💾 Archived View for aphrack.org › issues › phrack50 › 15.gmi captured on 2021-12-03 at 14:04:38. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
.oO Phrack 50 Oo.
Volume Seven, Issue Fifty
15 of 16
PWN PWN PNW PNW PNW PNW PNW PNW PNW PNW PNW PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Compiled by disorder/alhambra PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Intro: As usual there are literally hundreds of interesting articles
that could be put here. I have tried to narrow the focus to
hacker/security related stuff only. Enjoy.
Sources: Access All Areas mail list:
echo "help" | mail majordomo@access.org.uk
CSP (run by Frosty):
Computer Underground Digest:
echo "subscribe cu-digest" | mail cu-digest-request@weber.ucsd.edu
Cyberwire Dispatch:
echo "subscribe" | mail cwd-l-request@cyberwerks.com
Defcon Stuff:
echo "subscribe" | mail majordomo@dis.org
Half a dozen other mail lists, elite people who forward me
neat shit, and various news type web pages.
Phrack World News #50 -- Index
01. Computer Attack Slows Service at New York Times' Web Site
02. [Chinese Hacker Convicted]
03. Phone 'Super Scanner' Alert
04. Computer Hacking Whiz Pleads Guilty To Electronic Break-And-Enter
05. Hackers release two upcoming U2 songs on Internet
06. Computer Crime Prompts New Parole Restrictions
07. [Evil Hacker SYN-Flood's WebCom]
08. German Police Seek 12 After Raids On Computer Gang
09. The tale of the Russian Hacker
10. Expert Warns Of Lax Security On Web
11. [Man pleads guilty to writing AOL hacking soft]
12. Hackers Hack Crack, Steal Quake
13. Hackers Sabotage Blair's Internet Image
14. Police looking into hacking of Government web site
15. Programmer Accused Of Breaking Into California State Contract Data
16. [Australian Phone Worker Rigs Radio Contest]
17. Hacker challenges `dark side' book
01. The 1997 Summer Security Conference
02. Hacking In Progress
03. Defensive Information Warfare And Systems Assurance
04. Second International Workshop on Enterprise Security
05. DEF CON V Convention Announcement #1.00 (02.26.97)
[=-------------------------------------------------------------------------=]
title: Computer Attack Slows Service at New York Times' Web Site
author:
source: The Wall Street Journal Interactive Edition
date: November 7, 1996
Numerous World Wide Web sites offering political information found
themselves overwhelmed by requests for election information from Tuesday
night. But the New York Times' Web site also had to deal with waves of
requests for access apparently generated by a computer hacker.
Nancy Nielsen, a New York Times Co. spokeswoman, noted that the attacks
-- which continued Wednesday -- only slowed the Times' computers, which
were still able to serve a record number of users on Tuesday.
The attack was similar to a September incident that virtually paralyzed
Public Access Networks Corp., or Panix, an Internet-access provider that
hosts nearly a thousand corporate Web sites. In that incident, a computer
hacker bombarded the service's computers with requests to send information.
Such attacks, presumably generated by malicious computer programs, work
by sending repeated requests -- sometimes more than a hundred per second --
seeking to establish a connection to send or receive information. The
requests contain fake Internet addresses, which the site's computers waste
valuable resources attempting to establish contact with. This process
prevents the computers from handling legitimate requests from Internet
users for access.
Such attacks are, in effect, similar to campaigns used by some activist
groups to flood a politician's switchboard with phone calls. So much time
is spent sorting out the bogus calls -- in this case, the hacker's false
requests for an electronic "handshake" with a site's machines -- that the
legitimate ones can't get through. The attacks can be differentiated from
heavy volume on a site because of the fake Internet addresses and the
regularity with which such requests come in.
Attacks such as the ones directed at Panix and the New York Times
underscore a key vulnerability of the Internet.
"This is the first major attack of a kind that I believe to be the final
Internet security problem," said William Cheswick, an Internet security
expert at the Bell Laboratories unit of Lucent Technologies Inc., in the
wake of the attack on Panix.
Mr. Cheswick, who assisted Panix during the attacks, said at the time
that while there had been a few previous reports of such incidents, the
Panix episode was the most severe.
Internet computers have no quick way of distinguishing a bogus request
for information from a real one, Mr. Cheswick noted. While upgrades to the
software controlling these computers could ease the problem, hackers could
respond with even more intensive attacks.
"There's going to be the usual arms race" between better security
measures and hackers, Mr. Cheswick predicts.
Panix tried to find the source of the attack by working backward through
the labyrinthine network of phone lines and specialized "router" computers
that form the Internet. But there is no easy way to trace such hackers, Mr.
Cheswick noted.
[=-------------------------------------------------------------------------=]
title: (none) [Chinese Hacker Convicted]
author: Magdalen Chow
source: South China Morning Post
Computer hacker who enjoyed free access to the Internet by using other
people's accounts was fined HK$125,000 (about US$16,000) in Hong Kong
Monday.
Judge Gareth Lugar-Mawson also ordered David Yip Shu-chew, 27, to pay
HK$40,400 in compensation to Hong Kong Star Internet Ltd. and HK$404
to one of the people whose accounts he had used.
The judge said he would not order Yip to pay the costs of approximately
HK$2.6 million incurred in the prosecution and investigation of the case,
but threatened him with jail if he misused the Internet again.
Yip is the first person to be charged with accessing a computer with
criminal or dishonest intent under the Crimes Ordinance.
[=-------------------------------------------------------------------------=]
title: Phone 'Super Scanner' Alert
source: The London Telegraph
date: 12th November 1996
Cellphone fraud, which already costs the British cellphone industry 200
million a year, is increasing because of a new device that makes it
easier than ever for criminals to "clone" phones, writes Aisling
Irwin.
The new "super-scanner" can soak up all the identification numbers of
vulnerable analogue phones within half a mile. Each phone contains two
numbers: its phone number and a secret verification code. When a call is
made, the phone transmits the two numbers to the nearest of a network of
base stations, which checks that the phone is legitimate before allowing
the call to go ahead.
Normally, thieves pick up the numbers as they are transmitted at the
beginning of each call. Until now, such thefts have been possible only
when victims are making calls - and stealing numbers has taken much
longer.
But the new technique, which is far more powerful, only requires mobile
phones to be switched on to obtain their identification numbers.
By sending out a signal identical to that of a real base station, the
super-scanner gets the cellphones to yield their numbers. These are
received by the scanner, passed to a computer and can then be programmed
into stolen phones.
According to the Federation of Communication Services, which represents
leading cellphone companies, the new technology has evolved over the
past few months. "Its impact is really being felt heavily," said a
spokesman. The FCS has launched a campaign to make the advertising,
sale, ownership or use of cloning equipment illegal.
Although the FCS says the technique cannot be used to clone digital
phones, New Scientist reported last week that criminals may be close to
cloning these as well. If so, the problem will be magnified because
these can be used abroad.
[=-------------------------------------------------------------------------=]
title: Computer Hacking Whiz Pleads Guilty To Electronic Break-And-Enter
ST. LOUIS (Nov 15, 1996 11:12 a.m. EST) -- A computer whiz deemed so
cunning he could control almost any computer system has accepted a plea
bargain for hacking his way into the secret files of two major
communications companies.
Christopher Schanot, 20, was linked to the Internet Liberation Front, a
group of hackers who have claimed responsibility for some high-profile
computer pranks and who decry the commercialization of cyberspace.
In exchange for a reduced sentence, Schanot pleaded guilty Thursday to
two counts of computer fraud and one count of illegal wiretapping. He
faces up to 15 years in prison and $750,000 in fines at his sentencing
on Jan. 31.
Prosecutors said Schanot broke into national computer networks and had
passwords to military computers, the credit reporting service TRW and
the phone company Sprint. They gave no indication he tried to profit
from his intrusion.
