.oO Phrack 49 Oo. Volume Seven, Issue Forty-Nine 16 of 16 PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Phrack World News PWN PWN PWN PWN Issue 49 PWN PWN PWN PWN Compiled by DisordeR PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN Phrack World News #49 -- Index 01. CIA attacked, pulls plug on Internet site 02. Letter From Senator Patrick Leahy (D-VT) on Encryption 03. Java Black Widows - Sun Declares War 04. Jacking in from the "Smoked Filled Room" Port 05. Panix Attack 06. Massive Usenet Cancels 07. Mitnick Faces 25 More Federal Counts of Computer Hacking 08. Hacker is freed but he's banned from computers 09. Computer Hacker Severely Beaten after Criticizing Prison Conditions Target of Campaign by U.S. Secret Service 10. Bernie S. Released! 11. 12. School Hires Student to Hack Into Computers 13. Paranoia and Brit Hackers Fuel Infowar Craze in Spy Agencies 14. Hackers Find Cheap Scotland Yard Phone Connection 15. U.S. Official Warns OF "Electronic Pearl Harbor" 16. Suit Challenges State's Restraint of the Internet Via AP 17. U.S. Government Plans Computer Emergency Response Team 18. Hackers $50K challenge to break Net security system 19. Criminal cult begins PGP crack attempt 20. Hackers Bombard Internet 21. Crypto Mission Creep 22. Hacker posts nudes on court's Web pages 23. Hacking Into Piracy 24. Revealing Intel's Secrets 25. Internet Boom Puts Home PCs At Risk Of Hackers 26. Computer hacker Mitnick pleads innocent 27. Hackers Destroy Evidence of Gulf War Chemical/Biological Weapons 28. Criminals Slip Through The Net [=-------------------------------------------------------------------------=] title: CIA attacked, pulls plug on Internet site author: unknown source: Reuter WASHINGTON (Reuter) - The Central Intelligence Agency, that bastion of spy technology and computer wizardry, pulled the plug on its World Wide Web site on the Internet Thursday after a hacker broke in and replaced it with a crude parody. CIA officials said their vandalized homepage -- altered to read "Welcome to the Central Stupidity Agency" -- was in no way linked to any mainframe computers containing classified national security information. [* Excuse me for a minute while my erection goes down. *] The site was tampered with Wednesday evening and the CIA closed it Thursday morning while a task force looked into the security breach, CIA spokeswoman Jane Heishman said. Part of the hacker's text read "Stop Lying." "It's definitely a hacker" who pierced the system's security, she said. "The agency has formed a task force to look into what happend and how to prevent it." [* No shit?! It was a hacker that did that? *] The CIA web site (http://www.odci.gov/cia) showcases unclassified information including spy agency press releases, officials' speeches, historical rundowns and the CIA's World Fact Book, a standard reference work. The cyber-attack matched one that forced the Justice Department to close its Web site last month after hackers inserted a swastika and picture of Adolph Hitler. The penetration of the CIA homepage highlighted the vulnerability of Internet sites designed to attract the public and drove home the need for multiple layers of security. "You want people to visit, you want them to interact, but you don't want them to leave anything behind," said Jon Englund of the Information Technology Association of America, a trade group of leading software and telecommunications firms. [=-------------------------------------------------------------------------=] From: Senator_Leahy@LEAHY.SENATE.GOV Date: Thu, 02 May 96 12:04:07 EST -----BEGIN PGP SIGNED MESSAGE----- LETTER FROM SENATOR PATRICK LEAHY (D-VT) ON ENCRYPTION May 2, 1996 Dear Friends: Today, a bipartisan group of Senators has joined me in supporting legislation to encourage the development and use of strong, privacy-enhancing technologies for the Internet by rolling back the out-dated restrictions on the export of strong cryptography. In an effort to demonstrate one of the more practical uses of encryption technology (and so that you all know this message actually came from me), I have signed this message using a digital signature generated by the popular encryption program PGP. I am proud to be the first member of Congress to utilize encryption and digital signatures to post a message to the Internet. [* The first?! We're doomed!! *] As a fellow Internet user, I care deeply about protecting individual privacy and encouraging the development of the Net as a secure and trusted communications medium. I do not need to tell you that current export restrictions only allow American companies to export primarily weak encryption technology. The current strength of encryption the U.S. government will allow out of the country is so weak that, according to a January 1996 study conducted by world-renowned cryptographers, a pedestrian hacker can crack the codes in a matter of hours! A foreign intelligence agency can crack the current 40-bit codes in seconds. [* That should read "As a fellow Internet user ..who doesn't read his own mail... *] Perhaps more importantly, the increasing use of the Internet and similar interactive communications technologies by Americans to obtain critical medical services, to conduct business, to be entertained and communicate with their friends, raises special concerns about the privacy and confidentiality of those communications. I have long been concerned about these issues, and have worked over the past decade to protect privacy and security for our wire and electronic communications. Encryption technology provides an effective way to ensure that only the people we choose can read our communications. I have read horror stories sent to me over the Internet about how human rights groups in the Balkans have had their computers confiscated during raids by security police seeking to find out the identities of people who have complained about abuses. Thanks to PGP, the encrypted files were undecipherable by the police and the names of the people who entrusted their lives to the human rights groups were safe. The new bill, called the "Promotion of Commerce On-Line in the Digital Era (PRO-CODE) Act of 1996," would: o bar any government-mandated use of any particular encryption system, including key escrow systems and affirm the right of American citizens to use whatever form of encryption they choose domestically; [* Thank you for permission to do that.. even though it is legal already *] o loosen export restrictions on encryption products so that American companies are able to export any generally available or mass market encryption products without obtaining government approval; and [* Loosen? Why not abolish? *] o limit the authority of the federal government to set standards for encryption products used by businesses and individuals, particularly standards which result in products with limited key lengths and key escrow. This is the second encryption bill I have introduced with Senator Burns and other congressional colleagues this year. Both bills call for an overhaul of this country's export restrictions on encryption, and, if enacted, would quickly result in the widespread availability of strong, privacy protecting technologies. Both bills also prohibit a government-mandated key escrow encryption system. While PRO-CODE would limit the authority of the Commerce Department to set encryption standards for use by private individuals and businesses, the first bill we introduced, called the "Encrypted Communications Privacy Act", S.1587, would set up stringent procedures for law enforcement to follow to obtain decoding keys or decryption assistance to read the plaintext of encrypted communications obtained under court order or other lawful process. It is clear that the current policy towards encryption exports is hopelessly outdated, and fails to account for the real needs of individuals and businesses in the global marketplace. Encryption expert Matt Blaze, in a recent letter to me, noted that current U.S. regulations governing the use and export of encryption are having a "deleterious effect ... on our country's ability to develop a reliable and trustworthy information infrastructure." The time is right for Congress to take steps to put our national encryption policy on the right course. I am looking forward to hearing from you on this important issue. Throughout the course of the recent debate on the Communications Decency Act, the input from Internet users was very valuable to me and some of my Senate colleagues. You can find out more about the issue at my World Wide Web home page (http://www.leahy.senate.gov/) and at the Encryption Policy Resource Page (http://www.crypto.com/). Over the coming months, I look forward to the help of the Net community in convincing other Members of Congress and the Administration of the need to reform our nation's cryptography policy. Sincerely, Patrick Leahy United States Senator [=-------------------------------------------------------------------------=] title: JAVA BLACK WIDOWS - SUN DECLARES WAR author: unknown from: staff@hpp.com Sun Microsystems' has declared war on Black Widow Java applets on the Web. This is the message from Sun in response to an extensive Online Business Consultant (OBC/May 96) investigation into Java security. OBC's investigation and report was prompted after renowned academics, scientists and hackers announced Java applets downloaded from the WWW presented grave security risks for users. Java Black Widow applets are hostile, malicious traps set by cyberthugs out to snare surfing prey, using Java as their technology. OBC received a deluge of letters asking for facts after OBC announced a group of scientists from Princeton University, Drew Dean, Edward Felten and Dan Wallach, published a paper declaring "The Java system in its current form cannot easily be made secure." The paper can be retrieved at http://www.cs.princeton.edu/sip/pub/secure96.html. Further probing by OBC found that innocent surfers on the Web who download Java applets into Netscape's Navigator and Sun's HotJava browser, risk having "hostile" applets interfere with their computers (consuming RAM and CPU cycles). It was also discovered applets could connect to a third party on the Internet and, without the PC owner's knowledge, upload sensitive information from the user's computer. Even the most sophisticated firewalls can be penetrated . . . "because the attack is launched from behind the firewall," said the Princeton scientists. One reader said, "I had no idea that it was possible to stumble on Web sites that could launch an attack on a browser." Another said, "If this is allowed to get out of hand it will drive people away from the Web. Sun must allay fears." [* Faster connections if people are driven from the web.. hmm... :) *] The response to the Home Page Press hostile applet survey led to the analogy of Black Widow; that the Web was a dangerous place where "black widows" lurked to snare innocent surfers. As a result the Princeton group and OBC recommended users should "switch off" Java support in their Netscape Navigator browsers. OBC felt that Sun and Netscape had still to come clean on the security issues. But according to Netscape's Product Manager, Platform, Steve Thomas, "Netscape wishes to make it clear that all known security problems with the Navigator Java and JavaScript environment are fixed in Navigator version 2.02." However, to date, Netscape has not answered OBC's direct questions regarding a patch for its earlier versions of Navigator that supported Java . . . the equivalent of a product recall in the 3D world. Netscape admits that flaws in its browsers from version 2.00 upwards were related to the Java security problems, but these browsers are still in use and can be bought from stores such as CompUSA and Cosco. A floor manager at CompUSA, who asked not to be named, said "its news to him that we are selling defective software. The Navigator walks off our floor at $34 a pop." OBC advised Netscape the defective software was still selling at software outlets around the world and asked Netscape what action was going to be taken in this regard. Netscape has come under fire recently for its policy of not releasing patches to software defects; but rather forcing users to download new versions. Users report this task to be a huge waste of time and resources because each download consists of several Mbytes. As such defective Navigators don't get patched. OBC also interviewed Sun's JavaSoft security guru, Ms. Marianne Mueller, who said "we are taking security very seriously and working on it very hard." Mueller said the tenet that Java had to be re-written from scratch or scrapped "is an oversimplification of the challenge of running executable content safely on the web. Security is hard and subtle, and trying to build a secure "sandbox" [paradigm] for running untrusted downloaded applets on the web is hard." Ms. Mueller says Sun, together with their JavaSoft (Sun's Java division) partners, have proposed a "sandbox model" for security in which "we define a set of policies that restrict what applets can and cannot do---these are the boundaries of the sandbox. We implement boundary checks---when an applet tries to cross the boundary, we check whether or not it's allowed to. If it's allowed to, then the applet is allowed on its way. If not, the system throws a security exception. "The 'deciding whether or not to allow the boundary to be crossed' is the research area that I believe the Princeton people are working on," said