Hacker Chronicles 1/HACKER1.ISO/cud3/cud319d.txt

Text File | 1992-09-11 | 24KB | 502 lines

------------------------------

From: Various
Subject: The CU in the News
Date: 4 June, 1991

********************************************************************
***  CuD #3.19: File 4 of 4: Moderators Corner                   ***
********************************************************************

From: [e-mail]
Subject:  Dutch Crackers as opposed to Graham Crackers
Date:     Mon,  6 May 91 22:16 EDT

                        Internet Break-Ins
           Dutch Cracker Easily Accessed U.S. Computers
                         By Mitch Wagner
                    Unix Today, April 29, 1991

Allegations that Dutch crackers have been operating with impunity for
months against U.S. computers has stirred a debate whether systems
administrators have been negligent in failing to close easy, obvious
security holes that have been well-known for years.

Dutch crackers have, since September, been using the Internet to
access computers, most of them Unix machines, at the Kennedy Space
Center, the Pentagon's Pacific meet Command, the Lawrence Livermore
National laboratories and Stanford University.  The techniques they've
used have been simple, well-known and uncreative, and they've found
the job an easy one, say sources. "These are not skilled computer
geniuses like Robert Morris," said Cliff Stoll, author of The Cuckoo's
Egg, who said he's been in contact with some Dutch crackers who may
have committed the break-ins. "These are more like the kind of hacker
I caught, sort of plodding, boring people." Stoll's 1989 book
concerned his pursuit of a cracker.

Techniques include guessing at commonly used passwords, default
passwords that ship with Unix systems and that some users don't bother
to change, and using guest accounts, said Stoll.

The crackers managed to obtain superuser privileges at a system at
Stanford University, said Bill Bauridel, information security officer
at Stanford University Data Center. They used a bug in sendmail - the
same program exploited by Robert Morris to loose a worm on the
Internet in 1988, though Bauridel said the crackers did not use the
sendmail feature that Morris exploited.

The Lawrence Livermore Laboratories computers were only used as a
gateway to other systems, said Bob Borchers, associate director for
computation at the labs.

The crackers have been able to access only non-classified material,
such as routine memos say authorities. So far, no evidence has been
found that they did anything malicious once they broke into a U.S.
site.

The lack of laws governing computer crime in Holland allows crackers
to operate with relative impunity, said Martin de Lange, managing
director of ACE, and Amsterdam-based Unix systems software company.

The impunity combines with an anti-authoritarian atmosphere in Holland
to make cracking a thriving practice, said Stoll.  "There's a national
sense of thumbing one's nose at the Establishment that's promoted and
appreciated in the Netherlands," he said. "Walk down the streets of
Amsterdam and you'll find a thriving population that delights in
finding ways around the Establishment's walls and barriers."

The break-ins became a subject of notoriety after a Dutch television
show called After the News ran film Feb. 2 purporting to be of an
actual cracker break-in, said Henk Bekket, a network manager at
Utrecht University.

Utrecht University in Holland was reported to be the first site broken
into. Bekker said he was able to detect two break-ins, one in October
and one again in January.

The crackers apparently dialed into a campus terminal network that
operates without a password, accessed the campus TCP/IP backbone, and
then accessed another machine on campus-a VAX 11/75-that hooks up to
SURFnet, a national X.25 network in Holland.

From SURFnet, they were presumably able to crack into an Inter-net
computer somewhere, and from there access the computers in the United
States, said Bekker.

The dial-in to SURFnet gateway has been canceled since the January
attempt, he said. (Presumably, the break-in footage aired Feb. 2 was
either through another channel, or filmed earlier.)

Bekker said he manages a network consisting of a DECsystem 5500 server
and 40 to 50 Sun and VAX VMS workstations.  He noted a break-in to
another machine on campus Jan. 16, and into a machine at the
University of Leyden in October.