His hacking caused security breaches that companies said cost tens of
thousands of dollars to repair.
The break-ins took place between October 1994 and April 1995, when
Schanot was an honor student at a Catholic boys' school in suburban St.
Louis. He vanished after graduating in May 1995.
Authorities caught up with Schanot last March and arrested him at the
suburban Philadelphia apartment he shared with a 37-year-old woman,
Netta Gilboa, the publisher of Gray Areas. The magazine professes to
explore subject matter that is "illegal, immoral and/or controversial."
In April, Schanot was placed under 24-hour house arrest and ordered to
not even talk about computers.
Originally accused in a five-count indictment, he pleaded guilty to
charges surrounding break-ins at Southwestern Bell and Bellcore, a
communications research company owned by seven regional telephone
companies.
Mike Schanot said his son made the plea bargain only after prosecutors
threatened him with a wider range of charges.
[dis: You can find a wide variety of other article on Schanot. Check
your favorite search engine to find them.]
[=-------------------------------------------------------------------------=]
title: Hackers release two upcoming U2 songs on Internet
source: The Associated Press
LONDON - Hackers have distributed two unreleased U2 songs on the Internet,
possibly after tapping into computers at the Irish rock group's recording
studio, the Sunday Times said.
The songs, Discotheque and Wake Up Dead Man, have appeared on Internet sites in
at least four countries, the newspaper said. The songs are to appear on an album
scheduled for release in the spring.
Since their illicit appearance on the Internet, the songs have also been copied
onto compact discs, the Times said. The bootleg CDs are going for $10 at street
markets in Ireland and Britain.
"It is an infringement of our copyright," Marc Marot, managing director of
Island Records, told the Times.
Island Records did not immediately return calls for comment Sunday. The Sunday
Times said the record company is trying to shut down the Internet sites.
Conventional, low-tech theft of the songs has been ruled out, the newspaper
said.
Band managers are investigating the possibility that hackers tapped into
computers at U2's Dublin studio, it said. They may have gained access through
cables that have been feeding images of the band's recording sessions to an
Internet site maintained by Island Records.
Since 1981, U2 has sold 70 million records and grossed more than $1.5 billion.
[=-------------------------------------------------------------------------=]
title: Computer Crime Prompts New Parole Restrictions
WASHINGTON (Dec 17, 1996 07:42 a.m. EST) -- The U.S. Parole Commission
has approved restrictions on the use of computers by certain high-risk
parolees.
The Justice Department announced Monday that the panel voted this month
to authorize such restrictions as requiring certain parolees to get
prior written approval from the commission before using an Internet
service provider, computerized bulletin board system or any public or
private computer network.
Other restrictions would: prohibit particular parolees from possessing
or using data encryption programs, require some parolees to agree to
unannounced inspection of computers by probation officers, require some
parolees to compile daily logs of computer use or to pay for equipment
to monitor their computer use.
"Unrestricted access to the Internet and other computer online services
can provide sophisticated offenders with new opportunities for crime and
criminal associations," said Edward F. Reilly Jr., commission chairman.
"We cannot ignore the possibility that such offenders may be tempted to
use computer services to repeat their crimes."
The commission noted a surge in "how-to" information on child
molestation, hate crime and the illegal use of explosives available on
the Internet and on computer online services.
[=-------------------------------------------------------------------------=]
title: (none) [Evil Hacker SYN-Flood's WebCom]
SAN FRANCISCO - The FBI says it is investigating charges that sabotage
caused a 40-hour outage last weekend on Web Communications, (WebCom) a
Silicon Valley service hosting 3,000 World Wide Web sites.
WebCom said it believes a hacker using a college computer network in
British, Columbia, Canada, flooded its server in San Jose with
requests for connections from phony addresses. It said the attack
ended Sunday after MCI Net, a unit of MCI Communications, blocked
telephone traffic between WebCom and CA-Net of Canada at the request
of WebCom and its local service provider.
WebCom Executive Vice President Thomas Leavitt said the sites the
company hosts were unreachable much of Saturday Dec. 14 and Sunday
Dec. 15, causing customers, some of who operate retail sites, to
suffer "extensive" damages,
"One customer said he lost about $20,000 in revenue due to a special
event that was not able to occur. Others said they lost business on
one of the busiest shopping weekends of the year," Leavitt said.
WebCom said the incident was due to a common type of Internet sabotage
known as "denial of service" or "SYN flood," in which a computer
hacker jams a server with requests for connections from addresses that
do not exist. These types of attacks are easy to carry out and hard to
trace, Leavitt said.
"You can fake where the messages are coming from," Leavitt said, and
almost any with access to the Internet and some technical
sophistication can do it.
Others in the industry have experienced similar attacks, WebCom said.
Public Access Networks of New York City experienced a SYN flood attack
in September.
WebCom, headquartered in Santa Cruz, said its own investigation helped
by three Internet service providers traced the origin of the flooding
message to a computer on a college network in British Columbia linked
to BC-Net, a local Internet service provider there.
Leavitt said that a network administrator at Malaspina
University-College in Nanaimo, British Columbia, has identified the
computer used for the sabotage and that it was broken into by someone
without authorized access to that computer or to the college network.
The individual has not been identified.
FBI spokesman George Grotz said that the FBI is working with the
information tracing the requests for connection to British Columbia
but noted the actual perpetrator may nothing to do with the college or
BC-Net. "BC-Net may just be another link in the case," he said.
The FBI has jurisdiction over such cases under Title 18 section 1030,
which deals with falsely perpetrating denial of service on a computer
network.
Leavitt said if the industry, or specifically Internet service
providers, adopt certain "source filtering" coding they can prevent
people from using one network to send messages that appear to come
from somewhere else.
The U.S. Department of Energy's Computer Incident Advisory Capability
has an advisory warning about SYN Floods.
[=-------------------------------------------------------------------------=]
title: German Police Seek 12 After Raids On Computer Gang
MUNICH, Germany (Nov 28, 1996 3:36 p.m. EST) - European police are
seeking 12 members of an international computer chip counterfeiting gang
that was smashed this week in Germany and nine other countries, Bavarian
law officials said Thursday.
The raids, part of an operation code-named "Goldfish," resulted in the
arrest of 12 others suspected of selling counterfeit Pentium chips and
pirated software programs as well as fraud, money-laundering and tax
evasion, Bavarian prosecutor Hubert Vollmann told a news conference.
Police did not release the names of the suspects.
The highly-organized ring specialized in smuggling old Intel Corp
Pentium chips into Europe and selling them as new, Vollmann said. It
also sold illegal copies of Microsoft Corp programs and counterfeit
Hercules graphics adapters, he said.
Vollmann said the ring caused damages of several millions of dollars in
lost sales.
Tuesday and Wednesday, more than 2,000 law enforcement officals
confiscated "truckloads" of files, computer disks and equipment in
Germany, France, Italy and Belgium, he said.
The raids centered on offices and apartments near Munich in southern
Germany, and in the state of North Rhine-Westphalia, Vollmann said.
Three Germans and five Asians were arrested in Germany. Four other
arrests were made in France.
The raids were the culmination of a three-year probe that began when a
Laotian businessman reported he was robbed of almost $20,000 in 1993. He
came under suspicion after two of his attackers told police they had
robbed him of 500,000 marks.
A series of unusually large bank transactions by the man's companies led
to an investigation into tax evasion and money laundering, police said.
In addition to the 12 individuals under arrest and the 12 still at
large, 16 others were arrested in the raids on charges unrelated to chip
counterfeiting, Vollmann said.
The chip counterfeiting ring operated a multi-tiered organization that
bought used 133-megahertz Pentium chips in Asia and retouched them in
Hong Kong to look like new 166- megahertz processors, Vollmann said.
The group shipped the chips to Europe by courier to avoid customs and
taxes, and sold them to personal computer companies, he said.