Mueller. "One way to allow applets additional flexibility is if the applet is signed (for example, has a digital signature so that the identity of the applet's distributor can be verified via a Certificate Authority) then allow the applet more flexibility. "There are two approaches: One approach is to let the signed applet do anything. A second approach is to do something more complex and more subtle, and only allow the applet particular specified capabilities. Expressing and granting capabilities can be done in a variety of ways. "Denial of service is traditionally considered one of the hardest security problems, from a practical point of view. As [Java's creator] James Gosling says, it's hard to tell the difference between an MPEG decompressor and a hostile applet that consumes too many resources! But recognizing the difficulty of the problem is not the same as 'passing the buck.' We are working on ways to better monitor and control the use (or abuse) of resources by Java classes. We could try to enforce some resource limits, for example. These are things we are investigating. "In addition, we could put mechanisms in place so that user interface people (like people who do Web browsers) could add 'applet monitors' so that browser users could at least see what is running in their browser, and kill off stray applets. This kind of user interface friendliness (letting a user kill of an applet) is only useful if the applet hasn't already grabbed all the resources, of course." The experts don't believe that the problem of black widows and hostile applets is going to go away in a hurry. In fact it may get worse. The hackers believe that when Microsoft releases Internet Explorer 3.00 with support for Java, Visual Basic scripting and the added power of its ActiveX technology, the security problem will become worse. "There is opportunity for abuse, and it will become an enormous problem," said Stephen Cobb, Director of Special Projects for the National Computer Security Association (NCSA). "For example, OLE technology from Microsoft [ActiveX] has even deeper access to a computer than Java does." JavaSoft's security guru Mueller agreed on the abuse issue: "It's going to be a process of education for people to understand the difference between a rude applet, and a serious security bug, and a theoretical security bug, and an inconsequential security-related bug. In the case of hostile applets, people will learn about nasty/rude applet pages, and those pages won't be visited. I understand that new users of the Web often feel they don't know where they're going when they point and click, but people do get a good feel for how it works, pretty quickly, and I actually think most users of the Web can deal with the knowledge that not every page on the web is necessarily one they'd want to visit. Security on the web in some sense isn't all that different from security in ordinary life. At some level, common sense does come into play. "Many people feel that Java is a good tool for building more secure applications. I like to say that Java raises the bar for security on the Internet. We're trying to do something that is not necessarily easy, but that doesn't mean it isn't worth trying to do. In fact it may be worth trying to do because it isn't easy. People are interested in seeing the software industry evolve towards more robust software---that's the feedback I get from folks on the Net." # # # The report above may be reprinted with credit provided as follows: Home Page Press, Inc., http://www.hpp.com and Online Business ConsultantOE Please refer to the HPP Web site for additional information about Java and OBC. [=-------------------------------------------------------------------------=] title: Jacking in from the "Smoked Filled Room" Port author: "Brock N. Meeks" source: CyberWire Dispatch // September // Copyright (c) 1996 // Washington, DC -- Federal provisions funding the digital telephony bill and roving wiretaps, surgically removed earlier this year from an anti-terrorism bill, have quietly been wedged into a $600 billion omnibus spending bill. The bill creates a Justice Department "telecommunications carrier compliance fund" to pay for the provisions called for in the digital telephony bill, formally known as the Communications Assistance in Law Enforcement Act (CALEA). In reality, this is a slush fund. Congress originally budgeted $500 million for CALEA, far short of the billions actually needed to build in instant wiretap capabilities into America's telephone, cable, cellular and PCS networks. This bill now approves a slush fund of pooled dollars from the budgets of "any agency" with "law enforcement, national security or intelligence responsibilities." That means the FBI, CIA, NSA and DEA, among others, will now have a vested interest in how the majority of your communications are tapped. The spending bill also provides for "multipoint wiretaps." This is the tricked up code phase for what amounts to roving wiretaps. Where the FBI can only tap one phone at a time in conjunction with an investigation, it now wants the ability to "follow" a conversation from phone to phone; meaning that if your neighbor is under investigation and happens to use your phone for some reason, your phone gets tapped. It also means that the FBI can tap public pay phones... think about that next time you call 1-800-COLLECT. In addition, all the public and congressional accountability provisions for how CALEA money was spent, which were in the original House version (H.R. 3814), got torpedoed in the Senate Appropriations Committee. Provisions stripped out by the Senate: -- GONE: Money isn't to be spent unless an implementation plan is sent to each member of the Judiciary Committee and Appropriations committees. -- GONE: Requirement that the FBI provide public details of how its new wiretap plan exceeds or differs from current capabilities. -- GONE: Report on the "actual and maximum number of simultaneous surveillance/intercepts" the FBI expects. The FBI ran into a fire storm earlier this year when it botched its long overdue report that said it wanted the capability to tap one out of every 100 phones *simultaneously*. Now, thanks to this funding bill, rather than having to defend that request, it doesn't have to say shit. -- GONE: Complete estimate of the full costs of deploying and developing the digital wiretapping plan. -- GONE: An annual report to Congress "specifically detailing" how all taxpayer money -- YOUR money -- is spent to carry out these new wiretap provisions. "No matter what side you come down on this (digital wiretapping) issue, the stakes for democracy are that we need to have public accountability," said Jerry Berman, executive director of the Center for Democracy and Technology. Although it appeared that no one in congress had the balls to take on the issue, one stalwart has stepped forward, Rep. Bob Barr (R-Ga.). He has succeeded in getting some of the accountability provisions back into the bill, according to a Barr staffer. But the fight couldn't have been an easy one. The FBI has worked congress relentlessly in an effort to skirt the original reporting and implementation requirements as outlined in CALEA. Further, Barr isn't exactly on the FBI's Christmas card list. Last year it was primarily Barr who scotched the funding for CALEA during the 104th Congress' first session. But Barr has won again. He has, with backing from the Senate, succeeded in *putting back* the requirement that the FBI must justify all CALEA expenditures to the Judiciary Committee. Further, the implementation plan, "though somewhat modified" will "still have some punch," Barr's staffer assured me. That includes making the FBI report on its expected capacities and capabilities for digital wiretapping. In other words, the FBI won't be able to "cook the books" on the wiretap figures in secret. Barr also was successful in making the Justice Department submit an annual report detailing its CALEA spending to Congress. However, the funding for digital wiretaps remains. Stuffing the funding measures into a huge omnibus spending bill almost certainly assures its passage. Congress is twitchy now, anxious to leave. They are chomping at the bit, sensing the end of the 104th Congress' tortured run as the legislative calender is due to run out sometime early next week. Then they will all literally race from Capitol Hill at the final gavel, heading for the parking lot, jumping in their cars like stock car drivers as they make a made dash for National Airport to return to their home districts in an effort to campaign for another term in the loopy world of national politics. Congress is "going to try to sneak this (spending bill) through the back door in the middle of the night," says Leslie Hagan, legislative director for the National Association of Criminal Defense Lawyers. She calls this a "worst case scenario" that is "particularly dangerous" because the "deliberative legislative process is short-ciricutied." Such matters as wiretapping deserve to be aired in the full sunlight of congressional hearings, not stuffed into an 11th hour spending bill. This is legislative cowardice. Sadly, it will most likely succeed. And through this all, the Net sits mute. Unlike a few months ago, on the shameful day the Net cried "wolf" over these same provisions, mindlessly flooding congressional switchboards and any Email box within keyboard reach, despite the fact that the funding provisions had been already been stripped from the anti-terrorism bill, there has been no hue-and-cry about these most recent moves. Yes, some groups, such as the ACLU, EPIC and the Center for Democracy and Technology have been working the congressional back channels, buzzing around the frenzied legislators like crazed gnats. But why haven't we heard about all this before now? Why has this bill come down to the wire without the now expected flurry of "alerts" "bulletins" and other assorted red-flag waving by our esteemed Net guardians? Barr's had his ass hanging in the wind, fighting FBI Director Louis "Teflon" Freeh; he could have used some political cover from the cyberspace community. Yet, if he'd gone to that digital well, he'd have found only the echo of his own voice. And while the efforts of Rep. Barr are encouraging, it's anything from a done deal. "As long as the door is cracked... there is room for mischief," said Barr's staffer. Meaning, until the bill is reported and voted on, some snapperhead congressman could fuck up the process yet again. We all caught a bit of a reprieve here, but I wouldn't sleep well. This community still has a lot to learn about the Washington boneyard. Personally, I'm a little tired of getting beat up at every turn. Muscle up, folks, the fight doesn't get any easier. Meeks out... Declan McCullagh contributed to this report. [=-------------------------------------------------------------------------=] title: Panix Attack author: Joshua Quittner source: Time Magazine - September 30, 1996 Volume 148, No. 16 It was Friday night, and Alexis Rosen was about to leave work when one of his computers sent him a piece of E-mail. If this had been the movies, the message would have been presaged by something dramatic--the woo-ga sound of a submarine diving into combat, say. But of course it wasn't. This was a line of dry text automatically generated by one of the machines that guard his network. It said simply, "The mail servers are down." The alert told Rosen that his 6,000 clients were now unable to receive E-mail. Rosen, 30, is a cool customer, not the type to go into cardiac arrest when his mail server crashes. He is the co-founder of Panix, the oldest and best-known Internet service provider in Manhattan. Years before the Net became a cereal-box buzz word, Rosen would let people connect to Panix free, or for only a few dollars a month, just because--well, because that was the culture of the time. Rosen has handled plenty of mail outages, so on this occasion he simply rolled up his sleeves and set to work, fingers clacking out a flamenco on the keyboard, looking for the cause of the glitch. What he uncovered sent a chill down his spine--and has rippled across the Net ever since, like a rumor of doom. Someone, or something, was sending at the rate of 210 a second the one kind of message his computer was obliged to answer. As long as the siege continued--and it went on for weeks--Rosen had to work day and night to keep from being overwhelmed by a cascade of incoming garbage. It was the dread "syn flood," a relatively simple but utterly effective means for shutting down an Internet service provider--or, for that matter, anyone else on the Net. After Panix went public with its story two weeks ago, dozens of online services and companies acknowledged being hit by similar "denial of service" attacks. As of late last week, seven companies were still under furious assault. None of the victims have anything in common, leading investigators to suspect that the attacks may stem from the same source: a pair of how-to articles that appeared two months ago in 2600 and Phrack, two journals that cater to neophyte hackers. Phrack's article was written by a 23-year-old editor known as daemon9. He also crafted the code for an easy-to-run, menu-driven, syn-flood program, suitable for use by any "kewl dewd" with access to the Internet. "Someone had to do it," wrote daemon9. [* WooWoo! Go Route! *] That gets to the core of what may be the Net's biggest problem these days: too many powerful software