A cracker was searching DECnet I password files for accounts with no
password.  The cracker was also breaking into machines over DECnet,
said Bekker. The cracker had a rough idea of the pattern of DECnet
node addresses in Holland, and was trying to guess machine addresses
from there. Node addresses begin with the numerals 28, said Bekker,
and he found log files of the cracker searching for machines at 28.1,
28.2, 28.3 and so on. But the cracker did not know that the actual
sequence goes 28.100, 28.110, and so on.

"Hackers are organized to get together, discuss technologies, and they
openly demonstrate where there are installations prone to break-in,"
de Lange said.  Computer crime in Holland can be prosecuted under laws
covering theft of resources, wiretapping and wire fraud, said Piet
Beertema, of the European Unix User Group, and network manager of the
Center for Mathematics and Computer Science in Amsterdam.

And finding someone to investigate can also be a problem, said Bekker.

"You cannot go to the police and say, 'Hey, someone has broken into my
computer.' They can't do anything about it," he said.

Stoll, the American author, said crackers appear firmly rooted in
Dutch soil.

"There is a history going back more than five years of people getting
together and breaking into computers over there," he said.  "Hacker
clubs have been active there since 1985 or 1986."

But he said it's more than lack of law that has made cracking so
popular. Most industrialized nations have no cracking laws, and those
that have them find prosecution extremely difficult, he said. Dutch
citizens also have an anti-authoritarian spirit, he added.

But Stoll condemmed the crackers.  "This is the sort of behavior that
wrecks the community, spreads paranoia and mistrust," he said. "It
brings a sense of paranoia to a community which is founded on trust."
Because no classified data was accessed, Mike Godwin, attorney for the
Electronic Frontiers Foundation (EFF), cautioned against making too
much of the incidents.

"What did these people do" he said. "There's no sense that they
vandalized systems or got ahold of any classified information." The
itself as an organization fighting to see civil rights guarantees
extended to information systems. The Cambridge, Mass., organization
has been involved in a number of cracker defenses.

The fact that the systems were breached means the data's integrity is
compromised, said Netunann. just because the data isn't classified
doesn't mean it isn't important, he noted. 'Just because you can't get
into classified systems doesn't mean you can't get sensitive
information," he said.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: Brendan Kehoe <[e-mail]>
Subject: Long-haul Carriers May Offer Toll-Fraud Monitoring
Date: Wed, 1 May 91 22:50:31 -0400

"Long-haul carriers may offer toll-fraud monitoring:  Services would
                help shield customers from hackers"
               by Anita Taff, Washington Bureau Chief

WASHINGTON D.C. -- Long-distance carriers are considering offering
services that would shield customers from toll fraud by monitoring
network activity for suspicious traffic patterns and tipping off
users before huge costs would be run up, Network World has
learned.

Hackers are defrauding corporations by dialing into their private
branch  exchanges and using stolen authorization codes to dial out
of the switches to remote destinations, sticking the switch owners
with charges ranging from several thousand to, in one case, a
million dollars.

Users have been loathe to report toll fraud because they are
embarrassed about the security breaches or because they have entered
into private settlements with carriers that cannot be disclosed. But
earlier this year, Pacific Mutual Life Insurance Co., exasperated by
$200,000 in fraudulent charges run up during one weekend and lack of
progress in settling the issue with AT&T, turned to the Federal
Communications Commission for help.

The insurance company asked the FCC to open a proceeding in order to
establish guidelines that fairly distribute liability for toll fraud
among users, long distance carriers and customer premises equipment
manufacturers. The company questioned the validity of AT&T's claims
that its tarriffs place the liability for fraud on users' shoulders.
Both AT&T and MCI Communications Corp. oppose Pacific Mutual's
position.

But it is clear something has to be done. Customers lose $500 million
annually to toll fraud, according to the Communications Fraud
Control Association.

"There are two kinds of customers: those who have been victims of
toll fraud and those who are about to [become victims]," said Jim
Snyder, staff member of the systems integrity department at MCI.

