mention in the zine, send in a postcard, I realize that some places it is cost prohibitive but if you have the time and money be a cool dude / gal and send a poor guy a postcard preferably one that has some scenery from your place of residence for my collection, I collect stamps too so you kill two birds with one stone by being cool and mailing in a postcard, return address not necessary, just a "hey dude being cool in Bahrain, take it easy" will do ... ;-) thanx. you know where to look for the address it appears earlier in this file ... ++ PRIVACY HACK ON PENTIUM III (TECH. Tuesday) http://www.wired.com/news/news/email/explode-infobeat/technology/story/18078.html The editors at a German computer magazine have discovered a hack for the controversial Pentium III serial number. Is it as safe as Intel claims? (the short answer is no, the long answer is no but what use is it in the end?) By Leander Kahney. ++ NEW CELL PHONE 'GETS' THE WEB (TECH. Tuesday) http://www.wired.com/news/news/email/explode-infobeat/technology/story/18076.html Nokia is the first to roll out a cell phone based on a protocol meant to shuttle data originating on the Internet to users on the go. ++ RUBIK'S CUBE AND Y2K (TECH. Tuesday) http://www.wired.com/news/news/email/explode-infobeat/technology/story/18075.html What's the connection? The same kid who solved that darned puzzle at age 12 has resurfaced to pitch a solution for the millennium bug. ++ FCC CLOSING NET CALL LOOPHOLE (BUS. Tuesday) http://www.wired.com/news/news/email/explode-infobeat/business/story/18077.html The agency is expected to approve a measure to keep new local phone companies from cashing in on Net calls. Also: US West sees slower growth.... Broadcast.com gets better flicks.... and more. ++ 'MY NEW JOB DOESN'T SUCK.' FIRED MED EDITOR LANDS ON NET (CULT. 7:35 am) http://www.wired.com/news/news/email/explode-infobeat/culture/story/18098.html George Lundberg, canned by a major medical journal for running an oral-sex survey article during the impeachment trial, is named editor in chief of Medscape. ++ VIRGINIA PASSES ANTI-SPAM BILL (Feb 26th POL. 7:35 am) http://www.wired.com/news/news/email/explode-infobeat/politics/story/18097.html The governor says he'll sign the legislation, which would make sending junk email a crime and include stiff punitive penalties. AOL likes it; the ACLU doesn't. ++ THINNER, SEXIER PALMPILOTS (Feb 22nd TECH. 9:30 am) http://www.wired.com/news/news/email/explode-infobeat/technology/story/18045.html The world's most successful handheld organizer gets lighter and sleeker with the introduction of a couple of cousins. Say hello to the Palm V and the Palm IIIx. By Chris Oakes. ++ WHOLE FOODS GOING ONLINE (Feb 22nd BUS. 7:30 am) http://www.wired.com/news/news/email/explode-infobeat/business/story/18042.html The natural-foods grocer establishes an e-commerce subsidiary. It hopes to offer 6,000 products online this spring, and become profitable within two years. ++ MP3 PLAYS SILICON ALLEY (Feb 22nd CULT. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/culture/story/18027.html Two big names in MP3, Chuck D and Michael Robertson, spread the word about digital download at the annual Silicon Alley conference. David Kushner reports from New York. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ++ A NEW CHIP OFF AN OLD BLOCK (Feb 22nd TECH. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/technology/story/18035.html Pioneer chipmaker Advanced Micro Devices unveils its K6-3 microprocessor, a product aimed squarely at Intel's new Pentium III. Analysts are ready with buckets of cold water. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ++ Train Technology at Center of Patent Action A joint venture that includes industrial giant General Electric Co. has sued a company founded by the inventor of the air brake for allegedly infringing on two patents for locomotive remote controls. The suit, filed in Delaware federal court by GE Harris Railway Electronics LLC, a joint venture between GE and Harris Corp., said that Westinghouse Air Brake Co. employs technology licensed to GE Harris. The technology at issue is used in systems that enable engineers in a front locomotive to remotely control several locomotives placed throughout a winding train. (Delaware Law Weekly -- For complete story, see http://www.lawnewsnetwork.com/stories/feb/e022399d.html) ++ Microsoft begins embedded NT beta http://www.news.com/News/Item/0%2C4%2C32687%2C00.html?dd.ne.txt.0222.15 ++ MCI WorldCom Accelerates Academic Backbone MCI WorldCom quadruples the capacity of its research and academic high-speed network with the installation of an OC-48 link between L.A. and San Francisco. http://www.techweb.com/wire/story/TWB19990222S0004 ++ IBM Plans System-On-Chip Products Big Blue announces it will start designing custom semiconductors that will hold both memory and logic functions. http://www.techweb.com/wire/story/TWB19990222S0003 ++ Judge Clarifies Microsoft Injunction The software giant is free to sell Java tools that it built itself without help from Sun's Java code. http://www.techweb.com/wire/story/msftdoj/TWB19990219S0026 ++ This is cool i've been waiting for this to take hold for years - Ed E-Book Poised To Eclipse 10,000 Units Sold Booksellers and publishers are converting hundreds of book titles to the e-book format. http://www.techweb.com/wire/story/TWB19990219S0025 ++ WHERE THE BIG BOYS ARE (Feb 22nd CULT. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/culture/story/18039.html Players in the videogame industry are big and getting bigger. Consolidation is their only defense against the Net and software piracy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ++ TAKING THE STAND AT ANTITRUST II (Feb 22nd POL. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/politics/story/18036.html Computer industry leaders are expected to testify as the government prepares for another high-profile antitrust case. This time the target is Intel Corp. 01.2 MAILBAG - and more last minute newsbytes from SPikeman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ . . . . . . . Date: Mon, 22 Feb 1999 19:02:59 +0100 (CET) From: Dariusz Zmokly <ak8735@box43.gnet.pl> Subject: zine hi ! I would like to subscribe and get your zine via email. see ya globi / I am linux enthusiast / globi on irc channels #plug #coders / . . . . . . . !>We don't currently have majordomo up and running but we're planning on doing this in the not so distant future, at that time the zine will be mailed out to all subscribers so you don't have to keep hitting the site for your copy we'll keep you posted on this in the zine or on the site... -Ed . . . . . . . From: "steve" <orders@hempbc.com> To: <hwa@press.usmc.net> Subject: Question -- Date: Sun, 21 Feb 1999 12:53:45 -0800 If this is a Canadian Con why are you asking ofr US funds? It seems odd to me. - cvt !>This is a good point and you'll notice on the updated con page which has its own redirector now http://come.to/canc0n99/ that this has been changed to $15 cdn or $10 us. thanks for the input. - Ed . . . . . . . Date: Sun, 28 Feb 1999 10:33:54 -0800 From: Spikeman <spikeman@myself.com> Reply-To: spikeman@myself.com X-Mailer: Mozilla 3.03 (Win16; U) MIME-Version: 1.0 To: cruciphux@dok.org Subject: (no subject) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit E-caveat emptor An eBay spokesman said he could not give any more details on the type of transactions involved, which agency had contacted the company, or why the statement had been delayed almost a month. The company did say the inquiry is unrelated to Microsoft's stepping up its scrutiny of pirated software trading on the service. http://www.news.com/News/Item/0%2C4%2C33001%2C00.html?dd.ne.txt.wr eBay also also made the news for temporarily blocking an ad from EarthLink that it didn't think complied with the rules of personal online trading. By week's end, Earthlink agreed to play by the rules and its offer was restored. http://www.news.com/News/Item/0%2C4%2C32957%2C00.html?dd.ne.txt.wr http://www.news.com/News/Item/0%2C4%2C32992%2C00.html?dd.ne.txt.wr Elsewhere, Compaq temporarily suspended sales agreements with as many as ten companies, including Buy.com, Cyberian Outpost, and even its own Shopping.com. Analysts said Compaq is worried about losing control of the distribution channel. Microsoft too wrestled with the problem of managing resellers in relaunching its online store. http://www.news.com/News/Item/0%2C4%2C32929%2C00.html?dd.ne.txt.wr http://www.news.com/News/Item/0%2C4%2C32990%2C00.html?dd.ne.txt.wr For some, the challenge is simply keeping the Web site up and running. Charles Schwab's site for online investors crashed for about an hour an one half on Wednesday, a glitch the brokerage firm blamed on a "mainframe problem." Schwab is not the first e-trader to suffer during a boom in online trading. http://www.news.com/News/Item/0%2C4%2C32847%2C00.html?dd.ne.txt.wr Undaunted, the highly anticipated Drugstore.com launched this week, and e-commerce giant Amazon.com--also backed by venture capitalist Kleiner Perkins--said it would buy a major stake. Both companies face stiff competition, both from e-tailers and brick-and- morter providers. Home Depot also said it expected to get into the online business later this year. http://www.news.com/News/Item/0%2C4%2C32838%2C00.html?dd.ne.txt.wr http://www.news.com/SpecialFeatures/0%2C5%2C32538%2C00.html?dd.ne.txt.wr Though e-commerce stocks are down between a third to one-half of the 52-week highs reached late last year, some analysts discern buying opportunities. One reason: the e-tailers are seen as acquisition targets. http://www.news.com/News/Item/0%2C4%2C32805%2C00.html?dd.ne.txt.wr Marketing headaches Intel launched its long-awaited Pentium III chip, but continued to encounter marketing headaches caused by an ID feature meant to facilitate, of all things, e-commerce. Privacy advocates worry it could used for nefarious purposes. IBM, Dell, and Gateway said they will ship computers with a secure method of turning the feature off. http://www.news.com/News/Item/0%2C4%2C32969%2C00.html?dd.ne.txt.wr At a developer's conference, Intel claimed a speed record for desktop processors in demonstrating a chip that reached 1002 Mhz. But much of the conference was devoted to plans for notebooks, including the company's "Geyserville" technology, which allows portables to operate at a lower power state when running on batteries. http://www.news.com/News/Item/0%2C4%2C32845%2C00.html?dd.ne.txt.wr http://www.news.com/News/Item/0%2C4%2C32894%2C00.html?dd.ne.txt.wr Advanced Micro Devices countered by unveiling its 400-Mhz K6-III, and announced K6-2 and K6-III design wins with IBM, Compaq, and Gateway, the latter for the first time. The K6-III costs significantly less than the Pentium III. http://www.news.com/News/Item/0%2C4%2C32664%2C00.html?dd.ne.txt.wr http://www.news.com/News/Item/0%2C4%2C32962%2C00.html?dd.ne.txt.wr Palm Computing launched its newest handheld devices, the Palm IIIx and the Palm V, at a critical juncture for the company--even though Palm is the established leader in the handheld space. Systems based on Microsoft's Windows CE operating system, which feature color displays, are expected to make serious gains in the