[=-------------------------------------------------------------------------=]
title: The tale of the Russian Hacker
Everyone wants to know how Vladimir Levin did it, writes Hugo Cornwall.
In mid-1994, as a 26-year-old computer scientist in St Petersburg, he is
supposed to have led a gang that hacked into Citibank in New Jersey, and
organised more than 40 wire transfers from customer accounts. Russia's
Mafia is said to have been involved.
Levin is still denying his involvement and, for the past 21 months, he
has been in prison in south London, fighting extradition. On Sunday, he
speaks for the first time to Channel 4's Equinox programme.
Could Levin really be living proof of the "professional hacker" so often
celebrated in movies, books and lurid conference presentations? Is he
a product of a KGB school of super hackers now turned loose on the
world as part of Russian criminal enterprise? If that turned out to be
true, it would delight the information warriors, the cyber-SWAT teams
set up by the US armed forces whose most recent claims on federal
budgets have been on the basis of threats to the global information
infrastructure. Equally pleased will be the platoons of consultants,
the sales forces of computer companies and the organisers of high-
price exclusive conferences.
Equinox tells a different story. The programme's researchers found a
Russian "recreational" hacker group called Megazoid. The Citibank fraud
because a group of hackers worldwide compiled files on the VAX/VMS
operating system, and some Russian hackers found a Citibank computer
with which they could play and use as a free jumping-off point to
other computers. One of them says that, for $100, he sold details to
Levin and his friends who ran a computer import/export business. In
reality Levin appears to have been an average-ability programmer
with entrepreneurial ambitions.
The Citibank fraud was possible only because of a number of coincidences -
poor security management, a group of Russian hackers getting lucky
and their information falling into the hands entreprenurs with the
right connections. This is the pattern of much computer crime.
[=-------------------------------------------------------------------------=]
title: Expert Warns Of Lax Security On Web
SAN FRANCISCO - An outspoken computer security expert, citing his
just-completed study, says up to two-thirds of certain Web sites,
including reputable institutions like banks and the media, are
vulnerable to hacker attacks.
Dan Farmer -- who stirred controversy in 1995 as co-author of software
dubbed SATAN that enables people with basic skills to infiltrate
computer systems -- surveyed more than 2,200 Web sites.
The survey released last week covered a relatively small portion of
the sprawling Web but focused on sites where security is more of a
concern.
Farmer probed 660 bank sites around the globe, 312 North American
online newspaper sites, 274 credit union sites, 47 U.S. federal
government sites and 451 Internet sex clubs.
In a summary, Farmer said that, out of his sample of about 1,700 Web
sites he selected, "over 60 percent could be broken into or
destroyed." As a control, he probed a random sample of 469 sites.
Farmer said he used relatively crude, non-intrusive methods and did
not actually break into the sites. He also said he would not publish
the names of the sites he surveyed.
"I barely electronically breathed on these (computer) hosts," he said
in his report, adding that, considering more intrusive tests, some 70
percent to 80 percent of sites may have security flaws.
Other computer security experts found Farmer's results credible and
authoritative, David Kennedy, director of research, education and
consulting at the National Computer Security Association, said in a
telephone interview.
Experts and computer industry executives said the study shed more
light on a problem well known within the industry but insufficiently
understood by the public at large.
The threat of hacker attacks was highlighted earlier this year when
intruders broke into the Justice Department and Central Intelligence
Agency Web sites and altered them, prompting the CIA to close its site
temporarily.
Farmer stressed that Web sites are being used primarily for marketing
and advertising purposes and that, although some bank sites may allow
visitors to look up balances, the sites do not provide access to
internal financial systems.
Deborah Triant, president of CheckPoint Software Technologies' U.S.
operating unit in Redwood City, Calif., said banks routinely keep Web
sites on separate computer systems.
"Our experience is the banks are so paranoid that they won't even
allow the access that they should be able to allow and would be quite
safe if you had a modern firewall" protecting their networks from
intruders, said Triant, whose company is the market leader in firewall
technology.
"So, if their Web site is vulnerable, that doesn't mean that anything
else at the bank is vulnerable, or that their customers' accounts or
the transactions their customers are doing are vulnerable," she said.
Nevertheless, with the advent of electronic commerce over the Internet
expected to gain momentum in 1997, lax security remains a critical
issue, experts said.
Farmer separated security flaws into two categories -- a red category
where he said a site was "essentially wide open to any potential
attacker" and a yellow category deemed less serious but with potential
for disastrous consequences.
Of the 660 bank sites, 68 percent were deemed vulnerable and nearly 36
percent were in the red category.
Some 51 percent of credit unions were vulnerable, 62 percent of the
federal sites, nearly 70 percent of newspapers and 66 percent of sex
clubs. Sites in the red category ranged from 20 percent for credit
unions to 38 percent for federal sites and 39 percent for online
newspapers.
Of the random sample of 469 Web sites used as the control, a far
smaller percentage -- 33 percent -- were found to be vulnerable, and
17 percent of the group was in the red category.
Farmer said part of the problem is that Web sites are trying to do too
much at once, increasing their complexity and making security far more
difficult to achieve.
But, even with security concerns, credit card transactions over the
Net are much safer than those carried out in shopping malls, said the
security association's Kennedy.
Farmer also said he plans to incorporate some newer testing tools into
a new version of SATAN, which stands for Security Administrator Tool
for Analyzing Networks, early next year.
The program enables people who manage corporate networks to locate
weaknesses and fix them. But it has been controversial because it can
also easily be used by malevolent intruders trying to cause damage.
Triant said there have been no reported security breaches at any of
the more than 15,000 institutions with CheckPoint network security
installed and said such precautions should provide adequate
protection.
[=-------------------------------------------------------------------------=]
title: (none) [Man pleads guilty to writing AOL hacking soft]
source: Reuters World ReportJanuary 8, 1997 14:55:00
WASHINGTON, Jan 8 (Reuter) - A Yale University student pleaded guilty
Wednesday to committing computer fraud for developing a programme that
allowed him to use America Online Inc. without paying, the Justice Department
said.
Prosecutors said Nicholas Ryan, 20 of Victor, New York, entered the
guilty plea at a federal court hearing in Alexandria, Virginia. He faces
up to five years in prison and a $250,000 fine at sentencing, scheduled at
the end of March.
Prosecutors said Ryan in June 1995 developed the programme, called
"AOL4FREE," and frequently used it through December 1995, avoiding having
to pay the firm's rate of $2.95 per hour.
Ryan, who identified himself as "Happy Hardcore," also made the
programme available to other America Online users, and it circulated within
AOL chat rooms, prosecutors said.
As the company made changes to stop the use of the programme, Ryan
modified it and made the updated version available to other online service
users, the prosecutors said.
They said the heaviest use of the programme took place from September
through December 1995. America Online estimated that on a single day
individuals using the programme logged onto the system about 2,000 times,
the prosecutors said.
The case was brought by the U.S. Attorney's office and the Justice
Department's computer crime section.
[=-------------------------------------------------------------------------=]
title: Hackers Hack Crack, Steal Quake
author: Annaliza Savage
8:00 pm PST - Hackers broke into the Web server and file server of Crack dot
Com, a Texas gaming company, on Wednesday, stealing the source code for
id's Quake 1.01, as well as Crack's newest project, Golgatha, and older games
Abuse and Mac Abuse.
Although the hackers left a trail that may make them easy to track, the
theft did its damage. "Quake's raw engine market value dropped several
hundred thousand dollars," said Dave Taylor, who formed Crack dot Com
after leaving id Software, where he worked on Doom and Quake. But Barrett
Alexander of id denies that the financial loss will be so great, saying
that the code for Quake's unique engine is recognizable, making it hard
for anyone to be able to use without id's knowledge.
Crack dot Com is also worried that its unreleased techniques, developed for
Golgotha, could make their way into the hands of other game competitors, who
could copy bits of code into their own software.
