The Hacker Chronicles - A Tour of the Computer Underground

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker Chronicles - A…the Computer Underground / The Hacker Chronicles - A Tour of the Computer Underground (P-80 Systems).iso / phrk3 / phrack28.9 < prev next >

Wrap

Text File | 1992-09-26 | 25KB | 495 lines

==Phrack Inc.== Volume Three, Issue 28, File #9 of 12 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN P h r a c k W o r l d N e w s PWN PWN ~~~~~~~~~~~ ~~~~~~~~~ ~~~~~~~ PWN PWN Issue XXVIII/Part 1 PWN PWN PWN PWN October 7, 1989 PWN PWN PWN PWN Created, Written, and Edited PWN PWN by Knight Lightning PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Welcome to Issue XXVIII of Phrack World News! This issue of Phrack World News contains stories and articles detailing events from June - October, 1989 and features Bellcore, Chalisti, Chaos Computer Club, Clifford Stoll, The Disk Jockey, Fry Guy, The Grim Phreaker, Legion of Doom, The Leftist, Major Havoc, Kevin Mitnick, Robert Morris, Oryan QUEST, The Prophet, Red Rebel, Shadow Stalker, Shadow 2600, Terra, The Urvile, and much more so keep reading. "The Real Future Is Behind You... And It's Only The Beginning!" _______________________________________________________________________________ Judge Suggests Computer Hacker Undergo Counseling July 17, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by Karen E. Klein (New York Times) LOS ANGELES -- A federal judge has suggested that Los Angeles computer hacker Kevin Mitnick be sentenced to a one-year residential treatment program to break his "computer addiction." Although she did not finalize her sentence, U.S. District Judge Mariana R. Pfaelzer said Monday that she thought Mitnick had some problems that would benefit from counseling. Pfaelzer will actually pass sentence at a hearing set for Tuesday, July 18. The idea that a computer "junkie" who cannot control his urge to break into computers could be helped with a program similar to Alcoholics Anonymous is a new one, Harriet Rossetto, director of the treatment program, told the judge. "His behavior is an impulse disorder," Rossetto said. "The disease is the addiction, whether it be drugs, alcohol, gambling, hacking, money or power." Rossetto, who was contacted by Mitnick's family, said Mitnick would be the first person addicted to computer crime to be treated in the Bet T'shuvah program , a 20-bed residential treatment program for Jewish criminal offenders. "It's not willful conduct, what Kevin does," she said. "He's tried to control his behavior but hacking gives him a sense of power, makes him feel like somebody when he's depressed or he's lost a job." Mitnick, age 25, has been in federal prison for seven months since his arrest last December on computer fraud charges. He pleaded guilty in May to possessing 16 unauthorized MCI long-distance codes and to stealing a computer security program from the Digital Equipment Corporation in Massachusetts. Mitnick has been described in court as a computer whiz who could break into secured systems and change telephone or school records at will. He told the judge on Monday, July 17 that he wants to stop hacking. "I sincerely want to change my life around and be productive rather than destructive," Mitnick said. "With counseling to break the addictive pattern I feel I have towards computer hacking, I can take an active role and I don't have to have the compulsive behavior again." Assistant U.S. Attorney James R. Asperger said that the government does not oppose Mitnick's release from prison to be treated at Bet T'shuvah. "The judge has taken this case very seriously. It shows computer hacking is not like a Nintendo game," Asperger said. Mitnick has cooperated with FBI investigators since his pleaded guilty and helped bring charges against his former best friend, Leonard DiCicco, 23, of Calabasas, Asperger said. DiCicco, who initially tipped the FBI to Mitnick's crimes, has agreed to plead guilty to a charge of aiding and abetting the transportation of a stolen computer program. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Authorities Backed Away From Original Allegations July 23, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ by Karen E. Klein (New York Times) LOS ANGELES -- Shortly after computer hacker Kevin Mitnick was arrested last December (1988), he was characterized as an extreme threat who could wreak electronic chaos if he got near so much as a telephone without supervision. Police and FBI agents started trying to corroborate the flurry of rumors that arose about the malicious actions of the computer whiz from suburban Panorama City, whose case attracted national attention. Three judges denied Mitnick, age 25, bail on the ground that he was a danger to society and ordered him held in a high-security jail cell. But after separating the Mitnick myth from the reality, authorities backed away from many of their original allegations. "A lot of the stories we originally heard just didn't pan out, so we had to give him the benefit of the doubt," said James R. Asperger, the assistant U.S. attorney who handled Mitnick's case. Mitnick, pudgy and nervous, appeared in court last week to apologize for his crimes and to ask for treatment to help break his compulsive "addiction" to computers. U.S. District Judge Mariana R. Pfaelzer sentenced him to serve one year in prison -- including the nearly eight months he already has served -- and then to undergo six months of counseling and treatment similar to that given to alcoholics or drug addicts. "I think he has problems that would benefit greatly from this kind of therapy," Pfaelzer said. "I want him to spend as much time as possible in counseling." The case that began with a bang ended with Asperger pointing out that the one-year prison term is the stiffest sentence ever handed out in a computer fraud case. Mitnick originally was accused of using unauthorized MCI long-distance codes to tap into Leeds University computers in England and of stealing a $4 million computer security system from the Digital Equipment Corporation in Massachusetts. He ultimately agreed to plead guilty to possessing 16 unauthorized MCI long-distance codes and to stealing the computer security program. The other charges were dismissed. Alan Rubin, Mitnick's lawyer, said he felt vindicated by the outcome of the case. Rubin contended from the start that computerphobia and adolescent exaggeration led authorities to mistakenly brand Mitnick a malicious criminal. "Once the snowball starts rolling, you can't stop it," said Rubin, who waged an unsuccessful campaign up to the federal appeals court to get bail for his client. Far from being serious, Rubin said, Mitnick's actions were mostly immature, adolescent pranks. He pointed to evidence that Mitnick was able to electronically cut off telephone service to people he was angry with and once sent an enemy a $30,000 hospital telephone bill. "It was the computer equivalent of sending your friend 14 pizzas," he said. Many of the legends surrounding Mitnick came from the subculture of computer hackers -- and specifically from a man who was once Mitnick's best friend, Leonard Mitchell DiCicco, age 23, of Calabasas, California. DiCicco, who had a falling out with Mitnick over a $100 bet, told computer security specialists at the Digital Equipment Corporation that Mitnick had been trespassing on their system. They in turn contacted the FBI agents, who arrested Mitnick. What DiCicco told investigators may or may not have been entirely truthful, Rubin said. "I have no idea what his motives were," Rubin said. But DiCicco, who alerted authorities to Mitnick's crime, had the tables turned on him after the government refused to grant him absolute immunity for his testimony against Mitnick. When the prosecution said they might charge him with a crime, DiCicco clammed up and refused to cooperate any further. But from his prison cell, Mitnick agreed to cooperate and provided enough incriminating evidence for the government to charge DiCicco. DiCicco is expected to plead guilty to a charge of aiding and abetting the interstate transportation of stolen property -- the computer security program -- on Monday. Asperger said he was not sure whether DiCicco would get a sentence similar to Mitnick's. "Although they were friends and partners in computer hacking, (DiCicco) appeared to play a subordinate role (in the crime)," Asperger said. Other rumors about Mitnick's conduct came from fellow hackers, who may have blown the stories out of proportion. "It's a very strange sub-culture, with a lot of jealousies," Rubin said. "Part of it is bragging about how macho you are and what systems you've broken into. It's very immature in a lot of ways." But prosecutors, citing Mitnick's various scrapes with computer misconduct since he was 13, aren't willing to let him off the hook entirely. "I think there's some substance to these things (the rumors that arose in Mitnick's case), an awful lot of them," said Los Angeles FBI chief Lawrence Lawler, who is a computer buff himself and followed Mitnick's case closely. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you are looking for other articles about Kevin David Mitnick aka Condor please refer to; "Pacific Bell Means Business" (10/06/88) PWN XXI. . .Part 1 "Dangerous Hacker Is Captured" (No Date ) PWN XXII . .Part 1 "Ex-Computer Whiz Kid Held On New Fraud Counts" (12/16/88) PWN XXII . .Part 1 "Dangerous Keyboard Artist" (12/20/88) PWN XXII . .Part 1 "Armed With A Keyboard And Considered Dangerous" (12/28/88) PWN XXIII. .Part 1 "Dark Side Hacker Seen As Electronic Terrorist" (01/08/89) PWN XXIII. .Part 1 "Mitnick Plea Bargains" (03/16/89) PWN XXV. . .Part 1 "Mitnick Plea Bargain Rejected As Too Lenient" (04/25/89) PWN XXVII. .Part 1 "Computer Hacker Working On Another Plea Bargain" (05/06/89) PWN XXVII. .Part 1 "Mitnick Update" (05/10/89) PWN XXVII. .Part 1 "Kenneth Siani Speaks Out About Kevin Mitnick" (05/23/89) PWN XXVII. .Part 1 _______________________________________________________________________________ BITNET/CSNET Announce Merger and Formation of CREN August 18, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Washington, DC -- Two of the nation's leading academic and research computer networks announced today that final steps are being taken to merge their organizations. Ira Fuchs, President of BITNET, and Bernard Galler, Chairman of CSNET, jointly reported that the two networks, which together include 600 colleges, universities, government agencies, and private sector research organizations, will unite to form the Corporation for Research and Educational Networking, CREN. Galler, a Professor of Electrical Engineering and Computer Science at the University of Michigan, commented: "The aims of CSNET and BITNET -- to support and promote the use of computer networks on campuses and within research organizations -- have converged over the last several years. We believe that by bringing these two networks into a single organization, we will be able to provide better service to our network users and more effectively participate in the fast-changing national network environment." Fuchs, Vice President for Computing and Information Technology at Princeton University, sees the move as a strengthening factor: "The need for campus networks and the introduction of new technology make it necessary to build a common base of network services using the most progressive technology available. By eliminating overlap between our two organizations, we will become more efficient, and more importantly, we can take a stronger role in the the formation of the national education and research network. We can achieve this goal faster and at lower cost by leveraging the efforts of the two major academic networking organizations." The merger of CSNET and BITNET has been studied for more than a year by a planning group consisting of representatives from both networks. CSNET currently lists 145 institutional and corporate members, and BITNET 480 members. Together, the two networks cover all 50 states and 32 foreign countries, including Japan, Brazil, Mexico, and Argentina. Both maintain gateways to EARN (European Academic Research Network), NetNorth (Canada), and the National Internet. The planning group's recommendations to merge were approved by the BITNET, Inc. Trustees and the Directors of the University Corporation for Atmospheric Research, operators of CSNET for the last five years. An information packet on the merger is being mailed to all members of both networks this week, with a ballot for BITNET members, who must approve the final legal steps under the provisions of BITNET By-Laws. In an advisory vote last winter, BITNET members approved the merger in principle by more than 90% of those voting. A gradual transition period is planned to bring together CSNET and BITNET services. CREN plans to continue use of EDUCOM and Bolt, Beranek and Newman (BBN) to provide technical and general management services to its members. EDUCOM President Kenneth M. King commented, "We are entering a particularly challenging period in the creation of an advanced national network infrastructure for research and education. CREN will play a major role in the future of these computer networks, which are becoming more and more important to the conduct of research and the quality of education. EDUCOM is pleased to have an opportunity to support the services and activities of CREN. " Frank Heart, Senior Vice President, BBN Systems and Technologies Corporation, said, "In keeping with its long involvement in the development of networking technologies, BBN is pleased to play a major supporting role in the evolution of BITNET and CSNET." The proposed CREN Board includes Fuchs and Galler; Douglas Bigelow. . . . . Wesleyan University William Curtis . . . . . University Corporation for Atmospheric Research David Farber . . . . . . University of Pennsylvania Suzanne Johnson. . . . . INTEL Corporation Mark Laubach . . . . . . Hewlett-Packard Corporation Philip Long. . . . . . . Yale University Dennis Ritchie . . . . . AT&T