---[ Phrack Magazine Volume 8, Issue 54 Dec 25th, 1998, article 11 of 12 -------------------------[ P H R A C K W O R L D N E W S --------[ Issue 54 Hi. A few changes have been made to Phrack World News (PWN) and will probably change again in the future. Because of the increase of news on the net, security, hackers and other PWN topics, it is getting more difficult to keep Phrack readers informed of everything. To combat this problem, PWN will include more articles, but only relevant portions (or the parts I want to make smart ass remarks about). If you would like to read the full article, look through the ISN (InfoSec News) archives located at: ftp.repsec.com /pub/text/digests/isn If you would like timely news delivered with less smart ass remarks, you can always subscribe to ISN by mailing majordomo@repsec.com with 'subscribe isn' in the body of your mail. The following articles have been accumulated from a wide variety of places. When known, original source/author/date has been included. If the information is absent, then it wasn't sent to us. As usual, I am putting some of my own comments in brackets to help readers realize a few things left out of the articles. Comments are my own, and do not necessarily represent the views of Phrack, journalists, government spooks, my cat, or anyone else. If you want to see more serious comments about the piss poor journalism plagueing us today, visit the Security Scene Errata web page: http://www.attrition.org/errata/ If you feel the need to send me love letters, please cc: route@infonexus.com so he can see I really do have fans. If you would like to mail my cat, don't, he hates you because you are a plebian in his eyes. Meow. This installment of PWN is dedicated to Feds, Hackers, and blatant stupidity. It was brought to you by the letters that collectively spell 'dumb shit'. - disorder --------[ Issue 54 0x1: Teen Crackers Admit Guilt 0x2: FBI grads get gun, badge, and now, a laptop 0x3: Meet the Hacker Trackers 0x4: Justice Department to Hire Computer Hackers 0x5: A Cracker-Proofing Guarantee 0x6: First-Ever Insurance Against Hackers 0x7: New Unit to Combat High-Tech Crime (National Police Agency) 0x8: First 'Cyber Warrior' Unit is Poised for Operational Status (DOD) 0x9: Tracking Global Cybercrime (Chamber of Commerce) 0xa: FBI Opens High-Tech Crisis Center 0xb: Navy fights new hack method 0xc: Pentagon Blocks DoS Attack 0xd: Hackers Elude Accelerator Center Staff 0xe: Cyberattacks leave feds chasing 'vapor' 0xf: Congress Attacks Cyber Defense Funds 0x10: Mudge on Security Vendors 0x11: More delays for Mitnick trial 0x12: 'Back door' doesn't get very far 0x13: ICSA Goon Pretends to be a Hacker 0x14: Is Your kid a Hacker 0x15: Paging Network Hijacked 0x16: FBI busts hacker who sold clandestine accounts on PageNet system 0x17: EFF DES Cracker Machine Brings Honesty to Crypto Debate 0x18: Hacking site gets hacked 0x19: From Criminals to Web Crawlers 0x1a: Running a Microsoft OS on a Network? Our Condolences 0x1b: Security expert explains New York Times site break in 0x1c: Merriam-Webster Taken Offline Old Fashioned Way 0x1d: Long Haired Hacker Works Magic 0x1e: Body of Evidence 0x1f: The Golden Age of Hacktivism 0x20: Phrack straddles the world of hackers 0x21: Cops see little hope in controlling computer crime 0x1>------------------------------------------------------------------------- Title: Teen Crackers Admit Guilt Source: Wired Date: 1:10pm 11.Jun.98.PDT Two California teenagers have pleaded guilty to federal charges of cracking Pentagon computers, the San Francisco Chronicle reports. Terms of the plea are still being negotiated after a meeting last week between attorneys for the youths and federal officials, the newspaper said. Neither youth is expected to serve time in custody, sources close to the case said. In February, the FBI raided the Cloverdale homes of the two suspected crackers -- nicknamed Makaveli, 16, and TooShort, 15 -- and seized computers believed to have been used to break into unclassified computer systems in government agencies, military bases, and universities. [Sucks to be busted. Sucks worse to plead guilty to being a script kiddie.] The youths were never formally arrested in the FBI probe. US Deputy Defense Secretary John Hamre called the breach "the most organized and systematic attack" to date on Pentagon systems. [Feds only enjoy sticking guns in the faces of these kids. Not actually arresting them.] 0x2>------------------------------------------------------------------------- Title: FBI grads get gun, badge, and now, a laptop Source: TechWeb Date: 7.22.98 When FBI special-agent trainees graduate from the bureau academy at Quantico, Va., they are each issued a gun, a badge -- and now, a laptop computer. [Unfortunately, they don't always get a clue.] Crime today often involves the use of sophisticated technology, and new agents have to be able to shoot straight, learn the law, and be able to use technology. Part of the FBI's duty is to investigate computer-related crimes and issues of national security. Because it needs these specialized skills, the bureau is in competition with other agencies such as the Secret Service and the Central Intelligence Agency (CIA) -- as well as the private sector -- for recruits. [Great low pay! Lots of travel! No respect! Come join the FBI!] Attorney General Janet Reno, addressing a conference on children's safety on the Internet in December, called on the technology community to help law enforcement. But Reno's call does not mean making a computer geek into a G-man. The FBI recruits in the high-tech industry and in colleges and universities for special agents with other attributes besides computer-science degrees. "There is not a specific category [in the FBI] for someone with more computer skills," said Special Agent Ron Van Vraken, an FBI spokesman. "But someone with skills and experience is highly marketable. We've recognized we need to attract those people into the FBI." The FBI is not alone. The CIA has a long listing of Web postings for technology-related jobs. There are ongoing requirements for knowledge-based systems engineers, software developers, and electronics engineers listed alongside jobs such as theatrical-effects specialists and clandestine service trainees. [Yet the CIA is scrambling to find jobs for all the cold-war spook rejects...] Although the CIA is not a law-enforcement agency like the FBI and the Secret Service, it, too, chases "bad guys" and needs people trained in technology, said Anya Guilsher, an agency spokeswoman. "We have a great interest in people with advanced technology skills," she said. The Secret Service, which investigates financially related crimes as well as protects the president, is also looking. Its jobs listings include openings for computer specialists and telecommunications specialists. The ideal candidate for these agencies is not necessarily a computer wiz, said Ron Williams, a former Secret Service agent and current CEO of high-tech security company Talon Technology. "The ideal candidate is well-rounded," he said, adding they should also understand computers, have good communications skills, and know human behavior. "To catch a criminal, you have to think like one," Williams said. "You can take agents, and if they have good street smarts and good computer skills, you can make them into hacker sleuths." [Hypothetically.. since they haven't done it yet.] 0x3>------------------------------------------------------------------------- Title: Meet the Hacker Trackers A gang of convicts dressed in cartoon-striped uniforms shuffle slowly along a sidewalk, searing in the noon-day sun. This is downtown Phoenix, a low-rise high-tech city with a decidedly old- fashioned approach to crime. From her office on the sixth floor of the county attorney's office, the prosecutor remains unmoved by the sight of the prisoners. "People 'round here don't have much in the way of sympathy for criminals of any kind. And most of those guys are real criminals, not jumped up nobodies screaming for attention - the kind of people I deal with!" Meet Gail Thackeray, the world's foremost legal expert on computer crime. A former assistant attorney general of the state of Arizona, Thackeray has been fighting hackers and fraudsters for nearly 25 years. Now she works as a prosecutor for the Maricopa County attorney's office, a jurisdiction the size of New England that takes in all of Phoenix. It's most famous as the home of Sheriff Joe Arpaio, "the meanest sheriff in America". This is the man responsible for the convicts in stripes. He has made his reputation by toughening up prison conditions, to loud hollers of approval from freedom-loving Arizonans. Good citizens of Maricopa County can now walk the streets in safety, but for the big technology companies that have moved to the "valley of the sun", the unseen hand of hackers and computer phreaks is proving a major distraction. Whether it's a left-over hippy feeling, the University campus or just a reaction to the extreme heat, Phoenix is a top spot for computer criminals. Thackeray is there to stop them. Arizona has perhaps the United States' strongest legal code against the activities of hackers, but sometimes Gail aches to fight fire with fire. "We have to document every step of the way we investigate. They don't need to have our education. They just need one other crook showing them, like monkeys at a keyboard, how to imitate the crime. The bulletin boards were the precursors to this, but the Net has exploded it down to the individual level anywhere in the world. You don't need sophistication, you don't even need very good equipment - one of the best hackers we've ever dealt with had a Compaq luggable 286 and he was wreaking havoc around the world. Just a list of his route on different systems attached to the Internet would keep me in the hacker business for the rest of my life - it goes on for pages." Getting away with it We move from her office to the conference room next door. Thackeray proudly displays her new Compaq notebook. Her famous slide show is now held on the notebook's hard disk. For more years than she'd care to remember, Thackeray has been showing her slides to police forces and prosecutors across the United States, advising them how to build a case against hackers. She also trains police forces all over the country, including secret service agents at the Georgia Federal training centre. Even the bad guys have been known to call her to find out what the cops have been up to. Although she has been a hacker tracker for 25 years, Thackeray is more depressed than ever by the escalating scale of computer crime. The Web, she says, has made it impossible to catch the crooks. "Even if it's the boy next door, we haven't a chance. He may be doing something rotten to your high-tech consulting firm, he may be next door trying to steal your stuff - but he's looping through a long-distance carrier, a corporate phone system, three Internet providers and circling the world twice before he hits you. That's the problem from our standpoint. Even assuming all those parties can trace the links they're involved in, we have to go through a different process, and probably a different law enforcement agency, for every single one. "In the old days out here, the Texas rangers were very famous for catching bank robbers. They didn't stop at the Texas border when chasing a killer. They'd jump on their horse and, even if they crossed the state line, they would follow wherever the chase lead them. In the computer age we can't do that at all. What we have now in the US is a mish-mash of laws and agencies. Multiply that on the international level and it's completely out of hand." High-tech law enforcement Thackeray moved to Arizona in 1986 after beginning her career as a prosecutor in Philadelphia. She worked in the attorney general's office running an organised crime and racketeering unit that won a national reputation for its technical ability in the fight against hackers. She was also the mastermind behind Operation Sundevil (see panel, overleaf), the first nationally coordinated raid on hackers. But then democracy took a turn and she became a victim of the strange process by which Americans elect their most senior law officers. Her boss lost the race to be elected attorney general. The victor wasn't interested in technology so 12 people got sacked, including Thackeray. Taking a break from the slide show for a moment, she shows me a little number-generating program stored on her laptop. It generates random numbers for Visa cards. Give it the four-digit code that identifies a card issuer and within minutes you'll have hundreds of false credit card numbers to play with. "Now supposing you had another little program that made the bank think these numbers were legitimate - How much do you think you could make?" We go on-line to see some of the hacker sites. Thackeray believes that the Web is making a bigger range of crimes much easier to commit. "In the future the good parts of the Internet will be bigger and more complex and available to more people and that's great. But this means all of those people will have victim potential. Thanks to the growth of the Web, one criminal can now do an unprecedented amount of damage, whether it's to corporations or to individual's feelings by threatening and stalking, spam attacks or just shutting down ISPs. "We have had four incidents in the first six months of this year. These people are attacking not just the little local service provider, but also some of the 19 Internet backbone carriers. They're absolutely ruthless and don't care who they hurt. In a case in Tucson, tens of thousands of users were shut down just because some person with an adolescent level