The hackers, who were able to get through the Crack's firewall, left intact a
bash-history file that recorded all their movements. They even logged onto
IRC's #quake to brag about their exploits, and made Quake's source available
on Crack dot Com's homepage (it is no longer there).
The hackers, who identified themselves as being from the group FEH,
probably broke through Crack's firewall through their Web site. The former
editor of the now defunct hacker magazine FEH denies any knowledge of the
event, and has already posted a disclaimer.
[=-------------------------------------------------------------------------=]
title: Hackers Sabotage Blair's Internet Image
author: Robert Uhlig, Technology Correspondent
source: The Telegraph
date: 10th December 1996
The Labour Party has called for a police inquiry after computer hackers
made repeated attacks on its Internet site, replacing a picture of Tony
Blair with his Spitting Image puppet and headlining the site with "New
Labour - Same Politicians. Same Lies".
A group of British hackers, calling itself the Digital Anarchists,
infiltrated the Labour publicity site for the second time yesterday and
said it would continue to attack the Labour Web site this week. "We're
going to keep doing it again and again until further notice. And we're
going to hit some other sites as well," a spokesman for the group said
last night.
The hackers later infiltrated the Labour site a third time, while
computer experts were attempting to rectify the second attack. The Web
site has now been closed until future notice to prevent more further
embarrassing alterations of its content.
It is believed that the hackers will attack other political parties
including the Conservatives, Liberal Democrats, Scottish National Party
and Plaid Cymru. Internet sites belonging to other public organisations,
blue-chip companies and newspapers may also be affected.
The first attack, which promised free drugs and beer to young voters,
was made on Saturday while the British hacker community was staging a
Christmas party in Manchester.
The Labour leader's response to the Budget was replaced with a live sex
show of women wearing the "demon eyes" masks seen in the Tory
advertising campaign. The hackers also changed the title "The road to
the Manifesto" to "The road to nowhere" and altered links to other parts
of the site so they read "The Labour Party sex shop".
[=-------------------------------------------------------------------------=]
title: Police looking into hacking of Government web site
author: Adeline Goh
source: The Straits Times
date: Dec 10 1996
POLICE are investigating how the Singapore government's Web site on the
Internet was modified without authorisation.
In the incident on Sunday, someone replaced the site's contents with a
list of more than 100 user identities (IDs) of people from various
government bodies.
Yesterday, the Commercial Crime Division (CCD) of the Criminal
Investigation Department told The Straits Times that three officers from
its computer crime team had started work on the case.
It added that the first step would be to trace the identity of the hacker
by checking the log files of the computer in which the Web site is housed.
These log files keep track of people who access it.
The web site -- at http://www.gov.sg -- is the on-line version of the
Singapore Government directory and has links to the Web sites of various
bodies such as the ministries.
The original contents of the site were restored by the National Computer
Board (NCB) on Sunday afternoon. When contacted yesterday, NCB, which
maintains the computer that houses the Web site, said that the hackers did
not gain access to any government networks which contain sensitive data.
It added that the computer where the Web site was stored did not contain
sensitive information.
It declined to give further details about the incident, saying that it had
referred the matter to the CCD.
Several computer experts contacted yesterday said that electronic networks
could be broken into with special computer programs.
They are placed into a network by hackers and they capture a user's log-in
password, which can then be retrieved.
Those contacted added that passwords which are proper English words were
easy for hackers to crack.
This is because there are also programs which try to log on by trying
words found in English dictionaries.
One of the experts, Mr A. I. Chow, 32, a partner in a computer firm, said
perpetrators could even impersonate computer system administrators and ask
a particular user on the network to change his password to one supplied by
them. "When the user changes his password, the hacker can then access the
network easily with the user's account."
Those contacted said data on Internet computers could be made more secure
if system administrators allowed Web pages to be updated only during
certain times or from computers within an organisation.
Security could also be improved, they said, if passwords were generated
randomly and refreshed constantly.
[=-------------------------------------------------------------------------=]
title: Computer Programmer Accused Of Breaking Into California
State Contract Data
SACRAMENTO, Calif. (Jan 17, 1997 00:36 a.m. EST) -- The Bay Area
computer programmer who was arrested for hacking into the state
Department of Information Technology computer system tapped into
confidential information dealing with nearly a half million dollars
worth of government contracts, court records show.
David Ernesto Salas of Alameda, who faces four years in prison,
allegedly told others he had obtained confidential communication between
a contractor and department officials and he was going to use it in a
lawsuit against the department, said documents on file in Sacramento
Superior Court.
Salas, 34, who is free on $50,000 bail, was arraigned Tuesday in
Sacramento on three felony counts of computer hacking, including one
count which alleges he attempted to destroy the department's computer
system after his hacking was discovered.
Although some data was lost in the crash and the department's computer
system was down for two days in September, nearly everything has been
re-created by a backup computer system. Damage was estimated about
$10,000, officials said.
The incident, however, has been an embarrassment to department officials
and is viewed with concern because Information Technology oversees $2.2
billion in computer projects throughout state government.
The department was established last year after a series of audits and
investigations showed that millions in public funds were wasted on
bungled state computer projects.
Kenneth Keller, Salas's San Francisco attorney, has said his client, who
was a subcontractor hired to develop and install the department's
computer system, will eventually be vindicated.
Keller, who couldn't be reached for comment Thursday, said last week
that Salas had permission to be using the computer.
But according to court documents, Salas lost his authority to access the
computer when he lost his contract after a dispute with another
contractor in August. Beginning shortly before 11 p.m. Sept. 25 and into
the following day, Salas gained access to the department's computer. To
this day, it is not known exactly what he did once he entered the
system.
The backup computer, unbeknownst to Salas, did capture a trail of
changed passwords that led to the highest administrative level, giving
Salas full access to the entire computer system, documents said.
"Electronic mail (E-mail) regarding state service contracts worth
approximately $400,000 between (a contractor) and DOIT resided on the
DOIT system," said a summary of the facts in the case prepared for
Salas's arrest.
Special Agent Fred Adler of the Sacramento Hi-Tech Crimes Task Force,
which arrested Salas, said Thursday the case is still under
investigation and another arrest is possible.
In his affidavit for the search warrant, Adler said on Sept. 9, Salas
told Information Technology deputy director and chief counsel Alexis
Schatten that he had contacted an attorney to initiate a lawsuit against
a competing contractor for slandering him and other subcontractors.
Adler said there were witnesses who had seen Salas "bringing up
privileged information on (his computer) screen" and that Salas had
"alluded" to others that he possessed confidential information about
Information Technology's business dealings, court records show.
Department officials told investigators that "numerous confidential
communications exist on the their system relative to procurement,
installation and maintenance of multi-million dollar, state computer
systems," the affidavit said.
"Knowledge of these communications could prove to be financially
advantageous to firms involved in these processes," the affidavit said.
Rich Halberg, department spokesman, declined to comment on the search
warrant out of fear it might jeopardize an ongoing prosecution and
investigation.
He did say, however, that the department computer system does not
contain actual contracts, but he did say that there may be E-mail
pertaining to such contracts.
"We are doing the right thing by going after this guy," Halberg said.
"It is all too common in large companies and government to not want to
go after the hacker because it is difficult to prove. Hopefully, this
guy won't be in a position to do this again to another government
agency," Halberg said.
[=-------------------------------------------------------------------------=]
title: (none) [Australian Phone Worker Rigs Radio Contest]
source: COMTEX Newswire
date: 12/10/96 7:48 PM
SYDNEY, Dec. 11 (UPI S) -- An Australian telephone company worker who won
$50,000 Australian (U.S. $40,000) in a radio station's phone-in
competition has been charged with fraud after allegedly hacking into the
phone line. Brian Ronald Francis, who police say used his expertise to
ensure he was the 10th caller in the competition, has also been charged
with two more offenses relating to two other radio competitions he won
this year.