Bell Laboratories Martin Solomon . . . . . University of South Carolina Douglas Van Houweling. . University of Michigan William Yundt. . . . . . Stanford University For more information, contact Corporation for Research and Educational Networking Suite 600 1112 16th Street NW Washington, DC 20036 (202) 872-4215 [Obviously they decided not to call it ONEnet --KL] _______________________________________________________________________________ CERT Internet Security Advisory August 16, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Kenneth R. van Wyk Many computers connected to the Internet have recently experienced unauthorized system activity. Investigation shows that the activity has occurred for several months and is spreading. Several UNIX computers have had their "telnet" programs illicitly replaced with versions of "telnet" which log outgoing login sessions (including usernames and passwords to remote systems). It appears that access has been gained to many of the machines which have appeared in some of these session logs. (As a first step, frequent telnet users should change their passwords immediately.) While there is no cause for panic, there are a number of things that system administrators can do to detect whether the security on their machines has been compromised using this approach and to tighten security on their systems where necessary. At a minimum, all UNIX site administrators should do the following: o Test telnet for unauthorized changes by using the UNIX "strings" command to search for path/filenames of possible log files. Affected sites have noticed that their telnet programs were logging information in user accounts under directory names such as "..." and ".mail". In general, we suggest that site administrators be attentive to configuration management issues. These include the following: o Test authenticity of critical programs - Any program with access to the network (e.g., the TCP/IP suite) or with access to usernames and passwords should be periodically tested for unauthorized changes. Such a test can be done by comparing checksums of on-line copies of these programs to checksums of original copies. (Checksums can be calculated with the UNIX "sum" command.) Alternatively, these programs can be periodically reloaded from original tapes. o Privileged programs - Programs that grant privileges to users (e.g., setuid root programs/shells in UNIX) can be exploited to gain unrestricted access to systems. System administrators should watch for such programs being placed in places such as /tmp and /usr/tmp (on UNIX systems). A common malicious practice is to place a setuid shell (sh or csh) in the /tmp directory, thus creating a "back door" whereby any user can gain privileged system access. o Monitor system logs - System access logs should be periodically scanned (e.g., via UNIX "last" command) for suspicious or unlikely system activity. o Terminal servers - Terminal servers with unrestricted network access (that is, terminal servers which allow users to connect to and from any system on the Internet) are frequently used to camouflage network connections, making it difficult to track unauthorized activity. Most popular terminal servers can be configured to restrict network access to and from local hosts. o Passwords - Guest accounts and accounts with trivial passwords (e.g., username=password, password=none) are common targets. System administrators should make sure that all accounts are password protected and encourage users to use acceptable passwords as well as to change their passwords periodically, as a general practice. For more information on passwords, see Federal Information Processing Standard Publication (FIPS PUB) 112, available from the National Technical Information Service, U.S. Department of Commerce, Springfield, VA 22161. o Anonymous file transfer - Unrestricted file transfer access to a system can be exploited to obtain sensitive files such as the UNIX /etc/passwd file. If used, TFTP (Trivial File Transfer Protocol - which requires no username/password authentication) should always be configured to run as a non-privileged user and "chroot" to a file structure where the remote user cannot transfer the system /etc/passwd file. Anonymous FTP, too, should not allow the remote user to access this file, or any other critical system file. Configuring these facilities to "chroot" limits file access to a localized directory structure. o Apply fixes - Many of the old "holes" in UNIX have been closed. Check with your vendor and install all of the latest fixes. If system administrators do discover any unauthorized system activity, they are urged to contact the Computer Emergency Response Team (CERT). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Internet Cracker On The Loose: Who Is He? October 2, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ There is a cracker on the loose in the Internet. This is the information made public so far. Traces of the cracker were found at the Institute for Advanced Studies in Princeton. He also left traces at one of the Super computer centers. Both CERT and the FBI have been called. The technique that is being used is as follows: 1) He has a modified telnet that tries a list passwords on accounts. Username forwards and backwards, username + pw, etc. 2) He seems to have a program call "ret", that is breaking into root. 3) He seems to be getting a list of victim machines via people's .rhosts files. 4) He copies password files to the machines that he is currently working from. 5) He is good about cleaning up after himself. He zeros out log files and other traces of himself. 6) The breakins are occurring between 10 PM Sunday nights and 8 AM Monday mornings. 7) He seems to bring along a text file of security holes to the machines he breaks into. 8) Backtracing the network connections seem to point to the Boston area as a base of operations. The system administrator at IAS found a directory with the name ".. " (dot dot space space). The files mentioned above were found in this directory. _______________________________________________________________________________ Worried Firms Pay Hush Money To "Hackers" June 12, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ By Richard Caseby (London Times) "Are London Firms Offering Amnesty To Hacker Thieves?" Firms in the City of London are buying the silence of hackers who break into their computers and steal millions of pounds. At least six London firms have signed agreements with criminals, offering them amnesty if they return part of the money. The firms fear that if they prosecute they will lose business when customers learn that their computer security is flawed. In several of the case the losses exceeded 1 million pounds, but only a tenth of the total was returned. The Computer Industry Research Unit (CIRU) which uncovered the deals and which is advising the Department of Trade and Industry in data security, believes the practice of offering amnesties is widespread. "Companies who feel vulnerable are running scared by agreeing to these immoral deals. Their selfishness is storing up serious problems for everyone else," said Peter Nancarrow, a senior consultant. Police have warned that deals struck with criminals could possibly lead to an employer being prosecuted for perverting the course of justice. Detective Inspector John Austin, of Scotland Yard's computer fraud squad, said, "Employers could find themselves in very deep water by such strenuous efforts to protect the credibility of their image." Legal experts say the firms are making use of section five of the Criminal Law Act 1967 which allows them to keep silent on crimes and privately agree on compensation. However, an employer becomes a witness to the offense by taking evidence from a criminal when the deal is drawn up. Hackers steal by electronically transferring funds or by programming a computer to round off all transactions by a tiny amount and diverting the money to a separate account. In one case, an assistant programmer at a merchant bank diverted 8 million pounds to a Swiss bank account and then gave back 7 million in return for a non-disclosure agreement protecting him against prosecution. Such thefts have spread alarm throughout London, with consultants offering to penetrate the computer networks of banks and finance houses to pinpoint loopholes before a hacker does. The biggest contracts cost up to 50,000 pounds and can involve a four month investigation in which every weakness is explored. Detectives have found that computer security at many London institutions is riddled with loopholes. A city of London police operation, codenamed Comcheck, revealed wide spread weaknesses. Firms were asked to track the number of unauthorized logons over Easter bank holiday. Some companies unable to tell whether hackers had penetrated their network, while others lacked any security defenses. In addition to theft, companies are vulnerable to blackmail. Hackers can threaten to sabotage computers by inserting "viruses" and "logic bombs" -- rogue programs which can paralyze a system. This type of threat has prompted the offer of a new insurance policy underwritten by Lloyd's which specifically covers viruses and other computer catastrophes. _______________________________________________________________________________ Downloaded From P-80 International Information Systems 304-744-2253 12yrs+