of maturity decided he was mad at another ISP, so he took all of its customers off-line. It's frighteningly easy to do and only took one broadcast message. All the routers that run the Internet shake hands periodically, so if you can infect one router, given time it will infect the entire world. And that's what happened. It took just a few days for the entire world to believe that this service provider, and all its customers, didn't exist." Not only is the Web host to a whole new range of crimes, it's also home to a brand new band of weirdos. "Unfortunately the Web is the best playground ever invented for sociopaths. They can hide, are anonymous and can't be traced. Nobody is in charge and it gives them that power rush that psychologists say is what they live off. It's their whole life's breath. It's the chest-beating power surge of being able to do it and get away with it. We are just seeing more acts of wanton destruction simply for the sake of showing that you can do it." Does she think this new generation of Web hackers is a real threat to people? "Every baby in America knows the 911 emergency system. If mommy's drowning in the pool, we've had three-year- olds save her life by dialling 911. The hackers have attacked the 911 system and they're still doing it. That's not for knowledge or for glory, that's just an act of vicious ego." Rat's nests and technocrap Personal liberty is taken very seriously in the western United States. No-one likes the idea of "big government" interfering with people's lives. Even hackers gain sympathy when they complain of harassment by police and prosecutors. Some say they've been victimised by the authorities. Thackeray denies this. "It's a hacker myth that we take away their computers and sit on them forever. In one case we came across, the guy had over 12Gb of data stored on his system - that's equivalent to 15,000 paperback books. It's better that we seize all that material - you might have love letters, cook book recipes and your extortion kidnapping letter on the same disk. We can't take one without taking the other. We cannot physically copy that volume. It is far easier for us to take computers away than for us to camp out in your house for six months." A hovel of a bedroom fills the projector screen. Coke cans everywhere, rubbish dotted across an unmade bed. In the corner sits a naked computer, stripped of casing, wires exposed. Thackeray calls it a rat's nest. She has hundreds of similar photos. "Back in Philadelphia I began collecting pictures of computers with their wires hanging out. When the geeks speak to a jury we call the language they use technocrap. What you have here is the physical version of technocrap." She gestures at the screen. Typically hackers will set up a stereo system within easy reach of the computer, and often a drinks cabinet as well. A recent innovation is the home network. "We've come up against four or five houses recently where people have had multiple systems networked in the house. And that's even without running a bulletin board. When we get lucky and we're fast enough we can find the guilty computer - but the hardest part of the job is finding the brain behind the computer. To find that person is good old- fashioned low-tech police work." Thackeray's team face another new problem caused by the huge increase in storage capacity. "In the computer situation no one throws anything out. That makes our life more difficult. We don't want to read the last five year's worth of your e-mail, life's too short and frankly it's not that interesting. But sometimes we're searching for one piece of evidence and it's buried in a huge volume of stuff so what else can we do?" Tracking or trailing? The slide show draws to an end. We amble downstairs to the office of another investigator. He shows us an array of hacker memorabilia on his computer. I ask Gail about the future. She believes that unless there's a fundamental change in the way police forces treat computer crime, there is no hope at all. "The police departments and prosecutors around the country are, frankly, paramilitary organisations with very bureaucratic, layered decision- making processes. They see the need for more training in gangs; they don't see the need for more training in computers because the management came out of the knife and gun club. "Police management is dominated by the physical crimes people. We've got to dissolve some of these barriers. When we move we need to move fast like the Texas rangers - both legally and bureaucratically we're just not there yet. When I started 20 years ago law enforcement was behind the computer crime wave. We're farther behind today than we were then." Matt McGrath is an investigative journalist who works for Radio 5. 0x4>------------------------------------------------------------------------- Title: Justice Department to Hire Computer Hackers Source: Business Week Date: Aug. 6, 1998 Wanted: Hackers to break into the Justice Dept. computer network. Under a program known as Operation Get Cracking, the Justice Dept. sought members of the computer underground at late July's Def Con hackers' conference in Las Vegas, BUSINESS WEEK reports in its August 17 issue. Attorney General Janet Reno has quietly committed $1 million to hire up to 16 hackers to test the Department's networks, says a source at Justice, which would neither confirm nor deny the operation. [Uh... huh... I won't go there.] 0x5>------------------------------------------------------------------------- Title: A Cracker-Proofing Guarantee Source: Wired News Report Date: 9:05 a.m. 5.Oct.98.PDT CIGNA Secure Systems Insurance is offering a US$25 million liability policy designed to cover losses resulting from attacks by computer crackers, the company said Monday. To qualify for coverage, a client must secure its systems or pass inspection from a CIGNA-approved security-management company. Otherwise, potential clients are encouraged to contract with security-management company NetSolve, in conjunction with Cisco's NetRanger intrusion-detection software, which is pre-approved by CIGNA. CIGNA Secure Systems Insurance provides coverage for theft of money, securities, and property; for damage done by crackers to a firm's data or software; and for business losses caused by attacks on a company's computer systems. [And how do they put value on your information? Who audits the system to make sure you are telling the truth about your policy?] A recent survey by the Computer Security Institute and the FBI found a 36 percent increase from the previous year in losses stemming from computer-security breaches. However, traditional property and liability insurance policies do not address these risks, according to CIGNA. "It's a nice marketing ploy," said computer security consultant Pete Shiply. "But if someone is concentrating on breaking into a site, eventually they will get in. There is no such thing as a secure site; security is economics, it's a question of money and how much you want to invest." Asked what kind of intrusion might lead to a $25 million claim, Shiply was skeptical. "While I haven't read the agreements, I am pretty sure you would not get that much," he said. "You would have to prove losses approaching that figure, and that will likely be a difficult thing to do." 0x6>------------------------------------------------------------------------- Title: First-Ever Insurance Against Hackers Source: Reuters Date: 14-JUN-98 By: Therese Poletti A computer security firm is so certain of its security prowess that it is offering to protect its customers with the first-ever hacker insurance, in the event a customer is successfully invaded by hackers. [So secure, hackers dumped logs of one of the ICSA's machines being hacked to several IRC channels. Do as we say, not as we do.] ICSA Inc., the International Computer Security Association, is now offering as part of its TruSecure service, insurance against hacker attacks. ISCA will pay up to $250,000 if a customer's network is hacked into, after it has followed the TruSecure criteria. ``This is the first hacker-related insurance,'' said Peter Tibbett, president of the ICSA, based in Carlisle, Penn. ``It puts our money where our mouth is.'' ICSA sells its TruSecure service for $40,000 a year. The service, which it has been offering for several years, is a series of steps, methods and procedures that an ICSA client must adhere to. Some steps are simple, common sense procedures, such as having the server which hosts your company's Web site inside a locked room. [You pay 40,000 a year, for up to 250,000 insurance. Pretty high premium. 40,000 will buy you a lot of security consulting and additional security precautions.] Other steps are more complicated, such as the requirement to have a secure firewall around an internal network. But the ICSA does not sell products. Instead, it recommends a whole range of software that it has approved as secure and meets its standards, through open meetings and debates, with all its members, many of whom develop security products. Then, ICSA tests a client's security by using typical hacker methods, through its 100 or so employees, none of whom are reformed hackers. ICSA believes, along with executives at International Business Machines Corp. who perform ``ethical'' hacking on its customers, that there is no such thing as a reformed hacker. ``We spray them with hacker tools and see where their vulnerabilities are,'' Tibbett said, referring to many of the widely-used hacker programs that are available over the Internet or shared among hackers. ``The average site took about two weeks to get to the place where they meet all our requirements.'' After ICSA completes a six-step process to test and improve a company's security, the customer is deemed secure and will then receive insurance. The ICSA said it will pay its customers if they fall prey to a hacker, even if they are not financially harmed from the attack. ``Whether you lose money or not, we will pay,'' Tibbett said. ''We believe that we reduce the risk dramatically ... Yes, we expect to write some checks, but we don't expect to write very many.'' Tibbett likens the ICSA to the Center for Disease Control, because it tracks all hacker attacks and tests every hacker tool and virus its progammers can find. The ICSA also is known for its emergency response center, which tracks the fallout from known computer viruses and helps companies in a crisis. ``Good enough is never going to be perfect,'' Tibbett said. ''But we have a motivation to improve our service. If we have to write a check when someone gets hacked, it gives us another emphasis.'' The company said it is partnering with major nationwide insurance carriers who recognize the ICSA TruSecure certification as a requirement for hacker policies. 0x7>------------------------------------------------------------------------- Title: New Unit to Combat High-Tech Crime By: Yomiuri Shimbun Date: June 05, 1998 The National Police Agency plans to create a special "cyberpolice" unit to combat the rise in high-tech crimes involving the Internet and other new technologies, the agency said Wednesday in announcing its new high-tech crime program. Information will be exchanged with its investigative counterparts overseas on a 24-hour-a-day basis, it said. The program will include special high-tech crime squads at the prefectural level, and information security advisers at prefectural police stations who will liaise directly with the private sector, with which the NPA wants to coordinate its efforts. The agency will also request a budget for a "hacker-proof" supercomputer next fiscal year. The NPA recorded 263 high-tech crimes last year-eight times more than in 1992. High-tech crime was on the agenda of the Group of Eight summit meeting in Britain last month, where the eight leaders agreed to report on their efforts to combat high-tech crime at the G-8 summit in Cologne, Germany, next year. The NPA said Japan's current laws are inadequate and it would push to have new laws enacted to limit access to computers by those with criminal intent. 