tools in the hands of people who aren't smart enough to build their own--or to use them wisely. Real hackers may be clever and prankish, but their first rule is to do no serious harm. Whoever is clobbering independent operators like Panix has as much to do with hacking as celebrity stalkers have to do with cinematography. Another of the victims was the Voters Telecommunications Watch, a nonprofit group that promotes free speech online. "Going after them was like going after the little old lady who helps people in the neighborhood and bashing her with a lead pipe," says Rosen. [* Gee. Is that to say that if you can't write your own operating system that you shouldn't have it or that it is a big problem? If so, poor Microsoft... *] Rosen was eventually able to repulse the attack; now he'd like to confront his attacker. Since some of these Netwits don't seem to know enough to wipe off their digital fingerprints, he may get his wish. [* Wow, they did it for two weeks without getting caught. Two weeks of 24/7 abuse toward this ISP, and now he thinks he can track them down? *] [=-------------------------------------------------------------------------=] title: none author: Rory J. O'Connor source: Knight-Ridder Newspapers WASHINGTON -- Vandals swept through the Internet last weekend, wiping clean dozens of public bulletin boards used by groups of Jews, Muslims, feminists and homosexuals, among others. In one of the most widespread attacks on the international computer network, the programs automatically erased copies of more than 27,000 messages from thousands of servers, before operators stopped the damage. The identity of those responsible for launching the apparent hate attacks -- some of the programs were titled "fagcancel" and "kikecancel" -- is unknown. The incident further illustrates the shaky security foundation of the Internet, which has mushroomed from academic research tool to international communications medium in just three years. And it raised the ire of many Internet users furious at the ease with which a user can erase someone else's words from worldwide discussion groups, known as Usenet newsgroups, in a matter of hours. "There's nothing you can do as an individual user to prevent someone from canceling your message," said John Gilmore, a computer security expert in San Francisco. "We need something added to Usenet's software that would only allow a cancellation from the originator." [* Which can then be forged just like fakemail... *] The incident follows closely three other well-publicized Internet attacks. In two cases, hackers altered the World Wide Web home pages of the Justice Department and the CIA, apparently as political protests. In the third, a hacker overloaded the computers of an Internet service provider called Panix with hordes of phony requests for a connection, thus denying use of the service to legitimate users. The latest attacks -- called cancelbots -- were launched sometime over the weekend from a variety of Internet service providers, including UUNet Technologies in Fairfax, Va., and Netcom Inc. in San Jose, Calif. One attack was launched from a tiny provider in Tulsa, Okla., called Cottage Software, according to its owner, William Brunton. "The offending user has been terminated and the information has been turned over to the proper (federal) authorities," Brunton said in a telephone interview Wednesday. "It's now in their hands." Legal experts said it's unclear if the attacks constitute a crime under federal laws such as the Computer Fraud and Abuse Act. "It's really a difficult issue," said David Sobel, legal counsel of the Electronic Privacy Information Center in Washington. "Can you assign value to a newsgroup posting? Because most of the computer crime statutes assume you're ripping off something of value." [* Hello? Several statutes don't assume that at all. You can be charged with HAVING information and not using it. *] A spokesman for the FBI in Washington said he was unaware of any federal investigation of the incident, although it is the agency's policy not to comment on investigations. While some of the deleted messages have been restored on certain servers, where operators have retrieved them from backup copies of their disks, users of other servers where the messages haven't been restored will never be able to read them. The fact that a user can stamp out the words of someone else is an artifact of the original design of the Internet, begun as a Department of Defense project in 1969. The Internet consists of tens of thousands of computers, called servers, that act as repositories for public messages, private electronic mail and World Wide Web home pages. Servers throughout the world are interconnected through telephone lines so they can exchange information and route messages to the individual users, or clients, of a given server. Each server stores a copy of the constantly changing contents of newsgroups, which function as giant electronic bulletin boards dedicated to particular subjects. There are thousands of them, covering everything from particle physics to soap operas. Any Internet user is free to post a contribution to nearly any newsgroup, and the posting is rapidly copied from one server to another, so the contents of a newsgroup are identical on every server. Almost the only form of control over postings, including their content, is voluntary adherence to informal behavior rules known as "netiquette." The idea of cancelbots originated when the Internet and its newsgroups were almost exclusively the domain of university and government scientists and researchers. Their purpose was to allow individuals to rescind messages they later discovered to contain an error. The action took the form of an automatic program, itself in the form of a message, because it would be impossible for an individual to find and delete every copy of the posting on every Internet server. But the Usenet software running on servers doesn't verify that the cancel message actually comes from the person who created the original posting. All a malicious user need do is replace their actual e-mail address with that of someone else to fool Usenet into deleting a message. That counterfeiting is as simple as changing an option in the browser software most people use to connect to the Internet. "It's pretty easy. There's no authentication in the Usenet. So anybody can pretend to be anybody else," Gilmore said. It takes only slightly more sophistication to create a program that searches newsgroups for certain keywords, and then issues a cancelbot for any message that contains them. That is how the weekend attack took place. The use of counterfeit cancelbots is not new. The Church of Scientology, embroiled in a legal dispute with former members, last year launched cancelbots against the newsgroup postings of the members. Attorneys for the church claimed the postings violated copyright laws, because they contained the text of Scientology teachings normally available only to longtime members who have paid thousands of dollars. Net users have also turned false cancelbots against those who violate a basic rule of netiquette by "spamming" newsgroups -- that is, posting a message to hundreds or even thousands of newsgroups, usually commercial in nature and unrelated to the newsgroup topic. "This technology has been used for both good and evil," Gilmore said. But an individual launching a wholesale cancelbot attack on postings because of content is considered a serious violation of netiquette -- although one about which there is little recourse at the moment. "For everybody who takes the trouble and time to participate on the Internet in some way, I think it is not acceptable for somebody else to undo those efforts," Sobel said. "But what are the alternatives? Not to pursue this means of communications? Unintended uses and malicious uses seem to be inevitable." What's needed, some say, is a fundamental change in the Internet that forces individual users to "sign" their postings in such a way that everyone has a unique identity that can't be forged. [* And how about for the technically challenged who can't figure out the point-and-drool America Online software? *] "The fatal flaw is that newsgroups were set up at a time when everybody knew everybody using the system, and you could weed out anybody who did this," Brunton said. "This points out that flaw in the system, and that there are unreasonable people out there who will exploit it." [=-------------------------------------------------------------------------=] title: Mitnick Faces 25 More Federal Counts of Computer Hacking source: nando.net - Los Angeles Daily News LOS ANGELES (Sep 27, 1996 02:06 a.m. EDT) -- A computer hacker who used his digital prowess to outrun FBI agents for three years has been indicted on charges that he stole millions of dollars in software through the Internet. The 25-count federal indictment against Kevin Mitnick is the biggest development in the sensational case since the self-taught computer whiz was arrested in February 1995 in North Carolina. The 33-year-old son of a waitress from suburban Los Angeles has been held in custody in Los Angeles ever since. With Thursday's indictment, federal prosecutors made good on their vow to hold Mitnick accountable for what they say was a string of hacking crimes that pushed him to the top of the FBI's most-wanted list. "These are incredibly substantial charges. They involve conducts spanning two and a half years. They involve a systematic scheme to steal proprietary software from a range of victims," Assistant U.S. Attorney David Schindler said in an interview. Mitnick's longtime friend, Lewis De Payne, 36, also was indicted Thursday on charges that he helped steal the software between June 1992 and February 1995 -- while Mitnick was on the run from the FBI. "I would say it is an absurd fiction," said De Payne's attorney, Richard Sherman. "I don't think the government is going to be able to prove its case." De Payne will surrender today to authorities in Los Angeles, Sherman said. Friends and relatives of Mitnick have defended his hacking, saying he did it for the intellectual challenge and to pull pranks -- but never for profit. Los Angeles' top federal prosecutor sees it differently. "Computer and Internet crime represents a major threat, with sophisticated criminals able to wreak havoc around the world," U.S. Attorney Nora M. Manella said in a written statement. The indictment charges Mitnick and De Payne with having impersonated officials from companies and using "hacking" programs to enter company computers. Schindler said the software involved the operation of cellular telephones and computer operating systems. Their alleged victims include the University of Southern California, Novell, Sun Microsystems and Motorola, Schindler said. [=-------------------------------------------------------------------------=] title: Hacker is freed but he's banned from computers author: Brandon Bailey (Mercury News Staff Writer) Convicted hacker Kevin Poulsen is out of prison after five years, but he still can't touch a computer. Facing a court order to pay more than $57,000 in restitution for rigging a series of radio station call-in contests, Poulsen has complained that authorities won't let him use his only marketable skill -- programming. Instead, Poulsen said, he's doomed to work for minimum wage at a low-tech job for the next three years. Since his June release from prison -- after serving more time behind bars than any other U.S. hacker -- the only work he's found is canvassing door to door for a liberal political action group. It's a big change for the 30-year-old Poulsen, once among the most notorious hackers on the West Coast. A former employee at SRI International in Menlo Park, he was featured on television's "America's Most Wanted" while living underground in Los Angeles as a federal fugitive from 1989 to 1991. Before authorities caught him, Poulsen burglarized telephone company offices, electronically snooped through records of law enforcement wiretaps and jammed radio station phone lines in a scheme to win cash, sports cars and a trip to Hawaii. Poulsen now lives with his sister in the Los Angeles area, where he grew up in the 1970s and '80s. But he must remain under official supervision for three more years. And it galls him that authorities won't trust him with a keyboard or a mouse. U.S. District Judge Manuel Real has forbidden Poulsen to have any access to a computer without his probation officer's approval. That's a crippling restriction in a society so reliant on computer technology, Poulsen complained in a telephone interview after a hearing last week in which the judge denied Poulsen's request to modify his terms of probation. To comply with those rules, Poulsen said, his parents had to put their home computer in storage when he stayed with them. He can't use an electronic card catalog at the public library. And he relies on friends to maintain his World Wide Web site. He even asked his probation officer whether it was OK to drive because most cars contain microchips. Living under government supervision apparently hasn't dampened the acerbic wit Poulsen displayed over the years. Prankster humor When authorities were tracking him, they found he'd kept photographs of himself, taken while burglarizing phone company offices, and that he'd created bogus identities in the names of favorite comic book characters. Today, you can click on Poulsen's web page (http://www.catalog.com/kevin) and