near future. http://www.news.com/News/Item/0%2C4%2C32679%2C00.html?dd.ne.txt.wr Be chief executive Jean-Louis Gassee said he would offer PC makers the company's operating system software for free, providing they configured the machine so that the BeOS is an initial interface choice a user sees when he or she fires up the computer. http://www.news.com/News/Item/0%2C4%2C32952%2C00.html?dd.ne.txt.wr Phone home The Federal Communications Commission ruled that a call to an Internet service provider should be treated as long distance, but promised it won't impact the flat-rate charges users now pay for dial-up access. The ruling applies only to contracts between individual phone companies. http://www.news.com/News/Item/0%2C4%2C32955%2C00.html?dd.ne.txt.wr http://www.news.com/News/Item/0%2C4%2C32789%2C00.html?dd.ne.txt.wr The FTC's case against Intel will boil down to motive, FTC director William Baer said in an interview. At a hearing set to start on March 9, the agency will try to prove that Intel unfairly withheld products and product plans from customers in good standing to force them to give up intellectual property claims against the chipmaker. http://www.news.com/News/Item/0%2C4%2C32719%2C00.html?dd.ne.txt.wr As its federal antitrust trial recessed, Microsoft appeared down after a week in which manager Dan Rosen's testimony about a key meeting with Netscape was badly undermined and his assertions that the Microsoft didn't view Netscape as a threat were contradicted by email. Additionally, the judge hearing the case challenged senior vice president Joachim Kempin's assertion that consumers aren't likely to use the browser that comes with their personal computers, preferring instead to seek out another one. http://www.news.com/SpecialFeatures/0%2C5%2C27528%2C00.html?dd.ne.txt.wr Nearly two years after would-be Internet registrar PGMedia accused Network Solutions of violating antitrust laws, the suit appears stalled over weighty legal issues and procedural hurdles raised by the government's recent attempts to privatize Internet administration. Bogging down the case is whether the government- appointed monopoly registrar for the most popular forms of Internet addresses can even be sued. http://www.news.com/News/Item/0%2C4%2C32865%2C00.html?dd.ne.txt.wr Extending reach America Online unveiled the latest test version of ICQ, a popular software client that allows users to chat and send instant messages to each other. AOL has set out to establish the client as a key property in its multibranded portal strategy. http://www.news.com/News/Item/0%2C4%2C32798%2C00.html?dd.ne.txt.wr Viacom revealed a major online push involving two projects: one aimed at music fans and another at children. The online music "destination" site, which bears the working title the "Buggles Project" and is scheduled to launch in June, involves the acquisition of Imagine Radio. The children's site, with the working title "Project Nozzle," comes out of Viacom's Nickelodeon unit and is expected to launch in September. The company will provide the new sites with at least $250 million in marketing support, executives said. http://www.news.com/News/Item/0%2C4%2C32779%2C00.html?dd.ne.txt.wr Cisco Systems inked a number of deals and partnerships in the wireless and telecommunications arena, trying to promote data- based technology as a means to implement converged voice, video, and data services across a single network. The company announced an expanded partnership with Bosch Telecom, a new alliance with telecom software provider Illuminet, and new deals for equipment from WIC Connexus and France Telecom. http://www.news.com/News/Item/0%2C4%2C32713%2C00.html?dd.ne.txt.wr Bell Atlantic said it has opened up its high-speed Internet services to many in the Macintosh community, but some Apple Computer users say they still can't sign up. Until earlier this month, the company's Infospeed DSL service had supported most PC-compatible computers, but only the colorful iMacs from among Apple's lineup. http://www.news.com/News/Item/0%2C4%2C32804%2C00.html?dd.ne.txt.wr IBM Global Services has begun piloting new financial applications with database giant Oracle and German software giant SAP, testing outsourced SAP R/3 applications for the auto industry in Brazil and Oracle financials applications with companies in Denmark. The company currently works with two main partners--J.D. Edwards and Great Plains Software--to provide financial applications hosting to small to mid-sized customers with 1,000 seats or less. http://www.news.com/News/Item/0%2C4%2C32862%2C00.html?dd.ne.txt.wr Tackling financial troubles, a tarnished reputation, and the possibility of yet another round of layoffs, the Dutch business software firm has cancelled its BaanWorld annual user meetings, which had been planned for this May in Nashville and later this year in Europe. Baan also was a no-show at this week's key Microsoft manufacturing industry press conference, according to attendees. http://www.news.com/News/Item/0%2C4%2C32918%2C00.html?dd.ne.txt.wr Going live The Internet2 and Abilene projects went live, promising to enhance and speed up Web surfing through the fruits of academic and corporate research conducted over the private network. http://www.news.com/News/Item/0%2C4%2C32822%2C00.html?dd.ne.txt.wr The Nuremberg Files, an anti-abortion site that gained notoriety during a federal lawsuit, was once again shut down by its service provider. http://www.news.com/News/Item/0%2C4%2C32948%2C00.html?dd.ne.txt.wr Lawmakers in Virginia adopted a bill that would make it a crime to spam. The legislation, which Gov. James Gilmore has promised to sign, makes illegal spamming a misdemeanor punishable by fines of up to $500. "Malicious" spamming, defined as causing more than $2,500 in losses for the victim, could be prosecuted as a felony. http://www.news.com/News/Item/0%2C4%2C32830%2C00.html?dd.ne.txt.wr Sony joined the swelling ranks of companies offering technologies designed to deliver music securely online, saying it is developing copyright-management software for secure download to portable devices and PC hard drives. The company will propose its technologies to the Secure Digital Music Initiative, an industry undertaking. http://www.news.com/News/Item/0%2C4%2C32941%2C00.html?dd.ne.txt.wr Also of note EDS named James Daley, a veteran Price Waterhouse board member, as its new executive vice president and chief financial officer ... The New York Times Company will invest $15 million in cash and services for a minority stake in TheStreet.com ... So many AOL subscribers are trying to use the online giant's Web page publishing system that service has slowed to a crawl or, in some cases, a complete halt ... AMD's K6 family of desktop processors outsold all Intel-based desktop PCs in the U.S. retail market for the first time, according to PC Data's January Retail Hardware Report ... Free-PC says it hopes to ship 1 million free personal computers within a year, having already received 1.2 million applications ...Gateway bought a 20 percent stake in NECX, a closely held online seller of computers and other electronic products, and said it will begin offering a year's free online access with its PCs. http://www.news.com/News/Item/0%2C4%2C32878%2C00.html?dd.ne.txt.wr Mucho thanks to Spikeman for directing his efforts to our cause of bringing you the news we want to read about in a timely manner ... - Ed . . . . . . . @HWA 02.0 From the editor.#8 ~~~~~~~~~~~~~~~~~~ #include <stdio.h> #include <thoughts.h> #include <backup.h> main() { printf ("Read commented source!\n\n"); /* *Well i screwed up this section in #7 it has the same as #6 in it! wonder *if anyone noticed ;-) * *#HWA.hax0r.news is keyed. why u may ask? thats a good question, the answer *is to make sure that ppl don't see the word 'hax0r' and think its some hax0r *channel, the idea being they have at least read an issue or two and know what *to expect. The channel is AFAIK one of (if not the) the first realtime news *channels that takes its news from the online ppl via irc its hosted on EFnet *coz thats where I hang, if anyone wants to bother with one of the other nets *they can ask me and so long as news is passed along I'll allow it to go ahead *thats about all for this issue, dig in and stay free! (and secure) ... * *Moving right along, thanks for the continued support everyone and tty next time... */ printf ("EoF.\n"); } * www.hwa-iwa.org is now 'almost' online but not ready for primetime if you go there you will just be presented with a link to the HWA.hax0r.news mirrors the site is under major development and will be announced here when it goes "online for primetime" with webboard and file archives etc etc, stay tuned for more as it becomes available ie: as I get it done ... ;) w00t w00t w00t! ... w00t! /`wu:t n & v w00ten /`wu:ten n & v Eng. Unk. 1. A transcursion or transcendance into joy from an otherwise inert state 2. Something Cruciphux can't go a day without typing on Efnet Congrats, thanks, articles, news submissions and kudos to us at the main address: hwa@press.usmc.net complaints and all nastygrams and mailbombs can go to /dev/nul nukes, synfloods and papasmurfs to 127.0.0.1, private mail to cruciphux@dok.org danke. C*:. @HWA 02.1 Canc0n99 moves ahead ~~~~~~~~~~~~~~~~~~~~ The tentative dates are now Aug 19th to 22nd and if any problems come up with venues then the con will be held in a public park. Planned events include a gamescon with t-shirts as prizes, we hope to have some vendors show up with door prizes etc also there will be a dj and band with some 'special guests' showing up if all goes well. If not it should still be a fun event so keep your calendar clear for those dates and watch this spot for further news on whats happening : http://come.to/canc0n99/ its a small grassroots con and there will be some interesting people there... come check it out. @HWA 02.2 ShadowCon 99 ~~~~~~~~~~~~ Contributed by Ken Williams Date: Sat, 27 Feb 1999 14:29:37 -0500 (EST) From: Ken Williams To: hwa@press.usmc.net Subject: ShadowCon October 1999 ShadowCon October 1999 Preliminary Announcement and Call for Proposals ShadowCon Oct 26 - 27 1999 Naval Surface Warfare Center, Dahlgren Va http://www.nswc.navy.mil/ISSEC/CID/ Please mark your calendars for this DoD sponsored Intrusion Detection and Information Assurance conference and workshop. There will be no charge for attendees, but even though it is free we will make sure it is a high-value two days. Please pass this one to people who would be interested. Oct 26 will be a vendor show and high quality talks by experts in the field. If you are interested in presenting, please send email to: shadow@nswc.navy.mil On Oct 27 we will have a workshop from 0800 - 1600. It is entitled "Where's the depth?". This will explore the "last mile" problem in implementing a defense in depth strategy focusing on issues related to instrumenting and protecting desktop computer systems. Once an attacker is inside a facility either by circumventing a firewall, using insider access, or exploiting a backdoor there is little chance they will be stopped or even detected. There are a number of approaches including personal firewalls and host based intrusion detection systems. Even so, we have a