0x8>------------------------------------------------------------------------- Title: First 'Cyber Warrior' Unit is Poised for Operational Status By: Bryan Bender Date: June 17 1998 The US Department of Defense (DoD) plans to stand up its first operational unit of `cyber warriors' by September to safeguard against and respond to computer attacks aimed at the US military, according to defence officials. The Joint Chiefs of Staff (JCS) is assessing several proposals for a Computer Defense Joint Task Force and JCS chairman Gen Henry Shelton is expected to make a recommendation to Defense Secretary William Cohen, who will have direct authority over the organisation, in the near future. The JCS has a computer attack response cell within its directorate of operations, but it "has not been codified as a warfighting entity," said JCS spokesman Lt Cdr Jim Brooks. The task force, which will conduct defensive rather than offensive information operations, will have the necessary authority to take action in the event of information attacks. Officials are determining how the unit should be structured, where it should be and how much it will cost. They say that the new unit will have to have a high level of co-ordination with other federal agencies, particularly the Federal Bureau of Investigation, given the constitutional limitations placed on the US armed forces in the area of law enforcement. JCS sources add that the task force is only expected to be an interim solution to the rising need for a specialised unit to counter incidents of cyber warfare. A permanent unit, possibly under the authority of one of the US warfighting commanders-in-chief, is planned for the future. The Pentagon has seen a steep rise in computer attacks and other attempts either to access or contaminate DoD information networks. Art Money, the DoD's senior civilian overseeing computer operations, said on 10 June that the Pentagon experiences an average of 60 cyber attacks per week. The US Department of Defense (DoD) plans to stand up its first operational unit of `cyber warriors' by September to safeguard against and respond to computer attacks aimed at the US military, according to defence officials. The Joint Chiefs of Staff (JCS) is assessing several proposals for a Computer Defense Joint Task Force and JCS chairman Gen Henry Shelton is expected to make a recommendation to Defense Secretary William Cohen, who will have direct authority over the organisation, in the near future. The JCS has a computer attack response cell within its directorate of operations, but it "has not been codified as a warfighting entity," said JCS spokesman Lt Cdr Jim Brooks. The task force, which will conduct defensive rather than offensive information operations, will have the necessary authority to take action in the event of information attacks. Officials are determining how the unit should be structured, where it should be and how much it will cost. They say that the new unit will have to have a high level of co-ordination with other federal agencies, particularly the Federal Bureau of Investigation, given the constitutional limitations placed on the US armed forces in the area of law enforcement. JCS sources add that the task force is only expected to be an interim solution to the rising need for a specialised unit to counter incidents of cyber warfare. A permanent unit, possibly under the authority of one of the US warfighting commanders-in-chief, is planned for the future. The Pentagon has seen a steep rise in computer attacks and other attempts either to access or contaminate DoD information networks. Art Money, the DoD's senior civilian overseeing computer operations, said on 10 June that the Pentagon experiences an average of 60 cyber attacks per week. 0x9>------------------------------------------------------------------------- Title: Tracking Global Cybercrime By: Claudia Graziano Date: 4:00 a.m. 25.Sep.98.PDT The International Chamber of Commerce said Thursday that it will open a new division to help companies around the world protect themselves against cybercrime. "Basically, any scams you can do terrestrially you can do even easier in cyberspace," said Eric Ellen, the chamber's executive director, who will take the reins of the new division. [Oooh.. 'terrestrially'.. three point word.] The London-based unit will work with Interpol to fight heavy-duty technological thievery -- such as money laundering, industrial espionage, and investment fraud -- as opposed to small-time consumer scams like selling nonexistent goods online. Interpol chief Ray Kendall said the international police agency had been pushing for years for such an alliance with the private sector since it could move more quickly than governments in purchasing the equipment needed to investigate high-tech crime. The cybercrime unit will provide the 7,000 International Chamber of Commerce members with information about how and where the myriad types of crimes are committed on the Net and what businesses can do to protect themselves against crackers and fraud artists. A Federal Trade Commission official praised the commission's efforts to raise domestic awareness of Internet fraud. "We welcome any international effort to crack down on cyberfraud, because crime and fraud perpetrated against consumers or businesses only undermines the electronic marketplace and stifles the great opportunities available through Internet commerce," said Paul Luehr, an assistant director at the commission. The chamber said it hopes to persuade governments, including the United States, to wipe out restrictions that limit the spread and availability of strong encryption algorithms. That position flies in the face of US law enforcement, which currently limits the export of powerful crypto on the grounds that it might be used by terrorists. Meanwhile, US crypto advocates have long said that ciphers are better suited to fighting crime than hiding it. "There will be some lobbying on our part, but many businesses can't wait for laws," Ellen said. "Crimes cross international borders, yet existing laws [against cybercrime] are national." The chamber's cybercrime unit will meet regularly with Interpol in Lyon, France, to exchange information and intelligence on cybercrime and its perpetrators. Additionally, the chamber division plans to exchange information with the FBI's National Infrastructure Protection Center and the FBI's National Security Awareness unit, which looks after the interests of US businesses. Headquartered in Paris, the International Chamber of Commerce establishes rules that govern the conduct of businesses worldwide. The nonprofit group holds top-level consultative status with the United Nations, where it puts forward the views of business in countries around the world. 0xa>------------------------------------------------------------------------- Title: FBI Opens High-Tech Crisis Center By: Michael J. Sniffen Date: Friday, November 20, 1998; 9:29 a.m. EST Entering its 91st year with new duties that extend around the world, the FBI today opened a high-tech, $20 million operations center nearly the size of a football field to allow headquarters to manage up to five crises at once. The new Strategic Information and Operations Center -- called ``sigh-ock'' after its initials -- has 35 separate rooms that can seat up 450 people total and covers 40,000 square feet on the fifth floor of FBI headquarters on Pennsylvania Avenue. It is 10 times bigger than its two-decade-old predecessor that could, with difficulty, handle two crises simultaneously. Bureau officials became convinced the old SIOC was outmoded in the summer of 1996 when they tried to manage investigations of the Olympic bombing in Atlanta, the explosion of TWA 800 and the Khobar Towers truck-bombing in Saudi Arabia at the same time. ``There weren't enough rooms or enough telephones,'' FBI Director Louis J. Freeh said. ``We had people working at desks in the hallway outside and reading top secret material in the vending area across the hall.'' The supersecret facility with no windows to the street, or even any outside walls, has a private ribbon-cutting today with former President George Bush as the FBI celebrates its 90th birthday. Introducing the new SIOC to reporters for a one-time-only tour, Freeh said it was emblematic of the bureau's expanded responsibilities and technology. He noted that the bureau's fastest growing component, its Counterterrorism Center, is arrayed in the offices around the SIOC -- as is its violent crime unit, which handles domestic attacks such as the Oklahoma City bombing or hijackings. Much of the counterterrorism work now extends overseas, to Saudi Arabia where U.S. soldiers have been killed in two bombings and East Africa where two U.S. embassies were bombed, for example. In the last five years, Freeh said, the FBI has nearly doubled its legal attaches working abroad -- to 32 cities now. Eight more are to open soon -- in Almaty, Kazakhstan; Ankara, Turkey; Brasilia, Brazil; Copenhagen, Denmark; Prague, Czech Republic; Santo Domingo, Dominican Republic; Singapore and Seoul, Korea. The computers at desks throughout the center and the 5-by-15-foot video screens on the walls of almost every room can display not only U.S. television broadcasts but also local TV channels from foreign countries. The bank of red-lettered digital clocks in each room can display the local time in five or six locations. The FBI's new National Infrastructure Protection Center, tasked to prevent and respond to attacks on government or private computer systems that keep America running, will have three representatives on each of the 10-member watch teams that staff the center at all times. Also present around the clock: a representative of the National Security Agency's Cryptologic Security Group to provide information from the government's worldwide electronic eavesdropping. Behind a series of blond wood doors, the complex warren of workrooms, many of which can be combined or divided as need requires, have light gray carpets, paler gray walls and dark gray metal desks with white plastic tops. The desks are fixed in place only in two control rooms that manage the flow of information to each room; elsewhere they are modular and can be rearranged at will over floor-mounted electric and telephone plugs. Interior windows allow views into conference rooms or the SIOC's hallways. Ron Wilcox, deputy chief of the SIOC, said the compartmented areas would allow bureau agents ``to work in one room with District of Columbia police on a local kidnapping while another room works on a terrorist bombing with top secret data.'' Each work station can receive data from three sets of phone and computer links: unclassified, secret and top secret-sensitive compartmented information. While the center will draw information from around the world, information will not leave without permission. The center is shielded to prevent outside detection of electronic emissions, so cell phones do not work inside it. In Operations Group D and G, the largest room with capacity for 118 people, there are printers with yard-wide rolls of paper to print out city maps. So the room will not be overcome with noise, the sound from video screens is broadcast silently from black boxes around the room to headphone sets available to each worker. The chairs, most on wheels, have arm rests. They are blue-green cloth in the workrooms; gray leather in the Executive Briefing Room, the center's second largest room, with three blond wood semicircles seating 36 and fixed theater seats at the back for 50 more. Rather than increasing the burden on field agents to report to Washington, Wilcox said the new center should reduce such demands, because ``we will offer one-stop shopping for headquarters. Field agents can report to us, and we will be responsible for making sure everybody is alerted who should be.'' 0xb>------------------------------------------------------------------------- Title: Navy fights new hack method By: Tim Clark Source: CNET NEWS.COM Hackers are banding together across the globe to mount low-visibility attacks in an effort to sneak under the radar of security specialists and intrusion detection software, a U.S. Navy network security team said today. Coordinated attacks from up to 15 different locations on several continents have been detected, and Navy experts believe that the attackers garner information by probing Navy Web sites and then share it among themselves. "These new patterns are really hard to decipher--you need expert forensics to get the smoking gun," said Stephen Northcutt, head of the Shadow intrusion detection team at the Naval Surface Warfare Center. "To know what's really happening will require law enforcement to get hold of the hackers' code so we can disassemble it." The new method involves sending as few as two suspicious probes per hour to a host computer, a level of interest that usually won't be detected by standard countermeasures. But by pooling information learned from those probes, hackers can garner considerable knowledge about a site. 0xc>------------------------------------------------------------------------- Title: Pentagon Blocks DoS Attack Source: Newsbytes via NewsEdge The Pentagon launched an attack applet of its own this month to thwart a denial-of-service attack against its DefenseLink Web site at http://www.defenselink.mil . DefenseLink was one of three sites targeted on Sept. 7 by a group that calls itself the Electronic Disturbance Theater. The group claimed to be acting in solidarity with Zapatista rebels in the Mexican state of Chiapas to protest Defense Department funding of the School of the Americas. Other target Web sites belonged to Germany's Frankfurt Stock Exchange and Mexican President Ernesto Zedillo. The theater group's Web site referred to the attacks as a virtual sit- in. Visitors to the group's site received a hostile Java applet designed to keep reloading the DefenseLink and other Web sites automatically as long as the the visitors' browsers were open. Multiple simultaneous reload requests can overwhelm a server, but the attacks apparently had little impact, DOD officials said. "Our support staff certainly was aware of the planned attack," Pentagon spokeswoman Susan Hansen said. "They took preventive measures to thwart the attack so that DefenseLink was available." Hansen would not specify the preventive measures, but the theater group reported, and a DOD official confirmed, that the Pentagon aimed its own hostile applet back at the attackers. Browsers "got back a message saying the (theater group's) server wasn't available," Hansen said. The Frankfurt exchange reported the reload requests had little or no impact on its server, either. The theater group has promised a second round of attacks, known as FloodNet, between Sept. 16, Mexican Independence Day, and Oct. 12, Columbus Day. Representatives of security software vendor Finjan Inc. of Santa Clara, Calif., said the attacks marked the first time Java applets have been used in a political protest, although the theater group has claimed participation in other virtual sit-ins against Zedillo and President Clinton since April. The group is a throwback to the 1960s guerrilla theater of the Yippies, who once hosted an attempt to mentally levitate the Pentagon. The theater group's Web site at http://www.nyu.edu/projects/wray/ecd.html advocates electronic civil disobedience. Its attempted Pentagon attack was part of Swarm, a project launched at the Ars Electronic Festival on InfoWar in Linz, Austria. The group's announced activities, in addition to the unspecified attacks planned through mid-October, include radio protests against the Federal Communications Commission on Oct. 4 and 5. The Swarm attacks reportedly did not meet with much approval among hackers, who view FloodNet as an abuse of network resources. 