------------------------------ From: Various Subject: The CU in the News Date: 4 June, 1991 ******************************************************************** *** CuD #3.19: File 4 of 4: Moderators Corner *** ******************************************************************** From: Silicon.Surfer@unixville.edu Subject: Dutch Crackers as opposed to Graham Crackers Date: Mon, 6 May 91 22:16 EDT Internet Break-Ins Dutch Cracker Easily Accessed U.S. Computers By Mitch Wagner Unix Today, April 29, 1991 Allegations that Dutch crackers have been operating with impunity for months against U.S. computers has stirred a debate whether systems administrators have been negligent in failing to close easy, obvious security holes that have been well-known for years. Dutch crackers have, since September, been using the Internet to access computers, most of them Unix machines, at the Kennedy Space Center, the Pentagon's Pacific meet Command, the Lawrence Livermore National laboratories and Stanford University. The techniques they've used have been simple, well-known and uncreative, and they've found the job an easy one, say sources. "These are not skilled computer geniuses like Robert Morris," said Cliff Stoll, author of The Cuckoo's Egg, who said he's been in contact with some Dutch crackers who may have committed the break-ins. "These are more like the kind of hacker I caught, sort of plodding, boring people." Stoll's 1989 book concerned his pursuit of a cracker. Techniques include guessing at commonly used passwords, default passwords that ship with Unix systems and that some users don't bother to change, and using guest accounts, said Stoll. The crackers managed to obtain superuser privileges at a system at Stanford University, said Bill Bauridel, information security officer at Stanford University Data Center. They used a bug in sendmail - the same program exploited by Robert Morris to loose a worm on the Internet in 1988, though Bauridel said the crackers did not use the sendmail feature that Morris exploited. The Lawrence Livermore Laboratories computers were only used as a gateway to other systems, said Bob Borchers, associate director for computation at the labs. The crackers have been able to access only non-classified material, such as routine memos say authorities. So far, no evidence has been found that they did anything malicious once they broke into a U.S. site. The lack of laws governing computer crime in Holland allows crackers to operate with relative impunity, said Martin de Lange, managing director of ACE, and Amsterdam-based Unix systems software company. The impunity combines with an anti-authoritarian atmosphere in Holland to make cracking a thriving practice, said Stoll. "There's a national sense of thumbing one's nose at the Establishment that's promoted and appreciated in the Netherlands," he said. "Walk down the streets of Amsterdam and you'll find a thriving population that delights in finding ways around the Establishment's walls and barriers." The break-ins became a subject of notoriety after a Dutch television show called After the News ran film Feb. 2 purporting to be of an actual cracker break-in, said Henk Bekket, a network manager at Utrecht University. Utrecht University in Holland was reported to be the first site broken into. Bekker said he was able to detect two break-ins, one in October and one again in January. The crackers apparently dialed into a campus terminal network that operates without a password, accessed the campus TCP/IP backbone, and then accessed another machine on campus-a VAX 11/75-that hooks up to SURFnet, a national X.25 network in Holland. From SURFnet, they were presumably able to crack into an Inter-net computer somewhere, and from there access the computers in the United States, said Bekker. The dial-in to SURFnet gateway has been canceled since the January attempt, he said. (Presumably, the break-in footage aired Feb. 2 was either through another channel, or filmed earlier.) Bekker said he manages a network consisting of a DECsystem 5500 server and 40 to 50 Sun and VAX VMS workstations. He noted a break-in to another machine on campus Jan. 16, and into a machine at the University of Leyden in October. A cracker was searching DECnet I password files for accounts with no password. The cracker was also breaking into machines over DECnet, said Bekker. The cracker had a rough idea of the pattern of DECnet node addresses in Holland, and was trying to guess machine addresses from there. Node addresses begin with the numerals 28, said Bekker, and he found log files of the cracker searching for machines at 28.1, 28.2, 28.3 and so on. But the cracker did not know that the actual sequence goes 28.100, 28.110, and so on. "Hackers are organized to get together, discuss technologies, and they openly demonstrate where there are installations prone to break-in," de Lange said. Computer crime in Holland can be prosecuted under laws covering theft of resources, wiretapping and wire fraud, said Piet Beertema, of the European Unix User Group, and network manager of the Center for Mathematics and Computer Science in Amsterdam. And finding someone to investigate can also be a problem, said Bekker. "You cannot go to the police and say, 'Hey, someone has broken into my computer.' They can't do anything about it," he said. Stoll, the American author, said crackers appear firmly rooted in Dutch soil. "There is a history going back more than five years of people getting together and breaking into computers over there," he said. "Hacker clubs have been active there since 1985 or 1986." But he said it's more than lack of law that has made