------------------------------ From: Gene Spafford Subject: Northern District (Ill.) Press Release on Len Rose Date: Fri, 29 Mar 91 19:10:13 EST ******************************************************************** *** CuD #3.11: File 4 of 5: Chicago Press Release on Len Rose *** ******************************************************************** Information Release US Department of Justice United States Attorney Northern District of Illinois March 22, 1991 FRED FOREMAN, United States Attorney for the Northern District of Illinois, together with TIMOTHY J. McCARTHY, Special Agent In Charge of the United States Secret Service in Chicago, today announced the guilty plea of LEONARD ROSE, 32, 7018 Willowtree Drive, Middletown, Maryland to felony charges brought against him in Chicago and in Baltimore involving Rose trafficing with others in misappropriated AT&T computer programs and computer access programs between May 1988 and February 1, 1990. Under the terms of plea agreements submitted to the United States District Court in Maryland, Rose will serve an agreed, concurrent one year prison term for his role in each of the fraud schemes charged. In pleading guilty to the Baltimore charges, Rose admitted that on October 5, 1989, he knowingly received misappropriated source code(1) for the AT&T UNIX computer operating system from a former AT&T technical contractor. The UNIX operating system is a series of computer programs used on a computer which act as an interface or intermediary between a user and the computer system itself. The UNIX operating system, which is licensed by AT&T at $77,000 per license, provides certain services to the computer user, such as the login program which is designed to restrict access to a computer system to authorized users. The login program is licensed by AT&T at $27,000 per license. In pleading guilty to the Chicago charges, Rose admitted that, after receiving the AT&T source code, he modified the source code governing the computer's login program by inserting a secret set of instructions commonly known as a "trojan horse." This inserted program would cause the computer on which the source code was installed to perform functions the program's author did not intend, while still executing the original program so that the new instructions would not be detected. The "trojan horse" program that Rose inserted into the computer program enabled a person with "system administrator" privileges to secretly capture the passwords and login information of authorized computer users on AT&T computers and store them in a hidden file. These captured logins and passwords could later be recovered from this hidden file and used to access and use authorized users' accounts without their knowledge. The program did not record unsuccessful login attempts. In connection with the Chicago charge, Rose admitted that on January 7, 1990, he transmitted his modified AT&T UNIX login program containing the trojan horse from Middletown, Maryland to a computer operator in Lockport, Illinois, and a student account at the University of Missouri, Columbia Campus. In pleading guilty to the Chicago charges, Rose acknowledged that when he distributed his trojan horse program to others he inserted several warnings so that the potential users would be alerted to the fact that they were in posession of proprietary AT&T information. In the text of the program Rose advised that the source code originally came from AT&T "so it's definitely not something you wish to get caught with." and "Warning: This is AT&T proprietary source code. DO NOT get caught with it." The text of the trojan horse program also stated: Hacked by Terminus to enable stealing passwords. This is obviously not a tool to be used for initial system penetration, but instead will allow you to collect passwords and accounts once it's been installed. (I)deal for situations where you have a one-shot opportunity for super user privileges.. This source code is not public domain..(so don't get caught with it). Rose admitted that "Terminus" was a name used by him in communications with other computer users. In addition to these warnings, the text of Rose's trojan horse program also retained the original warnings installed in the program by AT&T: Copyright (c) 1984 AT&T All rights reserved THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T This copyright notice above does not evidence any actual or intended publication of the source code. Inspection of this modified AT&T UNlX login source code by AT&T's UNIX licensing group revealed that the modified source code was in fact a "derivative work" based upon the standard UNIX login source code, which was regarded by AT&T as proprietary information and a trade secret of AT&T, which was not available in public domain software. In pleading guilty to the federal charges in Chicago and Baltimore, Rose also acknowledged that, after being charged with computer fraud and theft in federal court in Baltimore, he became employed at Interactive Systems Inc. in Lisle, Illinois. He acknowledged that his former employers at Interactive would testify that he was not authorized by them to obtain copies of their AT&T source code which was licensed to them by AT&T. Rose further admitted that John Hickey, a Member of Technical Staff with AT&T Bell Laboratories in Lisle, Illinois, correctly determined that Rose had downloaded copies of AT&T source code programs from the computer of Interactive to Rose's home computers in Naperville. The computers were examined after they were seized by the Naperville Police Department, executing a State search warrant, As part of the plea agreement charges filed by the DuPage County State's Attorney's Office will be dismissed without prejudice to refiling. The forfeited UNIX computer seized will be retained by the Naperville Police Department. Commenting on the importance of the Chicago and Baltimore cases, Mr. Foreman noted that the UNIX computer operating system, which is involved in this investigation, is used to support international, national, and local telephone systems. Mr. Foreman stated, "The traffic which flows through these systems is vital to the national health and welfare. People who invade our telecommunications and related computer systems for profit or personal amusement create immediate and serious consequences for the public at large. The law enforcement community and telecommunications industry are attentive to these crimes, and those who choose to use their intelligence and talent in an attempt to disrupt these vital networks will find themselves vigorously prosecuted." Mr. Foreman also stated that the criminal information filed in Chicago and a companion information in Baltimore are the initial results of a year long investigation by agents of the United States Secret Service in Chicago, Maryland, and Texas. Mr. Foreman praised the cooperation of the DuPage County State's Attorney's Office and the Naperville Police Department in the investigation. He also acknowledged AT&T's technical assistance to the United States Secret Service in analyzing the computer data seized pursuant to search warrants in Chicago, Baltimore and Austin, Texas. TIMOTHY J. McCARTHY, Special Agent ln Charge of the United States Secret Service in Chicago, noted that Rose's conviction is the latest result of the continuing investigation of the computer hacker organization, the "Legion of Doom." This investigation being conducted by the United States Secret Service in Chicago, Atlanta, New York and Texas, and has resulted in convictions of six other defendants for computer related crimes. Assistant United States Attorney William J. Cook, who heads the Computer Fraud and Abuse Task Force, and Assistant United States Attorneys Colleen D. Coughlin and David Glockner supervised the Secret Service investigation in Chicago. ---------- (1) The UNIX operating system utility programs are written initially in a format referred to as "source code," a high-level computer language which frequently uses English letters and symbols for constructing computer programs. The source code was translated, using another program known as a compiler, into another form of program which a computer can rapidly read and execute, referred to as the "object code." ******************************************************************** >> END OF THIS FILE << ***************************************************************************