0xd>------------------------------------------------------------------------- Title: Hackers Elude Accelerator Center Staff Source: San Francisco Chronicle Date: 06/11/98 Officials at Stanford Linear Accelerator Center are rethinking the openness of their computer system a week after hackers forced them to shut down outside access to the federal research facility's computer network. External access to the center's computer system was suspended after staff members failed to catch hackers who had intercepted a password and were moving in and out of more than 30 of the facility's Unix servers. "We traced the hackers around to the point that we weren't gaining on them," said center spokeswoman P.A. Moore. "The person or persons were successful in covering their tracks and in getting into and out of accounts." It is still unclear how the hackers got access to a password and the system, Moore said. But as a result of the breach, she said, officials are rethinking the center's policy of being an open scientific research facility. She said proposals are being considered to restrict the center's computer system. "A number of options are being considered and they range from very mild to more severe," she said. Moore said that most of the center's Internet services were restored Tuesday after security measures were put in place and that staff members were instructed to change their passwords. The shutdown did not create any serious problems, although it caused delays in many projects and denied researchers from all over the world access to the center's Web site, Moore said. Established in 1962, the Linear Accelerator Center is funded by the Department of Energy and operated by Stanford University. With a staff of about 1,300 and 2,000 researchers worldwide, the center conducts basic research on atomic and subatomic physics. The center's researchers use colliders to study matter at the atomic level. "Mostly, we've lost time on experiments," Moore said. "We do not see that any data has been compromised. It's more of a setback than a major disaster." But she said future break-ins will remain a problem for open scientific facility. The center does not conduct any classified research, she said. "Computer hackers are very sophisticated in terms of their knowledge and ease in traveling through cyberspace," she said. "We're vulnerable. By being an open facility, we are a target for vandals." Stephen Hansen, a Stanford University computer security officer, said campus system break-ins average at least two a month. A common tool used by hackers is a computer program dubbed "the sniffer," which allows intruders to decode data in a system, specifically passwords and log-on names. "Sniffers are quite dangerous," Hansen said. "If they are not caught right away, they can lead to break-ins to thousands of accounts, not just locally, but across the Internet." To minimize such break-ins, he said, more system operators are using encryption programs that prevent hackers from determining sign-on names and passwords. However, this is not an easy option for the Stanford center because encryption programs are prohibited in some countries, including France, where a number of center-affiliated researchers live. 0xe>------------------------------------------------------------------------- Title: Cyberattacks leave feds chasing 'vapor' By: Bob Brewin (antenna@fcw.com) Top administration officials last week warned that the United States lacks the capability to quickly identify the nature and scope of a continuing series of cyberattacks against both federal and private systems that support the country's telecommunications, financial and energy critical infrastructures. During a series of congressional hearings and in speeches last week, federal security and information technology officials made it clear that they anticipate a powerful ''Achilles' heel'' cyberattack that could cripple the nation's vital systems because the government lacks the ability to defend against such an attack. John Hamre, deputy secretary of Defense, told the House National Security Committee that such a paralyzing cyberattack against critical infrastructures is inevitable. "There will be an electronic attack sometime in our future," he said. "Should an attack come, it will likely not be aimed at just military targets but at civilian [targets] as well." Administration officials also reported that the attacks continue unabated. Art Money, who is slated to take over as assistant secretary of Defense for command, control, communications and intelligence later this year, said in a speech at a conference in Washington, D.C., last week that DOD "averages 60 intrusions a week" into its computer systems. An official of the FBI's new National Infrastructure Protection Center (NIPC) said the office is investigating a "half dozen" incidents, describing them as ''substantial.'' But security agencies said the process of chasing down and identifying attackers is frustrating, as in the case of the highly publicized series of hacks against DOD computers last February. The FBI and numerous DOD agencies worked together to track down the hackers, but the agencies could not "identify [until] the following week" the source and type of attack, Ellie Padgett, deputy chief of the National Security Agency, told the Senate Judiciary Committee's Subcommittee on Technology, Terrorism and Government Information. Padgett said it would still take the agency a "matter of days" to determine if an attack was strategic or just a teenage prank. Michael Vatis, director of NIPC, told the committee, "In most cyberattacks, it's impossible to know the identity of the penetrator," be it teenage hackers, criminals or a strategic attack by a hostile nation. Vatis, in an interview, likened chasing down hackers to "tracking vapor." Barry Collin, a senior researcher with the Institute for Security and Intelligence, said it will become increasingly difficult to identify strategic attacks because a nation that is sophisticated enough to mount a cyberwar against the United States also will have the sophistication to disguise that effort as a hacker attack mounted by teenagers. "They can make it appear as if it is a game instead of a real attack," he said. A "Predatory Phase" Also frustrating security experts is the possibility that attacks will be carried out in quick hits over a long period of time, Hamre said. "The predatory phase could take place over several years, making it hard to collate curious, seemingly unrelated events into a coherent picture," he said. These long-term attacks "could take place over multiple jurisdictions - [for example] power grids or air traffic control nodes in various states. Our knowledge of the origin of such attacks and their sponsorship is likely to be imprecise." Hamre also presented classified testimony to a joint closed hearing of the House National Security Committee's Military Procurement and the Military Research and Development subcommittees. Hamre may have presented more detailed evidence of computer vulnerabilities, based on remarks by Rep. Curt Weldon (R.-Pa.), chairman of the Military Research and Development Subcommittee, who called Hamre's classified testimony "the most provocative briefing" he had ever received during his 12 years in Congress. The Clinton administration hopes to protect the critical infrastructures with recently formed security organizations, including the National Infrastructure Assurance Plan, the NSA Network Incident Analysis Cell and the Critical Infrastructure Assurance Office in the Commerce Department. CIAO will spearhead multiple-agency efforts to develop better policies, processes, procedures and systems to detect and deter attacks. The administration also plans to heavily involve the private sector - banks, power companies and railroad companies - in "public/private partnerships'' to protect the infrastructure. Members of Congress on both sides of the Hill praised the administration's initial efforts, but they also expressed some skepticism about the approach. Sen. Diane Feinstein (D-Calif.) said she "wondered if the nexus between the public and private sectors will work." Rep. Herbert Bateman (R-Va.) said he is "deeply skeptical" about placing the CIAO in Commerce rather than in DOD. Bateman said Commerce's willingness to allow the exportation of critical satellite and rocketry information to the Chinese left him "unconvinced" that Commerce had the same "sensitivity" as the Pentagon has to the requirements of national security. 0xf>------------------------------------------------------------------------- Title: Congress Attacks Cyber Defense Funds Source: Defense News Date: 6/16/98 U.S. Congress Attacks Cyber Defense Funds By George I. Seffers Defense News Staff Writer WASHINGTON-- Congress is taking millions of dollars from the war chest intended to protect critical U.S. infrastructure from potentially crippling cyber attacks, according to Defense Department and White House sources. The House Appropriations Committee deleted the entire $69.9 million the Defense Department had requested for infrastructure protection in its 1999 budget. That funding should be restored, Linton Wells, principal deputy for the assistant secretary of defense for command, control, communications and intelligence, told lawmakers at a June 11 hearing here on protecting national infrastructures-- telecommunications, banking and finance, energy, transportation, and essential government services-- from cyber attack. [So they make all these new groups to fight cybercrime.. then this?] 0x10>------------------------------------------------------------------------ Title: Mudge on Security Vendors From: Bugtraq In the SAFER bulletin they mention compromising software that was explicitly installed as an additional security measure. While joking around I was mentioning to some colleagues about the attrocity of some (most) of the security related products out there right now. Not in what they are claiming to accomplish but in the lack of sound coding in their own products. I thought it was pretty much understood but the amazed looks on their faces told me otherwise. So I figured I might point this out in case that was not an isolated assumption that these people had. Hopefuly I'm already preaching to the choir on Bugtraq. [Note - though I explicitly mention ISS and Axent they are by no means any worse or better than others not mentioned here... in addition I am referring to older versions of their products. I have not spent time looking at their most current releases to verify whether things have improved or gotten worse. Please take this for what it is meant to be - a general rant about the security vendor world as it stands... not an attack against particular vendors] A few real world cases: A few revs back in ISS' commercial security scanner there were several vulnerabilities. One particular company contracted me to come in and give them a report on the level of competance that an auditing company they had hired were at. Sure enough, when the auditor scanned the box that we had setup they were using ISS (version 3? my memory isn't serving me very well right now). Upon an attempt to connect to tcp/79 (fingerd) we fed them back a bunch of 'garbage' (well, you know... that garbage that is comprised of a long run of NOPs followed by machine dependent opcodes and operands :). After a few tries, root on the scanning machine was handed out as there were no checks done on the data that was being retrieved (or more accurately assumptions were being made about the length). ... Axent swore up and down that their ESM systems were communicating via DES encrypted channels. In reality the communications were simply XOR'd and they would send the progressive XOR key every X packets. The DES components were slated for the 'next rev'. Doesn't matter - the point is that they shouldn't have done the XOR scheme to begin with when the purpose of the communications between the client and server are "lists" of vulnerabilities on said machines. Not something you want advertised to anyone passivle monitoring. ... I don't know how many "security" packages I've looked at that do outrageously stupid things like chmod(777), popen(), or system() even! Even if the program is running non-priveledged and is designed to be on a system that does not have multiple users it is a demonstration that the people writing the code to protect your systems (often at outrageous price tags!) seem incapable of demonstrating sane coding techniques themselves. How is one supposed to get 'warm fuzzies' that one is having their systems "protected" when the products doing the protecting show no security competence. Vendors listen up! .mudge 0x11>------------------------------------------------------------------------ Title: More delays for Mitnick trial By: Kevin Poulsen Date: November 25, 1998 3:33 PM PT Source: ZDNet Accusing government attorneys of stalling efforts to collect key documents for his case, the defense attorney representing Kevin Mitnick, famed criminal hacker, requested a continuance on Tuesday. According to Donald Randolph's motion, the government missed a court-ordered deadline to provide the defense with copies of prosecution witnesses statements. The statements were finally handed over on Tuesday, almost a month late. In addition, the prosecution is almost a week behind in handing over a list of evidence to the defense. Some electronic evidence is being withheld completely, claimed Randolph. Prosecution delays "Due to the government's significant delay in producing discovery as ordered by this court, and due to its continuing failure to produce certain discoverable evidence altogether, the defense cannot competently complete its investigations and prepare for trial in this matter absent a reasonable continuance in the trial date," stated the motion. The original trial was scheduled for Jan. 19, 1999. The prosecutors attacked any delay. "The contention that we have been late with materials is disingenuous," says prosecutor David Schindler. "We've provided thousands of pages of discovery." Government mole? The text of the motion also implied that the government had paid a one-time Mitnick cohort and employee of Mitnick's previous attorney, Ron Austin, to spy on his client. "Austin was privy to confidential communications between Mr. Mitnick and Mr. Sherman which he later disclosed to the government," said the statement. 