According to Snyder, about 80% of the calls placed by hackers go to
one of three places: Columbia, Pakistan and area code 809, which
covers Caribbean countries including the Dominican Republic and
Jamaica. Often, the calls are placed at night or during weekends. It
is this thumbprint that would enable carriers to set up monitoring
services to identify unusual activity. He said MCI is considering
such a service but has not yet decided whether to offer it.

AT&T would also be interested in rolling out such a monitoring
service if customer demand exists, a spokesman said.

Henry Levine, a telecommunications attorney in Washington, D.C. who
helps customers put together Tariff 12 deals, said he knows of
several users that have requested toll-fraud monitoring from AT&T.
He said AT&T is currently beta-testing technology that gives users
real-time access to call detail data, a necessary capability for
real-time monitoring.

US Sprint Communications Co. offers a monitoring service for its
800, UltraWATS, Virtual Private Network, SprintNet and voice mail
customers free of charge, but it is not a daily, around-the-clock
monitoring service, and the typical lag time until user are notified
of problems is 24 hours.

In a filing on behalf of the Securities Industry Association, Visa
USA, Inc., the New York Clearinghouse Association and Pacific
Mutual, Levine urged the agency to require carriers to offer
monitoring services. Network equipment could monitor traffic
according to preset parameters for call volume, off-hour calling and
suspicious area or country codes, he said. If an anomaly is
detected, Levine's proposal suggests that carriers notify users
within 30 minutes. Therefore, users would be held liable for only a
nominal amount of fraudulent charges.

Network World, April 29, 1991 [Volume 8 Number 17].
[161 Worcester Road, Framingham, MA. 01701    508/875-6400
MCI-Mail:390-4868]

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: [e-mail](Joe Abernathy)
Steve Jackson Games story from Houston Chronicle
Date: Thu, 16 May 91 16:40:28 CDT

    Lawsuit alleges rights violations in computer crime crackdown


By JOE ABERNATHY
Copyright 1991, Houston Chronicle

An Austin game publisher has sued the U.S. Secret Service for alleged
civil rights violations in connection with a nationwide crackdown on
computer crime.

Steve Jackson Games, whose case has become a cause celebre in the
computer network community, alleges in the lawsuit that a raid
conducted during OperationSun Devil violated the rights of the company
and its customers to free speech, free association, and a free press.

The lawsuit in federal district court in Austin further claims the
raid was a violation of the protection against unreasonable search and
seizure, and violated the law restricting the government from
searching the office of publishers for work products and other
documents. It seeks unspecified damages.

"This is a lawsuit brought to establish the statutory rights of
businesses and individuals who use computers," said Jackson's
attorney, Sharon Beckman of Boston.  "It's about the First Amendment,
it's about the right to privacy, and it's about unreasonable
government intrusion."

Defendants include the Secret Service; Assistant United States
Attorney William J. Cook in Chicago; Secret Service agents Timothy M.
Foley and Barbara Golden; and Henry M. Kluepfel of Bellcore, a
telephone company research consortium which assisted the agency in its
investigation.

Earl Devaney, special agent in charge of the Secret Service fraud
division, said that his agency was barred from responding to the
allegations contained in the lawsuit.

"Our side of the story can't be told because we're compelled by the
laws that govern us to remain mute," he said. "We'll have to let the
future indictments, if there are any, and the future trials speak for
themselves."

Devaney said the agency recently completed its review of evidence
seized during Operation Sun Devil and has sent it to federal
prosecutors. He couldn't predict how many indictments will result.

The Electronic Frontier Foundation, founded by computer industry
activists after questions arose regarding the legality of several Sun
Devil raids, is paying Jackson's legal fees. James R. George, an
Austin attorney with expertise in constitutional law, represents
Jackson in Texas.

Contending that civil rights normally taken for granted are often
denied to users of computer networks and bulletin boards, the EFF
attorneys designed Jackson's case as a test of how courts will treat
these issues.