read his account of his troubles with the law. Until it was revised Friday, you could click on the highlighted words "my probation officer" -- and see the scary red face of Satan. But though he's still chafing at authority, Poulsen insists he's ready to be a law-abiding citizen. "The important thing to me," he said, "is just not wasting the next three years of my life." He said he's submitted nearly 70 job applications but has found work only with the political group, which he declined to identify. Poulsen, who earned his high school diploma behind bars, said he wants to get a college degree. But authorities vetoed his plans to study computer science while working part-time because they want him to put first priority on earning money for restitution. Poulsen's federal probation officer, Marc Stein, said office policy prevents him from commenting on the case. Poulsen's court-appointed attorney, Michael Brennan, also declined comment. Differing view But Assistant U.S. Attorney David Schindler partly disputed Poulsen's account. "Nobody wants to see Mr. Poulsen fail," said Schindler, who has prosecuted both Poulsen and Kevin Mitnick, another young man from the San Fernando Valley whose interest in computers and telephones became a passion that led to federal charges. Schindler said Stein is simply being prudent: "It would be irresponsible for the probation office to permit him to have unfettered access to computers." Legal experts say there's precedent for restricting a hacker's access to computers, just as paroled felons may be ordered not to possess burglary tools or firearms. Still, some say it's going too far. "There are so many benign things one can do with a computer," said Charles Marson, a former attorney for the American Civil Liberties Union who handles high-tech cases in private practice. "If it were a typewriter and he pulled some scam with it or wrote a threatening note, would you condition his probation on not using a typewriter?" But Carey Heckman, co-director of the Law and Technology Policy Center at Stanford University, suggested another analogy: "Would you want to put an arsonist to work in a match factory?" Friends defend Poulsen. Over the years, Poulsen's friends and defense lawyers have argued that prosecutors exaggerated the threat he posed, either because law officers didn't understand the technology he was using or because his actions seemed to flaunt authority. Hacking is "sort of a youthful rebellion thing," Poulsen says now. "I'm far too old to get back into that stuff." But others who've followed Poulsen's career note that he had earlier chances to reform. He was first busted for hacking into university and government computers as a teen-ager. While an older accomplice went to jail, Poulsen was offered a job working with computers at SRI, the private think tank that does consulting for the Defense Department and other clients. There, Poulsen embarked on a double life: A legitimate programmer by day, he began breaking into Pacific Bell offices and hacking into phone company computers at night. When he learned FBI agents were on his trail, he used his skills to track their moves. Before going underground in 1989, he also obtained records of secret wiretaps from unrelated investigations. Though Poulsen said he never tipped off the targets, authorities said they had to take steps to ensure those cases weren't compromised. According to Schindler, the probation office will consider Poulsen's requests to use computers "on a case-by-case basis." [=-------------------------------------------------------------------------=] [* Blurb on Bernie's release follows this article. *] title: Computer Hacker Severely Beaten after Criticizing Prison Conditions Target of Campaign by U.S. Secret Service A convicted hacker, in prison for nothing more than possession of electronic parts easily obtainable at any Radio Shack, has been savagely beaten after being transferred to a maximum security prison as punishment for speaking out publicly about prison conditions. Ed Cummings, recently published in Wired and Internet Underground, as well as a correspondent for WBAI-FM in New York and 2600 Magazine, has been the focus of an increasingly ugly campaign of harrassment and terror from the authorities. At the time of this writing, Cummings is locked in the infectious diseases ward at Lehigh County prison in Allentown, Pennsylvania, unable to obtain the proper medical treatment for the severe injuries he has suffered. The Ed Cummings case has been widely publicized in the computer hacker community over the past 18 months. In March of 1995, in what can only be described as a bizarre application of justice, Cummings (whose pen name is "Bernie S.") was targetted and imprisoned by the United States Secret Service for mere possession of technology that could be used to make free phone calls. Although the prosecution agreed there was no unauthorized access, no victims, no fraud, and no costs associated with the case, Cummings was imprisoned under a little known attachment to the Digital Telephony bill allowing individuals to be charged in this fashion. Cummings was portrayed by the Secret Service as a potential terrorist because of some of the books found in his library. A year and a half later, Cummings is still in prison, despite the fact that he became eligible for parole three months ago. But things have now taken a sudden violent turn for the worse. As apparent retribution for Cummings' continued outspokenness against the daily harrassment and numerous injustices that he has faced, he was transferred on Friday to Lehigh County Prison, a dangerous maximum security facility. Being placed in this facility was in direct opposition to his sentencing order. The reason given by the prison: "protective custody". A day later, Cummings was nearly killed by a dangerous inmate for not getting off the phone fast enough. By the time the prison guards stopped the attack, Cummings had been kicked in the face so many times that he lost his front teeth and had his jaw shattered. His arm, which he tried to use to shield his face, was also severely injured. It is expected that his mouth will be wired shut for up to three months. Effectively, Cummings has now been silenced at last. >From the start of this ordeal, Cummings has always maintained his composure and confidence that one day the injustice of his imprisonment will be realized. He was a weekly contributor to a radio talk show in New York where he not only updated listeners on his experiences, but answered their questions about technology. People from as far away as Bosnia and China wrote to him, having heard about his story over the Internet. Now we are left to piece these events together and to find those responsible for what are now criminal actions against him. We are demanding answers to these questions: Why was Cummings transferred for no apparent reason from a minimum security facility to a very dangerous prison? Why has he been removed from the hospital immediately after surgery and placed in the infectious diseases ward of the very same prison, receiving barely any desperately needed medical attention? Why was virtually every moment of Cummings' prison stay a continuous episode of harrassment, where he was severely punished for such crimes as receiving a fax (without his knowledge) or having too much reading material? Why did the Secret Service do everything in their power to ruin Ed Cummings' life? Had these events occurred elsewhere in the world, we would be quick to condemn them as barbaric and obscene. The fact that such things are taking place in our own back yards should not blind us to the fact that they are just as unacceptable. Lehigh County Prison will be the site of several protest actions as will the Philadelphia office of the United States Secret Service. For more information on this, email protest@2600.com or call our office at (516) 751-2600. 9/4/96 [=-------------------------------------------------------------------------=] title: Bernie S. Released! As of Friday, September 13th, Bernie S. was released from prison on an unprecedented furlough. He will have to report to probation and he still has major medical problems as a result of his extended tour of the Pennsylvania prison system. But the important thing is that he is out and that this horrible ordeal has finally begun to end. We thank all of you who took an interest in this case. We believe it was your support and the pressure you put on the authorities that finally made things change. Thanks again and never forget the power you have. emmanuel@2600.com www.2600.com [=-------------------------------------------------------------------------=] title: ENGLAND: The Squidge was arrested at his home yesterday under the Computer Misuse Act. A long standing member of the US group the *Guild, Squidge was silent today after being released but it appears no formal charges will be made until further interviews have taken place. Included in the arrest were the confiscation of his computer equipment including two Linux boxes and a Sun Sparc. A number of items described as 'telecommunications devices' were also seized as evidence. Following the rumours of ColdFire's recent re-arrest for cellular fraud this could mean a new crackdown on hacking and phreaking by the UK authorities. If this is true, it could spell the end for a particularly open period in h/p history when notable figures have been willing to appear more in public. We will attempt to release more information as it becomes available. (not posted by Squidge) -- Brought to you by The NeXus..... [* Good luck goes out to Squidge.. we are hoping for the best. *] [=-------------------------------------------------------------------------=] title: School Hires Student to Hack Into Computers source: The Sun Herald - 22 August 1996 Palisades Park, NJ - When in trouble, call an expert. Students at Palisades Park's high school needed their transcripts to send off to colleges. But they were in the computer and no one who knew the password could be reached. So the school hired a 16-year-old hacker to break in. "They found this student who apparently was a whiz, and, apparently, was able to go in and unlock the password," School Board attorney Joseph R. Mariniello said. Superintendent George Fasciano was forced to explain to the School Board on Monday the $875 bill for the services of Matthew Fielder. [* He should have charged more :) *] [=-------------------------------------------------------------------------=] title: Paranoia and Brit Hackers Fuel Infowar Craze in Spy Agencies author: unknown source: Crypt Newsletter 38 Electronic doom will soon be visited on U.S. computer networks by information warriors, hackers, pannational groups of computer-wielding religious extremists, possible agents of Libya and Iran, international thugs and money-mad Internet savvy thieves. John Deutch, director of Central Intelligence, testified to the truth of the matter, so it must be graven in stone. In a long statement composed in the august tone of the Cold Warrior, Deutch said to the Senate Permanent Subcommittee on Investigations on June 25, "My greatest concern is that hackers, terrorist organizations, or other nations might use information warfare techniques" to disrupt the national infrastructure. "Virtually any 'bad actor' can acquire the hardware and software needed to attack some of our critical information-based infrastructures. Hacker tools are readily available on the Internet, and hackers themselves are a source of expertise for any nation or foreign terrorist organization that is interested in developing an information warfare capability. In fact, hackers, with or without their full knowledge, may be supplying advice and expertise to rogue states such as Iran and Libya." In one sentence, the head of the CIA cast hackers -- from those more expert than Kevin Mitnick to AOLHell-wielding idiots calling an America On-Line overseas account -- as pawns of perennial international bogeymen, Libya and Iran. Scrutiny of the evidence that led to this conclusion was not possible since it was classified, according to Deutch. " . . . we have [classified] evidence that a number of countries around the world are developing the doctrine, strategies, and tools to conduct information attacks," said Deutch. Catching glimpses of shadowy enemies at every turn, Deutch characterized them as operating from the deep cover of classified programs in pariah states. Truck bombs aimed at the telephone company, electronic assaults by "paid hackers" are likely to be part of the arsenal of anyone from the Lebanese Hezbollah to "nameless . . . cells of international terrorists such as those who attacked the World Trade Center." Quite interestingly, a Minority Staff Report entitled "Security and Cyberspace" and presented to the subcommittee around the same time as Deutch's statement, presented a different picture. In its attempt to raise the alarm over hacker assaults on the U.S., it inadvertently portrayed the intelligence community responsible for appraising the threat as hidebound stumblebums, Cold Warriors resistant to change and ignorant or indifferent to the technology of computer networks and their misuse. Written by Congressional staff investigators Dan Gelber and Jim Christy, the report quotes an unnamed member of the intelligence community likening threat assessment in the area to "a toddler soccer game, where everyone just runs around trying to kick the ball somewhere." Further, assessment of the