0x12>------------------------------------------------------------------------ Title: 'Back door' doesn't get very far Source: San Jose Mercury News A U.S. government panel has failed in a two-year effort to design a federal computer security system that includes ''back doors,'' a feature that would enable snooping by law enforcement agencies, people familiar with the effort said this week. The failure casts further doubt on the Clinton administration policy -- required for government agencies and strongly encouraged for the private sector -- of including such back doors in computer encryption technology used to protect computer data and communications, according to outside experts. But administration officials said the panel, which is set to expire in July, simply needed more time. The 22-member panel appointed by the secretary of commerce in 1996 concluded at a meeting last week that it could not overcome the technical hurdles involved in creating a large-scale infrastructure that would meet the needs of law enforcers, panel members said. The group was tapped to write a formal government plan known as a ''Federal Information Processing Standard,'' or FIPS, detailing how government agencies should build systems including back doors. 0x13>------------------------------------------------------------------------ Title: ICSA Goon Pretends to be a Hacker [my title] Source: Forbes Digital Tool By: Adam Penenberg J3 spends his days trolling around the hacker underground, monitoring hacker channels on Internet Relay Chat, checking out the latest on "phreaking,"--cracking the phone system-- dialing up bulletin boards and checking out web sites that offer password-cracking software and how-to guides. For J3 this isn't just a hobby, it's a job. ICSA, a computer security firm, hired J3 (not his real name nor his online "nick", since his success depends on total anonymity) two years ago as the company's lead underground analyst. His mission: to keep tabs on the latest trends and tools in the hacker world. When he gets wind of a new security hole, he passes the information on to ICSA's tech staff so that the company can either develop a defense or tip off software makers before the flaw can be exploited. J3 is very busy. Recently, a group of European hackers released a Trojan horse-like program that would enable them to set up backdoors in geeky programs known only to network administrators, such as "named" programs related to domain name servers, a basic component of any network connected to the larger Internet. J3 found out about it in the course of his monitoring, passed it on to ICSA, and the company informed CERT (Computer Emergency Response Team) which posted an advisory. The Internet is a lot like Lord of the Flies, a nasty, violent --yet virtual--world where the strong intimidate the weak. He was also instrumental in helping ICSA detect two types of denial of service attack modes--Teardrop and Land--that were being used to exploit vulnerabilities in the TCP/IP protocol. These new attacks took advantage of tweaks that would beat existing patches, which made it difficult for system administrators to stay ahead of hackers. But J3, because of his links to the underground, was able to learn of these exploits shortly after they were posted on hacker channels. "I'm proud of a lot of the work we do," J3 says. "I've found a company's entire password file posted to a web site, or that hackers have root in a network or that a merchant site with a database of credit cards has been compromised. I then contact the companies and warn them." He says that the Internet is a lot like Lord of the Flies, a nasty, violent--yet virtual--world where the strong intimidate the weak. Not all hackers are destructive, of course. There are many good ones on a quest for pure information, the lifeblood of their avocation, who post security flaws because they believe it's the best way to fix them. It's the ones who exploit these flaws to cause damage that irritate J3. But they have a vulnerability: their need for self-aggrandizement, which is key to J3's success. "If hackers didn't brag," he says, "I wouldn't have a job." J3, who works mostly nights since the Internet never sleeps, isn't just a full-time worker. He's also a graduate student working on his Ph.D. in psychology. And his area of study? Hackers, of course. 0x14>------------------------------------------------------------------------ Title: Is Your kid a Hacker Source: Family PC Magazine Date: November 1998 By: Kevin Poulsen If you suspect your kid is a computer hacker, here's some advice from a convicted hacker on how to handle it It starts with a knock on the door. A dozen men in suits and shoulder holsters are outside, their Buicks and Broncos crammed into your driveway and parked along the street. Over their shoulders you can see your bathrobe-clad neighbors watching the spectacle from their lawns. It might be the FBI, it may be the Secret Service, but whoever it is, the humorless agents hand you a piece of paper and head toward your son or daughter's room. You wonder, perhaps for the first time, what your kid has been doing in there with the computer. If you're a parent, you probably regard the Internet as a font of both promise and peril for your children. It can be an invaluable learning tool and a way to encourage your kids to develop the basic computer skills they'll eventually need. But what if they take to it a little too eagerly and enthusiastically and begin using it to get into places where they don't belong? In that case, normal youthful rebellion, or simple inquisitiveness, if it's expressed over the Internet, could turn your family upside down. It happened last February in Cloverdale, California, when surprised parents found out their teenage son was suspected in a series of Pentagon intrusions. It happened again in Massachusetts a week later, when the Justice Department won its first juvenile conviction under the Federal Computer Fraud and Abuse Act. It happened to my family 15 years ago, in one of the first hacker raids in the country. At that time, I was the teenage miscreant who was illegally accessing federal computers. Now, in my early thirties, I've begun to wonder how I would protect a kid of my own from becoming a poster child for computer crime. I believe the best approach is to stay informed and to communicate with your potential cyberpunks. Open Communication Channels Some of the things you might view as ominous warning signs are actually quite harmless. For example, if your teenager calls himself a "hacker," he may not be headed for trouble. Despite the media's breathless exhortation, hackers are not lawbreakers by definition. The word actually describes someone with a talent for technology, a deep interest in how things work, and a tendency to reject any limitations. If your son disassembled the Giga Pet you gave him for Christmas, he's probably a hacker. If he made it run better, he definitely is. Of course, some hackers go further and test their skills against the adult world of corporate and governmental computer systems. If I thought my kids were cracking computers, I would want to put a stop to it -- though not because it's the crime of the century. True hackers live by an ethical code that precludes damaging systems or profiting from their intrusions. There are worse values for a teenager to have. But regardless of motives, a hacker who's caught in the act today is likely to be treated as an industrial spy or a national security threat. A single moment of rebellious exploration could land a teenager an early felony conviction. If you suspect that your kid may be crossing the line, there are various software packages on the market that will allow you to monitor or control his or her access to the Internet. Don't even think about using one. If your teen really is a hacker, your technological solution will be a source of amusement and derision, as well as an insult to his talents. Instead of putting up barriers, I suggest you talk to your kids. If your kid is reading underground Web sites for hackers, read them yourself. If he has a subscription to a hacker magazine, go through it and ask questions. Feel free to marvel at the cleverness of the latest hacker technique. Then talk about consequences: the rising costs of legal representation, the problems that a convicted felon encounters in academia and the job market. Start looking at alternatives to a life of cybercrime. Constructive Alternatives If your kid has a rebellious streak, I suggest giving up on trying to suppress it; try to channel it instead. When hackers grow up, they often find a reasonable substitute for the thrill of intrusion by working the other side. Ask your teen how he would plug the latest security holes. Get him thinking about it. Ask him for advice on protecting your own e-mail or your ISP account. The hacker tradition has always contained an element of disrespect for authority. Up until 15 years ago, cracking systems was an acceptable rite of passage in the industry, and some of the same people who pioneered artificial intelligence and the personal computer also ushered in phone phreaking, lock hacking, and computer intrusion. Early hackers believed that computers were a public resource and that access to them and knowledge about them should be free. In a sense, the first-generation hackers won their battle when they created the personal computer: It gave them free access to computing power anytime they wanted. Today, kids can claim that victory on the Internet by authoring a Web page. There is plenty of room for innovation and creativity. Today's PCs are as powerful as yesterday's mainframes. With today's PCs, no one needs to break the law to explore technology. With the right tools, and parental support, kids can earn the respect of their peers and get an early start on their future by mastering the latest programming languages. If my kid were a hacker, I'd encourage him to shun the instant gratification of cracking a Fortune 500 company in favor of the greater satisfaction of creating something unique from scratch. Ultimately, that's what hacking really is all about. 0x15>------------------------------------------------------------------------ Title: Paging Network Hijacked By: Chris Oakes Date: 4:00am 24.Jul.98.PDT [A non internet hacking article! Woohoo!] Someone in Texas exploited a vulnerability in the PageMart paging network this week, sending a flurry of mysterious pages to tiny screens nationwide, confusing subscribers, and swamping the company's customer service center with phone calls. PageMart said a random discovery enabled the intruder to use a set of pager addressing numbers to send messages to entire groups of customers, rather than individual subscribers. But a security expert said the system may have been hacked. PageMart spokeswoman Bridget Cavanaugh detailed Wednesday's incident in an email late Thursday. "A person, unknown to PageMart," she said, "discovered that three PINs [personal identification numbers] on our paging terminal in Dallas were actually mail drops." [snip...] On Wednesday, PageMart customer and San Francisco resident Jeremiah Kelly reported that he received odd messages for a period of about an hour and a half on Wednesday afternoon. Upon receiving one incomprehensible page -- unrecognizable in source or content -- he suspected a simple "wrong-number" message. "But then, all of a sudden, I got a blitz" Kelly said. Most notable was a recurring message: "There is only one blu bula." "I received one of those several times," he said. Another pair of messages said "Mike, you're Mom drives a Passat," and another was sexually suggestive. Both of the latter pages were signed "Christian." Kelly said he received about 30 of the senseless messages. [snip...] "The incident impacted about 1.5 percent of our customers nationwide," Cavanaugh said. "Statistically, it's a small number." PageMart provides numeric and text paging service in all 50 states, Canada, Mexico, Central America, and the Caribbean, serving approximately 2.7 million customers. "It's a perfect example of how overconfidence can eventually cause a problem," said Peter Shipley, who analyzes and bolsters system security for accounting firm KPMG Peat Marwick. Though it wasn't clear that PageMart's system was actually broken into, Shipley said poor protection against break-ins is all too common. "I'm in the business of doing these type of security audits, and a large number of systems I've seen have easy password access -- under the assumption of 'why would somebody want to hack it?'" In fact, paging services are