"What happened was so clearly wrong," Beckman said.  "Here we have a
completely innocent businessman, a publisher no less, whose
publications are seized, whose computers are seized, whose private
electronic mail is seized, and all for no good reason."

Jackson's firm was raided on March 1, 1990, along with 27 other homes
and businesses across the nation. The Secret Service confiscated
dozens of computers and tens of thousands of computer data disks in
the raids. After several months passed with no charges being filed,
the agency came under increasing fire for Sun Devil.

"They raided the office with no cause, confiscated equipment and data,
and seriously delayed the publication of one big book by confiscating
every current copy," Jackson said. "It very nearly put us out of
business, and we are still extremely shaky."

Seven months after the raid on Jackson's firm, the search warrant was
unsealed, revealing that the firm was not even suspected of
wrongdoing. An employee was suspected of using a company bulletin
board system to distribute a document stolen from the telephone
company.

Bulletin board systems, called BBSs in computer jargon, allow people
with common interests  to share information using computers linked by
telephone.  Jackson's bulletin board, Illuminati, was used to provide
product support for his games - which are played with dice, not
computers.

Beckman said the search warrant affidavit indicates investigators
thought the phone company document was stored on a bulletin board at
the employee's home, and therefore agents had no reason to search the
business.

"Computers or no computers, the government had no justification to
walk through that door," she said.

Beckman said that by seizing the BBS at Steve Jackson Games, the
Secret Service had denied customers the right to association.

"This board was not only a forum for discussion, it was a forum for a
virtual community of people with a common interest in the gaming
field," she said. "Especially for some people who live in a remote
location, this forum was particularly important, and the Secret
Service shut that down."

Jackson was joined in the lawsuit by three New Hampshire residents,
Elizabeth McCoy, Walter Milliken and Steffan O'Sullivan, who used the
Illuminati BBS.

"Another right is privacy," Beckman said. "When the government seized
the Illuminati board, they also seized all of the private electronic
mail that (callers) had stored. There is nothing in the warrant to
suggest there was reason to think there was evidence of criminal
activity in the electronic mail - the warrant doesn't even state that
there was e-mail."

"That, we allege, is a gross violation of the Electronic
Communications Privacy Act," Beckman said.

Mitchell D. Kapor, creator of the popular Lotus spreadsheet program
and co-founder of the Electronic Frontier Foundation, said:

"The EFF believes that it is vital that government, private entities,
and individuals who have violated the Constitutional rights of
individuals be held accountable for their actions. We also hope this
case will help demystify the world of computer users to the general
public and inform them about the potential of computer communities."


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: <[e-mail]>
Subject:  More info on a past article
Date:     Sat,  1 Jun 91 08:27 EDT

                         Court Tosses Inslaw Appeal
                             By Gary H. Anthes
                         Computerworld May 13, 1991

Washington, D.C.- A three-judge panel of the US Court of Appeals throw
out two lower court rulings last week that said the US Department of
Justice had stolen software from Inslaw, Inc. and had conspired to
drive the firm out of business.

The Court of Appeals for the Washington, D.C., circuit did not
consider the validity of the lower court findings but said the
bankruptcy court that first upheld Inslaw's charges had exceeded its
authority.

This is a serious setback for Inslaw, which said it has spent five
years and $6 million in legal fees on the matter, but the company
vowed to fight on. It may ask the full court to reconsider, it may
appeal to the US Supreme Court, or it may go to more specialized
tribunals set up by the government to hear disputes over contracts,
trade secrets, and copyrights, Inslaw President William Hamilton said.

"Not many firms could have lasted this long, and now to have this
happen is just unbelievable. But there's no way in hell we will put up
with it," an obviously embittered Hamilton said. It may cost the tiny
firm "millions more" to reach the next major legal milestone, he said.