long way to go before our desktops are truly a sensor network, or before we can actually protect these systems. Workshop topics will be divided between pragmatic and research solutions and challenges. The workshop is invitation only. There will be a limited number of observer seats for funding agencies, but this is primarily for active participants. If you wish to particpate send a proposal describing what you can bring to the table to shadow@nswc.navy.mil There may also be a workshop for issues facing Information System Security Managers. Hope to see you there! The Shadow Team Packet Storm Security http://packetstorm.genocide2600.com/ Trinux: Linux Security Toolkit http://www.trinux.org/ ftp://ftp.trinux.org PGP DH/DSS/RSA Public Keys http://packetstorm.genocide2600.com/pgpkey/ E.H.A.P. VP & Head of Operations http://www.ehap.org/ tattooman@ehap.org NCSU Computer Science http://www.csc.ncsu.edu/ jkwilli2@csc.ncsu.edu @HWA 02.3 Another gem from Phiregod ~~~~~~~~~~~~~~~~~~~~~~~~~ From: "liquid phire" <liquidphire@hotmail.com> To: cruciphux@dok.org Subject: Re: intel Date: Fri, 26 Feb 1999 17:28:11 PST febuary 28th 1999 is the end of personal privacy on the internet as we know it. a false sense of freedom will envelope every person who buys a new pentium III processor, for with this purchase we will no longer be private citizens. anyone who uses this processor can and will be monitored by any interested third party, for whatever reason. this unconsulted move by the intel corporation toward the consumer is the first step towards a world in which the individual will no longer exsist. we can not let this happen, by boycott or by ballot this encroachment upon our values must not go unnoticed. the very words that the founders of this nation fought for will soon be twisted into mottos reminiscent of nightmares. war is peace freedom is slavery ignorance is strength spread the word of this flagrant violation against the citizens of the free and imprisioned world. if this mistake is incorporated blindly into our lives there will be no turning back, and there will be no way to correct this horrible disregard for our personal lives. this another wrong that must be righted if not by laws then by the people they are supposed to protect. i am not one who would like my movements or the contents of my computer open to public view, and i'm sure no one else does either so with this i leave you. america is an empire, and like all great empires it will fall. it is just a question of by whom and when. phiregod liquidphire@hotmail.com please excuse any punctuation and/or spelling errors Kewl, thanks again for sharing Phiregod, I hope to see more in the future...;) - Ed @HWA 03.0 News from the UK by Qubik ~~~~~~~~~~~~~~~~~~~~~~~~~ Spotlight on - ??? ~~~~~~~~~~~~~~~~~~ Would you like to have yoursite featured in an issue of Hackerz Without Attitudez? If so, just send an e-mail to qubik@bikkel.com, with a breif description of yourself and your site. Mail me at qubik@bikkel.com. UK Hackers and Phreaks Panal at this years Def Con..? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Live in the UK? Going to Def Con? I'm interested in hearing from all you folks from the UK underground, lets discuss the possibilities of a UK hack/phreak panal. You'll need a good understanding of the UK underground and your specialised area, be able to talk to a crowd, and preferably have spoken at a Con before. Interested? I'll be at the 2600 meeting in London on Friday the 5th of March, why not talk face-to-face? Or mail me at qubik@bikkel.com. @HWA 03.1 Hackers Reportedly Seize British Military Satellite ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by FProphet via: webcrawler top headlines/reuters LONDON (Reuters) - Hackers have seized control of one of Britain's military communication satellites and issued blackmail threats, The Sunday Business newspaper reported. The newspaper, quoting security sources, said the intruders altered the course of one of Britain's four satellites that are used by defense planners and military forces around the world. The sources said the satellite's course was changed just over two weeks ago. The hackers then issued a blackmail threat, demanding money to stop interfering with the satellite. "This is a nightmare scenario," said one intelligence source. Military strategists said that if Britain were to come under nuclear attack, an aggressor would first interfere with military communications systems. "This is not just a case of computer nerds mucking about. This is very, very serious and the blackmail threat has made it even more serious," one security source said. Police said they would not comment as the investigation was at too sensitive a stage. The Ministry of Defense made no comment. @HWA 04.0 Cracker makes off with $100k ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eftpos scam nets crafty expert a sizeable refund By GARRY BARKER - TECHNOLOGY REPORTER Contributed by Spikeman Somewhere on the run from police, a computer-smart criminal is spending $100,000 stolen from the National Bank of Australia through Eftpos terminals. The fraud, part of a complex scam, was first discovered late last year when bogus refunds on debit card purchases began to appear, according to the bank's corporate relations manager, Mr Hayden Park. On 4January, the bank withdrew refund facilities through Eftpos terminals for debit cards. Further fraud, involving credit cards, appeared in January, and on 12February all refund facilities through Eftpos terminals were withdrawn. ``The customer still gets the money back, but the refund has to be done manually, not electronically through the terminal,'' Mr Park said. ``We expect to have fixed the problem - closed the door - and have automatic refunds back on the terminals in six to eight weeks.'' The fraud involved a small family business. How did they do it? ``In one case, the crooks pinched a terminal; physically removed it. Then they linked it back into the merchant's system, in effect hacked into his link with the bank, and issued themselves with credits, paid to a variety of real bank accounts in branches all over the place,'' Mr Park said. ``In a couple of other cases the merchant's terminal had been tampered with. That may indicate a lack of security on the part of the merchant. Or maybe he was in cahoots with the crooks, but we don't think so. ``So we know who got the money or, at least, the identity of the person for whom the bank account was established. But when we go to that account, there's no money in it. ``We tell the police, but when they go to the address we have recorded, there's no one there.'' Obviously, he said, the criminals were computer literate, and prepared to take risks. ``You always have to keep upgrading your security, whether it is for cheques, robberies or electronic fraud,'' Mr Park said. ``We'll fix this problem, restore the refund facility on our Eftpos terminals, and wait for the next crook to try something.'' Automatic teller machines have also been targets for criminals. In Melbourne some years ago criminals used a frontend loader or a bulldozer to wrench an automatic teller machine out of a bank wall and made off with it. But one of the neatest ``stings'' took place in the United States recently. A criminal gang set up a phony automatic teller machine in a big shopping mall. The machine would not dispense cash, but readily accepted deposits with which, at the end of a week, the criminals absconded. @HWA 04.1 SANS WEB BRIEFING ;WHAT THE HACKERS KNOW ABOUT YOUR SITE III; ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Fri, 19 Feb 1999 15:41:35 -0700 (MST) From: mea culpa <jericho@dimensional.com> To: InfoSec News <isn@repsec.com> Subject: [ISN] SANS Web briefing: ``What the Hackers Know About Your Site, III'' Message-ID: <Pine.SUN.3.96.990219154105.13984e-100000@flatland.dimensional.com> X-NoSpam: You do not have consent to spam me. X-Attrition: Attrition is only good when forced. http://www.attrition.org X-Copyright: This e-mail copyright 1998 by jericho@dimensional.com where applicable X-Encryption: rot26 MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-isn@repsec.com Precedence: bulk Reply-To: mea culpa <jericho@dimensional.com> x-unsubscribe: echo "unsubscribe isn" | mail majordomo@repsec.com x-infosecnews: x-loop, procmail, etc iii) WEB BRIEFING: March 2, 1999 This note announces the March 2 SANS web-based briefing on security: ``What the Hackers Know About Your Site, III''. For one hour, Rob Kolstad and Steven Northcutt will interview H. D. Moore (developer of nlog, the database interface to nmap) and John Green, member of the Shadow Intrusion Detection Team (John discovered the multi-national attack reported by CNN and ABC). As with all SANS web-based briefings, you don't have to leave your office or home, and can tap in at any time 24 hours a day (though only at the time below will the presentation be live!). Participants during the live briefing can e-mail questions to be answered during the broadcast (time permitting, of course). When: Tuesday, March 2, 1999 (and later for `reruns') 10 am Pacific Time, 11 am Mountain, noon Central, 1 pm Eastern, 18:00 GMT Duration: 60 minutes Cost: Free How: Register at http://www.sans.org/mar2.htm The website should reply within a minute or two with some background literature from our sponsor and the URL and password for the free broadcast. If you don't get a reply, please let me know at <sans@clark.net>. Feel free to share this announcement with any potentially interested parties. -o- Subscribe: mail majordomo@repsec.com with "subscribe isn". Today's ISN Sponsor: Internet Security Institute [www.isi-sec.com] @HWA 05.0 Copyrights on security advisories? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Subject: OT: Copyright on Security advisories To: BUGTRAQ@netspace.org I'm sorry for this off topic message, but I think others share my opinion on this. My message is directed mainly at H.E.R.T (Hacker Emergency Response Team) and at ISS Alert, but also to all bugtraq subscribers. I'm writing behalf of a small group of people, operating a security portal page (www.SecuriTeam.com), where we try to write about important security issues and security news. Our site is non-commercial and totally advetisement free, and we see it as a service to the security community (just like many other free services offered to the security community by others). Naturally, we don't discover all the security holes ourselves, and we rely heavily on mailing lists such as the Microsoft alert, ISS alert, CERT alert, bugtraq, NTBugtraq and other helpful mailing lists and web site that deal with security. The problem starts with advisories that contain: "Permission is granted to reproduce and distribute HERT advisories in their entirety, provided the HERT PGP signature is included and provided the alert is used for noncommercial purposes and with the intent of increasing the aware- ness of the Internet community" (this is taken from a HERT advisory. ISS have a similar policy). So what are my options (mine, and all the other folks who want to publish this information)? The way I see it, I can only do copy & paste of this information into an html page (including the PGP signature!!!), and put it on-line. I agree that this advisory has a very nice design to it, but it's way different from the design of our web pages. The content is also different. The target audience is different. These advisories are usually long, and very technical. Our articles are short, and less technical. On the bottom line, my options shrink to one: Wait until someone else publishes it, and paraphrase them. (now they're the "offenders"). I don't want to take the credit away from the authors. Every article we publish contains explicit mentions of who found the bug, who reported the bug, who published the fix, etc. We don't want to take credit for things we didn't do, but we *do* want to provide good service to the people who come to our web site! And this good service cannot include "It is not to be edited in any way without express consent of X-Force" (taken from the ISS alert advisories). I can't wait to get ISS's permission for every exploit they find! Doing so will make the whole concept of "security news" pointless. I can only see two roads from here. The first road means the gradual disappearance of non-commercial security information centers. Security information will not be shared in forums such as bugtraq/ntbugtraq, security newsgroups and web sites. You'll have to pay security consultants to get information . (Actually, this doesn't sound that bad. It means we'll make a lot of money) The second road leads to totally free and open sharing of information. ISS and HERT: If this is what you would like to see when you look at the future, please loosen your restrictions from the security advisories you publish. I really want to emphasize one important point. We *really* don't want the credit. We believe that if a someone discovered a bug or exploit they should have all the credit they deserve (hell, they could name the bug after themselves if they wish. Am I right, Mr. Cuartango?). It seems to me, they get more recognition when information about their exploit spreads. But the actual text they wrote about the bug/exploit should not be the main issue here, and putting a copyright on the full text misses the point entirely. I apologize for boring to death some (most?) of you on this list, but I believe this is important enough to share with you, and I would really like to hear what you all have to say about this issue. -- ------------------------- Aviram Jenik "Addicted to Chaos" ------------------------- Today's quote: Service to others is the rent you pay for your room here on earth. - Muhammad Ali, in "Time", 1978 Do what we do: take what you can and publish it however you feel like, if someone doesn't like what you're doing you will hear from them if they don't mind you won't. Problem #1. .com insinuates a commercial entity, (non profit commercial entity?) a .org site might get more leeway... - Ed @HWA 06.0 Book review: "Top Secret Intranet", Fredrick Thomas Martin, 1999, 0-13-080898-9, ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ BKTPSCIN.RVW 990117 "Top Secret Intranet", Fredrick Thomas Martin, 1999, 0-13-080898-9, U$34.99/C$49.95 %A Fredrick Thomas Martin %C One Lake St., Upper Saddle River, NJ 07458 %D 1999 %G 0-13-080898-9 %I Prentice Hall %O U$34.99/C$49.95 800-576-3800, 416-293-3621 %P 380 p. %S Charles F. Goldfarb Series on Open Information Management %T "Top Secret Intranet" Does anyone else think it is ironic that this book is part of a series on *open* information management? No, I didn't think so. Part one is an introduction to Intelink, the intranet connecting the thirteen various agencies involved in the US intelligence community. Chapter one is a very superficial overview of some basics: who are the departments, packet networks, layered protocols, and so forth. The description of Intelink as a combination of groupware, data warehouse, and help desk, based on "commercial, off-the-shelf" (COTS) technology with Internet and Web protocols, in chapter two, should come as no big surprise. Part two looks at the implementation (well, a rather high level design, anyway) of Intelink. Chapter three reviews the various government standards used as reference materials for the system, which boil down to open (known) standards except for the secret stuff, for which we get acronyms. There is a quick look at electronic intruders, encryption, and security policy in chapter four. Various security practices used in the system are mentioned in chapter five, but even fairly innocuous details are lacking. For example, "strong authentication" is discussed in terms of certificates and smartcards, but a challenge/response system that does not send passwords over the net, such as Kerberos, is not, except in the (coded?) word "token." Almost all of chapter six, describing tools and functions, will be immediately familiar to regular Internet users. Chapter seven takes a return look at standards. The case studies in chapter eight all seem to lean very heavily on SGML (Standard Generalized Markup Language) for some reason. Part three is editorial in nature. Chapter nine stresses the importance of information. (Its centerpiece, a look at statements from some of the Disney Fellows from the Imagineering division is somewhat paradoxically loose with the facts.) The book closes with an analysis of intelligence service "agility," using technology as an answer to everything except interdepartmental rivalries. Probably the most interesting aspect of the book is the existence of Intelink at all, and the fact that it uses COTS components and open standard protocols. (Of course, since it was defence money that seeded the development of the Internet in the first place, one could see Intelink simply as a belated recognition of the usefulness of the product.) For those into the details of the US government's more secretive services there is some mildly interesting information in the book. For those charged with building secure intranets there is some good pep talk material, but little assistance. copyright Robert M. Slade, 1999 BKTPSCIN.RVW 990117 -o- Subscribe: mail majordomo@repsec.com with "subscribe isn". Today's ISN Sponsor: Internet Security Institute [www.isi-sec.com] @HWA 07.0 MCI Worldcom joins security force ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.news.com/News/Item/0,4,32590,00.html MCI Worldcom joins security force By Tim Clark February 18, 1999, 12:35 p.m. PT Add MCI WorldCom to the parade of companies entering the security services and outsourcing market. Knitting together pieces from its many acquisitions, MCI WorldCom's new security unit will compete with GTE Internetworking, Pilot Network Services, IBM, the Big Five accounting and consulting firms, and Lucent Technologies, which entered the security fray last week. "We can bring together networking, security, and Internet hosting," said Jason Comstock, general manager of the new security unit. The service includes offerings from CompuServe Network Services, ANS, UUNet, and GridNet, all WorldCom acquisitions. "We see security as a core offering for MCI WorldCom, especially security consulting." As corporations move toward Internet commerce and sharing corporate information with partners on so-called extranets, network security has become a growing concern. Even the largest corporations are having trouble hiring scarce talent in the field, so security outsourcing has boomed. "When you look at security as an enabling technology that allows you to make money safely, then it starts to make sense to outsource," said Jim Balderston, security analyst at Zona Research. Matthew Kovar, an industry analyst at the Yankee Group, likes MCI's move. "MCI WorldCom has made a great stride to catch up to the leader in this area, which has been GTE Internetworking," he said. MCI WorldCom's new security service comes barely a week after the company's complex, $17 billion deal to sell its MCI Systemhouse computer services unit and 12,000 employees to Electronic Data Systems. The security services unit is far smaller than Systemhouse, with about 170 people, a data center in Reston, Virginia, and a limited range of outsourcing options. Housed within MCI WorldCom's Advanced Networks unit, the managed security services' menu includes outsourcing or installation of Virtual Private Networks (VPNs); firewalls; authentication services; security training; and security assessment. The SecureSweep service, which checks networks for holes intruders might exploit, is handled by independent contractors. "Security outsourcing is a subset of the larger market moving toward application service providers, or ASPs," Balderston said. The ASP movement, which emerged last year, involves an ISP or other service provider hosting e-commerce, enterprise resource planning, or other applications for customers. Comstock said MCI WorldCom will add managed authentication, broader training programs, and partnerships with certificate authorities for using digital IDs for security on corporate networks or extranets. In addition to offering managed security directly to multinational corporations worldwide, MCI WorldCom plans a "private label" version that resellers can market to smaller U.S. companies and in Latin America. The service will use internally developed firewall software as well as products from Check Point Software, authentication servers and tokens from Security Dynamics and Secure Computing, and scanning tools from Internet Security Systems @HWA 08.0 "15yr old sets up a new EFNet server" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From OPERLIST ... somewhat interesting I thought, perhaps not to all but we all started somewhere and everyone grows up. I recall running a BBS and having some "12yr old wannabe hacker" try breaking into the board or harassing me voice when I tried to verify one of his multiple accounts for tradewars, well that kid now works for IBM and me? well the board is long dead but the point is the same, we all go thru phases, some last longer than others, you can't judge someone by their age and we all grow up, some faster than others.. - Ed Date: Sat, 27 Feb 1999 08:25:53 EST To: operlist@the-project.org Subject: about irc.globalized.net Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-Mailer: AOL 4.0 for Windows 95 sub 13 Resent-Message-ID: <"Dz7baD.A.6-E.RJ_12"@the-project.org> Resent-From: operlist@the-project.org X-Mailing-List: <operlist@the-project.org> archive/latest/639 X-Loop: operlist@the-project.org Precedence: list Resent-Sender: operlist-request@the-project.org well irc.globalized.net is run by a 15 year old former packet kiddie (AaronWL)who also used to be an ircop for irc02.irc.aol.com, does that make him reputable? lets look at the AOL profile for the screenname PositivePI@aol.com Member Name: Aaron W. LaFramboise Location: Lafayette, Louisiana, United States Birthdate: 06/19/1983 Sex: Male Hobbies: Running, Biking, Internet, Computer Programming Computers: Pentium 233MHz MMX with 24MB of RAM Occupation: Student at Lafayette High School Ok, so this 15 year old kid aaronwl doesnt actually work for globalized (fake company) he just knows the owner of the domain/box and said 'hey lets start an efnet server' now my question is, is everyone aware that this server irc.globalized.net is actually linked to efnet with a 15 year old