[=-------------------------------------------------------------------------=]
title: Hacker challenges `dark side' book
author: Simson Garfinkel
Special to the Mercury News
KEVIN Poulsen was one of the most talented "dark side hackers" ever to
phreak a phone call.
For more than two years, Poulsen lived the life of a fugitive as part
of the seedy Los Angeles underground. He made money by reprogramming
Pacific Bell's computers for pimps and escort services, re-activating
old telephone numbers and building a voice-mail network pairing
prostitutes with their johns.
And he cleaned up by messing with the phones used by Los Angeles radio
stations, rigging their call-in contests so that he would always win
the big bucks or the car.
But Poulsen got caught and he spent more than five years in jail.
Behind bars in 1993, Poulsen did what any phone phreak would do: He
picked up the pay phone and started making collect calls. But these
calls where different: they went to Jonathan Littman, a journalist in
Mill Valley who had just published a magazine article about Poulsen's
crimes and exploits and was about to write a book on the same topic.
Poulsen wanted to make sure that Littman got the story right. He felt
that Littman had made a lot of mistakes in the magazine article.
Today, Poulsen feels somewhat betrayed by the journalist to whom he
gave total access. After reading an advance copy of Littman's book,
Poulsen says Littman has twisted the truth in order to make a more
compelling story.
"Most of my complaints about Littman's book are small things," said
Poulsen, who is on parole and living in Sherman Oaks, a Los Angeles
suburb. "He has major events right but then he changes the meaning of
them by changing minor events and making up quotes."
Littman stands by his work.
The book, "The Watchman: The Twisted Life and Crimes of Serial Hacker
Kevin Poulsen," is due to be published next month by Little, Brown and
Co. It's an insider's look at the world of a criminal computer hacker,
one of the most detailed yet published.
"He was one of the first to hack the Internet and get busted for it,"
said Littman, referring to Poulsen's 1984 arrest for breaking into
university computers on the ARPAnet, predecessor to today's Internet.
"They decided not to prosecute him because he was 17" when he was
arrested, Littman said. Instead, Poulsen was hired by a Silicon Valley
defense contractor. "It was every hacker's dream -- to commit a crime
and instead of going to jail, to get a job with what was a top think
tank and defense contractor," Littman said.
Soon, however, Poulsen was back to his old tricks -- with a vengeance,
according to the book. He started physically breaking into Pacific
Bell offices, stealing manuals and writing down passwords. Much of
what he found went into a storage locker. But Poulsen couldn't handle
his finances, and got behind in his rent. When the locker company
broke open Poulsen's lock his stash was discovered and a trap was
laid. As the FBI closed in, Poulsen left town, a fugitive on the run.
Guilty plea
He was caught June 21, 1991, and spent nearly three years in pre-trial
detention. On June 14, 1994, in federal court in Southern California,
he pleaded guilty to seven counts of computer fraud, interception of
wire communications, mail fraud, money laundering and obstruction of
justice. He was then transferred to Northern California to face a
spying charge, based on his possession of material the government
called classified. He pleaded guilty to fraud, possession of
unauthorized access devices and fraudulent use of a Social Security
number, and was released June 4, last year.
The Watchman is Littman's second book on the computer hacker
underground. His first, "The Fugitive Game," followed the exploits of
hacker Kevin Mitnick, who was on the run and eventually caught by
computer security expert Tsutomu Shimomura and New York Times reporter
John Markoff. Shimomura and Markoff wrote their own book describing
the chase, and they both objected to Littman's version of the events.
For his part, Poulsen seems most angry about the implication of the
new book's title -- that he was somehow obsessed with eavesdropping
and largely acted alone.
Only two wiretaps
In the book, Littman has Poulsen listening to dozens of conversations
-- even wiretapping the telephones of people trying to sell used
equipment through newspaper classified ads, to see if they are being
honest with their prices.
Poulsen insists that he wiretapped the telephones of only two people:
another hacker who was also an FBI informant and his high-school
girlfriend.
"He also reports that I obsessively followed the details of every
escort date, including details of the tricks," Poulsen says, among
other complaints. "He made that up. Totally made that up."
Littman denies making up quotes, and insists that everything in the
book was told to him by one of the participants.
"I've written a book about a very complicated story about
controversial people who had very different versions of what
happened," Littman said. "I've done the best I can to view them
objectively. Somebody else might view them differently, and the
participants obviously have a subjective perspective. My views are in
the book."
But Poulsen says that Littman's fundamental premise is flawed. "John
had a problem in writing this book," Poulsen said. "He wanted to sell
it as the troubled loner-hacker-stalker guy. The problem is I had five
co-defendants and it is hard to portray someone as a troubled loner
when you have five other people making it happen."
Not a loner
Ron Austin, Poulsen's friend and co-conspirator, agrees. "Littman has
to write an interesting book, I guess," he said. "He downplays the
role of a lot of people, but I think that's because he is writing a
book about Kevin. My role is downplayed." Austin also said the role of
Justin Petersen, a hard-rocking hacker and co-conspirator is
underplayed.
Austin, also on parole, said he is concerned that the controversy
regarding Littman's portrayal of Poulsen might obscure some of the
more important issues raised by Littman's book: That the FBI engaged
in widespread wiretapping of foreign consulates in the San Francisco
area, the FBI's apparent hiring of an informant to commit illegal acts
on the agency's behalf, and that the FBI's apparent ability to decrypt
files on Poulsen's computer that had been encrypted with the
U.S. government's Data Encryption Standard, a popular data-scrambling
algorithm.
The FBI office in Los Angeles declined to comment on the Poulsen
case. A representative of the FBI's Washington office said, "We
normally do not comment on books that are coming out until we have had
an opportunity to review the book."
As a condition of his plea bargain, Poulsen is prohibited from
discussing FBI wiretaps.
Littman said he feels "lucky as a writer to have been able to spend
some time with Poulsen and these other characters in the story."
"One thing about Poulsen is he really had a very highly developed
ethical model that he believed in," Littman said. "He found it
challenged by his circumstances and the people he associated with. I
found it fascinating to see how he resolved this age-old computer
hacker ethic with a changing world."
Cellular Code-breakers Blame Standards Process
577 Words
4312 Characters
04/03/97
TR Wireless News
Copyright (c) 1997 BRP Publications, Inc.
Computer scientists claim they have demonstrated how to break the
industry-standard code that encrypts cellular phone calls-a discovery
they termed "a setback to the U.S. cellular telephone industry." The
code-breakers included Bruce Schneier of Counterpane Systems, a
Minneapolis consulting firm, and graduate student David Wagner of the
University of California at Berkeley.
They criticized the wireless industry's technical standards-setting
process for establishing what they consider a weak standard, and they
attacked the government for "hamstringing emerging cellular security
technology." Release of their announcement and academic paper was timed
to coincide with congressional hearings on encryption policy.
The researchers' press release observes that the digital cellular
system uses encryption to "scramble voice communications." Their paper,
Cryptanalysis of the Cellular Message Encryption Algorithm (CMEA),
concerns cellular phone keypad entries, but not voice conversations. Mr.
Schneier told TRWN that the digital cellular voice encryption standard
is "so incredibly vulnerable" to decryption that it was "not worth
writing about." The voice standard's fundamental code was broken by the
"Union Army in the Civil War," he added.
The researchers didn't challenge either the subscriber
"authentication" or the "fingerprinting" antifraud procedures now common
in the cellular service. Authentication and fingerprinting technologies
"are not compromised by the cryptography announced today," according to
the Cellular Telecommunications Industry Association.
The technical paper describes a cryptographic "attack" on the CMEA.
Such an attack, in practice, would require analysis of data recovered
from recorded calls, received on radios capable of decoding digital
cellular transmissions. Such radios aren't easily available; the common
"scanner" can't receive them.