threat posed by information warriors was "not presently a priority of our nation's intelligence and enforcement communities." The report becomes more comical with briefings from intelligence agencies said to be claiming that the threat of hackers and information warfare is "substantial" but completely unable to provide a concrete assessment of the threat because few or no personnel were working on the subject under investigation. "One agency assembled [ten] individuals for the Staff briefing, but ultimately admitted that only one person was actually working 'full time' on intelligence collection and threat analysis," write Gelber and Christy. The CIA is one example. "Central Intelligence Agency . . . staffs an 'Information Warfare Center'; however, at the time of [the] briefing, barely a handful of persons were dedicated to collection and on [sic] defensive information warfare," comment the authors. " . . . at no time was any agency able to present a national threat assessment of the risk posed to our information infrastructure," they continue. Briefings on the subject, if any and at any level of classification, "consisted of extremely limited anecdotal information." Oh no, John, say it ain't so! The minority report continues to paint a picture of intelligence agencies that have glommed onto the magic words "information warfare" and "hackers" as mystical totems, grafting the subjects onto "pre-existing" offices or new "working groups." However, the operations are based only on labels. "Very little prioritization" has been done, there are few analysts working on the subjects in question. Another "very senior intelligence officer for science and technology" is quoted claiming "it will probably take the intelligence community years to break the traditional paradigms, and re-focus resources" in the area. Restated, intelligence director Deutch pronounced in June there was classified evidence that hackers are in league with Libya and Iran and that countries around the world are plotting plots to attack the U.S. through information warfare. But the classified data is and was, at best, anecdotal gossip -- hearsay, bullshit -- assembled by perhaps a handful of individuals working haphazardly inside the labyrinth of the intelligence community. There is no real threat assessment to back up the Deutch claims. Can anyone say _bomber gap_? The lack of solid evidence for any of the claims made by the intelligence community has created an unusual stage on which two British hackers, Datastream Cowboy and Kuji, were made the dog and pony in a ridiculous show to demonstrate the threat of information warfare to members of Congress. Because of a break-in at an Air Force facility in Rome, NY, in 1994, booth hackers were made the stars of two Government Accounting Office reports on network intrusions in the Department of Defense earlier this year. The comings and goings of Datastream Cowboy also constitute the meat of Gelber and Christy's minority staff report from the Subcommittee on Investigations. Before delving into it in detail, it's interesting to read what a British newspaper published about Datastream Cowboy, a sixteen year-old, about a year before he was made the poster boy for information warfare and international hacking conspiracies in front of Congress. In a brief article, blessedly so in contrast to the reams of propaganda published on the incident for Congress, the July 5 1995 edition of The Independent wrote, "[Datastream Cowboy] appeared before Bow Street magistrates yesterday charged with unlawfully gaining access to a series of American defense computers. Richard Pryce, who was 16 at the time of the alleged offences, is accused of accessing key US Air Force systems and a network owned by Lockheed, the missile and aircraft manufacturers." Pryce, a resident of a northwest suburb of London did not enter a plea on any of 12 charges levied against him under the British Computer Misuse Act. He was arrested on May 12, 1994, by New Scotland Yard as a result of work by the U.S. Air Force Office of Special Investigations. The Times of London reported when police came for Pryce, they found him at his PC on the third floor of his family's house. Knowing he was about to be arrested, he "curled up on the floor and cried." In Gelber and Christy's staff report, the tracking of Pryce, and to a lesser extent a collaborator called Kuji -- real name Mathew Bevan, is retold as an eight page appendix entitled "The Case Study: Rome Laboratory, Griffiss Air Force Base, NY Intrusion." Pryce's entry into Air Force computers was noticed on March 28, 1994, when personnel discovered a sniffer program he had installed on one of the Air Force systems in Rome. The Defense Information System Agency (DISA) was notified. DISA subsequently called the Air Force Office of Special Investigations (AFOSI) at the Air Force Information Warfare Center in San Antonio, Texas. AFOSI then sent a team to Rome to appraise the break-in, secure the system and trace those responsible. During the process, the AFOSI team discovered Datastream Cowboy had entered the Rome Air Force computers for the first time on March 25, according to the report. Passwords had been compromised, electronic mail read and deleted and unclassified "battlefield simulation" data copied off the facility. The Rome network was also used as a staging area for penetration of other systems on the Internet. AFOSI investigators initially traced the break-in back one step to the New York City provider, Mindvox. According to the Congressional report, this put the NYC provider under suspicion because "newspaper articles" said Mindvox's computer security was furnished by two "former Legion of Doom members." "The Legion of Doom is a loose-knit computer hacker group which had several members convicted for intrusions into corporate telephone switches in 1990 and 1991," wrote Gelber and Christy. AFOSI then got permission to begin monitoring -- the equivalent of wiretapping -- all communications on the Air Force network. Limited observation of other Internet providers being used during the break-in was conducted from the Rome facilities. Monitoring told the investigators the handles of hackers involved in the Rome break-in were Datastream Cowboy and Kuji. Since the monitoring was of limited value in determining the whereabouts of Datastream Cowboy and Kuji, AFOSI resorted to "their human intelligence network of informants, i.e., stool pigeons, that 'surf the Internet.' Gossip from one AFOSI 'Net stoolie uncovered that Datastream Cowboy was from Britain. The anonymous source said he had e-mail correspondence with Datastream Cowboy in which the hacker said he was a 16-year old living in England who enjoyed penetrating ".MIL" systems. Datastream Cowboy also apparently ran a bulletin board system and gave the telephone number to the AFOSI source. The Air Force team contacted New Scotland Yard and the British law enforcement agency identified the residence, the home of Richard Pryce, which corresponded to Datastream Cowboy's system phone number. English authorities began observing Pryce's phone calls and noticed he was making fraudulent use of British Telecom. In addition, whenever intrusions at the Air Force network in Rome occurred, Pryce's number was seen to be making illegal calls out of Britain. Pryce travelled everywhere on the Internet, going through South America, multiple countries in Europe and Mexico, occasionally entering the Rome network. From Air Force computers, he would enter systems at Jet Propulsion Laboratory in Pasadena, California, and the Goddard Space Flight Center in Greenbelt, Maryland. Since Pryce was capturing the logins and passwords of the Air Force networks in Rome, he was then able to get into the home systems of Rome network users, defense contractors like Lockheed. By mid-April of 1994 the Air Force was monitoring other systems being used by the British hackers. On the 14th of the month, Kuji logged on to the Goddard Space Center from a system in Latvia and copied data from it to the Baltic country. According to Gelber's report, the AFOSI investigators assumed the worst, that it was a sign that someone in an eastern European country was making a grab for sensitive information. They broke the connection but not before Kuji had copied files off the Goddard system. As it turned out, the Latvian computer was just another system the British hackers were using as a stepping stone; Pryce had also used it to cover his tracks when penetrating networks at Wright-Patterson Air Force Base in Ohio, via an intermediate system in Seattle, cyberspace.com. The next day, Kuji was again observed trying to probe various systems at NATO in Brussels and The Hague as well as Wright-Patterson. On the 19th, Pryce successfully returned to NATO systems in The Hague through Mindvox. The point Gelber and Christy seem to be trying to make is that Kuji, a 21-year old, was coaching Pryce during some of his attacks on various systems. By this point, New Scotland Yard had a search warrant for Pryce with the plan being to swoop down on him the next time he accessed the Air Force network in Rome. In April, Pryce penetrated a system on the Korean peninsula and copied material off a facility called the Korean Atomic Research Institute to an Air Force computer in Rome. At the time, the investigators had no idea whether the system was in North or South Korea. The impression created is one of hysteria and confusion at Rome. There was fear that the system, if in North Korea, would trigger an international incident, with the hack interpreted as an "aggressive act of war." The system turned out to be in South Korea. During the Korean break-in, New Scotland Yard could have intervened and arrested Pryce. However, for unknown reasons, the agency did not. Those with good memories may recall mainstream news reports concerning Pryce's hack, which was cast as an entry into sensitive North Korean networks. It's worth noting that while the story was portrayed as the work of an anonymous hacker, both the U.S. government and New Scotland Yard knew who the perpetrator was. Further, according to Gelber's report English authorities already had a search warrant for Pryce's house. Finally, on May 12 British authorities pounced. Pryce was arrested and his residence searched. He crumbled, according to the Times of London, and began to cry. Gelber and Christy write that Pryce promptly admitted to the Air Force break-ins as well as others. Pryce confessed he had copied a large program that used artificial intelligence to construct theoretical Air Orders of Battle from an Air Force computer to Mindvox and left it there because of its great size, 3-4 megabytes. Pryce paid for his Internet service with a fraudulent credit card number. At the time, the investigators were unable to find out the name and whereabouts of Kuji. A lead to an Australian underground bulletin board system failed to pan out. On June 23 of this year, Reuters reported that Kuji -- 21-year-old Mathew Bevan -- a computer technician, had been arrested and charged in connection with the 1994 Air Force break-ins in Rome. Rocker Tom Petty sang that even the losers get lucky some time. He wasn't thinking of British computer hackers but no better words could be used to describe the two Englishmen and a two year old chain of events that led to fame as international computer terrorists in front of Congress at the beginning of the summer of 1996. Lacking much evidence for the case of conspiratorial computer-waged campaigns of terror and chaos against the U.S., the makers of Congressional reports resorted to telling the same story over and over, three times in the space of the hearings on the subject. One envisions U.S. Congressmen too stupid or apathetic to complain, "Hey, didn't we get that yesterday, and the day before?" Pryce and Bevan appeared in "Security in Cyberspace" and twice in Government Accounting Office reports AIMD-96-84 and T-AIMD96-92. Jim Christy, the co-author of "Security in Cyberspace" and the Air Force Office of Special Investigations' source for the Pryce case supplied the same tale for Jack Brock, author of the GAO reports. Brock writes, ". . . Air Force officials told us that at least one of the hackers may have been working for a foreign country interested in obtaining military research data or areas in which the Air Force was conducting advanced research." It was, apparently, more wishful thinking. Notes: The FAS Web site also features an easy to use search engine which can be used to pull up the Congressional testimony on hackers and network intrusion. These example key words are effective: "Jim Christy," "Datastream Cowboy". [=-------------------------------------------------------------------------=] title: Hackers Find Cheap Scotland Yard Phone Connection source: Reuters/Variety Monday August 5 12:01 AM EDT LONDON (Reuter) - Computer hackers broke into a security system at Scotland Yard, London's metropolitan police headquarters, to make international calls at police expense, police said Sunday. A police spokesman would not confirm a report in the Times newspaper that the calls totaled one million pounds ($1.5 million). He said the main computer network remained secure. "There is no question of any police information being accessed," the spokesman said. "This was an incident which was investigated by our fraud squad and by AT&T investigators in the U.S." AT&T Corp investigators were involved because most of the calls were to the United States, the Times said. According