cracking so popular. Most industrialized nations have no cracking laws, and those that have them find prosecution extremely difficult, he said. Dutch citizens also have an anti-authoritarian spirit, he added. But Stoll condemmed the crackers. "This is the sort of behavior that wrecks the community, spreads paranoia and mistrust," he said. "It brings a sense of paranoia to a community which is founded on trust." Because no classified data was accessed, Mike Godwin, attorney for the Electronic Frontiers Foundation (EFF), cautioned against making too much of the incidents. "What did these people do" he said. "There's no sense that they vandalized systems or got ahold of any classified information." The itself as an organization fighting to see civil rights guarantees extended to information systems. The Cambridge, Mass., organization has been involved in a number of cracker defenses. The fact that the systems were breached means the data's integrity is compromised, said Netunann. just because the data isn't classified doesn't mean it isn't important, he noted. 'Just because you can't get into classified systems doesn't mean you can't get sensitive information," he said. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Brendan Kehoe Subject: Long-haul Carriers May Offer Toll-Fraud Monitoring Date: Wed, 1 May 91 22:50:31 -0400 "Long-haul carriers may offer toll-fraud monitoring: Services would help shield customers from hackers" by Anita Taff, Washington Bureau Chief WASHINGTON D.C. -- Long-distance carriers are considering offering services that would shield customers from toll fraud by monitoring network activity for suspicious traffic patterns and tipping off users before huge costs would be run up, Network World has learned. Hackers are defrauding corporations by dialing into their private branch exchanges and using stolen authorization codes to dial out of the switches to remote destinations, sticking the switch owners with charges ranging from several thousand to, in one case, a million dollars. Users have been loathe to report toll fraud because they are embarrassed about the security breaches or because they have entered into private settlements with carriers that cannot be disclosed. But earlier this year, Pacific Mutual Life Insurance Co., exasperated by $200,000 in fraudulent charges run up during one weekend and lack of progress in settling the issue with AT&T, turned to the Federal Communications Commission for help. The insurance company asked the FCC to open a proceeding in order to establish guidelines that fairly distribute liability for toll fraud among users, long distance carriers and customer premises equipment manufacturers. The company questioned the validity of AT&T's claims that its tarriffs place the liability for fraud on users' shoulders. Both AT&T and MCI Communications Corp. oppose Pacific Mutual's position. But it is clear something has to be done. Customers lose $500 million annually to toll fraud, according to the Communications Fraud Control Association. "There are two kinds of customers: those who have been victims of toll fraud and those who are about to [become victims]," said Jim Snyder, staff member of the systems integrity department at MCI. According to Snyder, about 80% of the calls placed by hackers go to one of three places: Columbia, Pakistan and area code 809, which covers Caribbean countries including the Dominican Republic and Jamaica. Often, the calls are placed at night or during weekends. It is this thumbprint that would enable carriers to set up monitoring services to identify unusual activity. He said MCI is considering such a service but has not yet decided whether to offer it. AT&T would also be interested in rolling out such a monitoring service if customer demand exists, a spokesman said. Henry Levine, a telecommunications attorney in Washington, D.C. who helps customers put together Tariff 12 deals, said he knows of several users that have requested toll-fraud monitoring from AT&T. He said AT&T is currently beta-testing technology that gives users real-time access to call detail data, a necessary capability for real-time monitoring. US Sprint Communications Co. offers a monitoring service for its 800, UltraWATS, Virtual Private Network, SprintNet and voice mail customers free of charge, but it is not a daily, around-the-clock monitoring service, and the typical lag time until user are notified of problems is 24 hours. In a filing on behalf of the Securities Industry Association, Visa USA, Inc., the New York Clearinghouse Association and Pacific Mutual, Levine urged the agency to require carriers to offer monitoring services. Network equipment could monitor traffic according to preset parameters for call volume, off-hour calling and suspicious area or country codes, he said. If an anomaly is detected, Levine's proposal suggests that carriers notify users within 30 minutes. Therefore, users would be held liable for only a nominal amount of fraudulent charges. Network World, April 29, 1991 [Volume 8 Number 17]. [161 Worcester Road, Framingham, MA. 01701 508/875-6400 MCI-Mail:390-4868] +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: edtjda@MAGIC322.CHRON.COM(Joe Abernathy) Steve Jackson Games story from Houston Chronicle Date: Thu, 16 May 91 16:40:28 CDT Lawsuit alleges rights violations in computer crime crackdown By JOE ABERNATHY Copyright 1991, Houston Chronicle An Austin game publisher has sued the U.S. Secret Service for alleged civil rights violations in connection with a nationwide crackdown on computer crime. Steve Jackson Games, whose case has become a cause celebre in the computer network