responsible for enormously valuable data, from billing addresses to credit card information and more, Shipley said. Then there are the messages themselves, which can be easily netted as they make their way through the airwaves. "Smaller companies believe they are not targets [for hackers]," concluded KPMG's Shipley. "But small companies are as equally targeted as large companies. They're stepping stones -- the small fish that hackers start on." 0x16>------------------------------------------------------------------------ Title: FBI busts hacker who sold clandestine accounts on PageNet system Date: July 30, 1998 7:28 p.m. EDT Source: Nando Times PageNet Inc., one of the largest wireless message providers, said U.S. federal agents arrested a San Diego man Thursday who allegedly set up unauthorized voice mailboxes and paging accounts on its system, costing the company about $1 million. [snip...] 0x17>------------------------------------------------------------------------ Title: EFF DES Cracker Machine Brings Honesty to Crypto Debate Date: July 17, 1998 "EFF DES CRACKER" MACHINE BRINGS HONESTY TO CRYPTO DEBATE ELECTRONIC FRONTIER FOUNDATION PROVES THAT DES IS NOT SECURE SAN FRANCISCO, CA -- The Electronic Frontier Foundation (EFF) today raised the level of honesty in crypto politics by revealing that the Data Encryption Standard (DES) is insecure. The U.S. government has long pressed industry to limit encryption to DES (and even weaker forms), without revealing how easy it is to crack. Continued adherence to this policy would put critical infrastructures at risk; society should choose a different course. To prove the insecurity of DES, EFF built the first unclassified hardware for cracking messages encoded with it. On Wednesday of this week the EFF DES Cracker, which was built for less than $250,000, easily won RSA Laboratory's "DES Challenge II" contest and a $10,000 cash prize. It took the machine less than 3 days to complete the challenge, shattering the previous record of 39 days set by a massive network of tens of thousands of computers. The research results are fully documented in a book published this week by EFF and O'Reilly and Associates, entitled "Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design." [snip...] 0x18>------------------------------------------------------------------------ Title: Hacking site gets hacked By: Paul Festa Source: CNET News.com Date: October 28, 1998, 11:30 a.m. PT Hacking and security news and information site Rootshell.com was the subject of its own coverage today after suffering an early morning hack. The hack, preserved here, occurred this morning at 5:12 a.m. PT, according to Rootshell. Administrators took the site down after discovering the attack at 6 a.m. PT. The site was restored two hours later. "Steps have been taken to prevent re-entry, and full details are now being turned over to law enforcement for what we hope will turn into arrests," Rootshell administrator Kit Knox said this morning in a statement. [Hrm. Lets give out scripts that help every clueless script kiddie break into thousands of sites worldwide.. then narc off the one that breaks into us. Time to face the music. That's like the pot calling the kettle black. Name your cliche', they deserved it.] Knox later said that the matter had been turned over to the FBI. The attacker replaced the Rootshell.com front page with a rambling screed peppered with profanity as well as references to groups and luminaries in the hacking world, including imprisoned hacker and perennial cause Kevin Mitnick. The attacker also threatened to hit another hacking news site, AntiOnline. 0x19>------------------------------------------------------------------------ Title: From Criminals to Web Crawlers By: Kristen Philipkoski Date: 4:00am 15.Jul.98.PDT A crime-fighting search engine used to fight terrorism and insurance scams may soon find a home at one of the Web's top search engines. The system, called VCLAS, has helped detectives crack cases all over the world. "In 11 days, the PhoneFraud software helped law-enforcement agencies in New York uncover US$1.2 billion in stolen services," said Jay Valentine, president and CEO of InfoGlide, the company that owns the VCLAS software package. The software is built around a "Similarity Search Engine," which thrives on imperfect and complex information, data that engineer David Wheeler said often stumps search algorithms based on neural networks. Similarity searching is well-suited to crime work, Wheeler said, because investigations are often inherently random and disconnected. For instance, if police are looking for a red vehicle, but a witness says it was maroon, a traditional keyword search wouldn't register a match since it couldn't recognize that the colors are similar. 0x1a>------------------------------------------------------------------------ Title: Running a Microsoft OS on a Network? Our Condolences Date: July 21, 1998 [The title alone made this worth including.] The CULT OF THE DEAD COW (cDc) will release Back Orifice, a remote MS Windows Administration tool at Defcon VI in Las Vegas (www.defcon.org) on August 1. Programmed by Sir Dystic [cDc], Back Orifice is a self-contained, self-installing utility which allows the user to control and monitor computers running the Windows operating system over a network. Sir Dystic sounded like an overworked sysadmin when he said, "The two main legitimate purposes for BO are, remote tech support aid and employee monitoring and administering [of a Windows network]." Back Orifice is going to be made available to anyone who takes the time to download it. So what does that mean for anyone who's bought into Microsoft's Swiss cheese approach to security? Plenty according to Mike Bloom, Chief Technical Officer for Gomi Media in Toronto. [snip...] None of this is lost on Microsoft. But then again, they don't care. Security is way down on their list of priorities according to security expert Russ Cooper of NT BUGTRAQ (www.ntbugtraq.com). "Microsoft doesn't care about security because I don't believe they think it affects their profit. And honestly, it probably doesn't." Nice. But regardless of which side of the firewall you sit on, you can't afford not to have a copy of Back Orifice. Here are the specs: [snip...] After August 3, Back Orifice will be available from www.cultdeadcow.com free of charge. 0x1b>------------------------------------------------------------------------ Title: Security expert explains New York Times site break in Date: September 18, 1998 By: Ellen Messmer Although the New York Times is not revealing the details of what happened last weekend when it was hijacked by a hacker group, one security expert has it figured out. A group of hackers calling themselves Hackers for Girlies broke into the Times news site on Sunday. The hackers took control of the site to display their own diatribe complete with nude images and to protest the arrest of hacker Kevin Mitnick. The Times worked for half a day to regain command of its server. Hackers often break in by exploiting security vulnerabilities associated with default Common Gateway Interface scripts that ship with Web servers, according to Patrick Taylor, director of strategic marketing at Internet Security Systems in Atlanta. They exploit these scripts to send a string of long commands to cause a buffer overflow that lets them into the operating system. They first give themselves an account in the system and then stick in a backdoor Trojan horse program such as "rootkit" to gain and maintain root control, he said. "CGI scripts are intended to pass commands from the Web server to something in the operating system, perhaps to pull database information," Taylor said. "But you should get rid of these superfluous CGI scripts and depend on your own custom scripts." The Times may have had a long struggle regaining control of its Web site because the latest Trojan horses are designed so well that they hide within the operating system, encrypted or even providing the same checksum as the legitimate operating system. "It's nefarious--the hacker essentially has remote administration of the Web server," Taylor said. "You can't rely on a backup of the machine. You may have to reinstall the entire operating system." By coincidence, the Times had once looked at using the ISS security gear, but decided not to, he said. The Times declined to discuss any aspect of its Web operations, saying it was "a matter of security." [The real reason for this article and quoting a PR person from ISS maybe? Fact is, ISS didn't audit the network before OR after the breakin. How would this guy know the method they used to compromise the machine?] The "Hackers for Girlies" ranted in its own posting to have "busted root" on the Times, and directed some invective toward Times reporter John Markoff and security expert Tsutomu Shimomura for their respective roles in the investigation of hacker Kevin Mitnick, now held in jail. Markoff and Shimomura two years ago collaborated on a book entitled "Takedown" about the law enforcement pursuit of Mitnick. In its own account, the Times said the hacker incident at nytimes.com may be related to an upcoming trial in January of Mitnick. While hacker rantings and pornography can be bad enough to discover on a Web site, a far more serious scenario involves a hijacker more surreptitiously posting information that has been slightly changed, leading the reader to view it as authentic. "This could end up like 'War of the Worlds,' where people went into a panic because they didn't know what they were hearing on the radio was made up," commented Doug Barney, Network World news editor. 0x1c>------------------------------------------------------------------------ Title: Merriam-Webster Taken Offline Old Fashioned Way Date: Wed Aug 5 00:41:57 MDT 1998 Source: www.m-w.com What happened? On Thursday night, July 30th, the facility that hosts Merriam-Webster's Web site was burglarized and its servers were stolen. We've managed to restore limited capacity, but we need to obtain new hardware from our suppliers before we can return to full service. We hope to have the entire site active again in a few days. We apologize for the inconvenience and hope you will bear with us as we deal with the situation. Thank you for your patience. --The Merriam-Webster Web Team [Guess we shouldn't put the computer by the window...] 0x1d>------------------------------------------------------------------------ Title: Long Haired Hacker Works Magic [my title] Source: Nando Times Date: September 20, 1998 The hacker calling himself Mudge pushed his long hair back, scratched his beard and stared at the computer screen. He knew there was something wrong with the data traffic he was watching, but what was it? A week earlier, Mudge and his fellow hackers in their hangout known as the L0pht -- pronounced "loft" -- had acquired some software that was supposed to let computers talk to each other in code. But as Mudge watched the data he realized someone else was doing the same and maybe even decoding it, which shouldn't happen. "So you are saying that you're using DES to communicate between the computers?" Mudge recalled asking representatives of the software maker. Yes, they said, they were using DES, a standard encryption method that for years was considered virtually uncrackable. But this wasn't DES, thought Mudge. It's almost as if... Whoa. He blinked and felt the adrenaline kick in. This wasn't secure at all. In fact, the encoding was only slightly more complex than the simple ciphers kids did in grade school -- where "A" is set to 1, "B" is set to 2, and so on. The company was selling this software as a secure product, charging customers up to $10,000. And yet, it had a security hole big enough to waltz through. Instead of exploiting this knowledge, Mudge confronted the company. "You realize there isn't any secure or 'strong' encoding being used in your communications between the computers, don't you?" he asked. "Well..." "And that you claimed you were using DES to encrypt the data," he pressed. "That will go in the next revision." Mudge is a "real" hacker -- one who used to snoop around the nation's electronic infrastructure for the sheer love of knowing how it worked. His kind today are sighted about as often as the timberwolf, and society has attached to them the same level of legend. Like the wolf, they were once considered a scourge. Law enforcement and telecommunication companies investigated and arrested many of them during the late 1980s and early '90s. Today, many elite hackers of the past are making a go at legitimate work, getting paid big bucks by Fortune 500 companies to explore computer networks and find the weak spots. And none too soon. The void left by the old hackers has been filled by a new, more destructive generation. So today, Mudge -- who uses a pseudonym like others in the hacker community, a world where anonymity keeps you out of trouble -- wears a white hat. As part of L0pht, the hacker think tank, he and six comrades hole up in a South End loft space in Boston and spend their evenings peeling open software and computer networks to see how they work. When they find vulnerabilities in supposedly secure systems, they publish their findings on the Web in hopes of embarrassing the companies into fixing the problems. A recent example: They posted notice via the Internet of a problem that makes Lotus Notes vulnerable to malicious hackers... A Lotus spokesman said the company was aware of the flaw but it was extremely technical and unlikely to affect anyone. The hackers at L0pht have made enemies among industry people, but they command respect. They were even called to testify before the U.S. Senate Committee on Governmental Affairs