Hacker Chronicles 1

home *** CD-ROM | disk | FTP | other *** search

/ Hacker Chronicles 1 / HACKER1.ISO / phrk3 / phrack25.10 < prev next >

Wrap

Text File | 1992-09-26 | 26KB | 441 lines

==Phrack Inc.== Volume Three, Issue 25, File 10 of 11 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN P h r a c k W o r l d N e w s PWN PWN ~~~~~~~~~~~ ~~~~~~~~~ ~~~~~~~ PWN PWN Issue XXV/Part 2 PWN PWN PWN PWN March 29, 1989 PWN PWN PWN PWN Created, Written, and Edited PWN PWN by Knight Lightning PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN German Hackers Break Into Los Alamos and NASA March 2, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Three hours ago, a famous German TV-magazine revealed maybe one of the greatest scandals of espionage in computer networks: They talk about some (three to five) West German hackers breaking into several secret data networks (Los Alamos, Nasa, some military databases, (Japanese) war industry, and many others) in the interests of the KGB, USSR. They received sums of $50,000 to $100,000 and even drugs, all from the KGB, the head of the political television-magazine said. The following news articles (and there are a lot) all deal with (directly and indirectly) the recent Spy scandal situation that occurred in West Germany. The majority of the articles shown here are taken from RISKS Digest, but they have been edited for this presentation. This presentation contains some information not previously seen (at least not in this format). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Computer Espionage: Three "Wily Hackers" Arrested March 2, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Three hackers have been arrested in Berlin, Hamburg and Hannover, and they are accused of computer espionage for the Soviet KGB. According to the television magazine "Panorama" (whose journalists have first published the NASA and SPAN hacks), they intruded scientific, military and industry computers and gave passwords, access mechanisms, programs and data to 2 KGB officers; among others, intrusion is reported of the NASA headquarters, the Los Alamos and Fermilab computers, the United States Chief of Staff's data bank OPTIMIS, and several more army computers. In Europe, computers of the French-Italian arms manufacturer Thomson, the European Space Agency ESA, the Max Planck Institute for Nuclear Physics in Heidelberg, CERN/GENEVA and the German Electron Accelerator DESY/Hamburg are mentioned. The report says that they earned several 100,000 DM plus drugs (one hacker evidently was drug addict) over about 3 years. For the German Intelligence authorities, this is "a new quality of espionage." The top manager said that they had awaited something similar but are nevertheless surprised that it happened so soon and with such broad effects. Summarizing the different events which have been reported earlier -- NASA and SPAN hacks, Clifford Stoll's report of the "Wily Hacker" -- I regard this as essentially the final outcome of the Wily Hackers story (with probably more than the 3 which have now been imprisoned). It is surprising that the Intelligence authorities needed so long time (after Cliff's Communications Of The ACM report, in May 1988) to finally arrest and accuse these crackers. Moreover, the rumors according to which design and production plans of a Megabit chip had been stolen from Philips/France computers seems to become justified; this was the background that CCC hacker Steffen Wernery had been arrested, for several months, in Paris without being accused. CAD/CAM programs have also been sold to KBG. Information Provided By Klaus Brunnstein - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Computer Spy Ring Sold Top Secrets To Russia March 3, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ West German counter-intelligence has uncovered a spy ring centered on computer hackers suspected of having supplied the Soviet Union with top secret military and economic information. They are said to have penetrated computer networks in the United States, Western Europe and Japan, according to a television report last night. In a special program, the North German Broadcasting Network said that thousands of computer codes, passwords and programs which allowed the Soviet Union access to major computer centers in the Western world have been passed on by the hackers. They had been recruited by the KGB in 1985 and are alleged to have supplied the information in return for money and drugs. In Karlsruhe, the West German Chief Public Prosecutor's Office, which is in charge of spy cases, would only confirm last night that three arrests have been made March 2nd during house searches in Hannover and West Berlin. Those detained were suspected of "having obtained illegally, through hacking and in exchange for money, information which was passed on to an Eastern secret service." But the spokesman did not share West German television's evaluation, which said the case was the most serious since the unmasking in 1974 of an East German agent in the office of ex-Chancellor Willy Brandt. The Interior Ministry in Bonn last night also confirmed several arrests and said the suspects had supplied information to the KGB. The arrests followed months of investigations into the activities of young computer freaks based in Hamburg, Hannover and West Berlin, the ministry said. According to the television report, the hackers gained access to the data banks of the Pentagon, NASA Space Center, and the nuclear laboratory in Los Alamos. They also penetrated leading West European computer centers and armament companies, including the French Thomson group, the European Nuclear Research Center, CERN, in Geneva; the European Space Authority, ESA, and German companies involved in nuclear research. The Russians are alleged to have put pressure on the hackers because of their involvement with drugs, and to have paid several hundred thousands marks for information, the program said. West German security experts on the evening of March 2nd described the new spy case as "extremely grave." The KGB has been provided with a "completely new possibility of attack" on Western high technology and NATO military secrets. The sources said it was "sensational" that the hackers should have succeeded in penetrating the US defense data systems from Western Europe. The North German Broadcasting Network program said its research was based on information given by two members of the suspected espionage ring. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - KGB Computer Break-Ins Alleged In West Germany March 3, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Taken From the International Herald Tribune Bonn - Three West German computer hackers have been arrested on suspicion of infiltrating computer networks worldwide to obtain secret data for an East block intelligence service, prosecutors said on March 2nd. A spokesman for the federal prosecutor, Alexander Prechtel, confirmed that three men were arrested, but did not identify the East Block country involved or the networks infiltrated. The ARD television networks "Panorama" program, the thrust of which the spokesman confirmed, said the hackers had passed secrets from a range of highly sensitive U.S., French, and West German computer networks to the KGB, the Soviet secret police. The television report said it was the worst such espionage case to be uncovered in West Germany since the 1974 exposure of Guenter Guillaume, an East German spy who was a top aide to Willy Brandt, then the West German chancellor. Among the systems believed to have been infiltrated were the U.S.: Defense Department's staff data bank, the U.S. nuclear arms laboratory in Los Alamos, New Mexico, the National Aeronautics and Space Administration, and U.S. military supply depots. The report said other systems entered were at the French arms and electronics company Thomson SA, a European nuclear-research center in Geneva, the European Space Agency and the Max-Planck Institute for Nuclear Physics in West Germany. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - News From The KGB/Wily Hackers March 7, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Now, five days after the "sensational" disclosure of the German (NDR) Panorama Television team, the dust of speculations begins to rise and the facts become slowly visible; moreover, some questions which could not be answered in Clifford Stoll's Communications of the ACM paper may now be answered. Though not all facts are known publicly, the following facts seem rather clear. - In 1986, some hackers from West Berlin and Hannover discussed, in "hacker parties" with alcohol and drugs, how to solve some personal financial problems; at that time, first intrusions of scientific computers (probably CERN/Geneva as hacker training camp) and Chaos Computer Club's spectacular BTX-intrusion gave many hackers (assisted by newsmedia) the *puerile impression* that they could intrude *into every computer system*; I remember contemporary discussions on 1986/87 Chaos Computer Conferences about possibilities, when one leading CCC member warned that such hacks might also attract espionage (Steffen Wernery recently mentioned that German counter-espionage had tried several times to hire him and other CCC members as advisors -- unsuccessfully). - A "kernel group" of 5 hackers who worked together, in some way, in the "KGB case" are (according to Der SPIEGEL, who published the following names in its Monday, March 6, 1989 edition): -> Markus Hess, 27, from Hannover, Clifford Stoll's "Wily Hacker" who was often referred to as the Hannover Hacker and uses the alias of Mathias Speer; after having ended (unfinished) his studies in mathematics, he works as programmer, and tries to get an Informatics diploma at the University of Hagen (FRG); he is said to have good knowledge of VMS and UNIX. -> Karl Koch, 23, from Hannover, who works as programmer; due to his luxurious lifestyle and his drug addiction, his permanent financial problems have probably added to his desire to sell "hacker knowledge" to interested institutions. -> Hans Huebner, alias "Pengo," from Berlin, who after having received his Informatics diploma from Technical University of West Berlin, founded a small computer house; the SPIEGEL writes that he needed money for investment in his small enterprise; though he does not belong to the Chaos Computer Club, he holds close contacts to the national hacker scenes (Hamburg: Chaos Computer Club; Munich: Bavarian Hacker Post; Cologne: Computer Artists Cologne, and other smaller groups), and he was the person to speak about UUCP as a future communications medium at the Chaos Communication Congress. -> Dirk Brezinski, from West Berlin, programmer and sometimes "troubleshooter" for Siemens BS-2000 systems (the operating system of Siemens mainframe computers), who earned, when working for Siemens or a customer (BfA, a national insurance for employees) 20,000 DM (about $10,800) a month; he is regarded (by an intelligence officer) as "some kind of a genius." -> Peter Carl, from West Berlin, a former croupier, who "always had enough cocaine." No information about his computer knowledge or experience is available. After successfully stimulating KGB's interest, the group (mainly Hess and Koch) committed their well-documented hacks [See Clifford Stoll's "Stalking the Wily Hacker," Communications of the ACM, May 1988]. SPIEGEL writes that the group *sold 5 diskettes full of passwords*, from May to December 1986, to KGB officers which they met in East Berlin; when Bremen University computer center, their favorite host for transatlantic hacks, asked the police to uncover the reasons for their high telephone bills, they stopped the action. This statement of Der SPIEGEL is probably wrong because, as Cliff describes, the "Wily Hacker" successfully worked until early 1988, when the path from