packet kiddie admin and what exactly is globalized, is it an isp? No. is an internet backbone? nope. aaron? what is this wonderful company that you dont work for and why does their webpage have about 3 words total, work with me baby? ill be sending in my efnet application shortly, im 14 and the server will be on my norweigan dialup but i once had tcm access on dalnet so i should be able to slide in ------------------ [ operlist@the-project.org ] ------------------------- To unsub: operlist-request@the-project.org with unsub operlist in the subject List Maintainer: Matthew Ramsey <mjr@blackened.com> Web Archives: http://www.the-project.org/operlist/current --------------------------------------------------------------------------- a Rebuttal; X-Authentication-Warning: cdy.wwiv.com: cyarnell owned process doing -bs Date: Sat, 27 Feb 1999 11:32:19 -0800 (PST) From: Chris Yarnell <cyarnell@wwiv.com> To: Showmount@aol.com cc: OprahsLust <operlist@the-project.org> Subject: Re: about irc.globalized.net In-Reply-To: <742668fe.36d7f261@aol.com> Precedence: list Resent-Sender: operlist-request@the-project.org > well irc.globalized.net is run by a 15 year old former packet kiddie > (AaronWL)who also used to be an ircop for irc02.irc.aol.com, does that make > him reputable? lets look at the AOL profile for the screenname > PositivePI@aol.com What does his age have to do with anything? I know several teens (both online and IRL) who are much more mature than some >30something people I know. Also, what, exactly, do you hope to accomplish by posting this to Oprahslust? Here are my questions for you: Did you know about application was pending before it was linked? -> If yes, did you bring your concerns to the routing secretary so that the voting routing admins could be made aware of them? -> If no, have you NOW brought your concerns to the routing secretary and Aaron's uplinks so that they can review and evaluate them? There is a probationary period -- if your concerns are valid, and there are problems with the server, it shouldn't be a problem to have it removed at the end of probation. Posting to this list will accomplish nothing. In fact, I doubt many of the voting routing admins are even on this list anymore. I had a few concerns about the globalized link as well. I didn't bother to bring them to the routing secretary (I don't much care about EFnet politics anymore), so I'm not going to whine now that it's linked. If someone screws up, or it's unreliable, it will be removed. ------------------ [ operlist@the-project.org ] ------------------------- To unsub: operlist-request@the-project.org with unsub operlist in the subject List Maintainer: Matthew Ramsey <mjr@blackened.com> Web Archives: http://www.the-project.org/operlist/current --------------------------------------------------------------------------- From: PositivePi@aol.com Message-ID: <4426de93.36d834ba@aol.com> Date: Sat, 27 Feb 1999 13:08:58 EST To: operlist@the-project.org Mime-Version: 1.0 Subject: Re: about irc.globalized.net X-Mailer: AOL 4.0 for Windows 95 sub 219 Precedence: list Resent-Sender: operlist-request@the-project.org whoo an operlist post about me and my aol account .. famous aaronwl =) I'm curious.... what exactly does Showmount@aol.com want from me? Was there any kind of constructive change he was trying to suggest? Yes, I work for Globalized. No, as later posts bring up, I do not know everything about the complexities of BGP etc. But lets take your standard ISP... Does every person in the company know how to operate every program and do every task that it is demanded that the company must do? No, of course not. Every person has their own job to take care of. As administrator of the IRC server, I know how to keep it running at top preformance. I know how to fix problems if they arise (and they have, and they will). And I know how to deal with the wonder DOS attacks that we keep getting. And for everything I don't know, there is someone else who does. I'll do my best to run irc.globalized.net. I'll admit, I'm not perfect, and I have my flaws. I am *always* open to comments, suggestions, and constructive critism. And I guess that is all I can do :) Thanks.. Aaron W. LaFramboise (aaronwl@zealth.net) In a message dated 2/27/99 7:27:43 AM Central Standard Time, Showmount@aol.com writes: > well irc.globalized.net is run by a 15 year old former packet kiddie > (AaronWL)who also used to be an ircop for irc02.irc.aol.com, does that make > him reputable? lets look at the AOL profile for the screenname > PositivePI@aol.com ------------------ [ operlist@the-project.org ] ------------------------- To unsub: operlist-request@the-project.org with unsub operlist in the subject List Maintainer: Matthew Ramsey <mjr@blackened.com> Web Archives: http://www.the-project.org/operlist/current --------------------------------------------------------------------------- @HWA 09.0 DISA WEB RISK ASSESSMENT TEAM ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ contributed by erewhon via HHN Secretary of Defense William S. Cohen has approved the creation of the the Joint Web Risk Assessment Cell (JWRAC) This 22-member Reserve component team has been established to monitor and evaluate Department of Defense Web sites to ensure the sites do not compromise national security. This team will be comprised of two full-time Reservists and 20 drilling Reserve and National Guard personnel. The Defense Information Systems Agency (DISA) will start up the cell on March 1, 1999. @HWA 10.0 Next Up: 10-Gbps Ethernet ~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.techweb.com/wire/story/TWB19990224S0008 (02/24/99, 10:43 a.m. ET) By Christine Zimmerman, Data Communications With the bulk of the work on the Gigabit Ethernet standard done, engineers and vendors already have their sights on higher speeds. Tony Lee, product-line manager at Extreme Networks, in Cupertino, Calif., and chair of the Gigabit Ethernet Alliance, said the IEEE 802 committee will begin to assess interest in 10-gigabit-per-second Ethernet on March 9. And based on what he's seen so far, Lee said he predicts a standard for fiber-based 10-Gbps Ethernet in the next 3yrs. "I know there are companies concept-proving the speed right now," he said. "There's nothing to prevent them from seeking 10 times the performance of Gigabit Ethernet." He said he believes once 1,000-BaseT is in place, Gigabit Ethernet to the desktop will become a reality. As that occurs, network managers will need more bandwidth in the backbone. But there is at least one challenge. While engineers developing the physical layer of Fast Ethernet borrowed from FDDI, and those developing Gigabit Ethernet turned to Fibre Channel, there's really no physical-layer technology that will serve as a suitable base for 10-Gbps Ethernet. @HWA 11.0 Thieves Trick Crackers Into Attacking Networks ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (02/16/99, 12:10 p.m. ET) By Lee Kimber, Network Week Corporate networks are coming under attack from an army of amateur crackers working unwittingly for professional thieves, security experts have warned. They have identified signs that organized criminals and "professional" crackers are using trick software that lets teenage enthusiasts -- known as "script kiddies" -- attack networks for amusement. The software then secretly sends the findings of these surveys to experienced crackers. Professional gangs could use this trick to build massive databases of network insecurities for thieves to exploit. Consultants cited the hacking group New Order's Aggressor network-attack software, which invites amateurs to register for a full copy on the promise that they will receive hidden tools to mount stronger attacks on their victims. "We could be looking at half a dozen teenagers doing cracking on behalf of New Order," warned Internet Security Systems security expert Kevin Black. "It's: 'Here's a toy to play with,' then: 'Thank you, soldier.' " The growth of Java programming skills lies behind another new trick, where crackers build Java cracking software into websites. When surfers browse the site, the program returns the surfer's IP address to network security tools' logs, leaving the cracker's real location a secret. Canadian hacking group HackCanada is encouraging crackers to rewrite the Python network-scanning script Phf in Java so it can be loaded into Web surfers' browsers during a visit to an innocuous-looking site. HackCanada adopted the tactic after a cracker received a warning from a corporate network administrator who detected him using the Phf script in its native Python form. And in a gloomy warning for network administrators, Axent security consultant David Butler warned teenagers and students who collected cracking tools to impress their peers would quickly try them out. "Cracking attempts rise by a factor or three or four during school holidays," Butler told a joint Toshiba-Inflo security presentation earlier this month. The news came shortly after security experts learned the freely available password authenticator Tcpwrapper had been rewritten and redistributed in a form that sends passwords it finds to an anonymous Hotmail address. "It's a shift in the mentality of cracking," said Black. "It's the difference between the men and the boys." "We have been under constant attack by hackers since Christmas," said Nokia Telecommunications' Europe, Middle East, and Africa marketing director Bob Brace. The company had detected 24,000 cracking attempts since October last year, he said. Nokia runs IP440 firewall and NAT with log analysis, so Brace could see the hackers first tried to ping every IP address, then probed for specific ports such as the default ports for Back Orifice (31337 and 1234) and port 80. (Back Orifice lets crackers gain control of a remote PC and is often hidden as a trojan in games.) "I believe much of the probing is automated and some of the more serious attacks are spread out so they are not easy to identify in a trace," Brace said. @HWA 12.0 How Nokia Guards Against Crackers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (02/24/99, 10:34 a.m. ET) By Lee Kimber, Network Week Faced with 24,000 attempted network attacks in the past six months, Finnish telecommunications leader Nokia has developed a smart strategy to protect itself: Follow the network security rule book to the letter. Marketing manager Bob Brace said the policy started at the ICMP level -- by disallowing pings. "The hackers first try do things like ping every IP address on a class C subnet," he said. "So they will try for x.x.x.1 to x.x.x.254. We do not allow pings." He said Nokia protected its networks with an integrated firewall/router -- the IP1440 -- providing logs showing the attacks came from different types of crackers -- amateurs that tried to scan ports sequentially and professionals that carried out long-term port scanning from different IP addresses. The logs proved the crackers' attempts to find a service on 1234 -- the default port used by the remote-control Trojan Back Orifice, Brace said. (erhm whups??? thats netbus ... - Ed) The firewall also offered NAT, which could be configured to drop ICMP packets regardless of the packet filtering set up on the firewall. That won the approval