to The Times, the hackers made use of a system called PBX call forwarding that lets employees to make business calls from home at their employer's expense. [=-------------------------------------------------------------------------=] title: U.S. Official Warns OF "Electronic Pearl Harbor" source: BNA Daily Report - 17 Jul 96 Deputy U.S. Attorney General Jamie Gorelick told a Senate subcommittee last week that the possibility of "an electronic Pearl Harbor" is a very real danger for the U.S. She noted in her testimony that the U.S. information infrastructure is a hybrid public/private network, and warned that electronic attacks "can disable or disrupt the provision of services just as readily as -- if not more than -- a well-placed bomb." On July 15 the Clinton Administration called for a President's Commission on Critical Infrastructure Protection, with the mandate to identify the nature of threats to U.S. infrastructure, both electronic and physical, and to work with the private sector in devising a strategy for protecting this infrastructure. At an earlier hearing, subcommittee members were told that about 250,000 intrusions into Defense Department computer systems are attempted each year, with about a 65% success rate. [=-------------------------------------------------------------------------=] title: Suit Challenges State's Restraint of the Internet Via AP author: Jared Sandberg source: The Wall Street Journal Can the state of Georgia hold sway over the global Internet? A federal lawsuit filed against the state Tuesday by the American Civil Liberties Union should eventually answer that question. The suit, filed in federal district court in Georgia, challenges a new Georgia law that makes it illegal in some instances to communicate anonymously on the Internet and to use trademarks and logos without permission. The ACLU, joined by 13 plaintiffs including an array of public- interest groups, contends that the Georgia law is "unconstitutionally vague" and that its restraints on using corporate logos and trade names are "impermissibly chilling constitutionally protected expression." The plaintiffs also argue that the Georgia law, which imposes a penalty of up to 12 months in jail and $1,000 in fines, illegally tries to impose state restrictions on interstate commerce, a right reserved for Congress. The legal challenge is one of the first major assaults on state laws that seek to rein in the Internet, despite its global reach and audience. Since the beginning of 1995, 11 state legislatures have passed Internet statutes and nine others have considered taking action. Connecticut passed a law last year that makes it a crime to send an electronic-mail message "with intent to harass, annoy or alarm another person" -- despite the Internet's hallowed tradition of "flaming" users with messages designed to do just that. Virginia enacted a bill this year making it illegal for a state employee -- including professors who supposedly have academic freedom on state campuses -- to use state-owned computers to get access to sexually explicit material. New York state has tried to resurrect prohibitions on "indecent material" that were struck down as unconstitutional by a federal appeals panel ruling on the federal Communications Decency Act three months ago. Most Internet laws target child pornographers and stalkers. Opponents argue the well-intended efforts could nonetheless chill free speech and the development of electronic commerce. They maintain that the Internet, which reaches into more than 150 countries, shouldn't be governed by state laws that could result in hundreds of different, and often conflicting, regulations. "We've got to nip this in the bud and have a court declare that states can't regulate the Internet because it would damage interstate commerce," says Ann Beeson, staff attorney for the ACLU. "Even though it's a Georgia statute, it unconstitutionally restricts the ability of anybody on the Internet to use a pseudonym or to link to a Web page that contains a trade name or logo. It is unconstitutional on its face." Esther Dyson, president of high-tech publisher EDventure Holdings Inc. and chairwoman of the Electronic Frontier Foundation, a high-tech civil liberties organization that is a co-plaintiff in the lawsuit, calls the Georgia law "brain-damaged and unenforceable" and adds: "How are they going to stop people from using fake names? Anonymity shouldn't be a crime. Committing crimes should be a crime." But Don Parsons, the Republican state representative who sponsored the Georgia bill, countered that the law is a necessary weapon to combat fraud, forgery and other on-line misdeeds. The groups that oppose it, he says, "want to present (the Internet) as something magical, as something above and beyond political boundaries." It is none of these things, he adds. Nor does the Georgia law seek to ban all anonymity, Mr. Parsons says; instead, it targets people who "fraudulently misrepresent their (Web) site as that of another organization." Misrepresenting on-line medical information, for example, could cause serious harm to an unsuspecting user, he says. But Mr. Parsons's critics, including a rival state lawmaker, Rep. Mitchell Kaye, say political reprisal lies behind the new law. They say Mr. Parsons and his political allies were upset by the Web site run by Mr. Kaye, which displayed the state seal on its opening page and provided voting records and sometimes harsh political commentary. Mr. Kaye asserts that his Web site prompted the new law's attack on logos and trademarks that are used without explicit permission. "We've chosen to regulate free speech in the same manner that communist China, North Korea, Cuba and Singapore have," Mr. Kaye says. "Legislators' lack of understanding has turned to fear. It has given Georgia a black eye and sent a message to the world -- that we don't understand and are inhospitable to technology." Mr. Parsons denies that the political Web site was the primary reason for his sponsorship of the new statute. The very local dispute underscores the difficulty of trying to legislate behavior on the Internet. "It creates chaos because I don't know what rules are going to apply to me," says Lewis Clayton, a partner at New York law firm Paul, Weiss, Rifkind, Wharton & Garrison. "Whose laws are going to govern commercial transactions? You don't want to have every different state with the ability to regulate what is national or international commerce." In the case of the Georgia statute, while its backers say it isn't a blanket ban of anonymity, opponents fear differing interpretations of the law could lead to the prosecution of AIDS patients and childabuse survivors who use anonymity to ensure privacy when they convene on the Internet. "Being able to access these resources anonymously really is crucial," says Jeffery Graham, executive director of the AIDS Survival Project, an Atlanta service that joined the ACLU in the lawsuit. His group's members "live in small communities," he says, and if their identities were known, "they would definitely suffer from stigmas and reprisals." [=-------------------------------------------------------------------------=] title: U.S. Government Plans Computer Emergency Response Team source: Chronicle of Higher Education - 5 Jul 96 The federal government is planning a centralized emergency response team to respond to attacks on the U.S. information infrastructure. The Computer Emergency Response Team at Carnegie Mellon University, which is financed through the Defense Department, will play a major role in developing the new interagency group, which will handle security concerns related to the Internet, the telephone system, electronic banking systems, and the computerized systems that operate the country's oil pipelines and electrical power grids. [=-------------------------------------------------------------------------=] title: Hackers $50K challenge to break Net security system source: Online Business Today World Star Holdings in Winnipeg, Canada is looking for trouble. If they find it, they're willing to pay $50,000 to the first person who can break their security system. The company has issued an open invitation to take the "World Star Cybertest '96: The Ultimate Internet Security Challenge," in order to demonstrate the Company's Internet security system. Personal email challenges have been sent to high profile names such as Bill Gates, Ken Rowe at the National Center for Super Computing, Dr. Paul Penfield, Department of Computer Science at the M.I.T. School of Engineering and researchers Drew Dean and Dean Wallach of Princeton University. [* Challenging Bill Gates to hack a security system is like challenging Voyager to a knitting contest. *] OBT's paid subscription newsletter Online Business Consultant has recently quoted the Princeton team in several Java security reports including "Deadly Black Widow On The Web: Her Name is JAVA," "Java Black Widows---Sun Declares War," Be Afraid. Be Very Afraid" and "The Business Assassin." To read these reports go to Home Page Press http://www.hpp.com and scroll down the front page. Brian Greenberg, President of World Star said, "I personally signed, sealed and emailed the invitations and am very anxious to see some of the individuals respond to the challenge. I am confident that our system is, at this time, the most secure in cyberspace." World Star Holdings, Ltd., is a provider of interactive "transactable" Internet services and Internet security technology which Greenberg claims has been proven impenetrable. The Company launched its online contest offering more than $50,000 in cash and prizes to the first person able to break its security system. According to the test's scenario hackers are enticed into a virtual bank interior in search of a vault. The challenge is to unlock it and find a list of prizes with inventory numbers and a hidden "cyberkey" number. OBT staff used Home Page Press's Go.Fetch (beta) personal agent software to retrieve the World Star site and was returned only five pages. If you're successful, call World Star at 204-943-2256. Get to it hackers. Bust into World Star at http://205.200.247.10 to get the cash! [=-------------------------------------------------------------------------=] title: Criminal cult begins PGP crack attempt from: grady@netcom.com (Grady Ward) The Special Master has informed me that Madame Kobrin has asked her to retain a PC expert to attempt to "crack" a series of pgp-encrypted multi-megabyte files that were seized along with more than a compressed gigabyte of other material from my safety deposit box. Ironically, they phoned to ask for assistance in supplying them with a prototype "crack" program that they could use in iterating and permuting possibilities. I did supply them a good core pgpcrack source that can search several tens of thousands of possible key phrases a seconds; I also suggested that they should at least be using a P6-200 workstation or better to make the search more efficient. The undercurrent is that this fresh hysterical attempt to "get" something on me coupled with the daily settlement pleas reflects the hopelessness of the litigation position of the criminal cult. It looks like the criminal cult has cast the die to ensure that the RTC vs Ward case is fought out to the bitter end. Which I modestly predict will be a devastating, humiliating defeat for them from a pauper pro per. I have given them a final settlement offer that they can leave or take. Actually they have a window of opportunity now to drop the suit since my counterclaims have been dismissed (although Judge Whyte invited me to re-file a new counterclaim motion on more legally sufficiant basis). I think Keith and I have found a successful counter-strategy to the cult's system of litigation harassment. Meanwhile, I could use some help from veteran a.r.s'ers. I need any copy you have of the Cease and Desist letter that you may have received last year from Eliot Abelson quondam criminal cult attorney and Eugene Martin Ingram spokespiece. Physical mail: Grady Ward 3449 Martha Ct. Arcata, CA 95521-4884 JP's BMPs or fax-images to: grady@northcoast.com Thanks. Grady Ward Ps. I really do need all of your help and good wishes after all. Thanks for all of you keeping the net a safe place to insult kook kults. [=-------------------------------------------------------------------------=] title: Hackers Bombard Internet author: Dinah Zeiger source: Denver Post 9/21/96 Computer hackers have figured out a new way to tie the Internet in knots - flooding network computers with messages so other users can't access them. Late Thursday, the federally funded Computer Emergency Response Team at Carnegie-Mellon University in Pittsburgh issued an advisory to Internet service providers, universities and governments detailing the nature of the attacks, which have spread to about 15 Internet services over the past six weeks. Three were reported this week. Thus far, none of the Colorado-based Internet providers contacted has been victimized, but all are on alert and preparing defenses. The worst of it is that there is no rock-solid defense, because the attacks are launched using the same rules - or protocols- that allow Internet computers to establish a connection. The best the Computer Emergency Response Team can do so far is to suggest modifications that can reduce the likelihood that a site will be targeted. In essence, hackers bombard their victim sites with hundreds of messages from randomly generated, fictitious