community, alleges in the lawsuit that a raid conducted during OperationSun Devil violated the rights of the company and its customers to free speech, free association, and a free press. The lawsuit in federal district court in Austin further claims the raid was a violation of the protection against unreasonable search and seizure, and violated the law restricting the government from searching the office of publishers for work products and other documents. It seeks unspecified damages. "This is a lawsuit brought to establish the statutory rights of businesses and individuals who use computers," said Jackson's attorney, Sharon Beckman of Boston. "It's about the First Amendment, it's about the right to privacy, and it's about unreasonable government intrusion." Defendants include the Secret Service; Assistant United States Attorney William J. Cook in Chicago; Secret Service agents Timothy M. Foley and Barbara Golden; and Henry M. Kluepfel of Bellcore, a telephone company research consortium which assisted the agency in its investigation. Earl Devaney, special agent in charge of the Secret Service fraud division, said that his agency was barred from responding to the allegations contained in the lawsuit. "Our side of the story can't be told because we're compelled by the laws that govern us to remain mute," he said. "We'll have to let the future indictments, if there are any, and the future trials speak for themselves." Devaney said the agency recently completed its review of evidence seized during Operation Sun Devil and has sent it to federal prosecutors. He couldn't predict how many indictments will result. The Electronic Frontier Foundation, founded by computer industry activists after questions arose regarding the legality of several Sun Devil raids, is paying Jackson's legal fees. James R. George, an Austin attorney with expertise in constitutional law, represents Jackson in Texas. Contending that civil rights normally taken for granted are often denied to users of computer networks and bulletin boards, the EFF attorneys designed Jackson's case as a test of how courts will treat these issues. "What happened was so clearly wrong," Beckman said. "Here we have a completely innocent businessman, a publisher no less, whose publications are seized, whose computers are seized, whose private electronic mail is seized, and all for no good reason." Jackson's firm was raided on March 1, 1990, along with 27 other homes and businesses across the nation. The Secret Service confiscated dozens of computers and tens of thousands of computer data disks in the raids. After several months passed with no charges being filed, the agency came under increasing fire for Sun Devil. "They raided the office with no cause, confiscated equipment and data, and seriously delayed the publication of one big book by confiscating every current copy," Jackson said. "It very nearly put us out of business, and we are still extremely shaky." Seven months after the raid on Jackson's firm, the search warrant was unsealed, revealing that the firm was not even suspected of wrongdoing. An employee was suspected of using a company bulletin board system to distribute a document stolen from the telephone company. Bulletin board systems, called BBSs in computer jargon, allow people with common interests to share information using computers linked by telephone. Jackson's bulletin board, Illuminati, was used to provide product support for his games - which are played with dice, not computers. Beckman said the search warrant affidavit indicates investigators thought the phone company document was stored on a bulletin board at the employee's home, and therefore agents had no reason to search the business. "Computers or no computers, the government had no justification to walk through that door," she said. Beckman said that by seizing the BBS at Steve Jackson Games, the Secret Service had denied customers the right to association. "This board was not only a forum for discussion, it was a forum for a virtual community of people with a common interest in the gaming field," she said. "Especially for some people who live in a remote location, this forum was particularly important, and the Secret Service shut that down." Jackson was joined in the lawsuit by three New Hampshire residents, Elizabeth McCoy, Walter Milliken and Steffan O'Sullivan, who used the Illuminati BBS. "Another right is privacy," Beckman said. "When the government seized the Illuminati board, they also seized all of the private electronic mail that (callers) had stored. There is nothing in the warrant to suggest there was reason to think there was evidence of criminal activity in the electronic mail - the warrant doesn't even state that there was e-mail." "That, we allege, is a gross violation of the Electronic Communications Privacy Act," Beckman said. Mitchell D. Kapor, creator of the popular Lotus spreadsheet program and co-founder of the Electronic Frontier Foundation, said: "The EFF believes that it is vital that government, private entities, and individuals who have violated the Constitutional rights of individuals be held accountable for their actions. We also hope this case will help demystify the world of computer users to the general public and inform them about the potential of computer communities." +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Subject: More info on a past article Date: Sat, 1 Jun 91 08:27 EDT Court Tosses Inslaw Appeal By Gary H. Anthes Computerworld May 13, 1991 Washington, D.C.