Double Trouble
Since the bankruptcy court trial in 1987, Inslaw has learned of
additional alleged wrongdoings by the Justice Department.

"The new evidence indicates that the motive of the [software theft]
was to put Inslaw's software in the hands of private sector friends of
the Reagan/Bush administration and then to award lucrative government
contracts to those political supporters," Hamiliton said.

He said that other evidence suggests that the software was illegally
sold to foreign intelligence agencies.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From:  [e-mail]
Subject:  Time to Copyright Underground Material
Date:     Sat,  1 Jun 91 07:32 EDT

The following article was interesting to read for many reasons but
most importantly about the database on the computer underground. I
wonder if they will also act as a "unofficial" archive site for issues
of Phrack, LoD, CuD, etc. If this is the case, then it might not be a
good idea anymore to provide information to the Internet sites unless
it could be copyrighted. Because on most of the PC BBS's you must
state that you are a non-security and law enforcement type to gain
access. Just a thought.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

                       Systems Security Tips Go On-Line
                             By Michael Alexander
                          Computerworld May 13, 1991

Farifax, Va.-- Information systems security managers, electronic data
processing auditors and others involved in systems protection know
that it can often be difficult to keep on top of security technology
and fast-breaking news. This week, National Security Associates, Inc.,
will officially kick off an on-line service dedicated solely to
computer security.

The repository contains databases of such articles on computer
security that have appeared in 260 publications, computer security
incident reports and vendor security products. One database is devoted
to activity in the computer underground and to techniques used to
compromise systems security.

  "This is a tough industry to keep up with," said Dennis Flanders, a
communications engineer with computer security responsibilities at
Boing Co.  Flanders has been an alpha tester of National Security
Associates' systems for about six months. "Security information is now
being done piecemeal, and you have to go to many sources for
information. The appealing thing about this is [that] all of the
information is in one place."

  The service costs $12.50 per hour. There is a onetime sign-up charge
of $30, which includes $15 worth of access time.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: Anonymous
Subject: Justice Dept as Pirates: More Inslaw News
Date:     Tue, 2 June  91 21:19:28 PDT

Source: "Software Pirates," IN THESE TIMES (May 29-June 11, 1991, pp
11-13). Author: Joel Bleifuss.

I found the following article in the latest In These Times.  It's
lengthy, so readers can obtain a copy from their newstands.  The
author summarizes Inslaw Corp.'s case against the U.S. Department of
Justice, which it charges robbed it of its program, conspired to send
the company into bankruptcy, and then initiated a cover-up.

     "In 1987, Judge George Bason, the federal bankruptcy judge for
     Washington, D.C., ruled that 'the Department of Justice took,
     convereted, stole' the Inslaw software "by trickery, fraud and
     deceit." The case is still in the courts."

The author links the Inslaw case to the 1980 arms-for-hostages
allegations of the Bush-Reagan campaign and suggests that foreign
intrigue is the root of the matter.  After a lengthy description of
the case, which has been summarized elsewhere so I won't repeat it,
the author concludes:

          "The St. Louis Post-Dispatch, which has assigned reported
     Phil Linsalata to cover the alleged Inslaw and 1980 scandals, ahs
     called for a congressional inquiry to 'alert the public to the
     pervasiveness of underground government, both legal and illegal.'
     As the May 13 editorial put it, 'If a subterranean network of
     operatives (like that exposed in the Iran-contra investigation)
     still exists, carrying out secret government policies, the very
     survival of a democratic political system based on law requires
     that it be exposed to the light.  (The Inslaw case) may reveal
     pat of an illegal policy that was put in place even before the
     Regan administration had taken office. That is why Congress must
     try to find out the truth behind (allegations that the 1980
     Reagan-Bush campaign arranged a secret arms-for-hostages deal
     with Iran).'
          Only when these allegations are brought to light can justice
     be served.'"

********************************************************************

------------------------------

                         **END OF CuD #3.19**
********************************************************************