in May. Why do they publish what they find? "If that information doesn't get out," Mudge replies, "then only the bad guys will have it." The "bad guys" are the hacker cliche: secretive teens lurking online, stealing credit card numbers, breaking into Pentagon systems, and generally causing trouble. One of L0pht's members, Kingpin, was just such a cad when he was younger, extending his online shenanigans to real-world breaking and entering. Today, L0pht keeps him out of mischief, he said. "We're like midnight basketball for hackers," said Weld Pond, another member. **** Malicious hacking seems to be on the rise. Nearly two out of three companies reported unauthorized use of their computer systems in the past year, according to a study by the Computer Security Institute and the FBI. Another study, from Software AG Americas, said 7 percent of companies reported a "very serious" security breach, and an additional 16 percent reported "worrisome" breaches. However, 72 percent said the intrusions were relatively minor with no damage. American companies spent almost $6.3 billion on computer security last year, according to research firm DataQuest. The market is expected to grow to $13 billion by 2000. Government computers are vulnerable, too. The Defense Department suffered almost 250,000 hacks in 1995, the General Accounting Office reported. Most were detected only long after the attack. This is why business booms for good-guy hackers. Jeff Moss, a security expert with Secure Computing Inc., runs a $995-a-ticket professional conference for network administrators, where hackers-cum-consultants mingle with military brass and CEOs. "I don't feel like a sellout," said Moss, who wouldn't elaborate on his hacking background. "People used to do this because they were really into it. Now you can be into it and be paid." News reports show why such services are needed: ----Earlier this month, hackers struck the Web site of The New York Times, forcing the company to shutter it for hours. Spokeswoman Nancy Nielsen said the break-in was being treated as a crime, not a prank. The FBI's computer crime unit was investigating. ----This spring, two California teenagers were arrested for trying to hack the Pentagon's computers. Israeli teen Ehud Tenebaum, also known as "The Analyzer," said he mentored the two on how to do it. The two Cloverdale, Calif., youths pleaded guilty in late July and were placed on probation. ----Kevin Mitnick, the only hacker to make the FBI's 10 Most Wanted list, was arrested in 1995, accused of stealing 20,000 credit card numbers. He remains in prison. A film called "TakeDown," about the electronic sleuthing that led to Mitnick's capture, is in the works. Comments protesting Mitnick's prosecution were left during the hack of the New York Times Web site. ----In 1994, Vladimir Levin, a graduate of St. Petersburg Tekhnologichesky University, allegedly masterminded a Russian hacker gang and stole $10 million from Citibank computers. A year later, he was arrested by Interpol at Heathrow airport in London. ****** "Lemme tell ya," growled Mark Abene one night over Japanese steak skewers. "Kids these days, they got no respect for their elders." Abene, known among fellow hackers as Phiber Optik, should know. He was one of those no-account kids in the 1980s when he discovered telephones and computers. For almost 10 years, he wandered freely through the nation's telephone computer systems and, oh, the things he did and saw. Celebrities' credit reports were his for the taking. Unlimited free phone calls from pilfered long-distance calling card numbers. Private phone lines for his buddies, not listed anywhere. And the arcane knowledge of trunk lines, switches, the entire glory of the network that connected New York City to the rest of the world. But Abene's ticket to ride was canceled in January 1994, when, at age 22, he entered Pennsylvania's Schuylkill Prison to begin serving a year-and-a-day sentence for computer trespassing. The FBI and the Secret Service described him as a menace. The sentencing judge said Abene, as a spokesman for the hacking community, would be made an example. And yet, to many in the digital community, Abene's offenses amounted to unbridled curiosity. He was just a kid poking around, doing what teen boys do, going to places they're told to avoid. "Phree Phiber Optik" pins appeared. Many felt Abene embodied the hacker ethic espoused by his friend and fellow hacker, Paul Stira: "Thou Shalt Not Destroy." With black hair parted in the middle and falling to the center of his back, a thin beard ringing his mouth, the 26-year-old Abene still looks like a mischievous kid. Hacking, he said, is hardwired in boys. When they play with toys when they're young, they break them, then try to figure out how the parts fit back together. He added, "For some of us, it just never goes away." ****** Still, the hackers of the 1980s and early '90s have grown up. Some got busted, others simply graduated from college and fell out of the scene. Today, many want to be seen as mainstream, said Jeremy Rauch, a network security expert for Secure Computing Inc. When it's time to talk consulting contracts with major corporations, the hair gets neatly combed, the suit replaces the combat boots and black T-shirt, and the counterculture rhetoric gets toned down. A hacker in San Francisco who edits the online publication Phrack and goes by the pseudonym Route talks about his job at a security firm as a sign of maturity. Contentedly, he notes he can work from home, write as much code as he can and never punch a clock. "Are there still hackers out there?" asked Mike Godwin, counsel for the Electronic Frontier Foundation, a cyber-rights group. In the early 1990s, he pushed hard for the organization to champion Abene and other members of the cyber gang Masters of Deception. By 1993, he said, hysteria surrounding hackers began to sputter, to be replaced by a fear of pornography. "There never were very many hackers," he said, not major ones, anyway. Mainly, they were and are "this tiny minority of 13- to 18-year-olds who learned how to make toll-calls for free." Today's younger hackers pull programs off the Web that sniff for passwords and unlock backdoors automatically. It's the equivalent of rattling every door on a street and finally getting lucky, chancing upon one that's unlocked. As for the true hackers of the first generation, Godwin said: "These guys are genuinely smart and genuinely have a fascination with the technology. And they're mostly harmless." ********* What do younger hackers say to all this? Not much, if you judge by interviews at DefCon6.0, the sixth annual hacker forum and party held in Las Vegas at the end of July. Some said they hack to learn. Others took a counter-culture stance: hacking as civil disobedience. They wouldn't give names or talk specifically about any criminal activities. It was as if they wanted to present themselves as blank slates, upon which the fears of their non-wired elders could be inscribed. At DefCon, they set off stink bombs at one point, and pulled other juvenile pranks. "Paging Mr. Mitnick," the intercom droned through the hotel-casino's meeting rooms. The unwitting hotel staff member repeated the call for the jailed hacker. "Paging Mr. Kevin Mitnick." Pony-tailed guys dressed in black smirked. Gotcha. As hard house and techno music provided a soundtrack, they drooled over new software and pawed through piles of stuff for sale: computer equipment, of course, but also more books on conspiracy, privacy protection, and police methods than any paranoid could want. Among the titles: "Scanners & Secret Frequencies," "Secrets of a Super Hacker," even "Throbbing Modems." The kids flocked to DefCon's talk by the "white hat" hackers of L0pht. "We're in the middle generation right now," said convention organizer Moss. "You've got your original hackers from MIT -- the old school -- who are established. They're the forefathers of this information revolution. And you've got us who watched computers go from mainframe to desktop to laptop. And you've got the younger generation that have always known computers." 0x1e>------------------------------------------------------------------------ Title: Body of Evidence By: Beverly Hanly Date: 4:00am 5.Aug.98.PDT Real criminals are tried in real courts, so why shouldn't virtual criminals be tried in virtual courts? A handful of legal scholars from the Institute on the Arts and Civic Dialogue (IACD) are mulling over the question and will convene Wednesday to discuss whether virtual courts are the best forum for cybercrime trials and if a virtual legal system could lead to new legal processes regarding real world crimes. The experts will join multimedia artist Shu Lea Cheang, creator of the Brandon project, for a webcast forum from 8 to 11 pm, EDT, at the Harvard Law School. The group will play out a fictitious courtroom drama based on several disputes involving cyberetiquette, gender identity, and the hazy line between fantasy vs. reality as the first public forum in the year-long Brandon project commissioned by New York's Guggenheim Museum. Brandon explores issues of gender identity and the consequences of experimenting with sexuality in real life and in cyberspace. The ongoing media and legal debate regarding hate speech and the proliferation of sexual content on the Internet and whether or not these are harmful -- and to whom -- is the territory the mock trial will cover. Harvard theater director Liz Diamond will collaborate with Cheang to guide the group as they dramatize elements drawn from real-life sexual assault cases, including that of the project's namesake Teena Brandon, a transsexual who was murdered in Nebraska in 1993. Other cases will involve a virtual trial for "cyberrape," a MUD character named Mr. Bungle, and the FBI arrest of Michigan student Jake Baker for his rape-and-murder fantasy about a fellow student posted to a Usenet newsgroup in 1994. Actors will play the roles of victims and perpetrators, while professors from Harvard, University of Virginia, and Columbia law schools will act as "standing jurors" to examine and comment on the legalities. "This is a venue where you can experiment with the process and substance of these [cyberlaw] cases," said Jennifer Mnookin, professor of law at Virginia's School of Law in Charlottesville, who will sit in on the session. She feels that virtual worlds like LambdaMOO can provide a new and more appropriate arena for dispute resolution. "Part of what's at issue here is how much someone can be hurt with words," said Mnookin. "Someone who commits a violation in cyberspace shouldn't necessarily be subject to consequences in real courtrooms. Something like the LambdaMOO 'cyberrape' was appropriately settled in a virtual court. The perpetrator was expelled from that world, his virtual identity was annihilated -- he was 'toaded.' What is a violation in one world might not be in another." Virtual penalties can translate from one world to the other as well. Cheang, in her virtual court, suggests the idea of "virtual castration" as an alternative to "chemical castration" advocated by some as a way of dealing with sexual offenders. The August public event in Cambridge, Massachusetts, is the first time since the Brandon project began on 20 June that Cheang will be able to interact with both a live and a Net audience. "The test will serve as a base toward constructing a digiarchitextual space of a virtual court at the Guggenheim's [proposed] virtual museum," said Cheang, who will collaborate with an architect of physical spaces to create a "courtroom" at the museum. "My work has always fused actual and virtual space." Netizens need nothing more than an Internet connection to tune in to the mock trial. But Cheang also wants to include a public that has no access to Net technology. Anyone in the Harvard area who's interested can physically attend the staged trial. In New York, street audiences can visit the Guggenheim SoHo's video wall, which is made up of 75 contiguous 40-inch projection cubes. The video wall will display images from the Brandon project and audiences will be able to interact at scheduled times. "We're not sure how the 'experimentation' with the audience will go," said Cheang. "Maybe we'll fail badly. But it is this uncertainty, this feeling that we're exploring new ground in public interaction that is most exciting for me and my collaborators here at the Institute." Law professor Mnookin looks at the experiment as a venue that can open up the dialog on cyberlaw issues. "What's interesting to me about 'virtual law' is that it's much more obvious than in the real world that the rules are malleable, that they're created by the participants. "In the real world, it's easy to take the legal processes for granted, to assume that [those processes] can't easily be transformed," she continued. "If virtual worlds are used as laboratories, it's easier to recognize the possibilities for change -- both within a virtual environment, and, just maybe, in the real world as well." The Brandon Project is hosted at Harvard in conjunction with the brand-new IACD until 14 August. IACD puts artists in various media together with a community of scholars, journalists, and civic activists to explore current events and controversies. After the test trial, Cheang will move on to Amsterdam, Netherlands, to begin setting up the next live installation of the project: "Digi Gender, Social Body: Under the Knife, Under the Spell of Anesthesia," to be webcast in September 1998. "Would the Jurors Please Stand Up? Crime and Punishment as Net Spectacle" is scheduled for May 1999. 