of Integralis security expert Tony Rowan: "If you've got NAT," he said, "you're almost there." He said the ICMP suite contained commands most people had forgotten -- unless they were crackers. "Router redirect lets you make a router hand requests to someone else. This is an ICMP request, and you can get packet shapers that let you set these up," he said. When setting up a CheckPoint firewall for an Integralis customer, he recommended they turn on the "stealth rule" -- any packet from anywhere to the firewall is dropped, rather than rejected, which would give them feedback. Log it with a long log, he said. Nokia runs an internal U.K. Web server and a public Web server in Helsinki, and Brace said he saw port 80 scans of the U.K. intranet all the time. "Our intranet server here in the U.K. cannot be seen from the outside; the IP440 keeps these hackers at arm's length. They can see we are here, but they don't know what is on the other side of the firewall." The last weapon is encryption. Given Nokia's firewall logs have proved some of its attempted cracks are by extremely knowledgeable people, the company said remote-access services are the biggest vulnerability in its network. (gee whiz) Remote users dialed in using encrypted VPNs over the Internet, it said. Nokia then authenticated them again if they tried to access key resources. So Brace had strong advice for governments (better listen up! <sic>) that wanted to impose key escrow. "Key escrow weakens authentication and threatens the whole issue of e-commerce," he said. @HWA 13.0 BILL H.R 514 COULD BAN PERSONAL "ACTION" FREQUENCY MONITORING ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Well, they tried banning oral sex, they'd probably tax fucking and shitting if they could attach a meter to your cock or ass and now they are preventing the pleasurable experience of monitoring fun radio channels by introducing this bill. I'd personally like to roll the bill up into a tight wad and stuff it in various orifices of the people that thought this up and as an addendum to this i'd also like to say "why don't you just fuck off?" anyone in the know can modify or build a fucking scanner to bypass anything that they come up with they are just making it more difficult for people to do so. I am a licensed ham radio operator and because of this bill i'll have to pay MORE money to get my gear from countries that don't have such rediculous restrictions like I dunno bumfuck Egypt or somewhere, I really just want to piss down these peoples throats and shit down their necks. Ok enough of the hack journalism i'm too pissed off to continue... read the bill then mailbomb your local house representative as to why this is a stupid idea... Just some reasons this bill sucks: 1) Citizens have helped out law enforcement officers by monitoring local action bands 2) Citizens that are volunteer fire-fighters or emergency volunteers will have to spend extra money to locate and run exotic non-american made gear 3) Licensed radio enthusiasts will have to pay even more for their gear and these fellas (and gals) help out with emergency nets out of their own pockets. 4) The equipment already exists in abundance and will just make black market versions available to the masses en masse 5) You can build your own scanner or convert any existing one using a transverter are they going to ban basic discreet components next??? The Bull erh. Bill, in its entirety follows: Wireless Privacy Enhancement Act of 1999 (Introduced in the House) HR 514 IH 106th CONGRESS 1st Session H. R. 514 To amend the Communications Act of 1934 to strengthen and clarify prohibitions on electronic eavesdropping, and for other purposes. IN THE HOUSE OF REPRESENTATIVES February 3, 1999 Mrs. WILSON (for herself, Mr. TAUZIN, Mr. MARKEY, Mr. OXLEY, Ms. ESHOO, Mr. DEAL of Georgia, Mr. WYNN, Mrs. CUBIN, Mr. LUTHER, Mr. ROGAN, Mr. SAWYER, Mr. PICKERING, and Mr. GILLMOR) introduced the following bill; which was referred to the Committee on Commerce A BILL To amend the Communications Act of 1934 to strengthen and clarify prohibitions on electronic eavesdropping, and for other purposes. Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1. SHORT TITLE. This Act may be cited as the `Wireless Privacy Enhancement Act of 1999'. SEC. 2. COMMERCE IN ELECTRONIC EAVESDROPPING DEVICES. (a) PROHIBITION ON MODIFICATION- Section 302(b) of the Communications Act of 1934 (47 U.S.C. 302a(b)) is amended by inserting before the period at the end thereof the following: `, or modify any such device, equipment, or system in any manner that causes such device, equipment, or system to fail to comply with such regulations'. (b) PROHIBITION ON COMMERCE IN SCANNING RECEIVERS- Section 302(d) of such Act (47 U.S.C. 302a(d)) is amended to read as follows: `(d) EQUIPMENT AUTHORIZATION REGULATIONS- `(1) PRIVACY PROTECTIONS REQUIRED- The Commission shall prescribe regulations, and review and revise such regulations as necessary in response to subsequent changes in technology or behavior, denying equipment authorization (under part 15 of title 47, Code of Federal Regulations, or any other part of that title) for any scanning receiver that is capable of-- `(A) receiving transmissions in the frequencies that are allocated to the domestic cellular radio telecommunications service or the personal communications service; `(B) readily being altered to receive transmissions in such frequencies; `(C) being equipped with decoders that-- `(i) convert digital domestic cellular radio telecommunications service, personal communications service, or protected specialized mobile radio service transmissions to analog voice audio; or `(ii) convert protected paging service transmissions to alphanumeric text; or `(D) being equipped with devices that otherwise decode encrypted radio transmissions for the purposes of unauthorized interception. `(2) PRIVACY PROTECTIONS FOR SHARED FREQUENCIES- The Commission shall, with respect to scanning receivers capable of receiving transmissions in frequencies that are used by commercial mobile services and that are shared by public safety users, examine methods, and may prescribe such regulations as may be necessary, to enhance the privacy of users of such frequencies. `(3) TAMPERING PREVENTION- In prescribing regulations pursuant to paragraph (1), the Commission shall consider defining `capable of readily being altered' to require scanning receivers to be manufactured in a manner that effectively precludes alteration of equipment features and functions as necessary to prevent commerce in devices that may be used unlawfully to intercept or divulge radio communication. `(4) WARNING LABELS- In prescribing regulations under paragraph (1), the Commission shall consider requiring labels on scanning receivers warning of the prohibitions in Federal law on intentionally intercepting or divulging radio communications. `(5) DEFINITIONS- As used in this subsection, the term `protected' means secured by an electronic method that is not published or disclosed except to authorized users, as further defined by Commission regulation.'. (c) IMPLEMENTING REGULATIONS- Within 90 days after the date of enactment of this Act, the Federal Communications Commission shall prescribe amendments to its regulations for the purposes of implementing the amendments made by this section. SEC. 3. UNAUTHORIZED INTERCEPTION OR PUBLICATION OF COMMUNICATIONS. Section 705 of the Communications Act of 1934 (47 U.S.C. 605) is amended-- (1) in the heading of such section, by inserting `interception or' after `unauthorized'; (2) in the first sentence of subsection (a), by striking `Except as authorized by chapter 119, title 18, United States Code, no person' and inserting `No person'; (3) in the second sentence of subsection (a)-- (A) by inserting `intentionally' before `intercept'; and (B) by striking `and divulge' and inserting `or divulge'; (4) by striking the last sentence of subsection (a) and inserting the following: `Nothing in this subsection prohibits an interception or disclosure of a communication as authorized by chapter 119 of title 18, United States Code.'; (5) in subsection (e)(1)-- (A) by striking `fined not more than $2,000 or'; and (B) by inserting `or fined under title 18, United States Code,' after `6 months,'; and (6) in subsection (e)(3), by striking `any violation' and inserting `any receipt, interception, divulgence, publication, or utilization of any communication in violation'; (7) in subsection (e)(4), by striking `any other activity prohibited by subsection (a)' and inserting `any receipt, interception, divulgence, publication, or utilization of any communication in violation of subsection (a)'; and (8) by adding at the end of subsection (e) the following new paragraph: `(7) Notwithstanding any other investigative or enforcement activities of any other Federal agency, the Commission shall investigate alleged violations of this section and may proceed to initiate action under section 503 of this Act to impose forfeiture penalties with respect to such violation upon conclusion of the Commission's investigation.'. @HWA 14.0 Linux autofs overflow in 2.0.36+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Fri, 19 Feb 1999 00:09:29 -0500 From: Brian Jones <balif@SHELL.NACS.NET> Subject: Linux autofs overflow in 2.0.36+ To: BUGTRAQ@NETSPACE.ORG Reply-to: Brian Jones <balif@SHELL.NACS.NET> - -----BEGIN PGP SIGNED MESSAGE----- Overflow in Autofs - Feb 18 1999 _____________________________________________________________________________ Affected: Linux autofs kernel module in linux-2.0.36 to 2.2.1 Type of Problem: Buffer overflow in kernel module. Effects: Denial of Service, potential root exploit By: Brian Jones <balif@nacs.net> Contributors: Patrick Lewis <patrick@apk.net>, phazer <phazer@battlemech.nws.net> _____________________________________________________________________________ Summary The autofs kernel module does not check the size of the directory names it receives. It is passed the name and the names length through dentry->d_name.name and dentry->d_name.len respectively. Later on it memcpy()'s the name into a 256 byte buffer, using dentry->d_name.len as the number of bytes to copy, without checking its size. A nonprivilaged user may attempt to cd to a directory name exceeding 255 characters. This overwrites memory, probably the kernel stack and anything beyond it, and causes kernel errors or makes the machine reboot. Overview of Automount drwxr-xr-x 3 root root 0 Feb 18 17:40 misc The autofs module provides support for the automount filesystem, as well as the interface between the kernel and the automountd daemon, which is responsible for the actual mounting. Calls such as chdir() executed in the automount directory are handled by the module, and if the desired directory is defined in the configuration files, automountd then mounts that directory/device. Details When a chdir() or similar function is called in the autofs directory, by a user doing something along the lines of "cd xxxx", the function fs/autofs/root.c:autofs_root_lookup() is called. autofs_root_lookup() receives the name of the directory through "dentry->d_name.name", and it's length through "dentry->d_name.len". The dentry structure is passed via pointer through two functions, each performing various operations along the way. It eventually reaches waitq:autofs_wait(). The name, length, and other bits of information are copied into a 'wq' structure, which stands for waiting queue. "wq.name" is "char *name", a pointer to the dentry pointer that refers back to the filename somewhere in the kernel. autofs_wait() then passes 'wq' to autofs_notify_daemon(), which copies the information into a structure called 'pkt'. This is passed to autofs_write(), which write()'s the packet down the pipe connecting the module with automountd. The Overflow The problem occurs when 'wq' is copied to 'pkt'. Before this point, the path name was shuffled around via pointers. 