his PC/telephone was disclosed by TYMNET/German Post authorities. The German public prosecutors did not find enough evidence for a trial, when examining Hess' apartment; moreover, they had acquired the material in illegal actions, so the existing evidence could not be used and finally had to be scratched! In Hess' apartment, public prosecutors found (on March 3, 1989) password lists from other hacks. On Monday, March 6, 1989, the Panorama team (who had disclosed the NASA hack and basically the KGB connection) asked Klaus Brunnstein to examine some of the password lists; the material which he saw (for 30 minutes) consisted of about 100 photocopied protocols of a hack during the night of July 27 to 28, 1987; it was the famous "NASA hack." From a VAX 750 (with VMS 4.3), which they entered via DATEX-P (the German packed-switched data-exchange network, an X.25 version), where they evidently previously had installed a Trojan horse (UETFORT00.EXE), they tried, via SET HOST... to log-into other VAXes in remote institutes. They always used SYSTEM account and the "proper" password (invisible). Remark: Unfortunately, DEC's installation procedure works only if a SYSTEM account is available; evidently, most system managers do not change the preset default password MANAGER; since Version 4.7, MANAGER is excluded, but on previous VMS versions, this hole probably exists in many systems! Since the hackers, in more than 40% of the cases, succeeded to login, their first activities were to SET PRIV=ALL; SET PRIO=9, and then to install (via trans-net copy) the Trojan horse. With the Trojan horse (not displayed under SHow Users), they copied the password lists to their PCs. When looking through the password list, Klaus observed the well-known facts: More than 25% female or male first names, historical persons, countries, cities, or local dishes (in the Universities of Pisa, Pavia, and Bologna, INSALATA was/is a favorite password of several people). Only in CASTOR and POLLUX, the password lists contained less than 5% passwords of such nature easy to guess! Apart from many (about 39) unsuccessful logins, many different CERN/GENEVA, NASA systems (CASTOR, POLLUX, Goddard and Ames Space Flight Centers), several USA, GB, French, Italian and some German institutes connected in SPAN were "visited." The documented session was from July 27, 10 p.m. to July 28, 1 a.m. The media report that other hacks (probably not all committed by Hess and Koch themselves) were sold to KGB. Among them, Electronic and Computer Industry seem to be of dominant interest for the USSR. If special CAD/CAM programs and Megabit designs (especially from Thomson/France, from VAX systems) have been stolen, the advantage and value for the USSR cannot be (over)estimated. In FRG, the current discussion is whether the hackers succeeded to get into "kernel areas" or only "peripheral areas." This discussion is ridiculous since most "peripheral systems" contain developments (methods, products) for future systems, while the "kernel systems" mainly contain existing applications (of past architectures). The well-known hackers (especially CCC) have been seriously attacked by some media. My best guess is that CCC was itself *a victim* because the group succeeded to informally get much of the information which they needed for some of the hacks, and which they finally sold to KGB. Apart from "Pengo," there doesn't seem to be a close relation between CCC and the KGB/Wily Hackers. Nevertheless, CCC and others, like Cheshire Catalyst in the USA, have prepared a climate where espionage inevitably sprang-off. Information Provided By Klaus Brunnstein _______________________________________________________________________________ Pengo Speaks Out About The KGB Hackers And More March 10, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following are statements made by Pengo to Phrack Inc. during an interview with Knight Lightning; KL: What is your response to the accusations of being a KGB spy? P: I have been involved into this espionage circle throughout some months in 1986. I did not actually work for the KGB, nor did I hand out hacker information to the East. All my hacking activities since then have been for the pure purpose of personal enlightenment. I never hid my name before, and I won't go undercover now that the real story comes to the surface. In the middle of 1988, I informed the West German authorities (secret service) about my involvement with the KGB. This is one of the main reasons for the big busts last week. I have to live with the fact that some hackers now think I am working for the authorities now. I don't, and I will try anything to avoid getting into all these secret service/espionage problems again. KL: What about the statements made in DER SPIEGEL? P: They published my name and claimed that I was "very active" for the east, but also that I am the :most hopeful head in West Berlin's hacking scene." I now try to make the best out of this publicity. KL: Klaus Brunnstein made some strong statements about you in RISKS Digest, what did you think of that? P: It really upsets me a lot. Klaus Brunnstein doesn't know anything detailed about this case, but he seems to love seeing himself as the insider in the German scene. At the last congress I got in kind of a dispute with him. He could not understand why I, as a computer scientist, still support hackers. Perhaps this is one of the reasons for his publication. KL: Any other comments? P: What I would be interested in hearing about the reaction to this situation from the United States hackers' point of view. I have already heard that most people seem to believe that the whole Chaos Computer Club is an association of spies. This is of course untrue. KL: What do you intend to do about the bad press you have received? P: I have posted a reply to Brunnstein's posting in RISKS (shown in next article). Apart from Hagbard, those guys never were hackers, and it seems to