"We did not touch a cellular phone in our analysis, and there is no
commercial equipment available that could receive digital cellular
signals. We worked with a paper standard only," Mr. Schneier said. The
attack took "minutes or hours" on a Pentium-class personal computer, and
to comply with U.S. laws and who agreed not to "misuse" the
information. Federal agencies, including NSA, had certain
"sensitivities" as to the encryption power of CMEA and its lawful export
under then-current laws, he said. These concerns led to CMEA's being
somewhat less "robust" than the authentication algorithm.
Updating CMEA to address the concerns raised by the cryptographers'
announcement has become the "highest priority" for the TR45 committee at
its upcoming meetings, Mr. Marinho said. He added that the shift in
federal jurisdiction over encryption from the State Department to the
Commerce Department has enabled TIA to move forward in improving CMEA.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
TRENDS IN BRIEF...
285 Words
2117 Characters
04/07/97
Report on Microsoft
Copyright 1997 Information Access Company. All rights reserved.
A trade publication reports that a "major" security flaw has been
uncovered in Microsoft's network operating system, Windows NT.
The flaw could enable a user dialing in from a remote location to
unscramble encrypted information -- including a corporate network's
entire registry of user passwords -- and display it as plain text. EE
Times Online (http://www.eet.com) said the discovery is especially
troublesome for Microsoft because it has tried to position NT as more
secure network server than alternatives such as Unix. Two professional
security technologists wrote the code for the "hack" that found the
flaw.
The code has been verified by several experts and is making the
rounds on the Internet via an mailing list frequented by skilled
hackers with an interest in NT-security issues. The potentially
password-cracking code is the third major security flaw found in NT in
as many months and follows recent revelations of security holes in
Microsoft's Internet Explorer Web browser. The software giant's
security technology has come under closer scrutiny by the hacking
community as NT and Internet Explorer have found broader market
acceptance... At least a dozen major companies have joined the race to
buy, invest or strike strategic alliances with small Java developers,
according to a trade publication report. Driven by the growing
popularity of Java and the need to get products to market more quickly
than they can be developed internally, these vendors frequently are
courting the same developers to shore up their Java offerings. One
developer, while declining to comment on any talks his company has had,
named Sun Microsystems Inc., Microsoft, Novell Inc., Netscape
Communications Corp. and IBM/Lotus as the top Java hunters, followed by
a second tier of tools vendors that include Symantec Corp.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Social Security officials insist Web info is secure
April 8, 1997
Web posted at: 12:10 a.m. EST
WASHINGTON (CNN) -- Social security records now available through the
Internet pose few security threats to the individuals who request them
administration officials said Monday.
For the past month, Americans have had the option of having their Personal
Earnings and Benefit Estimate Statement (PEBES) sent to them electronically.
The information previously had to be mailed to them in a process that took as
long as six weeks -- and at a cost of millions of dollars in postage each year.
Phil Gambino, a spokesman for the Social Security Administration, said the top
priority of the new program is maintaining privacy, and several security
features have been built into the new system to do just that.
"The information going back and forth between the requester and Social Security
is encrypted, so if it gets intercepted in the middle, it can't be interpreted -- it
would look like jibberish," he said.
Auditors also are able to trace the origin of a request to the exact personal
computer used to make it, he said.
Still, critics concerned about privacy rights are worried.
"As soon as crooks start exploiting this service to get other people's
information, Social Security is going to have a real problem on its hands,"
Evan Hendricks, chairman of the U.S. Privacy Council in Washington, told USA
Today.
The newspaper identified various types of potential abuse: potential employers
could get the salary history of job applicants; co-workers could determine how
much fellow employees make; landlords could use the information to determine
whether someone can afford an apartment.
While Gambino insisted someone would have to "go through a great deal of
effort" to steal information, even the PEBES Web page offers a disclaimer: "We
cannot absolutely guarantee that the information you are sending will not be
intercepted by others and decrypted."
Indeed, one person in January decoded an encryption code similar to the one
used to secure the Social Security information.
Responding to a challenge from a computer security firm, a graduate student
cracked the code in 3 1/2 hours. He used 250 work stations to do test 100
billion code combinations per hour to crack a 40-bit electronic key. The
PEBES page is encrypted with at least a 40-bit key, although it could have
128 bits or more.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Web authors linked to suicide sect
By Alan Boyle and Paul Chavez
MSNBC
Members of the religious community who died in Rancho Santa Fe
earned money by designing business sites on the World Wide Web and
may have tied their death pact to coincide with the return of the
Hale-Bopp comet.
Farewell tape shows cultists' calm resolve Cult built an 'earth ship' of
old tires Rendezvous with mortality Cults growing on the Net How to know if a
loved one is in a cult Talk about this story in our News BBS.
The group did business as Higher Source Contract Enterprises and
designed a variety of sites, including the San Diego Polo Clubs home
page on the World Wide Web.
Commander Al Fulmer of the San Diego County Sheriffs Office said
during a Thursday press conference that the group also called itself
Heavens Gate. A Web site using that name makes a connection
between the Hale-Bopp comet, which last visited Earth about 4,200
years ago, and a time of closure.
The Heavens Gate site was found under several addresses
Thursday, including one Internet address located in Romania. Most of
the sites were either pulled off the World Wide Web later Thursday or
were made inaccessible because of high volumes of Internet traffic.
Katie Greene, a spokesperson for Internet service provider
Concentric Network, located in Californias Silicon Valley south of San
Francisco, said they have been providing Internet service to the group
since March 1995.
A section of one Heavens Gate site outlined the groups beliefs and
said that 2,000 years ago a crew member of the kingdom of heaven took
over the body of Jesus. This Christ-like member prepared others for
departure into the kingdom of heaven.
The site said the groups mission was the same.
I am in the same position to todays society as was the One that
was in Jesus then, the sites author wrote. My being here now is
actually a continuation of that last task as was promised, to those who
were students 2,000 years ago. ... Our only purpose is to offer the
discipline and grafting required of this transition.
Another section of the site described two leaders, a male and
female, who in the early 1970s took over two bodies, which they called
vehicles.
The Heavens Gate group may be a high-tech reincarnation of a
1970s community that had been dubbed the UFO Cult.
Strong similarities exist between the 1970s group and information
found on World Wide Web sites connected to Heavens Gate. The two
leaders of the the so-called UFO cult have been previously identified in
news reports as Houston residents. News reports also said the female
leader is dead.
One page called Last Chance to Evacuate Earth Before Its
Recycled outlined the groups history and mission. The author of the
page identified himself as Do as in the musical tone.
The author said he was related to the Ti and Do that made news in
1975 as the UFO cult. The author also said that his female partner, Ti,
left earth in 1985.
Much of the information on the site outlined how representatives
from a Kingdom Level Above Human were on Earth to escort others to
the higher level.
The site also had a section detailing its position against suicide by
non-members. Larry Trachte, professor of religion at Wartburg College, said
that suicide often has a different meaning among religious groups and cults.
Death is seen more in an Eastern perspective, Trachte said. So
there isnt a sense that all this is tragic. Its more the spiritual, mental
orientation of these people that believe this way. They believe this life
is just one in an ongoing cycle or series or wheel of life. And ending this
life is like opening a window or door and moving into another existence.
Trachte said he took some solace in the news that no children were
involved with the group.
He also was not surprised with the connection to the Hale-Bopp comet.
Throughout history, the heavens and the signs of the stars and
peculiar events like comets have signified extraterrestrial powers,
Trachte said. Its not totally surprising that a comet would trigger such a
response.
He said the group was unique in that it apparently mixed modern
phenomena, such as UFOs, computers, the comet and the Internet, with
age-old beliefs of being swept into heaven.
Even in the Christian experience you have that recorded experience
of people from another country following a heavenly display or
revelation, which to them pointed to the birth of Christ, Trachte said.