'pkt' is defined as: struct autofs_packet_missing pkt; struct autofs_packet_missing { struct autofs_packet_hdr hdr; autofs_wqt_t wait_queue_token; int len; char name[NAME_MAX+1]; }; NAME_MAX is 255, making pkt.name a 256 byte buffer. pkt.name is copied using this method: pkt.len = wq->len; memcpy(pkt.name, wq->name, pkt.len); pkt.name[pkt.len] = '\0'; Remember that wq->len and wq->name are directly copied from the dentry structure. The len and name were never checked to ensure they would fit inside pkt's buffer. If you attempt to cd to a directory name over 255 characters, you will overflow this buffer. Because this is running in the kernel, a large enough value can overwrite as much memory as you want, over top any process you want. No bounds checking is done, and the code makes no check to see if dentry->d_name.len is under 255. Examples [balif@localhost misc]# cd `perl -e 'print "x" x 255'` bash: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx: No such file or directory [balif@localhost misc]# cd `perl -e 'print "x" x 256'` invalid operand: 0000 CPU: 0 EIP: 0010:[<c0155b00>] EFLAGS: 00010282 eax: 00000000 ebx: c2a90c20 ecx: c265904c edx: c0000000 esi: c29d3b00 edi: c2928000 ebp: c260d940 esp: c26c5ee8 ds: 0018 es: 0018 ss: 0018 Process bash (pid: 360, process nr: 21, stackpage=c26c5000) Stack: 00000000 00000000 c260d940 c260d900 00000286 c0154c58 c0154ca8 c2928000 c260d940 c2928000 c260d900 c2659d50 c26cd3a0 00000286 c0154def c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900 c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900 c260d900 Call Trace: [<c0154c58>] [<c0154ca8>] [<c0154def>] [<c0154ef7>] [<c0128759>] [<c0128912>] [<c01289e9>] [<c012126e>] [<c0107a40>] Code: fe ff ff 83 c4 08 eb 03 ff 43 1c 8b 7c 24 1c 83 7f 0c 00 74 - - -{Shell dies}- /var/log/messages Feb 16 23:09:13 localhost automount[1361]: attempting to mount entry /misc/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxq%^D^HH# ^_ buffer has been exceeded Very large numbers will cause various kernel errors, or a reboot as giant chunks of memory are being clobbered. The Fix This quick fix limits the length of a directory name to 255 characters, and patches /usr/src/linux-2.2.1/fs/autofs/root.c. I contacted the author, who said he was going to fix this at a different point in the code. This seems to work for the time being. [---cut here---] - - --- root.c.orig Thu Feb 18 20:26:23 1999 +++ root.c Thu Feb 18 20:26:17 1999 @@ -217,6 +217,11 @@ DPRINTK(("autofs_root_lookup: name = ")); autofs_say(dentry->d_name.name,dentry->d_name.len); + /* quick patch by balif@nacs.net 2-18-99 */ + /* Prevents overflow of pkt.name in waitq.c:autofs_notify_daemon() */ + if (dentry->d_name.len > 255) + return -ENAMETOOLONG; + if (!S_ISDIR(dir->i_mode)) return -ENOTDIR; [---cut here---] - -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: noconv iQB1AwUBNszxXSMC9wnJPLr1AQEvOQMAgeWVliqaW0CrM0NMsybSmw/a4yKdEJ4V QkzVY+E9bb7wwMGxmC4nxJyhiUn9f9I4f0S19LMON0g7rBRQqlUi3rfgVOsBa18g wBfY1bF3iwV7zYph08Tqd7So31j/ux7S =88Co - -----END PGP SIGNATURE----- - --- Balif@Nacs.Net - http://setiathome.ssl.berkeley.edu/ - Get ready in April N = N* fp ne fl fi fc fL @HWA 15.0 Linux RedHat sysklogd vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Tue, 16 Feb 1999 02:22:56 -0500 From: Cory Visi <visi@CMU.EDU> Subject: RedHat sysklogd vulnerability To: BUGTRAQ@NETSPACE.ORG Reply-to: Cory Visi <visi@CMU.EDU> I'd like to apologize for being so late with this e-mail as I have known about this problem for months. The vulnerability was discussed in a Thu, 10 Sep 1998 BugTraq e-mail by Michal Zalewski (lcamtuf@IDS.PL). I replied to it with a quick patch. Here are some lines from my e-mail: > I'm not completely happy with this, as it modifies the reference parameter, > ptr, but it will solve the problem. However, later on: > > ExpandKadds(line, eline) > > Where eline is the same size as line. I think the real solution is to make > sure the buffer is larger (LOG_LINE_LENGTH) like Michal said, and make sure > modules and programs don't generate obsurdly long messages, because you > can't be certain how much room is necessary for the expanded symbols. It > would be nice if ExpandKadds() allocated memory dynamically, but it doesn't. RedHat immediately issued a "fix" to their current package: sysklogd-1.3-26 This "fix" is merely my patch (and nothing more). My patch DOES NOT fix the problem. As discussed by the package co-maintainer (Martin Schulze (joey@FINLANDIA.INFODROM.NORTH.DE)) the bug is fixed in the latest sysklogd package (1.3-30). In fact, the bug was fixed in 1996. What this comes down to is that any Linux distribution running an old sysklogd package (namely RedHat all versions) STILL has a potential (rather obscure) buffer overflow. They need to upgrade to the latest version ASAP. I e-mailed bugzilla@redhat.com and got no response. Thank you, .-. ,~~-. .-~~-. ~._'_.' \_ \ / `~~- | `~- \ / `.__.-'ory \/isi @HWA 16.0 Microsoft Security Bulletin (MS99-007) Taskpads Scripting Vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Approved-By: secnotif@MICROSOFT.COM Date: Mon, 22 Feb 1999 19:08:01 -0800 Sender: Microsoft Product Security Notification Service <MICROSOFT_SECURITY@ANNOUNCE.MICROSOFT.COM> From: Microsoft Product Security <secnotif@MICROSOFT.COM> Subject: Microsoft Security Bulletin (MS99-007) To: MICROSOFT_SECURITY@ANNOUNCE.MICROSOFT.COM The following is a Security Bulletin from the Microsoft Product Security Notification Service. Please do not reply to this message, as it was sent from an unattended mailbox. ******************************** Microsoft Security Bulletin (MS99-007) -------------------------------------- Patch Available for Taskpads Scripting Vulnerability Originally Posted: February 22, 1999 Summary ======= Microsoft has released a patch that eliminates a vulnerability in the Taskpads feature, which is provided as part of the Microsoft(r) Windows(r) 98 Resource Kit, Windows 98 Resource Kit Sampler, and BackOffice(r) Resource Kit, second edition. The vulnerability could allow a malicious web site operator to run executables on the computer of a visiting user. Only customers who have installed one of the affected products and who surf the web using the machine on which it is installed are at risk from this vulnerability. A fully supported patch is available to remove the Taskpads functionality, and Microsoft recommends that affected customers download and install it. Issue ===== Taskpads is a feature provided by several Microsoft Windows Resource Kit products, as detailed below in Affected Software Versions. It is part of the Resource Kits' Tools Management Console Snap-in, and allows users to view and run Resource Kit Tools via an HTML page rather than through the standard Large Icon, Small, Icon, List, and Detailed Views. A vulnerability exists because certain methods provided by Taskpads are incorrectly marked as "safe for scripting" and can be misused by a web site operator to invoke executables on a visiting user's workstation without their knowledge or permission. The affected products are, by default, not installed on Windows 95, Windows 98 or Windows NT«. The Windows 98 Resource Kit and Resource Kit Sampler can only be installed on Windows 98. The BackOffice Resource Kit can be installed on Windows 95, Windows 98 or Windows NT, but is most commonly installed on Windows NT servers, which, per recommended security practices, usually will not be used for web surfing. While there have not been any reports of customers being adversely affected by these problems, Microsoft is releasing a patch to proactively address this issue. The patch for this issue works by removing the Taskpads functionality, which is rarely used. It does not affect any other features of the affected products. Affected Software Versions ========================== - Microsoft Windows 98 Resource Kit, Microsoft Windows 98 - Resource Kit Sampler (included as part of Windows 98 but not installed by default) - Microsoft BackOffice Resource Kit, second edition What Microsoft is Doing ======================= Microsoft has released patches that fix the problem identified. The patches are available for download from the sites listed below in What Customers Should Do. Microsoft also has sent this security bulletin to customers subscribing to the Microsoft Product Security Notification Service. See (http://www.microsoft.com/security/services/bulletin.asp) for more information about this free customer service. Microsoft has published the following Knowledge Base (KB) article on this issue: - Microsoft Knowledge Base (KB) article Q218619, Taskpads Lets Web Sites Invoke Executables from a User's Computer. http://support.microsoft.com/support/kb/articles/Q218/6/19.ASP (Note: It might take 24 hours from the original posting of this bulletin for the KB article to be visible in the Web-based Knowledge Base.) What Customers Should Do ======================== Microsoft highly recommends that all affected customers download the appropriate patch to protect their computers. The patches can be found at: - Windows 98 Resource Kit, Windows 98 Resource Kit Sampler, and BackOffice, second Edition for Windows 95 and 98 ftp://ftp.microsoft.com/reskit/win98/taskpads/tmcpatch.exe - Microsoft BackOffice Resource Kit, second edition for Windows NT x86 version: ftp://ftp.microsoft.com/reskit/nt4/x86/ taskpads/itmcpatch.exe Alpha version: ftp://ftp.microsoft.com/reskit/nt4/ alpha/taskpads/atmcpatch.exe (Note: URLs have been word-wrapped) More Information ================ Please see the following references for more information related to this issue. - Microsoft Security Bulletin MS99-007, Patch Available for Taskpads Scripting Vulnerability (the Web-posted version of this bulletin), http://www.microsoft.com/security/bulletins/ms99-007.asp. - Microsoft Knowledge Base (KB) article Q218619, Taskpads Lets Web Sites Invoke Executables from a User's Computer. http://support.microsoft.com/support/kb/articles/Q218/6/19.ASP (Note: It might take 24 hours from the original posting of this bulletin for the KB article to be visible in the Web-based Knowledge Base.) Obtaining Support on this Issue =============================== If you require technical assistance with this issue, please contact Microsoft Technical Support. For information on contacting Microsoft Technical Support, please see http://support.microsoft.com/support/contact/default.asp. Acknowledgments =============== Microsoft would like to acknowledge Adrian O'Neill for discovering this issue and bringing it to our