0x1f>------------------------------------------------------------------------ Title: The Golden Age of Hacktivism By: Niall McKay Date: 4:00a.m. 22.Sep.98.PDT On the eve of Sweden's general election, Internet saboteurs targeted the Web site of that country's right-wing Moderates political party, defacing pages and establishing links to the homepages of the left-wing party and a pornography site. But the Scandanavian crack Saturday was not the work of bored juveniles armed with a Unix account, a slice of easily compiled code, and a few hours to kill. It advanced a specific political agenda. "The future of activism is on the Internet," said Stanton McCandlish, program director of the Electronic Frontier Foundation. "More and more, what is considered an offline issue, such as protesting the treatment of the Zapatistas in Mexico, is being protested on the Net." In the computer-security community, it's called "hacktivism," a kind of electronic civil disobedience in which activists take direct action by breaking into or protesting with government or corporate computer systems. It's a kind of low-level information warfare, and it's on the rise. Last week, for example, a group of hackers called X-pilot rewrote the home page of a Mexican government site to protest what they said were instances of government corruption and censorship. The group, which did not reply to several emails, made the claims to the Hacker News Network. The hacktivists were bringing an offline issue into the online world, McClandish said. The phenomenon is becoming common enough that next month, the longtime computer-security group, the Cult of the Dead Cow will launch the resource site hacktivism.org. The site will host online workshops, demonstrations, and software tools for digital activists. "We want to provide resources to empower people who want to take part in activism on the Internet," said Oxblood Ruffian, a former United Nations consultant who belongs to the Cult of the Dead Cow. Oxblood Ruffian's group is no newcomer to hacktivism. They have been working with the Hong Kong Blondes, a near-mythical group of Chinese dissidents that have been infiltrating police and security networks in China in an effort to forewarn political targets of imminent arrests. In a recent Wired News article, a member of the group said it would target the networks and Web sites of US companies doing business with China. Other recent hacktivist actions include a wave of attacks in August that drew attention to alleged human rights abuses in Indonesia. In June, attacks on computer systems in India's atomic energy research lab protested that country's nuclear bomb tests. More recently, on Mexican Independence Day, a US-based group called Electronic Disturbance Theater targeted the Web site of Mexican President Ernesto Zedillo. The action was intended to protest Zedillo's alleged mistreatment of the Zapatista rebels in Chiapas. Nearly 8,000 people participated in the digital sit-in, which attempted to overwhelm the Mexican president's Web servers. "What we are trying to do is to find a place where the public can register their dissatisfaction in cyberspace, so that your everyday [mouse] clicker can participate in a public protest," said EDT co-founder Ricardo. The apparent increase in hacktivism may be due in part to the growing importance of the Internet as a means of communication. As more people go online, Web sites become high-profile targets. It also demonstrates that many government sites are fairly easy to crack, said one former member of Milw0rm, the now defunct group that defaced the Indian research lab's Web site. In an interview in Internet Relay Chat, the cracker rattled off a list of vulnerable US government Web sites -- including one hosting an electron particle accelerator and another of a US politician -- and their susceptibility to bugs. "They don't pay enough for computer people," said the cracker, who goes by the name t3k-9. "You get $50,000 for a $150,000 job." Some security experts also believe that there is a new generation of crackers emerging. "The rise in political cracking in the past couple of years is because we now have the first generation of kids that have grown up with the Net," John Vranesevich, founder of the computer security Web site AntiOnline. "The first generation of the kids that grew up hacking are now between 25 and 35 - often the most politically active years in peoples' lives." "When the Cult of the Dead Cow was started in 1984, the average age [of our members] was 14, and they spent their time hacking soda machines," said Oxblood Ruffian. "But the last couple of years has marked a turning point for us. Our members are older, politicized, and extremely technically proficient." While hacktivists are lining up along one border, police and law enforcement officials are lining up along another. This year the FBI will establish a cyber warfare center called the National Infrastructure Protection Center. The US$64 million organization will replace the Computer Investigations and Infrastructure Threat Assessment Center and involve the intelligence community and the military. Allan Paller, director of research for the SANS Institute, said the FBI is staffing the new facility with the government's top security experts. "They are stealing people from good places, including a woman from the Department of Energy who was particularly good," he said in a recent interview. "They are taking brilliant people." Paller also said that a grassroots effort is under way in Washington to establish a National Intrusion Center, modeled after the Centers for Disease Control. "There is definitely an increased threat of cyber terrorism," said Stephen Berry, spokesman for the FBI press office in Washington. As offline protests -- which are protected in the United States by the constitution -- enter the next digital age, the question remains: How will the FBI draw the distinction between relatively benign online political protests and cyber terrorism? 0x20>------------------------------------------------------------------------ Title: Phrack straddles the world of hackers Source: Nando Times Date: September 20, 1998 The lines of text scrolled off the screen quickly, but the bleached-blond hacker snatched quick glances at the visitors' log on his Web page. Lots of visitors using military and government computers. The hacker, who calls himself Route, said he always gets a kick out of the feds' visits. He smiled. The FBI, the CIA and the others "wouldn't be doing their job if they weren't tracking computer information both legitimate and illegitimate," Route said. "I guess Phrack falls somewhere in between." Phrack is an online publication called a 'zine. It's a digital chimera: written for hackers but read by law enforcement, too. It's been the subject of federal prosecution, yet it still operates in the open. Its name combines "hack" and "phreak," which refers to phone hacking. It's got attitude, technical know-how and in many ways defines today's hacker scene. It first hit the electronic bulletin boards Nov. 17, 1985, ages ago in hacker years. To put its longevity in perspective, Phrack came out two years after the movie "WarGames" in which actor Matthew Broderick established the now-cliched image of the hacker as the lonely kid who altered his grades with a computer. Phrack predates the World Wide Web by almost a decade. And Phrack is older than many of its readers, who number about 8,000, said Route, who refuses to give his real name. Route, 24, doesn't look like the scrawny computer nerd with the cathode-ray pallor so many think of when the word hacker is mentioned. Silver earrings dangle from each ear and a bar pierces his tongue. Spidery tattoos creep down his shoulders and over biceps grown solid with hours of iron work. Behind his glower lies a keen mind that cuts through computer network problems like a digital knife, an invaluable skill for his day job at a computer security firm with Fortune 500 companies for clients. Route refused to name his company. Phrack's improbable history begins in 1985 when a hacker with the handle Taran King cobbled together various subversive texts that had been circulating like Soviet-era samizdat on the archipelago of underground electronic bulletin boards. It included all sorts of mischief-making: "How to Pick Master Locks," "How to Make an Acetylene Bomb" and "School/College Computer Dial-Ups." But Phrack found itself the focus of federal prosecution in 1990, when editor Craig Neidorf, also known as Knight Lightning, was prosecuted by the Chicago Computer Fraud and Abuse Task Force. His alleged crime? He published a document in Phrack with certain details of the emergency 911 systems in use around the country. It had been given to him by another hacker who had copied it from computers owned by BellSouth, which valued it at almost $80,000. But the task force wanted to prove the document was more than valuable. Assistant U.S. Attorney William J. Cook said it put dangerous information in the hands of hackers. The case fell apart when Neidorf's lawyer proved that more detailed information about the system had appeared in other publications. You could order them from phone company technical catalogs for $13. The charges were dropped. Neidorf's trial was over. If today's Phrack is a bit less confrontational, that's understandable. Like many of the older hackers, Route is shifting his focus away from anarchy texts and phone hacking to computer security. Its "how-to" days are pretty much over. "Phrack is not meant to be a manual of vulnerabilities," he said. As the editor, Route knows that Phrack can still be used for illegal purposes. "But you can't hold people completely liable for just putting information out there." He said he has had "blatantly illegal stuff" sent to him. Once, he said he received the technical specifications for most pager systems used in the country, complete with how to hack those systems. He didn't publish. "It's a judgment call," he said. "I have no intention of running up against the law or (upsetting) the military." But it's almost guaranteed that something gleaned from Phrack will be used against the computer system of a big and powerful organization or business. "The scene is going to do what the scene is going to do," he said. "It's like any clique in society. You have good people and you have bad people." 0x21>------------------------------------------------------------------------ Title: Cops see little hope in controlling computer crime By: Rob Lemos, Source: ZDNN Date: August 6, 1998 10:16 AM PT Despite making headway combating high-tech criminals, law enforcement officials say they remain worried about their ability to investigate and prosecute cyber crimes. Encryption, anonymity, and the jurisdictional problems posed by a global Internet are quickly turning from small headaches to full-blown migraines for local, state, and federal police forces. "It's hard to predict where we will be in 10 years," said Scott Charney, chief of the computer crime and intellectual property section of the U.S. Department of Justice. "But there are going to be all sorts of birthing pains." Charney gathered here with other computer-savvy law enforcement officials to attend an international symposium on criminal justice issues at the University of Illinois at Chicago. The symposium focused on high-tech crime, cyber-terrorism, and information warfare. Invisible criminals Law enforcement officers say one of their biggest challenges paradoxically remains knowing when a crime is committed. According to the General Accounting Office, there were 250,000 attempted break-ins at the Department of Defense in 1995. NASA estimates that crackers -- hacker criminals -- broke in to over 120,000 of its systems in 1996. Yet, few of those incidents are detected, much less reported. When DOD hackers broke into their own servers in 1996 and 1997, they attacked 38,000 machines. Only four percent of the incidents were detected. Out of that number, only 27 percent of detected break-ins were reported. "We will get better," said Doris Gardner, an investigator with the National Infrastructure Protection Center, a new federal agency established to fight computer crime. "We need to educate -- to work better with each other." Pandora's box Yet, even as law enforcement is educating itself on the challenges ahead, experts here said cyber-criminals continue to refine their abilities. According to the DOJ's Charney, the number of cases involving encrypted data climbed from three percent in 1996 to seven percent in 1997. If that trend continues, he said, the only tactic left for law enforcement is to increase its surveillance capabilities. "If privacy advocates get their way on encryption," said Charney, "they may not be happy." With no way to read into encrypted electronic documents, he added, the FBI and others will have to rely on capturing the evidence at the source. "And that could really decrease privacy." Even so, there are other ways around encryption. In 1996, when an ISP reported that its system had been cracked, all FBI leads ran into brick walls. Luckily, the cracker, Carlos Salgado Jr. -- who had stolen over 100,000 credit card numbers worth more than an estimated $160 million -- found a potential buyer who suspected his credit card was one of the ones on the block to be sold. The "buyer" contacted the FBI and became a cooperative witness in the case. Despite Salgado's extensive use of encryption -- both his e-mails and the actual credit-card data were encrypted -- the FBI had no problems collecting evidence, because their witness received all the codes from Salgado. Luck, or a trend? It's too early to tell, but Gardner, for one, seems positive on the FBI's ability to prosecute. "If we know about it," she said, "we can usually prosecute it." ----[ EOF