- A three-judge panel of the US Court of Appeals throw out two lower court rulings last week that said the US Department of Justice had stolen software from Inslaw, Inc. and had conspired to drive the firm out of business. The Court of Appeals for the Washington, D.C., circuit did not consider the validity of the lower court findings but said the bankruptcy court that first upheld Inslaw's charges had exceeded its authority. This is a serious setback for Inslaw, which said it has spent five years and $6 million in legal fees on the matter, but the company vowed to fight on. It may ask the full court to reconsider, it may appeal to the US Supreme Court, or it may go to more specialized tribunals set up by the government to hear disputes over contracts, trade secrets, and copyrights, Inslaw President William Hamilton said. "Not many firms could have lasted this long, and now to have this happen is just unbelievable. But there's no way in hell we will put up with it," an obviously embittered Hamilton said. It may cost the tiny firm "millions more" to reach the next major legal milestone, he said. Double Trouble Since the bankruptcy court trial in 1987, Inslaw has learned of additional alleged wrongdoings by the Justice Department. "The new evidence indicates that the motive of the [software theft] was to put Inslaw's software in the hands of private sector friends of the Reagan/Bush administration and then to award lucrative government contracts to those political supporters," Hamiliton said. He said that other evidence suggests that the software was illegally sold to foreign intelligence agencies. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Silicon.Surfer@unixville.edu Subject: Time to Copyright Underground Material Date: Sat, 1 Jun 91 07:32 EDT The following article was interesting to read for many reasons but most importantly about the database on the computer underground. I wonder if they will also act as a "unofficial" archive site for issues of Phrack, LoD, CuD, etc. If this is the case, then it might not be a good idea anymore to provide information to the Internet sites unless it could be copyrighted. Because on most of the PC BBS's you must state that you are a non-security and law enforcement type to gain access. Just a thought. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Systems Security Tips Go On-Line By Michael Alexander Computerworld May 13, 1991 Farifax, Va.-- Information systems security managers, electronic data processing auditors and others involved in systems protection know that it can often be difficult to keep on top of security technology and fast-breaking news. This week, National Security Associates, Inc., will officially kick off an on-line service dedicated solely to computer security. The repository contains databases of such articles on computer security that have appeared in 260 publications, computer security incident reports and vendor security products. One database is devoted to activity in the computer underground and to techniques used to compromise systems security. "This is a tough industry to keep up with," said Dennis Flanders, a communications engineer with computer security responsibilities at Boing Co. Flanders has been an alpha tester of National Security Associates' systems for about six months. "Security information is now being done piecemeal, and you have to go to many sources for information. The appealing thing about this is [that] all of the information is in one place." The service costs $12.50 per hour. There is a onetime sign-up charge of $30, which includes $15 worth of access time. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Anonymous Subject: Justice Dept as Pirates: More Inslaw News Date: Tue, 2 June 91 21:19:28 PDT Source: "Software Pirates," IN THESE TIMES (May 29-June 11, 1991, pp 11-13). Author: Joel Bleifuss. I found the following article in the latest In These Times. It's lengthy, so readers can obtain a copy from their newstands. The author summarizes Inslaw Corp.'s case against the U.S. Department of Justice, which it charges robbed it of its program, conspired to send the company into bankruptcy, and then initiated a cover-up. "In 1987, Judge George Bason, the federal bankruptcy judge for Washington, D.C., ruled that 'the Department of Justice took, convereted, stole' the Inslaw software "by trickery, fraud and deceit." The case is still in the courts." The author links the Inslaw case to the 1980 arms-for-hostages allegations of the Bush-Reagan campaign and suggests that foreign intrigue is the root of the matter. After a lengthy description of the case, which has been summarized elsewhere so I won't repeat it, the author concludes: "The St. Louis Post-Dispatch, which has assigned reported Phil Linsalata to cover the alleged Inslaw and 1980 scandals, ahs called for a congressional inquiry to 'alert the public to the pervasiveness of underground government, both legal and illegal.' As the May 13 editorial put it, 'If a subterranean network of operatives (like that exposed in the Iran-contra investigation) still exists, carrying out secret government policies, the very survival of a democratic political system based on law requires that it be exposed to the light. (The Inslaw case) may reveal pat of an illegal policy that was put in place even before the Regan administration had taken office. That is why Congress must try to find out the truth behind (allegations that the 1980 Reagan-Bush campaign arranged a secret arms-for-hostages deal with Iran).' Only when these allegations are brought to light can justice be served.'" ******************************************************************** ------------------------------ **END OF CuD #3.19** ********************************************************************