attention. Revisions ========= - February 22, 1999: Bulletin Created For additional security-related information about Microsoft products, please visit http://www.microsoft.com/security ------------------------------------------------------------ THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. (c) 1999 Microsoft Corporation. All rights reserved. Terms of Use. ******************************************************************* You have received this e-mail bulletin as a result of your registration to the Microsoft Product Security Notification Service. You may unsubscribe from this e-mail notification service at any time by sending an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM The subject line and message body are not used in processing the request, and can be anything you like. For more information on the Microsoft Security Notification Service please visit http://www.microsoft.com/security/bulletin.htm. For security-related information about Microsoft products, please visit the Microsoft Security Advisor web site at http://www.microsoft.com/security. @HWA 17.0 Security risk with Computer Associates' (CA) ARCserveIT backup software ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Approved-By: mark@NTSHOP.NET Received: from frog ([207.174.103.85] (may be forged)) by sys (2.5 Build 2640 (Berkeley 8.8.6)/8.8.4) with SMTP id JAA00304 for <ntsd@listserv.ntsecurity.net>; Tue, 23 Feb 1999 09:07:57 -0600 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 1 (Highest) X-MSMail-Priority: High X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Importance: High Message-ID: <00b801be5f4f$62ff82c0$5567aecf@frog.dev.nul> Date: Tue, 23 Feb 1999 10:10:18 -0700 Reply-To: security@NTSHOP.NET From: three <three@ONELIGHT.ORG> Subject: [ SECURITY ALERT ] ARCserve Exposes Passwords To: NTSD@LISTSERV.NTSECURITY.NET ============== SPONSORED BY AELITA SOFTWARE =============== Want to know what going on with your NT Network? Download NT Manage NOW! http://www.lanware.net/products/ntmanage/overview.asp =========================================================== February 23, 1999 - NTSD - A person using the pseudonym "Elvis" has reported a security risk with Computer Associates' (CA) ARCserveIT backup software, where usernames and passwords are transmitted over the network in clear text. CA has been informed of this risk. Their response to the issue is unknown at this time. For information on how to test this vulnerability, please visit the following Web page: http://www.ntsecurity.net/scripts/load.asp?iD=/security/arcserve.htm Thanks for subscribing to NTSD! Please tell your friends about this list. Sincerely, The NTSD Team http://www.ntsecurity.net To SUBSCRIBE to this newsletter and alert list DO NOT REPLY, instead send e-mail to listserv@listserv.ntsecurity.net with the words "subscribe ntsd" in the body of the message without the quotes -- To UNSUBSCRIBE, send e-mail to the same address listed above with the words "unsubscribe ntsd" in the body of the message. =========================================== NTSD is powered by LISTSERV(R) software. http://www.lsoft.com/LISTSERV-powered.html =========================================== Copyright (c) 1996-99 M.E. - ALL RIGHTS RESERVED Forwarding NTSD Alerts is permitted, as long as the entire message body, the mail header, and this notice are included. @HWA EF.F (Effluent) ~~~~~~~~~~ Seen on the DC-STUFF list: From: bingo <bingo@ZAJIL.NET> To: Multiple recipients of list HACKPROJ <HACKPROJ@UTKVM1.UTK.EDU> Date: Thu, 18 Feb 1999 00:09:16 +0300 Reply-To: Hacker Project <HACKPROJ@UTKVM1.UTK.EDU> Subject: THANK YOU WoW guys, i like this highly speed co-operation so much, but the problem is that i am dump in hacking and i am looking for a guidelines to start with. i had a hackerz CD at a time in the past but i couldn't run any!! do i have to learn more about C and C++ to achieve it like you, or what? anyway, i have some poor knowledge about "firwall", "wingate", "cracking tools" and ... very very poor! in brief, i want to know more about hacking and how to perform it and also the new hacking programs and alike. P.S: i don't have internet yet! P.S.S: i have heard of a program which can download a site to your account!! is it true? can anyone thankfully send it over? YOURS bingo @HWA AD.S ADVERTISING. The HWA black market ADVERTISEMENTS. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ *** IT HAS BEEN FOUR YEARS! *** F R E E M I T N I C K **NOW!** $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co m www.2600.com ########################################ww.2600.com www.freeke vin.com www.kev# Support 2600.com and the Free Kevin #.com www.kevinmitnick. com www.2600.co# defense fund site, visit it now! . # www.2600.com www.free kevin.com www.k# FREE KEVIN #in.com www.kevinmitnic k.com www.2600.########################################om www.2600.com www.fre ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net * * www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV * * JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUESDAY SIMULCAST ON WBAI AT 8PM * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Freebie: I am Alle Computer( http://www.cybershop.co.kr/computer) in Korea manager. First, I thank for your concern about our Site. e prepare small EVENT!! we give game software guest who buy our hardware more than $100. Please invite our site and give me your good advice. ////////////////////////////////////////////////////////////////////////////// // To place an ad in this section simply type it up and email it to // // hwa@press,usmc.net, put AD! in the subject header please. - Ed // ////////////////////////////////////////////////////////////////////////////// @HWA H.W Hacked websites Feb 20th-27th ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Note: The hacked site reports stay, especially with some cool hits by groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed * Hackers Against Racist Propaganda (See issue #7) MASS HACK From help net security; http://net-security.org/ by BHZ, Sunday 28th Feb 1999 on 2:32 am Cyrus and MagicFX, hacked 112 domains earlier this day. Main page that was hacked is http://www.intensive.net. Hacked page can be described with following sentence:"These sites were compromised to expose Carolyn Meinel for the fraud she is". Archived at http://net-security.org/spec/hack/www_intensive_net.htm CHANNEL 5 HACKED by BHZ, Sunday 28th Feb 1999 on 1:10 am From help net security; http://net-security.org/ "Earlier I hacked the St. Paul Library, but it didn't seem to get noticed. So I thought this'd work better". Kon is back.... This time he hacked site of Channel 5 News. He reprinted the text he wrote on hacked Library yesterday . See archive of the hack here;.http://net-security.org/spec/hack/www_kstp_com.htm DAILY HACK #2 by BHZ, Friday 26th Feb 1999 on 3:29 pm Another hack by Dutch hackers. This time http://www.hanbit.com was hacked. Hacker (Xoloth1), identifies himself as member of Dutch Threat, Dutch hacking group. I was contacted by Acos Thunder, real member of Dutch Threat, and he says that this guys hasn't got anything to do with them. BTW you can see hacked page here.http://net-security.org/spec/hack/www_hanbit_com.htm MASS HACK BY HCV by BHZ, Friday 26th Feb 1999 on 12:29 pm It seems that HcV is back on rampage. I got several mails stating that http://www.calweb.com and 200 more servers were hacked "/* HcV kapasa mexicana style'e ( r00ted ) by sizc4l *\ p1mp the sySt3m- Greetz to Hcv , Hp4 , and all that want their name on this 0wnedserver.Werd to I-L ... No damage was preformed - sizc4l - in0de (c) 99 ' n shit. W3 kn0w Yew lub Uz. D1z wAz a Qu1ck1e- opt1muz meet the real estate (inside Info)". Hack is archived on http://206.107.119.63. DAILY HACK by BHZ, Friday 26th Feb 1999 on 12:09 pm Website for Cross, Gunter, Witherspoon & Galchus (http://www.cgwg.com) company has been hacked earlier. This time hacker told:"If there was a competition for sites with bad security you would have lost. I did not root or administrate you in any kind of way.. but still i was able to alter this p4ge... Guess how? ". See hacked page here. http://net-security.org/spec/hack/www_cgwg_com.htm Z-Rock 106.7 Cracked [ contributed by cassa33 via HNN Feb 26th] www.z-rock.com a local California branch of "Z-rock, the worlds rock superstation" was recently cracked. The perpetrators of the crack claim that the site was only hacked to prove the point that their "security sucks". The crack was claimed to have been done by Nightmare, Shadow, Screeching Demon, and some credit to Zonis Teqneek. They claim that no files were deleted and that the original index.html was backed up. Z-Rock -> http://www.z-rock.com/ Cracked Pages Archive -> http://www.hackernews.com/archive/crackarch.html [ Contributed by Anonymous HNN Feb 26th ] We have recieved reports that the following sites have been cracked: http://www.cgwg.com http://www.eroticwishes.com http://calweb.com http://www.hanbit.com http://www.mundoeletronico.com.br [ Contributed by Everybody (HHN) ] Cracked We recieved reports that the following sites had been cracked over the weekend: http://www.babyspice.co.uk http://www.per.nl http://www.diningma.org/ http://www.wachterhaus.com http://www.200cigarettes.com http://www.ukip.co.uk/ http://www.comdex.com/ http://hollywoodbookstore.com http://www.ipswitch.com/ http://www.wsftp.com http://www.mre.gov.br http://www.swiss-web.com http://www.des-con-systems.com http://www.boscoenterprises.com/ http://jamco.smn.co.jp http://wgendai.smn.co.jp http://broadia.smn.co.jp http://sun122.smn.co.jp @HWA _________________________________________________________________________ A.0 APPENDICES _________________________________________________________________________ A.1 PHACVW, sekurity, security, cyberwar links ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The links are no longer maintained in this file, there is now a links section on the http://welcome.to/HWA.hax0r.news/ url so check there for current links etc. The hack FAQ (The #hack/alt.2600 faq) http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html Hacker's Jargon File (The quote file) http://www.lysator.liu.se/hackdict/split2/main_index.html International links:(TBC) ~~~~~~~~~~~~~~~~~~~~~~~~~ Foreign correspondants and others please send in news site links that have security news from foreign countries for inclusion in this list thanks... - Ed Netherlands...: http://security.pine.nl/ Russia........: http://www.tsu.ru/~eugene/ Indonesia.....: http://www.k-elektronik.org/index2.html http://members.xoom.com/neblonica/ Brasil........: http://www.psynet.net/ka0z http://www.elementais.cjb.net Got a link for this section? email it to hwa@press.usmc.net and i'll review it and post it here if it merits it. @HWA -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF-- ⌐ 1998, 1999 (c) Cruciphux/HWA.hax0r.news (r) Cruciphux is a trade mark of Hairy White Armpitz -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- Hackers Without Attitudes Information Warfare Alliance Website Opening soon: www.hwa-iwa.org --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF-- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ] [45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65] 