The Heavens Gate group also designed pages publicizing
Pre-Madonna, an album of Madonnas early songs;
1-800-HARMONY, a music and video mail-order operation; British
Masters, a clearinghouse for auto parts; and Keep the Faith, a site
devoted to contemporary Christian music and news.
The group used advanced Web page design and technology,
including Java and Javascript, animated images and virtual reality
modeling language.
Beverly Hills businessman Nick Matzorkis, who runs the
Pre-Madonna site, told authorities that he now employs a former
member of the Higher Source group. Matzorkis said that members sent
the employee whom he identified only as Rio two videotapes this week
that described their intentions to commit suicide.
Members of Heavens Gate believed it was time to shed their
containers, perhaps to rendezvous with a UFO they believed was
traveling behind the Hale-Bopp comet, Matzorkis told NBCs Today
show.
The author identified as Do said on the Heavens Gate site, dated
Sept. 29, 1996, that time was short.
The end of this civilization is very close, the site said. The end of
a civilization is accompanied by a spading under, refurbishing the
planet in preparation for another civilization. And the only ones who
can survive that experience have to be those who are taken into the
keeping of the Evolutionary Level Above Human.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Hecklers hack at human bugs that crawl the Web
A couple of weeks ago the U.S. public was distracted by issues of
Internet pornography. The U.S. Supreme Court was considering the
Communications Decency Act, a law meant to control obscenity
supposedly bombarding youthful computer users.
Meanwhile Marshall Herff Applewhite and 38 members of the Heaven's
Gate cult were updating their Web site, laying in a supply of new
Nike sneakers, and preparing to kill themselves.
Politicians and clergy had a firm grip on the anti-porn franchise.
Who, on the other hand, was tackling murderous mass delusion?
The answer: a few skeptics and hecklers, and they did a good job
of it.
Their postings continue to collect in the forums of Usenet where
cult followers put their prophecies about the alien spaceship that
supposedly follows the comet Hale-Bopp.
"It seems odd that a higher life form would prefer us paltry
humans to wear black Nikes with a white "swoosh' as our ceremonial
sending off garb," sneers a contributor to sci.astro, a group of
otherwise sensible astronomers. "What is wrong with Reebok or
Adidas? Is there a conspiracy here?"
Criticism also focused on syndicated radio host Art Bell, who has
promoted the astronaut-messiah movement. He used to talk more about
evil government, until the Oklahoma City federal building bomb went
off. Lately his agenda has been heavier on spaceships.
"Art's role in their deaths was that of a liar and snake oil
salesman, trafficker in junk science, a promoter of charlatans and
their wares, and a parasitic peddler of pernicious poppycock," says a
contributor "decieving you're some sort of chosen spokesman
for some trumped-up alien scam so you can sell your booklet," says
another.
A preacher surrounding himself with goons in a sealed-off temple,
a con artist fleecing followers in a distant commune, even an
infomercial huckster on radio or television, is protected from
opponents who might distract his victims.
But how many of Jim Jones' followers might have been deterred from
going to Guyana with him, and tasting his deadly brew, had the
Internet been in wider use 20 years ago, complete with its noisy
skeptics countering his preachings?
Jones took more than 900 lives with him. Applewhite only got 38
to go along. That's progress.
"Think of it as evolution in action. Or maybe they were right and
are aboard the mothership now. Either way, it's 39 fewer idiots
cluttering up the planet," says another contributor. This does not
encourage copycats.
Skeptical argument is not limited to religious themes. In
Usenet's thousands of newsgroups, forums cover politics, social life,
dating and marriage, most of the arts and sciences, journalism and
international relations. To some degree, they are all the scenes of
noisy, sometimes sarcastic and even profane debate. Group members
even patrol for porn, often vigorously repelling sexual-oriented
postings with the same forensic muscle.
Anyone can join in soc.couples, alt.fan.rush-limbaugh,
alt.politics.clinton, alt.politics.british, alt.history.what-if,
rec.arts.movies, sci.military, alt.journalism and other cyberbrawls.
They argue feminism, political campaign funding, TV violence,
landmines, sex and Nazism. There is even a fun group that regularly
argues the perennial subject of world domination by hamburger
franchise (it's called alt.nuke.the.usa).
Heckling and skepticism? Indeed, as it should be.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Netly News Network
April 3, 1997
IRS raids a cypherpunk
by Declan McCullagh (declan@well.com)
Jim Bell's first mistake was publishing an
essay describing how disgruntled citizens could
kill off Federal government agents by using
anonymous betting pools and digital cash. His
second mistake was informing the IRS that the
agency had no legal authority to tax him.
About twenty armed IRS agents and other
Federal police swarmed into Bell's home in
Washington state on Tuesday morning, hunting for
evidence that Bell's "Assassination Politics"
essay had come to fruition. They expropriated
Bell's three computer systems, two guns and even
a solitary mouse cable. The Feds were taking no
chances: Since Bell's voluminous Net postings
mentioned tax collectors, agents from the BATF,
FBI, DEA, and local police forces joined the
raid.
[...]
The raid stemmed from a six-month tussle
between Bell and the IRS, which began in November
1996 when the 38-year old computer engineer
demanded a hefty tax refund and threatened to
convene his own "common-law court" if it was
refused. That grabbed the Feds' attention. (So
did the actions of the "Multnomah County Common
Law Court," which apparently met in January to
convict IRS agents and Attorney General Janet
Reno of "theft by deception.") In February, IRS
agents seized Bell's 1986 Honda as payment for
back taxes -- and found inside it a printout of
his "Assassination Politics" essay. "
[...]
And it was, ultimately, a Federal magistrate
who signed the search warrant on 9:02 am on March
28 at the request of the IRS. Jeffrey Gordon, an
inspector in the IRS' Internal Security Division,
details in an 10-page affidavit how he traced
Bell's use of allegedly fraudulent Social
Security Numbers, how he learned that Bell had
been arrested in 1989 for "manufacturing a
controlled substance," how he found out that Bell
possessed the home addresses of a handful of IRS
agents. Gordon's conclusion: Bell planned "to
overthrow the government." The IRS investigator
says in his affidavit that Bell's "essay details
an illegal scheme by Bell which involves plans to
assassinate IRS and other government officals...
I believe that Bell has begun taking steps to
carry out his Assassination Politics plan."
[...]
[=-------------------------------------------------------------------------=]
Security/Hacker Conferences
[=-------------------------------------------------------------------------=]
The 1997 Summer Security Conference
"SUMMERCON IX.V"
May 31st, 1997
Atlanta, GA
This is the official announcement and open invitation to the nine
and 1/2 summer security conference, Summercon. A long time ago,
Summercon was an invite-only hacker gathering held annually in St.
Louis, Missouri. Starting in 1995, SummerCon became an open event to
any and all interested parties: Hackers, Phreaks, Pirates, Virus
Writers, System Administrators, Law Enforcement Officials,
Vigilantes, Neo-Hippies, Secret Agents, Teachers, Disgruntled
Employees, Telco Flunkies, Journalists, New Yorkers, Programmers,
Conspiracy Nuts, Musicians, Nudists, and Rug Sucking Wannabes.
This con is going to be different than previous SummerCons. First
off, there are two other major cons happening this summer, Defcon
and Beyond HOPE. If you want to see good technical speakers, meet a
ton of hackers, and have a good time for a couple days, I suggest
you go to one or both of those cons. DefCon information is at
http://www.defcon.org, Beyond HOPE info is at http://www.2600.com.
So why have SummerCon at all? Well, its a tradition, and most
of the people I talked to said we should have it anyways. But,
because of the other 2 cons, I am really aiming just to make this
a fun weekend with yer friends in a new city, not a technical
hacker gala. If you want to learn something, go to HOPE or
Defcon. If you want to meet hackers, go to HOPE or DefCon. If
you have to choose one con to go to this summer, this one should
NOT be it. If you are already going to DefCon and HOPE, and still
have one more weekend you want to waste this summer, this is the
perfect place for you.