addresses. The targeted computers overload when they try to establish a connection with the false sites. It doesn't damage the network, it just paralyzes it. The Computer Emergency Response Team traces the attacks to two underground magazines, 2600 and Phrack, which recently published the code required to mount the assaults. [* Uh, wait.. above it said messages.. which sounds more like usenet, not SYN Floods.. *] "It's just mischief," said Ted Pinkowitz, president of Denver based e-central. "They're just doing it to prove that it can be done." One local Internet service provider, who declined to be identified because he fears being targeted, said it goes beyond pranks. "It's malicious," he said. "They're attacking the protocols that are the most basic glue of the Internet and it will take some subtle work to fix it. You can't just redesign the thing, because it's basic to the operation of the entire network." The response team says tracking the source of an attack is difficult, but not impossible. "We have received reports of attack origins being identified," the advisory says. [=-------------------------------------------------------------------------=] title: Crypto Mission Creep author: Brock N. Meeks The Justice Department has, for the first time, publicly acknowledged using the code-breaking technologies of the National Security Agency, to help with domestic cases, a situation that strains legal boundaries of the agency. Deputy Attorney General Jamie Gorelick admitted in July, during an open hearing of the Senate's Governmental Affairs permanent subcommittee on investigations, that the Justice Department: "Where, for example, we are having trouble decrypting information in a computer, and the expertise lies at the NSA, we have asked for technical assistance under our control." That revelation should have been a bombshell. But like an Olympic diver, the revelation made hardly a ripple. By law the NSA is allowed to spy on foreign communications without warrant or congressional oversight. Indeed, it is one of the most secretive agencies of the U.S. government, whose existence wasn't even publicly acknowledged until the mid-1960s. However, it is forbidden to get involved in domestic affairs. During the hearing Sen. Sam Nunn (D-Ga.) asked Gorelick if the President had the "the constitutional authority to override statutes where the basic security of the country is at stake?" He then laid out a scenario: "Let's say a whole part of the country is, in effect, freezing to death in the middle of the winter [because a power grid has been destroyed] and you believe it's domestic source, but you can't trace it, because the FBI doesn't have the capability. What do you do?" Gorelick replied that: "Well, one thing you could do -- let me say this, one thing you could do is you could detail resources from the intelligence community to the law enforcement community. That is, if it's under -- if it's -- if you're talking about a technological capability, we have done that." And then she mentioned that the NSA had been called on to help crack some encrypted data. But no one caught the significance of Gorelick's' statements. Instead, the press focused on another proposal she outlined, the creation of what amounts to a "Manhattan Project" to help thwart the threat of information warfare. "What we need, then, is the equivalent of the 'Manhattan Project' for infrastructure protection, a cooperative venture between the government and private sector to put our best minds together to come up with workable solutions to one of our most difficult challenges,'' Gorelick told Congress. Just a day earlier, President Clinton had signed an executive order creating a blue-ribbon panel, made up of several agencies, including the Justice Department, the CIA, the Pentagon and the NSA and representatives of the private sector. Though the press missed the news that day; the intelligence agency shivered. When I began investigating Gorelick's statement, all I got were muffled grumbling. I called an NSA official at home for comments. "Oh shit," he said, and then silence. "Can you elaborate a bit on that statement?" I asked, trying to stifle a chuckle. "I think my comment says it all," he said and abruptly hung up the phone. Plumbing several sources within the FBI drew little more insight. One source did acknowledge that the Bureau had used the NSA to crack some encrypted data "in a handful of instances," but he declined to elaborate. Was the Justice Department acting illegally by pulling the NSA into domestic work? Gorelick was asked by Sen. Nunn if the FBI had the legal authority to call on the NSA to do code-breaking work. "We have authority right now to ask for assistance where we think that there might be a threat to the national security," she replied. But her answer was "soft." She continued: "If we know for certain that there is a -- that this is a non-national security criminal threat, the authority is much more questionable." Questionable, yes, but averted? No. If Gorelick's answers seem coy, maybe it's because her public statements are at odds with one another. A month or so before her congressional bombshell, she revealed the plans for the information age"Manhattan Project" in a speech. In a story for Upside magazine, by old-line investigative reporter Lew Koch, where he broke the story, Gorelick whines in her speech about law enforcement going through "all that effort" to obtain warrants to search for evidence only to find a child pornography had computer files "encrypted with DES" that don't have a key held in escrow. "Dead end for us," Gorelick says. "Is this really the type of constraint we want? Unfortunately, this is not an imaginary scenario. The problem is real." All the while, Gorelick knew, as she would later admit to Congress, that the FBI had, in fact, called the NSA to help break codes. An intelligence industry insider said the NSA involvement is legal. "What makes it legal probably is that when [the NSA] does that work they're really subject to all the constraints that law enforcement is subject to." This source went on to explain that if the FBI used any evidence obtained from the NSA's code-breaking work to make it's case in court, the defense attorney could, under oath, ask the NSA to "explain fully" how it managed to crack the codes. "If I were advising NSA today I would say, there is a substantial risk that [a defense attorney] is going to make [the NSA] describe their methods," he said. "Which means it's very difficult for the NSA to do its best stuff in criminal cases because of that risk." Some 20 years ago, Sen. Frank Church, then chairman of the Senate Intelligence Committee, warned of getting the NSA involved in domestic affairs, after investigating the agency for illegal acts. He said the "potential to violate the privacy of Americans is unmatched by any other intelligence agency." If the resources of the NSA were ever used domestically, "no American would have any privacy left . . . There would be no place to hide," he said. "We must see to it that this agency and all agencies that possess this technology operate within the law and under proper supervision, so that we never cross over that abyss. That is an abyss from which there is no return," he said. And yet, the Clinton Administration has already laid the groundwork for such "mission creep" to take place, with the forming of this "Manhattan Project." But if the Justice Department can tap the NSA at will -- a position of questionable legality that hasn't been fully aired in public debate -- why play such hardball on the key escrow encryption issue? Simple answer: Key escrow is an easier route. As my intelligence community source pointed out, bringing the NSA into the mix causes problems when a case goes to court. Better to have them work in the background, unseen and without oversight, the Administration feels. With key escrow in place, there are few legal issues to hurdle. In the meantime, the Justice Department has started the NSA down the road to crypto mission creep. It could be a road of no return. Meeks out... [=-------------------------------------------------------------------------=] title: Hacker posts nudes on court's Web pages author: Rob Chepak source: The Tampa Tribune TALLAHASSEE - The Internet home of the Florida Supreme Court isn't the kind of place you'd expect to find nudity. But that's what happened Wednesday morning when a judge in Tallahassee found a pornographic photo while he was looking for the latest legal news. A computer hacker broke into the high court's cyberhome, placing at least three pornographic photos and a stream of obscenities on its Web pages. ``All I looked at was the one picture, then I checked with the court,'' said a surprised Charles Kahn Jr., a 1st District Court of Appeal judge. The altered pages were immediately turned off. The Florida Department of Law Enforcement is investigating the incident and the U.S. Justice Department has been contacted. The hacker didn't tamper with any official records, court officials said. ``We've got three photos and we're looking for more,'' said Craig Waters, executive assistant to Chief Justice Gerald Kogan. The culprit ``could be anyone from someone in the building to the other side of the world.'' [* I bet they are looking for more.. *] The Florida Court's Web site is used to post information about court opinions, state law and legal aid. Thousands of people, including children, use the court system's more than 500 Internet pages each month, Waters said. The court and other state agencies usually keep their most vital information on separate computers that can't be accessed on the Internet. Officials aren't sure how the culprit broke in, and FDLE had no suspects Thursday afternoon. But court officials long have suspected their Web site could be a target for hackers armed with the computer equipment to impose photos on the Web. The Florida Supreme Court became the first state Supreme Court in the nation to create its own Internet pages two years ago. While the episode sounds like a well-crafted high school prank, computer hackers are becoming a big problem for government agencies, which increasingly are finding themselves the victims of criminal tampering on the Internet. In August, someone placed swastikas and topless pictures of a TV star on the U.S. Department of Justice's home page. The Central Intelligence Agency has been victimized, too. ``It's certainly a common problem,'' said P.J. Ponder, a lawyer for the Information Resource Commission, which coordinates the state government's computer networks. However, there are no statistics on incidences of tampering with state computers. The best way for anyone to minimize damage by computer hackers is by leaving vital information off the Internet, said Douglas Smith, a consultant for the resource commission. Most state agencies follow that advice, he added. ``I think you have to weigh the value of security vs. the value of the information you keep there,'' he said. Court officials would not reveal details of the sexually explicit photos Thursday, but Liz Hirst, an FDLE spokeswoman, said none were of children. Penalties for computer tampering include a $5,000 fine and five years in jail, but the punishment is much higher if it involves child pornography, she said. Without a clear motive or obvious physical evidence, FDLE investigators, who also investigate child pornography on the Internet, hope to retrace the culprit's steps in cyberspace. However, Ponder said cases of Internet tampering are ``very difficult to solve.'' Thursday, the state's top legal minds, who are used to handing out justice, seemed unaccustomed to being cast as victims. ``No damage was done,'' Kogan said in a statement. ``But this episode did send a message that there was a flaw in our security that we now are fixing.'' [* I tell you (and other agencies) I do security consulting!! Please?! *] [=-------------------------------------------------------------------------=] title: Hacking Into Piracy source: The Telegraph 22nd October 1996 Computer crime investigators are using the techniques of their adversaries to crack down on illegally traded software. Michael McCormack reports. The adage "Set a thief to catch a thief" is being updated for the electronic age as online investigators use hackers' techniques to fight a thriving trade in counterfeit and pirate software that is reckoned to cost British program-makers more than £3 billion a year. "Jason", a computer crime investigator employed by Novell to shut down bulletin boards that trade pirate copies of its software, leads a confusing double life. First he spends weeks in his office, surfing the Internet and wheedling secrets from hackers around Europe; then he compiles dossiers of evidence on the system operators who deal in Novell wares, flies to their bases, presents the local police with his reports, and accompanies them on the inevitable raid. "Every day I'm on IRC [the Internet's chat lines, where information can be exchanged quickly and relatively anonymously] looking for tips on new bulletin boards that might have Novell products on them," he says. "Our policy has been to go country by country through Europe and try to take down the biggest boards in each one" "It tends to be the biggest boards that have our products, and those can be difficult to get on to. The operators have invested a lot of time and cash in setting them up and they're sometimes quite careful who they'll let on. I often start by joining dozens of little boards in the area to get myself a good reputation, which I can use as a reference to get on to the big board. "Our policy has been to go country by country through Europe and try to take down the biggest boards in each one. That has a chilling effect on the other operators. They think, 'If he could get caught, I'm doomed.' Within days of us taking down a big board, Novell products disappear off the smaller ones." Once Jason gains entry to a big board, the game begins in earnest: "Bulletin boards work on the principle that if you want to take something off, you first have to put something in. Obviously I can't put in Novell's products, or any other company's; instead, we use a program we wrote ourselves. It's huge, and it has an impressive front end full of colour screen indicators and menus. It doesn't actually do anything but it looks impressive and it lets you start pulling things off the site." Once Jason finds company products on a board, he makes a video of himself logging on and retrieving a copy of the software. [* Talk about freako bizarre narc fetishes.. *] Bulletin boards often have restricted areas closed to all but a few trusted members, and these are where the most illegal products - such as expensive business or word-processing packages copied from beta releases or pirate disks - are kept. Penetrating these areas takes a skill learned from the hackers. "It's called social engineering," says Jason. "It just means chatting up the operator until he decides to trust you with the goodies." Once Jason finds company products on a board, he makes a video of himself logging on and retrieving a copy of the software. Then it's on to a plane to go and lodge a complaint with the local police. He is helped by Simon Swale, a fellow Novell investigator and former Metropolitan Police detective who uses his experience of international police procedures and culture to ensure that foreign forces get all the technical help they need. In the past six months, Jason's investigations have shut down seven bulletin boards across Europe, recovering software valued at more than £500,000. The company reckons the closed boards would have cost it more than £2.5 million in lost sales over the next year. Jason has vivid memories of the early-morning raid on the operator's house. One of the Jason's biggest successes came earlier this year in Antwerp, when he guided Belgian police to the Genesis bulletin board, which held more than £45,000 worth of Novell products and a slew of other pirate software. Jason has vivid memories of the early-morning raid on the operator's house: "The first thing he said was, 'I have nothing illegal on my system.' So I set up my laptop and mobile and dialled into it from his kitchen. All the police watched as I tapped into my keyboard and everything popped up on his screen across the room. I went straight in to the Novell stuff and he said, 'Okay, maybe I have a little'." The system operator, Jean-Louis Piret, reached a six-figure out-of-court settlement with Novell. More importantly for the company, its products have all but disappeared from Belgium's boards in the wake of the raid. There are, however, many more fish to fry. Jason already has another three raids lined up for autumn . . . [=-------------------------------------------------------------------------=] title: Revealing Intel's Secrets The Intel's Secrets site may not be around for long if Intel has anything to say about it. The site provides a look at details, flaws, and programming tips that the giant chip manufacturer would rather not share with the general public. One particular page exposes some unflattering clitches of the P6 chip and a bug in the Intel486 chip. The site even has two separate hit counters: one for the average visitor, and one that counts the number of times Intel has stopped by. [=-------------------------------------------------------------------------=] title: Internet Boom Puts Home PCs At Risk Of Hackers author: Nick Nuttall source: The London Times 18th October 1996 Home computers, which carry everything from private banking details to love letters, are becoming vulnerable to hackers as more households connect to the Internet. The boom in electronic services is making the home PC as open to attack as company and government systems, a survey of hackers has disclosed. The Internet is also helping hackers to become more skilful as they exchange tips and computer programs around the globe. [* Survey of hackers?! Bullshit. *] A spokesman for Kinross and Render, which carried out the survey for Computacenter, said: "Breaking into home computers is now increasingly possible and of great interest to hackers. It may be a famous person's computer, like Tony Blair's or a sports personality. Equally it could be yours or my computer carrying personal details which they could use for blackmailing." Passwords remain easy to break despite warnings about intrusion. Companies and individuals frequently use simple name passwords such as Hill for Damon Hill or Blair for the Labour leader. Hackers also said that many users had failed to replace the manufacturer's password with their own. Hackers often use programs, downloaded from the Internet, which will automatically generate thousands of likely passwords. These are called Crackers and have names such as Satan or Death. [* Satan? Death? Ahhhh! *] John Perkins, of the National Computing Centre in Manchester, said yesterday: "The linking of company and now home computers to the global networks is making an expanding market for the hackers." The Computacenter survey was based on interviews with more than 130 hackers, supplemented by interviews over the Internet. The average hacker is 23, male and a university student. At least one of those questioned began hacking ten years ago, when he was eight. [* No offense to anyone out there, but how in the hell could they validate any claims in a survey like that? And especially with that amount? *] Most said it was getting easier, rather than harder, to break in and many hackers would relish tighter computer security because this would increase the challenge. Existing laws are held in contempt and almost 80 per cent said tougher laws and more prosecutions would not be a deterrent. Eighty-five per cent of those questioned had never been caught. Most said the attraction of hacking lay in the challenge, but a hard core were keen to sabotage computer files and cause chaos, while others hoped to commit fraud. [* Excuse me while I vomit. *] [=-------------------------------------------------------------------------=] title: Computer hacker Mitnick pleads innocent September 30, 1996 LOS ANGELES (AP) -- The notorious computer hacker Kevin Mitnick pleaded innocent Monday to charges he mounted a multimillion-dollar crime wave in cyberspace during 2 1/2 years as a fugitive. Mitnick, 33, held without bail on a fraud conviction, told the judge not to bother reading the indictment, which includes 25 new counts of computer and wire fraud, possessing unlawful access devices, damaging computers and intercepting electronic messages. "Not guilty," Mitnick said. His indictment, handed up Friday by a federal grand jury, follows an investigation by a national task force of FBI, NASA and federal prosecutors with high-tech expertise. It charges Mitnick with using stolen computer passwords, damaging University of Southern California computers and stealing software valued at millions of dollars from technology companies, including Novell, Motorola, Nokia, Fujitsu and NEC. ........... Mitnick pleaded guilty in April to a North Carolina fraud charge of using 15 stolen phone numbers to dial into computer databases. Prosecutors then dropped 22 other fraud charges but warned that new charges could follow. Mitnick also admitted violating probation for a 1988 conviction in Los Angeles where he served a year in jail for breaking into computers at Digital Equipment Corp. At 16, he served six months in a youth center for stealing computer manuals from a Pacific Bell switching center. Mitnick also got a new lawyer Monday, Donald C. Randolph, who represented Charles Keating Jr.'s top aide, Judy J. Wischer, in the Lincoln Savings swindle. [=-------------------------------------------------------------------------=] title: Hackers Destroy Evidence of Gulf War Chemical/Biological Weapons source: WesNet News Saturday, Nov. 2, 5:00 p.m. WASHINGTON DC -- Hackers broke into a Web site (http://insigniausa.com) containing suppressed evidence of Gulf War chemical and biological weapons Friday, erasing all files. "Someone hacked in Friday around 4 p.m. and completely trashed our machine," said Kenneth Weaver, webmaster of W3 Concepts, Inc. (http://ns.w3concepts.com) of Poolesville, Maryland (a suburb of Washington D.C.), which houses the site. The Web site contained recently-released supressed Department of Defense documents exposing biological and chemical warfare materials that U.S. companies allegedly provided to Iraq before the war. Bruce Klett, publisher, Insignia Publishing said they are now restoring the files. "We plan to be operational again Saturday evening or Sunday," he said. "We encourage anyone to copy these files and distribute them." There are over 300 files, requiring 50 MB of disk space. The Department of Defense has its own version of these files on its Gulflink Web site (http://www.dtic.dla.mil/gulflink/). Insignia plans to publish Gassed In the Gulf, a book on the government's coverup by former CIA analyst Patrick Eddington, in six to eight weeks, Klett added. Hackers also brought down SNETNEWS and IUFO, Internet mailing lists covering conspiracies and UFOs, on Oct. 25, according to list administrator Steve Wingate. He plans to move the lists to another Internet service provider be be back in operation soon. "We've seen this happen regularly when we get too close to sensitive subjects," Wingate said. "The election is Tuesday. This is a factor." He also said a "quiet" helicopter buzzed and illuminated his Marin County house and car Thursday night for several minutes. [=-------------------------------------------------------------------------=] title: Criminals Slip Through The Net source: The Telegraph, London 5th November 1996 Britain is way behind in the fight against computer crime and it's time to take it seriously, reports Michael McCormack BRITAIN'S police forces are lagging behind the rest of the world in combating computer crime, according to one of the country's most experienced computer investigators - who has just returned to walking the beat. Police Constable John Thackray, of the South Yorkshire Police, reached this grim conclusion after a three-month tour of the world's leading computer crime units, sponsored by the Winston Churchill Memorial Trust. All of the five countries he studied, he says, are putting Britain's efforts against electronic crime to shame. "The level of education and understanding of computer crime is far more advanced outside Britain," said Thackray. "Here, police forces are shying away from even attempting to investigate computer crimes. You see experienced detectives who lose all interest in pursuing cases where there are computers involved. "We know that computer crime, particularly software piracy, is closely connected with organised crime - they like the high profits and the low risk - but those connections aren't followed up." He adds:"We are far behind our own criminals on these matters. We only catch them when they get complacent and keep using old technology and old methods. If they simply keep up with current technology, they are so far ahead they are safe." Thackray was one of the officers responsible for closing down one of the largest pirate bulletin boards in the country, estimated to have stolen software worth thousands last year and has assisted officers from other forces in several similar cases. Pirates recently named a new offering of bootleg software "Thackray1 and 2" in his honour. He has seen how seriously such crimes are taken by police forces abroad: "In America there are specialist units in every state and a similar system is being put in place in Australia. There's nothing nearly as comprehensive in in Britain. "We have the Computer Crimes Unit at Scotland Yard and a small forensic team at Greater Manchester, but they're both badly under-resourced and there's little interest in, or support for, investigating computer crimes in other forces. "Our officers must get a better education, to start with, on what computer crime is, how it works and who is being hurt by it. We need to bury the impression that this is a victimless crime with no serious consequences." Thackray is preparing a report on his impressions of anti-crime initiatives in other countries and what must be done in Britain to equal them. "In my view, we need specially detailed officers who are educated in computer crime issues. "We also need to become much more pro-active in our approach. It's not good enough to sit back and wait for the complaints." But perhaps symptomatic of Britain's efforts is the way Thackray's valuable experience is being used. He is putting away his laptop and getting out his boots. "I'm now being moved back into uniform. The two year experience I have gained in investigating these matters is not going to be used to its full potential." "We pride ourselves on being an effective police service in Britain, and other countries look up to us. But when it comes to computer crime, we have to start following their lead." -EOF