turn out that they have really been mere spies. KL: Were there any other repercussions to this case besides bad publicity? P: Currently, I'm puzzling out a new way of earning money, since my company decided to fire me. That's what you get if you play with fire :-) Luckily, I'm optimist! -Pengo - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Pengo Speaks In RISKS Digest March 10, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In RISKS Digest, Klaus Brunnstein mentioned my name in the context of the hacker/espionage case recently discovered by the German authorities. Since Mr. Brunnstein is not competent to speak about the background of the case, I'd like to add some clarification to prevent misunderstandings, especially concerning my role. I think it is a very bad practice to just publish names of people without giving background information. I have been an active member of the net community for about two years now, and I want to explicitly express that my network activities have in no way been connected to any contacts to secret services, be it Western or Eastern ones. On the other hand, it is a fact that when I was younger (I'm 20 years old now), there had been a circle of people which tried to make deals with an eastern secret service. I have been involved in this, but I hope that I did the right thing by giving the German authorities detailed information about my involvement in the case in the summer of 1988. As long as the lawsuit on this case is still in progress, I am not allowed to give out any details about it to the public. As soon as I have the freedom to speak freely about all of this, I'll be trying to give a detailed picture about the happenings to anyone who's interested. I define myself as a hacker. I acquired most of my knowledge by playing around with computers and operating systems, and yes, many of these systems were private property of organizations that did not even have the slightest idea that I was using their machines. I think that hackers (people who creatively handle technology and not just see computing as their job) do a service for the computing community in general. It has been pointed out by other people that most of the "interesting" modern computer concepts have been developed or outlined by people who define themselves as "hackers." When I started hacking foreign systems, I was 16 years old. I was just interested in computers, not in the data which has been kept on their disks. As I was going to school at that time, I didn't even have the money to buy my own computer. Since CP/M (which was the most sophisticated OS I could use on machines which I had legal access to) didn't turn me on anymore, I enjoyed the lax security of the systems I had access to by using X.25 networks. You might point out that I should have been patient and wait until I could go to the university and use their machines. Some of you might understand that waiting was just not the thing I was keen on in those days. Computing had become an addiction for me, and thus I kept hacking. I hope this clears the question "why." It was definitely NOT to give the Russians any advantage over the USA, nor to become rich and get a flight to the Bahamas as soon as possible. The results of the court trial will reveal this again, but until then I want to keep rumors out that the German hackers were just the long (?) arm of the KGB to harm Western computer security or defense power. It should also be pointed out that the Chaos Computer Club has in no way been connected to this recent case, and again, that the CCC as an organization has never been a "hacker group." The CCC merely handles the press for hackers, and tries to point out implications of computers and communications for society in general. I have already lost my current job, because of my name being published in DER SPIEGEL and in RISKS. My business partners became anxious about my involvement in the case. Several projects I was about to complete in the near future have been cancelled, which forces me to start again at the beginning in some way. -Hans Huebner - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Klaus Brunnstein Reacts To Pengo In RISKS Digest March 14, 1989 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Pengo" Hans Huebner stated that he had no share in the KBG case as I mentioned in my report. Since I myself had no share in the KGB case (and in this sense, I am not as good a source as Pengo!), I tried to transmit only information where I had at least *two independent sources* of *some credibility*. In Pengo's case (where I was rather careful because I could not believe what I read), my two sources were: - The SPIEGEL report (I personally agree that names should be avoided as long as current investigations are underway; yet in this cases, the names have been widely published in FRG and abroad); - A telephone conversation with a leading Chaos Computer Club person after he had informed me about a public debate at Hannover fair (where the German daily business newspaper, Wirtschafts, which had organized a discussion with data protection people and CCC). I asked him whether he knew of Pengo's contribution; he told me that he directly asked Pengo, "Did you, without pressure and at your own will, work for the Russians?" Pengo answered, "Yes." He told me that he immediately cut-off any contact to Pengo. Evidently, there was a controversial discussion in Chaos Computer Club whether on should react in such a strict manner. I understand the strong reaction because the KGB hackers severely damaged the CCC's attempt to seriously contribute to the public discussion of some of the social consequences of computers. They now face, more seriously than before, the problem of being regarded as members of a criminal gang. -Klaus Brunnstein _______________________________________________________________________________ Downloaded From P-80 International Information Systems 304-744-2253 12yrs+