If you are a criminal, if you are an anarchist, if you are
interested in pulling fire alarms or breaking things, don't come
to this con; we don't want you here and you wouldn't like us
anyhow.
Why 9.5? Well, SummerCon X should be this huge major security
conference, but with HOPE this year, we didn't think it was the
right year to do another one of those. So, we'll have SummerCon X
next year, this one is just going to be a little party.
LOCATION
It will be held in Atlanta, GA, but we haven't actually figured
out WHERE in Atlanta. That's because this is a pre-release of the
announcement, when this becomes official, we'll fill in the
details.
DIRECTIONS
Fly to Hartsfield International Airport, look for the hackers.
CONFERENCE INFO
It has always been our contention that cons are for socializing.
"Seekret Hacker InPh0" is never really discussed except in private
circles, so the only way anyone is going to get any is to meet new
people and take the initiative to start interesting conversations.
Because of this, the formal speaking portion of Summercon will be
held on one day, not two or three, leaving plenty of time for
people to explore the city, compare hacking techniques, or go
trashing and clubbing with their heretofore unseen online
companions. Futhermore, except for maybe getting Mudge up on
stage to blow us all away with some cool technical details, it is
probably a pretty good bet that the speeches will end up being
boring, long, and a complete waste of time. Don't come to
SummerCon to learn anything, because you won't.
If you are coming from out of town and want the full
hacker/tourist experience, we will be having a specially scheduled
2600 meeting Friday, May 30th, at 6pm at Lenox Mall food court.
If you don't know how to get there, just ask, everyone in Atlanta
knows.
The formal conference will be held on Saturday, May 31st, 1997,
from 10am to 5pm (with a break for lunch). There will be a
variety of speakers, panel discussions, demonstrations, and other
events that will hopefully keep everyone entertained; if not you
can always start drinking early.
No video or audio tapes will be allowed in the conference room.
No still photography will be permitted in the conference room
without prior permission of all those being photographed.
Violation of these policies will result in you being asked to
leave the conference.
There will be no selling of t-shirts, disks, firewalls, payphones,
etc. in or around the conference area without prior permission of
the organizers, and you WON'T get permission. We can't keep you
from selling t-shirts in your hotel room, but we can keep you away
from the actual conference area, and we can probably get you
kicked out of the hotel for soliciting, and if we can, we will.
T-Shirt sales is where we make up all the money we spend putting
on the conference, and so we will be the only ones selling them.
If you want to sell t-shirts, go have your own con.
If you are interested in demoing or selling something, please
contact us at the address listed at the bottom. If you offer us
money, we might let you do it.
SPEAKERS
The speakers list for Summercon X is still being finalized, but it
is sure to be much less interesting than previous years. In fact,
right now we have NO speakers, and probably we won't until the day
of the con. So again, don't come to summercon for the speakers.
If you are an expert in some aspect of computer, network, or telco
security and are interested in speaking at Summercon, please
contact us to discuss the possibility further at the address
listed at the end of this document.. We won't pay you, don't ask.
We are also going to be having short speeches by real hackers or
phreakers giving their own perspective on some issue or insight
into a new technology. This is an open invitation for you hackers
to be heard; just provide us with a brief outline of the topic you
will be covering and the amount of time you will take (suggested:
5 - 15 minutes) at the address listed below.
COSTS
Costs for SummerCon X are as follows, these are same rates as last
year, which I think is pretty good. There will be NO refunds, and
if you annoy any of the organizers, we reserve the right to throw
you out, and you won't get your money back.
Secret Service / FBI Rate: $500.00
Government / Institutional Rate: $ 80.00
Hacker / Individual Rate: $ 20.00
Members of the United States Secret Service or Federal Bureau of
Investigations, and anyone that has in the past or currently is
providing information or services to the Secret Service or FBI are
required to pay the 'Secret Service / FBI Rate'.
Employees of a local, state, or federal government, members and
associates of any L.E.O., must pay the 'Government / Institutional
Rate'.
Anyone that does not fit into one of the above categories is
eligible for the 'Individual / Hacker Rate'.
Due to historical lack of interest, there will not be
pre-registration for the conference. Registration will begin at
10am the day of the conference, and will continue for the duration
of the conference or until the meeting facilities have reached their
capacity. Since the latter is likely to occur, it is suggested you
don't oversleep.
No purchase orders, checks, money orders, foreign currency, stock
certificates, IOUs, or coins will be accepted for registration.
Secret Service agents, small unmarked bills only, please.
Bring money for t-shirts, they are cool, and this year we will make
enough for everyone (we hope).
HOTEL INFORMATION
Still working on this part.
The cost for a double occupancy room at the hotel is $XX. There is
no special conference rate, there is no need to mention you are with
a conference at all, the people in reservations probably won't know
what you are talking about anyhow.
If the hotel is damaged in any manner, you are going to pay for it,
and you will probably end up in jail. And even if you are lucky
enough to get away with it, the rest of the hackers staying at the
hotel will end up paying for it, and I'm sure that's going to make
you a well-liked and respected hacker, especially among some of the
bigger hackers who might feel tempted to inflict bodily harm on
someone who causes any damage to the hotel. Please act responsibly,
don't drink and drive, chew all your food before you swallow, don't
swallow your gum, and recycle.
Anyhow, if you pull a fire alarm, if you damage a room, if you spit
on the floor, and any of the organizers, or any of their friends
find out, we are going to call the police and have you arrested. In
fact, we are making a game out of it. If anyone does any damage to
the hotel, we will give whoever tells us what person or persons did
it $100 in cash if we are able to get that person taken to jail.
CONTACTING SUMMERCON ORGANIZERS
You can contact the Summercon organizers through e-mail. If you
haven't figured out e-mail yet, you probably shouldn't be coming to
Summercon.
As a final note, if you are planning on coming to Summercon, we
would appreciate you sending e-mail to us with the subject of "GOING
TO SCON" or something similar, just so that we have a rough idea of
how many people are going to show up.
E-mail: scon@2600.com
[=-------------------------------------------------------------------------=]
--== Hacking In Progress ==--
8th, 9th and 10th of August 1997
Near Almere, Netherlands
http://www.hip97.nl/
info@hip97.nl
Welcome to the HIP announcement list. We are not
alone! More than 1600 (!) of you subscribed to this
list.
As you probably already know what HIP is about, this
announcement will focus on how you can help us and how
you can stay informed about HIP. Please read the FAQ
for more common questions.
What is HIP?
------------
HIP is a place for hackers, artists, activists and
many, many others to network themselves, both in the
social and electronic sense of the word. HIP is a
do-it-yourself event. We, the organizers, will provide
the infrastructure, such as large tents, showers,
toilets and large amounts of reliable electrical power
and network connectivity. We'll also arrange for a
basic set of workshops and lectures, mainly dealing
with the social and political aspects of information
technology, security, Internet, access to technology,
new developments, cryptography and other 'hacker-
related' topics that come to mind. We are open to
suggestions for other fields of interest.
At this moment we are working on discussions and
workshops about smartcard security, Tempest attacks,
the SPAM threat, virtual communities, cryptography and
the law (Trusted Third Parties and Key Recovery), a
tele-presence experiment, activism on the Net, and
much more.
A do-it-yourself event?
-----------------------
We will absolutely need your help setting up
everything once we're there. HIPcamp will open on
August 5th, three days before HIP starts. If you
decide to join in that early expect some pretty
primitive circumstances. If you don't care about that,
or think that's the best part, you can help build
HIPnet and all other facilities.
We also urgently need you to think now about what it
is you would like to see and do at HIP. Just like
Hacking at the End of the Universe in 1993, we need
lots of people that have ideas for organizing their
own small part of HIP and the organizational talent to
do this without too much help from us.
One of the proven recipes for fun: