💾 Archived View for clemat.is › saccophore › library › ezines › textfiles › ezines › HWA › hwa-hn46.… captured on 2021-12-04 at 18:04:22.
-=-=-=-=-=-=-
[63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
==========================================================================
= <=-[ HWA.hax0r.news ]-=> =
==========================================================================
[=HWA'99/2000=] Number 46 Volume 1 1999 Dec 12th 99
==========================================================================
[ 61:20:6B:69:64:20:63:6F:75: ]
[ 6C:64:20:62:72:65:61:6B:20:74:68:69:73: ]
[ 20:22:65:6E:63:72:79:70:74:69:6F:6E:22:! ]
==========================================================================
"This newsletter/ezine has been Declassified for the phearing impaired"
____
/ ___|_____ _____ _ __ __ _ __ _ ___
| | / _ \ \ / / _ \ '__/ _` |/ _` |/ _ \
| |__| (_) \ V / __/ | | (_| | (_| | __/
\____\___/ \_/ \___|_| \__,_|\__, |\___|
|___/
This is #46 covering Dec 6th to Dec 12th
(** #47 covers Dec 13th to 19th)
==========================================================================
"ABUSUS NON TOLLIT USUM"
==========================================================================
Mailing list members: 447 Can we bump this up somewhat? spread the word!
==========================================================================
Today the spotlight may be on you, some interesting machines that
have accessed these archives recently...
_ _ _
| | | | ___ | |_
| |_| |/ _ \| __|
| _ | (_) | |_
|_| |_|\___/ \__|
_ _ _ _
| | | (_) |
| |__| |_| |_ ___
| __ | | __/ __|
| | | | | |_\__ \
|_| |_|_|\__|___/
.gov and .mil activity
proxy.gintic.gov.sg
doegate.doe.gov
sunspot.gsfc.nasa.gov
gate1.mcbh.usmc.mil
homer.nawcad.navy.mil
maggie.nawcad.navy.mil
lisa.nawcad.navy.mil
msproxy.transcom.mil
b-kahuna.hickam.af.mil
sc034ws109.nosc.mil
infosec.se
gate2.mcbutler.usmc.mil
sc034ws109.nosc.mil
shq-ot-1178.nosc.mil
dhcp-036190.scott.af.mil
mcreed.lan.teale.ca.gov
dodo.nist.gov
mc1926.mcclellan.af.mil
kwai11.nsf.gov
enduser.faa.gov
vasfw02,fdic.gov
lisa.defcen.gov.au
ps1.pbgc.gov
guardian.gov.sg
amccss229116.scott.af.mil
sc022ws224.nosc.mil
sheppard2.hurlburt.af.mil
marshall.us-state.gov
digger1.defence.gov.au
firewall.mendoza.gov.ar
ipaccess.gov.ru
gatekeeper.itsec-debis.de
fgoscs.itsec-debis.de
fhu-ed4ccdf.fhu.disa.mil
citspr.tyndall.af.mil
kelsatx2.kelly.af.mil
kane.sheppard.af.mil
relay5.nima.mil
host.198-76-34-33.gsa.gov
ntsrvr.vsw.navy.mil
saic2.nosc.mil
wygate.wy.blm.gov
mrwilson.lanl.gov
p722ar.npt.nuwc.navy.mil
ws088228.ramstein.af.mil
car-gw.defence.gov.au
unknown-c-23-147.latimes.com
nytgate1.nytimes.com
There are some interesting machines among these, the *.nosc.mil boxes are
from SPAWAR information warfare centres, good Is It Worth It Followup to see
our boys keeping up with the news... - Ed
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
_ ___ ___ _ ___
| | | \ \ / / \ | |__ __ ___ __/ _ \ _ __ _ __ _____ _____
| |_| |\ \ /\ / / _ \ | '_ \ / _` \ \/ / | | | '__| '_ \ / _ \ \ /\ / / __|
| _ | \ V V / ___ \ _| | | | (_| |> <| |_| | |_ | | | | __/\ V V /\__ \
|_| |_| \_/\_/_/ \_(_)_| |_|\__,_/_/\_\\___/|_(_)|_| |_|\___| \_/\_/ |___/
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
http://welcome.to/HWA.hax0r.news/
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@
# #
@ The HWA website is sponsored by CUBESOFT communications I highly @
# recommend you consider these people for your web hosting needs, #
@ @
# Web site sponsored by CUBESOFT networks http://www.csoft.net #
@ check them out for great fast web hosting! @
# #
# http://www.csoft.net/~hwa @
@ #
@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
_ _ _ _ _____ _ _ _
| | | | __ _ ___| | _____ _ __( )__| ____| |_| |__ (_) ___
| |_| |/ _` |/ __| |/ / _ \ '__|/ __| _| | __| '_ \| |/ __|
| _ | (_| | (__| < __/ | \__ \ |___| |_| | | | | (__
|_| |_|\__,_|\___|_|\_\___|_| |___/_____|\__|_| |_|_|\___|
Sadly, due to the traditional ignorance and sensationalizing of the mass
media, the once-noble term hacker has become a perjorative.
Among true computer people, being called a hacker is a compliment. One of
the traits of the true hacker is a profoundly antibureaucratic and
democratic spirit. That spirit is best exemplified by the Hacker's Ethic.
This ethic was best formulated by Steven Levy in his 1984 book Hackers:
Heroes of the Computer Revolution. Its tenets are as follows:
1 - Access to computers should be unlimited and total.
2 - All information should be free.
3 - Mistrust authority - promote decentralization.
4 - Hackers should be judged by their hacking not bogus criteria such as
degrees, age, race, or position.
5 - You create art and beauty on a computer,
6 - Computers can change your life for the better.
The Internet as a whole reflects this ethic.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
_____ _ _ _
| ___|__ _ __ _ __ ___ __ _| |_| |_(_)_ __ __ _
| |_ / _ \| '__| '_ ` _ \ / _` | __| __| | '_ \ / _` |
| _| (_) | | | | | | | | (_| | |_| |_| | | | | (_| |
|_| \___/|_| |_| |_| |_|\__,_|\__|\__|_|_| |_|\__, |
|___/
A Comment on FORMATTING:
Oct'99 - Started 80 column mode format, code is still left
untouched since formatting will destroy syntax.
I received an email recently about the formatting of this
newsletter, suggesting that it be formatted to 75 columns
in the past I've endevoured to format all text to 80 cols
except for articles and site statements and urls which are
posted verbatim, I've decided to continue with this method
unless more people complain, the zine is best viewed in
1024x768 mode with UEDIT.... - Ed
BTW if anyone can suggest a better editor than UEDIT for
this thing send me some email i'm finding it lacking in
certain areas. Must be able to produce standard ascii.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
__ __ _
| \/ (_)_ __ _ __ ___ _ __ ___
| |\/| | | '__| '__/ _ \| '__/ __|
| | | | | | | | | (_) | | \__ \
|_| |_|_|_| |_| \___/|_| |___/
New mirror sites
*** http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/ ***
http://datatwirl.intranova.net * NEW *
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
http://net-security.org/hwahaxornews
http://www.sysbreakers.com/hwa
http://www.attrition.org/hosted/hwa/
http://www.ducktank.net/hwa/issues.html.
http://hwazine.cjb.net/
http://www.hackunlimited.com/files/secu/papers/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
* http://hwa.hax0r.news.8m.com/
* http://www.fortunecity.com/skyscraper/feature/103/
* Crappy free sites but they offer 20M & I need the space...
** Some issues are not located on these sites since they exceed
the file size limitations imposed by the sites :-( please
only use these if no other recourse is available.
*** Most likely to be up to date other than the main site.
HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net
thanks to airportman for the Cubesoft bandwidth. Also shouts out to all
our mirror sites! and p0lix for the (now expired) digitalgeeks archive
tnx guys.
http://www.csoft.net/~hwa
HWA.hax0r.news Mirror Sites:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
http://www.attrition.org/hosted/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.ducktank.net/hwa/issues.html. ** NEW **
http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT **
http://www.csoft.net/~hwa/
http://www.digitalgeeks.com/hwa. *DOWN*
http://members.tripod.com/~hwa_2k
http://welcome.to/HWA.hax0r.news/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.projectgamma.com/archives/zines/hwa/
http://www.403-security.org/Htmls/hwa.hax0r.news.htm
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
____ _
/ ___| _ _ _ __ ___ _ __ ___(_)___
\___ \| | | | '_ \ / _ \| '_ \/ __| / __|
___) | |_| | | | | (_) | |_) \__ \ \__ \
|____/ \__, |_| |_|\___/| .__/|___/_|___/
|___/ |_|
SYNOPSIS (READ THIS)
--------------------
The purpose of this newsletter is to 'digest' current events of interest
that affect the online underground and netizens in general. This includes
coverage of general security issues, hacks, exploits, underground news
and anything else I think is worthy of a look see. (remember i'm doing
this for me, not you, the fact some people happen to get a kick/use
out of it is of secondary importance).
This list is NOT meant as a replacement for, nor to compete with, the
likes of publications such as CuD or PHRACK or with news sites such as
AntiOnline, the Hacker News Network (HNN) or mailing lists such as
BUGTRAQ or ISN nor could any other 'digest' of this type do so.
It *is* intended however, to compliment such material and provide a
reference to those who follow the culture by keeping tabs on as many
sources as possible and providing links to further info, its a labour
of love and will be continued for as long as I feel like it, i'm not
motivated by dollars or the illusion of fame, did you ever notice how
the most famous/infamous hackers are the ones that get caught? there's
a lot to be said for remaining just outside the circle... <g>
@HWA
=-----------------------------------------------------------------------=
Welcome to HWA.hax0r.news ...
=-----------------------------------------------------------------------=
We could use some more people joining the channel, its usually pretty
quiet, we don't bite (usually) so if you're hanging out on irc stop
by and idle a while and say hi...
**************************************************************************
____| _| |
__| | __ \ _ \ __|
| __| | | __/ |
_____|_| _| _|\___|\__|
Eris Free Net #HWA.hax0r.news
**************************************************************************
*** /join #HWA.hax0r.news on EFnet the key is `zwen' when keyed ***
*** ***
*** please join to discuss or impart news on from the zine and around ***
*** the zine or just to hang out, we get some interesting visitors you ***
*** could be one of em. ***
*** ***
*** Note that the channel isn't there to entertain you its purpose is ***
*** to bring together people interested and involved in the underground***
*** to chat about current and recent events etc, do drop in to talk or ***
*** hangout. Also if you want to promo your site or send in news tips ***
*** its the place to be, just remember we're not #hack or #chatzone... ***
**************************************************************************
=--------------------------------------------------------------------------=
_____ _ _
/ ____| | | | |
| | ___ _ __ | |_ ___ _ __ | |_ ___
| | / _ \| '_ \| __/ _ \ '_ \| __/ __|
| |___| (_) | | | | || __/ | | | |_\__ \
\_____\___/|_| |_|\__\___|_| |_|\__|___/
=--------------------------------------------------------------------------=
[ INDEX ]
=--------------------------------------------------------------------------=
Key Intros
=--------------------------------------------------------------------------=
00.0 .. COPYRIGHTS ......................................................
00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC .......................
00.2 .. SOURCES .........................................................
00.3 .. THIS IS WHO WE ARE ..............................................
00.4 .. WHAT'S IN A NAME? why `HWA.hax0r.news'?..........................
00.5 .. THE HWA_FAQ V1.0 ................................................
ABUSUS NON TOLLIT USUM?
This is (in case you hadn't guessed) Latin, and loosely translated
it means "Just because something is abused, it should not be taken
away from those who use it properly). This is our new motto.
=--------------------------------------------------------------------------=
Key Content
=--------------------------------------------------------------------------=
01.0 .. GREETS ..........................................................
01.1 .. Last minute stuff, rumours, newsbytes ...........................
01.2 .. Mailbag .........................................................
02.0 .. From the Editor..................................................
03.0 .. Melissa conviction to stop virus writers?........................
04.0 .. Government asks hackers for Y2K break............................
05.0 .. China Upholds Death Sentence For Electronic Intruder ............
06.0 .. Symantec Discovers Another Worm .................................
07.0 .. EPIC Sues NSA Over Echelon ......................................
08.0 .. Wyoming Newspaper Attacked ......................................
09.0 .. DoD Offers Military Docs to Surfers .............................
10.0 .. NSA Funds Supercomputer Upgrade .................................
11.0 .. "I was a teenage nmapper"........................................
12.0 .. NIST Meeting Open To The Public .................................
13.0 .. NT Passes Government Security Certifications ....................
14.0 .. Mitnick's Codefendant Sentenced .................................
15.0 .. Videon Suffers Second Intrusion .................................
16.0 .. GSM Phones No Longer Secure .....................................
17.0 .. DARPA Looks At Face Recognition Technology ......................
18.0 .. More Info On the Phonemasters Revealed ..........................
19.0 .. Proactive AntiVirus Software Now Available ......................
20.0 .. South African Web Pages Defaced .................................
21.0 .. Not Just a Game Anymore .........................................
22.0 .. Y2K Fix Really An Extensible Worm ...............................
23.0 .. Distributed DoS Attacks Becoming Popular ........................
24.0 .. FBI to Remain on Alert Over Y2K .................................
25.0 .. IOPS Sets Up Y2K Watch Center ...................................
26.0 .. IDs Embedded In All Color Copies ................................
27.0 .. Valiant of Halcon Speaks ........................................
28.0 .. Scholarships for Surfing ........................................
29.0 .. Dec 8th HNN Rumours..............................................
30.0 .. Alleged Melissa Creator May Plead Guilty ........................
31.0 .. Non-Anonymous Internet Violates First Amendment .................
32.0 .. OSU Charges Two With Illegal Access .............................
33.0 .. Microsoft Files Lawsuit Against Online Pirates ..................
34.0 .. CERT Releases Distributed Attack Paper ..........................
35.0 .. PWC Finds Serious Weaknesses in Pension Fund Company ............
36.0 .. Freaks Macintosh Archives CD ....................................
37.0 .. Nortell Releases Personal Hardware Firewall .....................
38.0 .. sSh/Dap interview by Sla5h.......................................
39.0 .. Melissa Creator Pleads Guilty ...................................
40.0 .. Privacy of US Military Officers Breached ........................
41.0 .. Commerce Dept. Introduces New Security Initiative ...............
42.0 .. Attrition Celebrates One Year Birthday ..........................
43.0 .. Russian Echelon? ................................................
44.0 .. Russian Bug Did Frequency-Hopping ...............................
45.0 .. Security Focus Newsletter #18....................................
=-------------------------------------------------------------------------------=
AD.S .. Post your site ads or etc here, if you can offer something in return
thats tres cool, if not we'll consider ur ad anyways so send it in.
ads for other zines are ok too btw just mention us in yours, please
remember to include links and an email contact. Corporate ads will
be considered also and if your company wishes to donate to or
participate in the upcoming Canc0n99 event send in your suggestions
and ads now...n.b date and time may be pushed back join mailing list
for up to date information.......................................
Current dates: POSTPONED til further notice, place: TBA..........
Ha.Ha .. Humour and puzzles ............................................
Hey You!........................................................
=------=........................................................
Send in humour for this section! I need a laugh and its hard to
find good stuff... ;)...........................................
SITE.1 .. Featured site, .................................................
H.W .. Hacked Websites ...............................................
A.0 .. APPENDICES......................................................
A.1 .. PHACVW linx and references......................................
=--------------------------------------------------------------------------=
@HWA'99
00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _
| | ___ __ _ __ _| |
| | / _ \/ _` |/ _` | |
| |__| __/ (_| | (_| | |
|_____\___|\__, |\__,_|_|
|___/
THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE
OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO
WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT
(LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST
READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ).
Important semi-legalese and license to redistribute:
YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF
AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE
ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED
IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE
APPRECIATED the current link is http://welcome.to/HWA.hax0r.news
IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK
ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL
ME PRIVATELY current email cruciphux@dok.org
THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL
WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL
THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS:
I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE
AND REDISTRIBUTE/MIRROR. - EoD
Although this file and all future issues are now copyright, some of
the content holds its own copyright and these are printed and
respected. News is news so i'll print any and all news but will quote
sources when the source is known, if its good enough for CNN its good
enough for me. And i'm doing it for free on my own time so pfffft. :)
No monies are made or sought through the distribution of this material.
If you have a problem or concern email me and we'll discuss it.
cruciphux@dok.org
Cruciphux [C*:.]
00.1 CONTACT INFORMATION AND MAIL DROP
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _ _
/ ___|___ _ __ | |_ __ _ ___| |_ ___
| | / _ \| '_ \| __/ _` |/ __| __/ __|
| |__| (_) | | | | || (_| | (__| |_\__ \
\____\___/|_| |_|\__\__,_|\___|\__|___/
Wahoo, we now have a mail-drop, if you are outside of the U.S.A or
Canada / North America (hell even if you are inside ..) and wish to
send printed matter like newspaper clippings a subscription to your
cool foreign hacking zine or photos, small non-explosive packages
or sensitive information etc etc well, now you can. (w00t) please
no more inflatable sheep or plastic dog droppings, or fake vomit
thanks.
Send all goodies to:
HWA NEWS
P.O BOX 44118
370 MAIN ST. NORTH
BRAMPTON, ONTARIO
CANADA
L6V 4H5
WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are
~~~~~~~ reading this from some interesting places, make my day and get a
mention in the zine, send in a postcard, I realize that some places
it is cost prohibitive but if you have the time and money be a cool
dude / gal and send a poor guy a postcard preferably one that has some
scenery from your place of residence for my collection, I collect stamps
too so you kill two birds with one stone by being cool and mailing in a
postcard, return address not necessary, just a "hey guys being cool in
Bahrain, take it easy" will do ... ;-) thanx.
Ideas for interesting 'stuff' to send in apart from news:
- Photo copies of old system manual front pages (optionally signed by you) ;-)
- Photos of yourself, your mom, sister, dog and or cat in a NON
compromising position plz I don't want pr0n. <g>
- Picture postcards
- CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250
tapes with hack/security related archives, logs, irc logs etc on em.
- audio or video cassettes of yourself/others etc of interesting phone
fun or social engineering examples or transcripts thereof.
Stuff you can email:
- Prank phone calls in .ram or .mp* format
- Fone tones and security announcements from PBX's etc
- fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities)
- reserved for one smiley face -> :-) <-
- PHACV lists of files that you have or phac cd's you own (we have a burner, *g*)
- burns of phac cds (email first to make sure we don't already have em)
- Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp*
If you still can't think of anything you're probably not that interesting
a person after all so don't worry about it <BeG>
Our current email:
Submissions/zine gossip.....: hwa@press.usmc.net
Private email to editor.....: cruciphux@dok.org
Distribution/Website........: sas2@usa.net
@HWA
00.2 Sources ***
~~~~~~~~~~~
____
/ ___| ___ _ _ _ __ ___ ___ ___
\___ \ / _ \| | | | '__/ __/ _ Y __|
___) | (_) | |_| | | | (_| __|__ \
|____/ \___/ \__,_|_| \___\___|___/
Sources can be some, all, or none of the following (by no means complete
nor listed in any degree of importance) Unless otherwise noted, like msgs
from lists or news from other sites, articles and information is compiled
and or sourced by Cruciphux no copyright claimed.
News & I/O zine ................. http://www.antionline.com/
Back Orifice/cDc..................http://www.cultdeadcow.com/
News site (HNN) .....,............http://www.hackernews.com/
Help Net Security.................http://net-security.org/
News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/
NewsTrolls .(daily news ).........http://www.newstrolls.com/
News + Exploit archive ...........http://www.rootshell.com/beta/news.html
CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest
News site+........................http://www.zdnet.com/
News site+Security................http://www.gammaforce.org/
News site+Security................http://www.projectgamma.com/
News site+Security................http://securityhole.8m.com/
News site+Security related site...http://www.403-security.org/ s
News/Humour site+ ................http://www.innerpulse.com
News/Techie news site.............http://www.slashdot.org
+Various mailing lists and some newsgroups, such as ...
+other sites available on the HNN affiliates page, please see
http://www.hackernews.com/affiliates.html as they seem to be popping up
rather frequently ...
http://www.the-project.org/ .. IRC list/admin archives
http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk
alt.hackers.malicious
alt.hackers
alt.2600
BUGTRAQ
ISN security mailing list
ntbugtraq
<+others>
NEWS Agencies, News search engines etc:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.cnn.com/SEARCH/
http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0
http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack
http://www.ottawacitizen.com/business/
http://search.yahoo.com.sg/search/news_sg?p=hack
http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack
http://www.zdnet.com/zdtv/cybercrime/
http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column)
NOTE: See appendices for details on other links.
http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm
http://freespeech.org/eua/ Electronic Underground Affiliation
http://ech0.cjb.net ech0 Security
http://axon.jccc.net/hir/ Hackers Information Report
http://net-security.org Net Security
http://www.403-security.org Daily news and security related site
Submissions/Hints/Tips/Etc
~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _ _ _
/ ___| _ _| |__ _ __ ___ (_)___ ___(_) ___ _ __ ___
\___ \| | | | '_ \| '_ ` _ \| / __/ __| |/ _ \| '_ \/ __|
___) | |_| | |_) | | | | | | \__ \__ \ | (_) | | | \__ \
|____/ \__,_|_.__/|_| |_| |_|_|___/___/_|\___/|_| |_|___/
All submissions that are `published' are printed with the credits
you provide, if no response is received by a week or two it is assumed
that you don't care wether the article/email is to be used in an issue
or not and may be used at my discretion.
Looking for:
Good news sites that are not already listed here OR on the HNN affiliates
page at http://www.hackernews.com/affiliates.html
Magazines (complete or just the articles) of breaking sekurity or hacker
activity in your region, this includes telephone phraud and any other
technological use, abuse hole or cool thingy. ;-) cut em out and send it
to the drop box.
- Ed
Mailing List Subscription Info (Far from complete) Feb 1999
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~
ISS Security mailing list faq : http://www.iss.net/iss/maillist.html
ATTRITION.ORG's Website defacement mirror and announcement lists
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.attrition.org/mirror/attrition/
http://www.attrition.org/security/lists.html
--
defaced [web page defacement announce list]
This is a public LOW VOLUME (1) mail list to circulate news/info on
defaced web sites. To subscribe to Defaced, send mail to
majordomo@attrition.org with "subscribe defaced" in the BODY of
the mail.
There will be two types of posts to this list:
1. brief announcements as we learn of a web defacement.
this will include the site, date, and who signed the
hack. we will also include a URL of a mirror of the hack.
2. at the end of the day, a summary will be posted
of all the hacks of the day. these can be found
on the mirror site listed under 'relevant links'
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: mcintyre@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
(1) It is low volume on a normal day. On days of many defacements,
traffic may be increased. On a few days, it is a virtual mail
flood. You have been warned. ;)
-=-
--
defaced summary [web page defacement announce list]
This is a low traffic mail list to announce all publicly
defaced domains on a given day. To subscribe to Defaced-Summary, send mail to
majordomo@attrition.org with "subscribe defaced-summary" in the BODY of
the mail.
There will be ONE type of post to this list:
1. a single nightly piece of mail listing all reported
domains. the same information can be found on
http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
-=-
defaced GM [web page defacement announce list]
This is a low traffic mail list to announce all publicly
defaced government and military domains on a given day. To subscribe to
Defaced-GM, send mail to majordomo@attrition.org with "subscribe defaced-gm"
in the BODY of the mail.
There will be ONE type of post to this list:
1. sporadic pieces of mail for each government (.gov)
or military (.mil) system defaced. the same information
can be found on http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is designed primarily for government and military
personell charged with tracking security incidents on
government run networks.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
--
defaced alpha [web page defacement announce list]
This is a low traffic mail list to announce via alpha-numeric
pagers, all publicly defaced government and military domains
on a given day. To subscribe to Defaced-Alpha, send mail to
majordomo@attrition.org with "subscribe defaced-alpha" in
the BODY of the mail.
There will be ONE type of post to this list:
1. sporadic pieces of mail for each government (.gov)
or military (.mil) system defaced. the information
will only include domain names. the same information
can be found on http://www.attrition.org/mirror/attrition/
via sporadic updates.
This list is designed primarily for government and military
personell charged with tracking security incidents on
government run networks. Further, it is designed for
quick response and aimed at law enforcement agencies like
DCIS and the FBI.
To subscribe to this list, a special mail will be sent to YOUR
alpha-numeric pager. A specific response must be made within
12 hours of receiving the mail to be subscribed. If the response
is not received, it is assumed the mail was not sent to your
pager.
This list is for informational purposes only. Subscribing
denotes your acceptance of the following:
1. we have nothing to do with the hacks. at all.
2. we are only mirroring the work of OTHER people.
3. we can not be held liable for anything related to these
hacks.
4. all of the points on the disclaimer listed below.
Under no circumstances may the information on this list be used
to solicit security business. You do not have permission to forward
this mail to anyone related to the domain that was defaced.
enjoy.
List maintainer: jericho@attrition.org
Hosted by: majordomo@attrition.org
Relevant Links:
Disclaimer: http://www.attrition.org/mirror/attrition/notes.html
ATTRITION Mirror: http://www.attrition.org/mirror/
-=-
THE MOST READ:
BUGTRAQ - Subscription info
~~~~~~~~~~~~~~~~~~~~~~~~~~~
What is Bugtraq?
Bugtraq is a full-disclosure UNIX security mailing list, (see the info
file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to
bugtraq, send mail to listserv@netspace.org containing the message body
subscribe bugtraq. I've been archiving this list on the web since late
1993. It is searchable with glimpse and archived on-the-fly with hypermail.
Searchable Hypermail Index;
http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html
About the Bugtraq mailing list
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following comes from Bugtraq's info file:
This list is for *detailed* discussion of UNIX security holes: what they are,
how to exploit, and what to do to fix them.
This list is not intended to be about cracking systems or exploiting their
vulnerabilities. It is about defining, recognizing, and preventing use of
security holes and risks.
Please refrain from posting one-line messages or messages that do not contain
any substance that can relate to this list`s charter.
I will allow certain informational posts regarding updates to security tools,
documents, etc. But I will not tolerate any unnecessary or nonessential "noise"
on this list.
Please follow the below guidelines on what kind of information should be posted
to the Bugtraq list:
+ Information on Unix related security holes/backdoors (past and present)
+ Exploit programs, scripts or detailed processes about the above
+ Patches, workarounds, fixes
+ Announcements, advisories or warnings
+ Ideas, future plans or current works dealing with Unix security
+ Information material regarding vendor contacts and procedures
+ Individual experiences in dealing with above vendors or security organizations
+ Incident advisories or informational reporting
Any non-essential replies should not be directed to the list but to the originator of the message. Please do not
"CC" the bugtraq reflector address if the response does not meet the above criteria.
Remember: YOYOW.
You own your own words. This means that you are responsible for the words that you post on this list and that
reproduction of those words without your permission in any medium outside the distribution of this list may be
challenged by you, the author.
For questions or comments, please mail me:
chasin@crimelab.com (Scott Chasin)
UPDATED Sept/99 - Sent in by Androthi, tnx for the update
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I am pleased to inform you of several changes that will be occurring
on June 5th. I hope you find them as exciting as I do.
BUGTRAQ moves to a new home
---------------------------
First, BUGTRAQ will be moving from its current home at NETSPACE.ORG
to SECURITYFOCUS.COM. What is Security Focus you ask? Wait and read
below. Other than the change of domains nothing of how the list
is run changes. I am still the moderator. We play by the same rules.
Security Focus will be providing mail archives for BUGTRAQ. The
archives go back longer than Netspace's and are more complete than
Geek-Girl's.
The move will occur one week from today. You will not need to
resubscribe. All your information, including subscription options
will be moved transparently.
Any of you using mail filters (e.g. procmail) to sort incoming
mail into mail folders by examining the From address will have to
update them to include the new address. The new address will be:
BUGTRAQ@SECURITYFOCUS.COM
Security Focus also be providing a free searchable vulnerability
database.
BUGTRAQ es muy bueno
--------------------
It has also become apparent that there is a need for forums
in the spirit of BUGTRAQ where non-English speaking people
or people that don't feel comfortable speaking English can
exchange information.
As such I've decided to give BUGTRAQ in other languages a try.
BUGTRAQ will continue to be the place to submit vulnerability
information, but if you feel more comfortable using some other
language you can give the other lists a try. All relevant information
from the other lists which have not already been covered here
will be translated and forwarded on by the list moderator.
In the next couple of weeks we will be introducing BUGTRAQ-JP
(Japanese) which will be moderated by Nobuo Miwa <n-miwa@lac.co.jp>
and BUGTRAQ-SP (Spanish) which will be moderated by CORE SDI S.A.
from Argentina <http://www.core-sdi.com/> (the folks that brought you
Secure Syslog and the SSH insertion attack).
What is Security Focus?
-----------------------
Security Focus is an exercise in creating a community and a security
resource. We hope to be able to provide a medium where useful and
successful resources such as BUGTRAQ can occur, while at the same
time providing a comprehensive source of security information. Aside
from moving just BUGTRAQ over, the Geek-Girl archives (and the Geek Girl
herself!) have moved over to Security Focus to help us with building
this new community. The other staff at Security Focus are largely derived
from long time supporters of Bugtraq and the community in general. If
you are interested in viewing the staff pages, please see the 'About'
section on www.securityfocus.com.
On the community creating front you will find a set of forums
and mailing lists we hope you will find useful. A number of them
are not scheduled to start for several weeks but starting today
the following list is available:
* Incidents' Mailing List. BUGTRAQ has always been about the
discussion of new vulnerabilities. As such I normally don't approve
messages about break-ins, trojans, viruses, etc with the exception
of wide spread cases (Melissa, ADM worm, etc). The other choice
people are usually left with is email CERT but this fails to
communicate this important information to other that may be
potentially affected.
The Incidents mailing list is a lightly moderated mailing list to
facilitate the quick exchange of security incident information.
Topical items include such things as information about rootkits
new trojan horses and viruses, source of attacks and tell-tale
signs of intrusions.
To subscribe email LISTSERV@SECURITYFOCUS.COM with a message body
of:
SUBS INCIDENTS FirstName, LastName
Shortly we'll also be introducing an Information Warfare forum along
with ten other forums over the next two months. These forums will be
built and moderated by people in the community as well as vendors who
are willing to take part in the community building process.
*Note to the vendors here* We have several security vendors who have
agreed to run forums where they can participate in the online communities.
If you would like to take part as well, mail Alfred Huger,
ahuger@securityfocus.com.
On the information resource front you find a large database of
the following:
* Vulnerabilities. We are making accessible a free vulnerability
database. You can search it by vendor, product and keyword. You
will find detailed information on the vulnerability and how to fix it,
as well are links to reference information such as email messages,
advisories and web pages. You can search by vendor, product and
keywords. The database itself is the result of culling through 5
years of BUGTRAQ plus countless other lists and news groups. It's
a shining example of how thorough full disclosure has made a significant
impact on the industry over the last half decade.
* Products. An incredible number of categorized security products
from over two hundred different vendors.
* Services. A large and focused directory of security services offered by
vendors.
* Books, Papers and Articles. A vast number of categorized security
related books, papers and articles. Available to download directly
for our servers when possible.
* Tools. A large array of free security tools. Categorized and
available for download.
* News: A vast number of security news articles going all the way
back to 1995.
* Security Resources: A directory to other security resources on
the net.
As well as many other things such as an event calendar.
For your convenience the home-page can be personalized to display
only information you may be interested in. You can filter by
categories, keywords and operating systems, as well as configure
how much data to display.
I'd like to thank the fine folks at NETSPACE for hosting the
site for as long as they have. Their services have been invaluable.
I hope you find these changes for the best and the new services
useful. I invite you to visit http://www.securityfocus.com/ and
check it out for yourself. If you have any comments or suggestions
please feel free to contact me at this address or at
aleph1@securityfocus.com.
Cheers.
--
Aleph One / aleph1@underground.org
http://underground.org/
KeyID 1024/948FD6B5
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01
Crypto-Gram
~~~~~~~~~~~
CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
insights, and commentaries on cryptography and computer security.
To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
blank message to crypto-gram-subscribe@chaparraltree.com.� To unsubscribe,
visit http://www.counterpane.com/unsubform.html.� Back issues are available
on http://www.counterpane.com.
CRYPTO-GRAM is written by Bruce Schneier.� Schneier is president of
Counterpane Systems, the author of "Applied Cryptography," and an inventor
of the Blowfish, Twofish, and Yarrow algorithms.� He served on the board of
the International Association for Cryptologic Research, EPIC, and VTW.� He
is a frequent writer and lecturer on cryptography.
CUD Computer Underground Digest
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This info directly from their latest ish:
Computer underground Digest��� Sun� 14 Feb, 1999�� Volume 11 : Issue 09
�����
��������������������� ISSN� 1004-042X
������ Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
������ News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
������ Archivist: Brendan Kehoe
������ Poof Reader:�� Etaion Shrdlu, Jr.
������ Shadow-Archivists: Dan Carosone / Paul Southworth
������������������������� Ralph Sims / Jyrki Kuoppala
������������������������� Ian Dickinson
������ Cu Digest Homepage: http://www.soci.niu.edu/~cudigest
[ISN] Security list
~~~~~~~~~~~~~~~~~~~
This is a low volume list with lots of informative articles, if I had my
way i'd reproduce them ALL here, well almost all .... ;-) - Ed
UPDATED Sept/99 - Sent in by Androthi, tnx for the update
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--[ New ISN announcement (New!!)
Sender: ISN Mailing List <ISN@SECURITYFOCUS.COM>
From: mea culpa <jericho@DIMENSIONAL.COM>
Subject: Where has ISN been?
Comments: To: InfoSec News <isn@securityfocus.com>
To: ISN@SECURITYFOCUS.COM
It all starts long ago, on a network far away..
Not really. Several months ago the system that hosted the ISN mail list
was taken offline. Before that occured, I was not able to retrieve the
subscriber list. Because of that, the list has been down for a while. I
opted to wait to get the list back rather than attempt to make everyone
resubscribe.
As you can see from the headers, ISN is now generously being hosted by
Security Focus [www.securityfocus.com]. THey are providing the bandwidth,
machine, and listserv that runs the list now.
Hopefully, this message will find all ISN subscribers, help us weed out
dead addresses, and assure you the list is still here. If you have found
the list to be valuable in the past, please tell friends and associates
about the list. To subscribe, mail listserv@securityfocus.com with
"subscribe isn firstname lastname". To unsubscribe, "unsubscribe isn".
As usual, comments and suggestions are welcome. I apologize for the down
time of the list. Hopefully it won't happen again. ;)
mea_culpa
www.attrition.org
--[ Old ISN welcome message
[Last updated on: Mon Nov 04 0:11:23 1998]
InfoSec News is a privately run, medium traffic list that caters
to distribution of information security news articles. These
articles will come from newspapers, magazines, online resources,
and more.
The subject line will always contain the title of the article, so that
you may quickly and effeciently filter past the articles of no interest.
This list will contain:
o Articles catering to security, hacking, firewalls, new security
encryption, products, public hacks, hoaxes, legislation affecting
these topics and more.
o Information on where to obtain articles in current magazines.
o Security Book reviews and information.
o Security conference/seminar information.
o New security product information.
o And anything else that comes to mind..
Feedback is encouraged. The list maintainers would like to hear what
you think of the list, what could use improving, and which parts
are "right on". Subscribers are also encouraged to submit articles
or URLs. If you submit an article, please send either the URL or
the article in ASCII text. Further, subscribers are encouraged to give
feedback on articles or stories, which may be posted to the list.
Please do NOT:
* subscribe vanity mail forwards to this list
* subscribe from 'free' mail addresses (ie: juno, hotmail)
* enable vacation messages while subscribed to mail lists
* subscribe from any account with a small quota
All of these generate messages to the list owner and make tracking
down dead accounts very difficult. I am currently receiving as many
as fifty returned mails a day. Any of the above are grounds for
being unsubscribed. You are welcome to resubscribe when you address
the issue(s).
Special thanks to the following for continued contribution:
William Knowles, Aleph One, Will Spencer, Jay Dyson,
Nicholas Brawn, Felix von Leitner, Phreak Moi and
other contributers.
ISN Archive: ftp://ftp.repsec.com/pub/text/digests/isn
ISN Archive: http://www.landfield.com/isn
ISN Archive: http://www.jammed.com/Lists/ISN/
ISN is Moderated by 'mea_culpa' <jericho@dimensional.com>. ISN is a
private list. Moderation of topics, member subscription, and
everything else about the list is solely at his discretion.
The ISN membership list is NOT available for sale or disclosure.
ISN is a non-profit list. Sponsors are only donating to cover bandwidth
and server costs.
Win2k Security Advice Mailing List (new added Nov 30th)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To subscribe:
send "SUBSCRIBE WIN2KSECADVICE anonymous or name" in the message body
to listserv@listserv.ntsecurity.net
Welcome to Win2K Security Advice! Thank you for subscribing. If you have any
questions or comments about the list please feel free to contact the list
moderator, Steve Manzuik, at steve@win2ksecadvice.net.
To see what you've missed recently on the list, or to research an item
of interest, be sure to visit the Web-based archives located at:
http://www.ntsecurity.net/scripts/page_listserv.asp?s=win2ksec
==============
NTSecurity.net brings the security community a brand new (Oct 99) and
much-requested Windows security mailing list. This new moderated mailing list,
Win2KSecAdvice (formerly NTSecAdvice,) is geared towards promoting the open
discussion of Windows-related security issues.
With a firm and unwavering commitment towards timely full disclosure, this
new resource promises to become a great forum for open discussion
regarding security-related bugs, vulnerabilities, potential exploits, virus,
worms, Trojans, and more. Win2KSecAdvice promotes a strong sense of community
and we openly invite all security minded individuals, be they white hat,
gray hat, or black hat, to join the new mailing list.
While Win2KSecAdvice was named in the spirit of Microsoft's impending product
line name change, and meant to reflect the list's security focus both now and
in the long run, it is by no means limited to security topics centered around
Windows 2000. Any security issues that pertain to Windows-based networking are
relevant for discussion, including all Windows operating systems, MS Office,
MS BackOffice, and all related third party applications and hardware.
The scope of Win2KSecAdvice can be summarized very simply: if it's relevant to
a security risk, it's relevant to the list.
The list archives are available on the Web at http://www.ntsecurity.net,
which include a List Charter and FAQ, as well as Web-based searchable list
archives for your research endeavors.
SAVE THIS INFO FOR YOUR REFERENCE:
To post to the list simply send your email to
win2ksecadvice@listserv.ntsecurity.net
To unsubscribe from this list, send UNSUBSCRIBE WIN2KSECADVICE to
listserv@listserv.ntsecurity.net
Regards,
Steve Manzuik, List Moderator
Win2K Security Advice
steve@win2ksecadvice.net
@HWA
00.3 THIS IS WHO WE ARE
~~~~~~~~~~~~~~~~~~
__ ___ ___
\ \ / / |__ ___ __ _ _ __ _____ ____|__ \
\ \ /\ / /| '_ \ / _ \ / _` | '__/ _ \ \ /\ / / _ \/ /
\ V V / | | | | (_) | (_| | | | __/\ V V / __/_|
\_/\_/ |_| |_|\___/ \__,_|_| \___| \_/\_/ \___(_)
Some HWA members and Legacy staff
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cruciphux@dok.org.........: currently active/editorial
darkshadez@ThePentagon.com: currently active/man in black
fprophet@dok.org..........: currently active/programming/IRC+ man in black
sas2@usa.net .............. currently active/IRC+ distribution
vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black
dicentra...(email withheld): IRC+ grrl in black
twisted-pair@home.com......: currently active/programming/IRC+
Foreign Correspondants/affiliate members
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Qubik ............................: United Kingdom
D----Y ...........................: USA/world media
HWA members ......................: World Media
Past Foreign Correspondants (currently inactive or presumed dead)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sla5h.............................: Croatia
N0Portz ..........................: Australia
system error .....................: Indonesia
Wile (wile coyote) ...............: Japan/the East
Ruffneck ........................: Netherlands/Holland
Wyze1.............................: South Africa
Please send in your sites for inclusion here if you haven't already
also if you want your emails listed send me a note ... - Ed
Spikeman's site is down as of this writing, if it comes back online it will be
posted here.
http://www.hackerlink.or.id/ ............ System Error's site (in Indonesian)
Sla5h's email: smuddo@yahoo.com
*******************************************************************
*** /join #HWA.hax0r.news on EFnet the key is `zwen' ***
*******************************************************************
:-p
1. We do NOT work for the government in any shape or form.Unless you count paying
taxes ... in which case we work for the gov't in a BIG WAY. :-/
2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news
events its a good idea to check out issue #1 at least and possibly also the
Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ...
@HWA
00.4 Whats in a name? why HWA.hax0r.news??
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Well what does HWA stand for? never mind if you ever find out I may
have to get those hax0rs from 'Hackers' or the Pretorians after you.
In case you couldn't figure it out hax0r is "new skewl" and although
it is laughed at, shunned, or even pidgeon holed with those 'dumb
leet (l33t?) dewds' <see article in issue #4> this is the state
of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you
up and comers, i'd highly recommend you get that book. Its almost
like buying a clue. Anyway..on with the show .. - Editorial staff
@HWA
00.5 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ ___ ___ _____ _ ___
| | | \ \ / / \ | ___/ \ / _ \
| |_| |\ \ /\ / / _ \ | |_ / _ \| | | |
| _ | \ V V / ___ \ _| _/ ___ \ |_| |
|_| |_| \_/\_/_/ \_(_)_|/_/ \_\__\_\
Also released in issue #3. (revised) check that issue for the faq
it won't be reprinted unless changed in a big way with the exception
of the following excerpt from the FAQ, included to assist first time
readers:
Some of the stuff related to personal useage and use in this zine are
listed below: Some are very useful, others attempt to deny the any possible
attempts at eschewing obfuscation by obsucuring their actual definitions.
@HWA - see EoA ;-)
!= - Mathematical notation "is not equal to" or "does not equal"
ASC(247) "wavey equals" sign means "almost equal" to. If written
an =/= (equals sign with a slash thru it) also means !=, =< is Equal
to or less than and => is equal to or greater than (etc, this aint
fucking grade school, cripes, don't believe I just typed all that..)
AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21)
AOL - A great deal of people that got ripped off for net access by a huge
clueless isp with sekurity that you can drive buses through, we're
not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the
least they could try leasing one??
*CC - 1 - Credit Card (as in phraud)
2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's
CCC - Chaos Computer Club (Germany)
*CON - Conference, a place hackers crackers and hax0rs among others go to swap
ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk
watch videos and seminars, get drunk, listen to speakers, and last but
not least, get drunk.
*CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker
speak he's the guy that breaks into systems and is often (but by no
means always) a "script kiddie" see pheer
2 . An edible biscuit usually crappy tasting without a nice dip, I like
jalapeno pepper dip or chives sour cream and onion, yum - Ed
Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger
Vanilla Ice is a wigger, The Beastie Boys and rappers speak using
ebonics, speaking in a dark tongue ... being ereet, see pheer
EoC - End of Commentary
EoA - End of Article or more commonly @HWA
EoF - End of file
EoD - End of diatribe (AOL'ers: look it up)
FUD - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt",
usually in general media articles not high brow articles such as ours or other
HNN affiliates ;)
du0d - a small furry animal that scurries over keyboards causing people to type
weird crap on irc, hence when someone says something stupid or off topic
'du0d wtf are you talkin about' may be used.
*HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R
*HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to
define, I think it is best defined as pop culture's view on The Hacker ala
movies such as well erhm "Hackers" and The Net etc... usually used by "real"
hackers or crackers in a derogatory or slang humorous way, like 'hax0r me
some coffee?' or can you hax0r some bread on the way to the table please?'
2 - A tool for cutting sheet metal.
HHN - Maybe a bit confusing with HNN but we did spring to life around the same
time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper
noun means the hackernews site proper. k? k. ;&
HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html
J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d
MFI/MOI- Missing on/from IRC
NFC - Depends on context: No Further Comment or No Fucking Comment
NFR - Network Flight Recorder (Do a websearch) see 0wn3d
NFW - No fuckin'way
*0WN3D - You are cracked and owned by an elite entity see pheer
*OFCS - Oh for christ's sakes
PHACV - And variations of same <coff>
Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare
Alternates: H - hacking, hacktivist
C - Cracking <software>
C - Cracking <systems hacking>
V - Virus
W - Warfare <cyberwarfare usually as in Jihad>
A - Anarchy (explosives etc, Jolly Roger's Cookbook etc)
P - Phreaking, "telephone hacking" PHone fREAKs ...
CT - Cyber Terrorism
*PHEER - This is what you do when an ereet or elite person is in your presence
see 0wn3d
*RTFM - Read the fucking manual - not always applicable since some manuals are
pure shit but if the answer you seek is indeed in the manual then you
should have RTFM you dumb ass.
TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0
TBA - To Be Arranged/To Be Announced also 2ba
TFS - Tough fucking shit.
*w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions
from the underground masses. also "w00ten" <sic>
2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers)
*wtf - what the fuck, where the fuck, when the fuck etc ..
*ZEN - The state you reach when you *think* you know everything (but really don't)
usually shortly after reaching the ZEN like state something will break that
you just 'fixed' or tweaked.
@HWA
-=- :. .: -=-
01.0 Greets!?!?! yeah greets! w0w huh. - Ed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
____ _
/ ___|_ __ ___ ___| |_ ___
| | _| '__/ _ \/ _ \ __/ __|
| |_| | | | __/ __/ |_\__ \
\____|_| \___|\___|\__|___/
Thanks to all in the community for their support and interest but i'd
like to see more reader input, help me out here, whats good, what sucks
etc, not that I guarantee i'll take any notice mind you, but send in
your thoughts anyway.
* all the people who sent in cool emails and support
FProphet Pyra TwstdPair _NeM_
D----Y Dicentra vexxation sAs72
Spikeman p0lix Vortexia Wyze1
Pneuma Raven Zym0t1c duro
Repluzer astral BHZ ScrewUp
Qubik gov-boi _Jeezus_ Haze_
thedeuce ytcracker
Folks from #hwa.hax0r,news and #fawkerz
Ken Williams/tattooman ex-of PacketStorm,
& Kevin Mitnick
kewl sites:
+ http://www.hack.co.za NEW
+ http://blacksun.box.sk. NEW
+ http://packetstorm.securify.com/ NEW
+ http://www.securityportal.com/ NEW
+ http://www.securityfocus.com/ NEW
+ http://www.hackcanada.com/
+ http://www.l0pht.com/
+ http://www.2600.com/
+ http://www.freekevin.com/
+ http://www.genocide2600.com/
+ http://www.hackernews.com/ (Went online same time we started issue 1!)
+ http://www.net-security.org/
+ http://www.slashdot.org/
+ http://www.freshmeat.net/
+ http://www.403-security.org/
+ http://ech0.cjb.net/
@HWA
01.1 Last minute stuff, rumours and newsbytes
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"What is popular isn't always right, and what is right isn't
always popular..."
- FProphet '99
+++ When was the last time you backed up your important data?
++ AMD demostrates 900 MHz chips
December 17, 1999
"Advanced Micro Devices Inc. has demonstrated two different versions of its Athlon microprocessor running at 900
MHz. One uses the company's standard 0.18-micron process with aluminum interconnects, while the second is
produced at the same line width but comes from AMD's Dresden, Germany, fab and features copper interconnects."
Thanks to myself for providing the info from my wired news feed and others from whatever
sources, also to Spikeman for sending in past entries.... - Ed
@HWA
01.2 MAILBAG - email and posts from the message board worthy of a read
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Yeah we have a message board, feel free to use it, remember there are no stupid questions...
well there are but if you ask something really dumb we'll just laugh at ya, lets give the
message board a bit more use eh? i'll be using a real message board when the hwa-iwa.org
domain comes back online (soon) meanwhile the beseen board is still up...
==============================================================================
02.0 From the editor.
~~~~~~~~~~~~~~~~
#include <stdio.h>
#include <thoughts.h>
#include <backup.h>
main()
{
printf ("Read commented source!\n\n");
/*
* *still sick* ! this will prolly be a shorter issue than
* normal like last weeks, so enjoy what there is and we'll
* be back on track soon... sorry for the lack of quality
* I'm striving to catch up so I can provide you with the
* info you're used to getting in these issues, the last
* couple are definately not my best works.... hang in
* there... This issue 'features' an interview with the
* now defunct sSh... check it out, and I still want
* articles so send em in!... cruciphux@dok.org
*/
printf ("EoF.\n");
}
Congrats, thanks, articles, news submissions and kudos to us at the
main address: hwa@press.usmc.net complaints and all nastygrams and
mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to
127.0.0.1, private mail to cruciphux@dok.org
danke.
C*:.
-= start =--= start =--= start =--= start =--= start =--= start =--= start
____ _ _
/ ___|___ _ __ | |_ ___ _ __ | |_
| | / _ \| '_ \| __/ _ \ '_ \| __|
| |__| (_) | | | | || __/ | | | |_
\____\___/|_| |_|\__\___|_| |_|\__|
/ ___|| |_ __ _ _ __| |_
\___ \| __/ _` | '__| __|
___) | || (_| | | | |_
|____/ \__\__,_|_| \__|
-= start =--= start =--= start =--= start =--= start =--= start =--=
03.0 Melissa conviction to stop virus writers?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Contributed by Spikeman
http://www.zdnet.com/filters/printerfriendly/0,6061,2406928-2,00.html
--------------------------------------------------------------
This story was printed from ZDNN,
located at http://www.zdnet.com/zdnn.
--------------------------------------------------------------
Melissa conviction to stop virus writers?
By Robert Lemos, ZDNN
December 9, 1999 5:25 PM PT
URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2406928,00.html
Law enforcement officials and computer security specialists say that David L. Smith's conviction in
the Melissa virus case -- the first successful prosecution of a virus writer in the United States --
will have a strong chilling effect on other authors of malicious code.
"We are hoping that the sentence has a significant deterrent impact," said Robert J. Cleary, the
U.S. attorney for the District of New Jersey, who led the federal prosecution. "I think this will
have the effect we want. Those predisposed to white-collar crimes really do balance risk versus
reward."
Smith, 31, pleaded guilty in both state and federal courts on Thursday, agreeing that the virus he
wrote and released -- named "Melissa" after a Florida stripper -- caused $80 million in damages
(the minimum monetary amount needed in order to trigger stiffer federal sentencing guidelines).
Smith is expected to receive anywhere between a four- and five-year sentence in the federal case
and up to a 10-year sentence in the state case, accompanied by total fines of up to $400,000. As
part of the plea agreement, state prosecutors have recommended that the sentences run
concurrently.
"The sentencing guidelines attempt to minimize disparity. If that works here, then anyone else that
sends a virus out that does $80 million in damage should expect a similar sentence," said Cleary.
Melissa's March madness
The Melissa macro computer virus hit companies on Friday, March 26 after being released to a
Usenet newsgroup as part of a list of porn sites contained in a Word document infected with the
virus.
The virus, which mailed itself out to the first 50 addresses listed in the address book of Microsoft's
Outlook e-mail client, caused a massive spike in e-mail traffic, flooding corporate e-mail servers.
Companies such as Microsoft Corp. (Nasdaq:MSFT), Intel Corp. (Nasdaq:INTC), Lockheed
Martin Corp. (NYSE:LMT) and Lucent Technologies Inc. (NYSE:LU) shut down their gateways
to the Internet in the face of the threat.
Smith -- then a resident of Aberdeen, N.J. -- was arrested on April 1 by New Jersey authorities.
"This becomes a landmark case, because it's the first time the (U.S.) federal government has
successfully prosecuted a computer virus writer," said Dr. Peter Tippett, chief technologist at
computer security firm ICSA.net, which helped the U.S. prosecutors estimate the damages caused
by Melissa.
Deterrent effect
Tippett and others point to a virus case in England as potential proof that such a deterrent could
work.
In November 1995, the UK courts sentenced Chris Pile -- known
underground as the Black Baron -- to 18 months in jail. The 26-year-old,
self-taught programmer admitted to five counts of unauthorized access to
computers to facilitate crime and five unauthorized modifications of computer
software over a two-year period.
Since that time, no major viruses have come out of the UK, said Tippett.
Smith appeared in Monmouth County, N.J., Superior Court at 10 a.m. ET
on Thursday, followed by his appearance at the U.S. District Court in
Newark at 1:30 p.m. ET to answer to federal charges in the case. In both
courtrooms, Smith admitted his guilt and agreed with the damages.
When the judge in the Monmouth County court case asked if Smith agreed that it caused $80
million in damage to computer systems nationwide, Smith replied, "I certainly agree. It did result in
those consequences -- without question."
Edward Borden, Smith's attorney in the case, could not be reached for comment.
@HWA
04.0 Government asks hackers for Y2K break
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://www.zdnet.com/zdnn/stories/news/0,4586,2408969,00.html
Contributed by Duro
Government asks hackers for Y2K break
President Clinton's Y2K guru asks for a hack
moratorium during the New Millennium
weekend.
By Jim Wolf, Reuters
December 14, 1999 10:52 AM PT
WASHINGTON -- President Clinton's top aide on Y2K
matters has urged computer hackers to exercise
self-restraint until after year 2000 technology fears
largely have passed.
In an unusual plea for mercy, John Koskinen, chairman of
the President's Council on Year 2000 Conversion, said
that some people regard piercing computer network
security to be a "great public service" because it calls
attention to security cracks.
"Hopefully those people will recognize
we're going to have enough things
going on that (New Year's) weekend
that this will not be a particularly good
weekend to demonstrate the need for
more information security," he said on
Monday.
"If you want to, in fact, make those points, my hope is
(you'll) make them the following weekend," when Y2K
confusion is expected to have subsided, Koskinen said in
reply to a reporter's question.
One major concern of authorities is that confusion during
the century date change could mask a wide range of
malicious anti-U.S. activity, including possible
computer-based attacks by hostile nations or guerrillas.
Michael Vatis, the FBI agent who serves as the nation's
top "cyber-cop," said last week that the interagency outfit
he heads -- the National Infrastructure Protection Center
-- would be on alert although it had no hard evidence of
any planned attacks.
"It's natural to expect there might be people doing stupid
things with computers," he said of possible cyber attacks
timed to exploit any high-tech confusion sparked by the
century date change.
Increased vigilance" urged
Bruce McConnell, a former White House information
technology expert who now runs the U.N.-sponsored
International Y2K Cooperation Center, said viruses timed
to trigger on Jan. 1 appeared to be spreading, notably
hidden in e-mail attachments.
"Clearly the end of the year is a
time for increased vigilance with
respect to computer security,"
McConnell said in a telephone
interview.
Adding to the confusion may be
so-called denial-of-service attacks
aimed at swamping government or private sector Web
sites, according to Clark Staten, executive director of the
Chicago-based Emergency Response and Research
Institute.
Last week, the U.S. Office of Personnel Management
announced it would interrupt its Internet services for
"several hours" during the New Year's weekend as a
guard against hackers, power surges and other possible
Y2K headaches. The agency said it would bar access
during that limited period to the many data banks
normally available on its Web site.
The Defense Department and the U.S. Agriculture
Department said last week they also were considering
such precautions.
Growing number of computer viruses seen
Anti-virus software makers have reported a growing
number of computer viruses timed to go off on or about
Jan. 1, when systems engineered to recognize only the
last two digits in a date field may confuse 2000 with
1900.
"We are starting to see an increased frequency of viruses
related to the year 2000. Some of them are timed to
trigger on January first," said Narendar Mangalam,
director of security strategy for Computer Associates, an
Islandia, New York-based business computing firm.
The CERT Coordination Center, a Defense
Department-funded computer security project at Carnegie
Mellon University in Pittsburgh, said it did not consider
Y2K viruses a greater threat than the many others it has
tracked.
"There may be viruses that are particularly virulent that I'm
not familiar with that are set to go off on January first,"
Shawn Hernan, CERT's team leader for vulnerability
handling, said in a telephone interview.
"In general, though, if you are susceptible to viruses that
are spreading to be triggered on January first, you're
going to be susceptible to those that are triggered to go
off on January second and January third, and so on and
so forth," he said.
The best defense, Hernan said, was keeping up to date
with anti-virus software updates, avoiding running
programs of unknown origin, maintaining backups, paying
attention to anomalies and reporting them to network
security administrators.
@HWA
05.0 China Upholds Death Sentence For Electronic Intruder
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Ryan and Zorro
The death sentence, imposed as punishment for Hao
Jingwen last year, was upheld by The Yangzhou
Intermediate People's Court in eastern Jiangsu province.
Jingwen, together with his brother Hao Jinglong,
electronically broke into the system of a state run bank
that one of them worked at and transferred somewhere
between $31,000 and $87,000US (reports vary) into an
account they opened under false names. The elder of
the two brothers, Hao Jinglong, received life in prison
instead of the death penalty for assisting the police in
their investigation.
Reuters - via Yahoo
http://dailynews.yahoo.com/h/nm/19991203/tc/china_hacker_1.html
Associated Press - via Yahoo
http://dailynews.yahoo.com/h/ap/19991203/wl/china_death_sentences_1.html
Friday December 3 11:47 PM ET
China Upholds Death Sentence for Computer Hacker
BEIJING (Reuters) - A Chinese court has upheld the death sentence for a
man who hacked into the computer system of a state bank to steal money,
the Financial News reported on Saturday.
The Yangzhou Intermediate People's Court in eastern Jiangsu province
rejected the appeal of Hao Jingwen, upholding a death sentence imposed
last year, the newspaper said. Hao Jingwen and his brother Hao Jinglong
hacked into the computer network of the Industrial and Commercial Bank
of China and shifted 720,000 yuan ($87,000) into accounts they had opened
under false names, it said.
They withdrew 260,000 yuan from the bank accounts in September last year,
the newspaper said.
Hao Jinglong, who was also originally sentenced to death, received a
suspended death sentence in return for his testimony, it said.
($1.0 - 8.28 yuan)
AP;
Friday December 3 10:25 PM ET
Chinese Bank Hacker Gets Death
BEIJING - A court in the southern city of Yangzhou has sentenced one man
to death and his elder brother to life imprisonment for hacking into a
bank's computer system to steal $31,500, the state-run newspaper Beijing
Morning Post said Saturday.
An appeal by the two brothers was rejected after a higher court upheld the
recent decision by the Yangzhou Intermediate Court, the report said.
It said Hao Jingwen and Hao Jinglong used a homemade computer to hack into
the Industrial and Commercial Bank of China's system, where they set up fake
bank accounts.
By the time they were caught, they had withdrawn $30,266 in embezzled funds.
Police recovered all but $1,200 of it, the report said.
It said the Hao Jinglong, the elder brother, got a lighter sentence because
he had aided the police in their investigation.
In a separate report, the newspaper Guangming Daily said Lin Guodi, the
director of the Machinery Bureau in central Hunan province, was sentenced
Friday to death for taking $638,000 in bribes. Lin's son, Lin Ruhai was given
a life sentence and his wife, Zhao Youjuan, got a six-year jail term, it said.
Lin and his son lost their appeals, it said.
The reports did not say in either case if the death sentences had been carried
out.
@HWA
06.0 Symantec Discovers Another Worm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Nicola_Hibberd and no0ne
The W32.Mypics worm has four payloads. It emails itself
to fifty people in your address book, changes the web
browsers home page to a porn site and then attempts
to reformat the local hard drive. Also on Jan 1, 2000 the
worm attempts to overwrite the the checksum data in
the host computer's CMOS. Symantic, the discoverer of
the worm says that this is the fifth such virus it has
found with a payload that triggers at the start of the
new year. This worm appears to only infect people
running email clients from Microsoft.
ZDNet UK
http://www.zdnet.co.uk/news/1999/48/ns-11935.html
Newsbytes - via CNNfn
http://www.cnnfn.com/news/technology/newsbytes/140247.html
Reuters - via Yahoo
http://dailynews.yahoo.com/h/nm/19991206/tc/yk_virus_3.html
Fri, 03 Dec 1999 16:38:00 GMT
Will Knight
Symantec discover the nasty 'W32.Mypics worm'
A new mega-virus that combines three potentially devastating
characteristics has been found in the wild by the research
laboratories at Symantec Anti-Virus
Once the W32.Mypics worm arrives at an Outlook inbox, it sends
itself out to 50 people in the address book and attempts to convert
the Web browser's home page to a porn site. It also does its level
best to format the local hard drive.
Although Symantec has received only a small number of reports of
Mypics, Aled Miles managing director for Symantec UK and
Ireland says now is a crucial period in the development of the virus
that was found in the wild at 4.48 GMT Friday. "If it's going to
break, it's going to do it soon," he warns. "This sort of thing
happens very quickly."
Miles also believes Mypics represents a worrying new trend in
virus technology. "The capability of viruses is increasing greatly,
that's they key thing. There's a lot of talk about hype but you only
need one of these to cause a lot of damage."
Another daunting prospect raised by Miles: "What happens if two
or three of these happens at the same time? Time is definitely
condensing. Is this going to be a trend continuing up to and
beyond the New Year?"
A update for Symantec's anti-virus software that combats Mypics
can be downloaded from the company's labs .
http://www.sarc.com/avcenter/venc/data/w32.mypics.worm.html
-=-
Dangerous Y2K Worm Starts Weekend With A Bang
December 03, 1999: 4:59 p.m. ET
CUPERTINO, CALIFORNIA, U.S.A. (NB) -- By Steve Gold,
Newsbytes. Symantec's [NASDAQ:SYMC] Anti-virus
Research Center reported this morning that it has
discovered a new worm virus that reformats PC users' hard
disks and switches their Web browser home page to an
adult site.
Yunsun Wee, a spokesperson for Symantec, told
Newsbytes that the Y2K virus is no relation to the MiniZip
worm virus that hit PC users earlier this week and is far
more deadly.
"This is the fifth Y2K virus we've come across so far, but
it's the most deadly in that it can reformat a user's hard
disk, as well as cause other problems," she said.
Wee added that the virus was discovered overnight by the
company's SARC operation, and, as a result, the company
issued a public warning via the business wire service this
morning.
"Unlike MiniZip, which everyone reported on earlier this
week, and which was actually discovered some days earlier,
we wanted to ensure that we got the warning message out
as quickly as possible," she said.
Symantec says that the virus disguises itself as a Y2K
problem, and is received as an e-mail attachment disguised
as a picture.
Once the program infects the host PC, it attempts to
send itself using Microsoft Outlook to up to 50 people in the
users' Microsoft Outlook address book. It also changes the
home page in Internet Explorer to a site containing adult
content.
Additionally, Symantec warns, on Jan. 1, 2000, the
program will overwrite the checksum data in the host
computer's CMOS (complimentary metal oxide
semiconductor) memory so when the system is rebooted
the user will think that there may be a Y2K-related problem
with the computer's BIOS (basic input/output system).
The firm says that, once the PC is restarted, the virus will
attempt to format the local hard drives and erase all data.
Symantec says that the W32/Mypics.worm can be easily
spotted, since it arrives in an e-mail, with no subject line.
The body of the message reads, "Here's some pictures for
you!" with a Pics4You.exe" attachment that is
approximately 34,304 bytes in size.
Once the user opens the attachment, the worm loads
itself into memory and executes by sending out copies of
itself attached to e-mail addressed to up to 50 people in the
user's address list.
In addition, Symantec says that the code modifies the
system registry to load its dropped file "cbios.com" on
system startup and also changes the user's home page in
Internet Explorer to
http://www.geocities.com/siliconvalley/vista/8279/index.html,
a Web site that contains some adult content.
The firm advises PC users not to attempt to open the
attached document. Symantec anti-virus users should also
download a new definition set - available immediately
through the company's LiveUpdate feature or from the
Symantec Web site at
http://www/symantec.com/avcenter/download.html .
Reported by Newsbytes.com, http://www.newsbytes.com
.
10:22 CST Reposted 15:49 CST
(19991203/Press Contact: Yunsun Wee, Symantec
-=-
Monday December 6 2:43 AM ET
Virus Trackers Report Bug Aimed at Y2K
SAN FRANCISCO (Reuters) - The computer world's mischief makers struck
this week with the first in what is expected to be a wave of viruses
set to go off Jan. 1, 2000, computer experts said on Friday.
A virus was discovered in computer systems of a number of companies, set
to go off at New Year's and erase data from users' hard drives, security
experts reported.
``This is the first Y2K virus we've seen that has really infected a
number of people,'' said Sal Viveros, of Network Associates Inc.
(NasdaqNM:NETA - news) , the largest computer security firm in the world.
Anti-virus firm Symantec Corp.(NasdaqNM:SYMC - news) director of research
Vincent Weafer said, ``This is the kickoff for the Y2k -- which is going
to be like the Super Bowl for virus writers.''
The new virus, called W32/Mypics.worm, is set to disable computers as
people try to start them up Jan. 1. The virus writer apparently is hoping
to mislead users into thinking they've been hit by the much-publicized Y2K
software bug, which is caused by computers' inability to read the ``00''
of year 2000.
The virus is sent by e-mail with no subject line to a target user. Inside
the e-mail is a message saying ``Here's some pictures for you!'' Clicking
on the picture launches the damaging virus, or worm, a kind of virus that
does damage but doesn't continue to propagate itself inside the host computer.
Like the earlier Melissa ``worm,'' the new infection uses the target
computer's Microsoft Outlook mailing list to send itself to 50 people via
e-mail.
It can be detected ahead of the Jan. 1 ``payload date'' through use of an
anti-virus software, or by noting a suspicious switch in the default page
of the user's Web browser.
Computer security firm Symantech, the company that first sounded the alarm
about the Y2K bug, said it has found five different Y2K viruses in recent
days, but none reaching the level of the W32/Mypics.worm, which it classed
as a ``medium to high-risk virus.''
Simon Perry, Computer Associate International Inc.'s (NYSE:CA - news) eTrust
Business Manager said, ``As the year 2000 quickly approaches, we are starting
to see an increased frequency of dangerous viruses.''
The year has already been marked by a wave of destructive infections,
including the CIH, or Chernobyl Virus, which wiped out data on thousands of
hard disk drives, and Melissa, which was one of the most widespread infections
ever, though not as damaging to individual computers.
A concerted effort to sound the alarm by computer protection services has
tended to dampen the spread of the viruses, though some see their alarms as
self-serving, since most recommend a dose of their medicine, anti-virus
software, as the cure.
``Once a virus is in the wild, and it's on everyone's detection lists, it tends
to chill a bit. But that doesn't mean it's not still a threat,'' said David
Perry, security firm Trend Micro Inc. (NasdaqSC:TIMC - news) pubic information
director.
The most basic advice the security experts give is to avoid opening unsolicited
e-mails. ``Don't take candy from strangers,'' said Perry, ``and don't open
suspicious e-mails on your computer.''
@HWA
07.0 EPIC Sues NSA Over Echelon
~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by blueghost, knobdicker, and Alien Plaque
The Electronics Privacy Information Center (EPIC) has
filed suit against the National Security Agency (NSA) in
federal court in an attempt to gain more information
about the agency's spy network dubbed Echelon, and to
what extent the agency has been spying on American
citizens. The NSA has 30 days to respond to the court
filing. (I applaud EPIC for going after the NSA, however
the courts have been very favorable to the NSA in past
cases, so I personally doubt that much will come of
this, but it's definitely worth a shot.)
Electronic Privacy Information center
http://www.epic.org/
Federal Computer Week
http://www.fcw.com/pubs/fcw/1999/1129/web-lawsuit-12-3-99.html
ZDNet
http://www.zdnet.com/zdnn/stories/news/0,4586,2404126,00.html?chkpt=zdnntop
DECEMBER 3, 1999 . . . 17:35
Lawsuit claims NSA spying on Americans
BY DANIEL VERTON (dan_verton@fcw.com)
The privacy watchdog group Electronic Privacy Information Center today
filed a lawsuit in federal court that aims to force the National Security Agency
to release sensitive documents thought to contain evidence of surveillance
operations against U.S. citizens.
EPIC wants to obtain documents recently denied to Congress by NSA's
General Counsel on the grounds of attorney/client privilege. NSA also has
failed to reply to a Freedom of Information Act request filed by EPIC to
obtain the documents.
The lawsuit centers on documents that are said to detail the operations of the
so-called Echelon global surveillance network. Details surrounding Echelon
came to light last year when the European Union launched a full-scale
investigation into privacy abuses against European citizens by the NSA
["European Union may investigate U.S. global spy computer network,"
fcw.com, Nov. 17, 1998].
EPIC director Marc Rotenberg said in a statement released to the press, "The
charter of the National Security Agency does not authorize domestic
intelligence-gathering. Yet we have reason to believe that the NSA is engaged
in the indiscriminate acquisition and interception of domestic communications
taking place over the Internet."
A spokesperson for the agency said, "NSA operates in strict accordance with
U.S. laws and regulations in protecting the privacy rights of U.S. persons. Its
activities are conducted with the highest constitutional, legal and ethical
standards."
Echelon, a Cold War-vintage global spy system, is believed to consist of a
worldwide network of clandestine listening posts capable of intercepting
electronic communications such as e-mail, telephone conversations, faxes,
satellite transmissions, microwave links and fiber-optic communications traffic.
EPIC is planning a major study of the Echelon network to be published next
year that looks at the operations of signals intelligence agencies around the
world, such as the NSA.
"We expect that Congress will hold hearings on this early next year and we
plan to pursue our case very aggressively," Rotenberg told FCW. "If the NSA
is intercepting Internet communications of U.S. citizens -- and we believe they
are -- then it is a critical question of Constitutional government to determine
whether they are acting within the law or outside of it."
@HWA
08.0 Wyoming Newspaper Attacked
~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Alien Plague
George Russell James, 26, of Laramie, Wyoming has
been charged with one felony count of crime against
computer users. James is accused of several
unauthorized entries into Trib.com which is run by the
Casper Star-Tribune. According to the Trib.com staff,
the entries are said to have caused slowed online
response time over a couple of days and disrupted the
provider's news and information Web site. (From the
information posted in this article it would seem that
they don't have a very strong case against this guy.
Unfortunately he will probably plead guilty instead of
fighting these accusations.)
The Billings Gazette
http://www.billingsgazette.com/wyoming/991204_wyo02.html
Laramie man charged with hacking into major Internet
provider
CASPER, Wyo. (AP) - A Laramie man has been
charged with hacking into one of Wyoming's
primary Internet service providers.
George Russell James, 26, surrendered at the
Albany County Courthouse on Friday and was
charged with one felony count of crimes against
computer users, according to the state Division of
Criminal Investigation.
James is accused of several unauthorized entries
into trib.com, according to the Casper Star-Tribune,
which administers the service.
Police searched James' apartment Thursday and
seized a personal computer and other evidence,
said Steve Miller, deputy director of the state
Division of Criminal Investigation.
They also found about one-eighth ounce of
marijuana and charged James with possession of a
controlled substance, he said.
"Without going into a lot of detail, basically there are
a lot of electronic footprints you can often trace
back to the individual," he said of how James was
pinpointed.
Trib.com staff said the tampering slowed online
response time over a couple of days and disrupted
the provider's news and information Web site.
"We haven't been able to manipulate the programs
like we normally do, which has made stories
awkward to read," Web site designer Fred Jacquot
said.
Some subscribers who logged onto the site
Thursday may have found pages with incomplete
information or graphic artwork, he said.
Larry Ash, systems administrator for trib.com, said
the problems resulted from a two-fold attack on the
system.
First, the alleged hacker tapped into the trib.com
server, which meant the entire system needed to be
checked for possible flaws.
"We spent a lot of time tearing down the old system
and building it up again from scratch," he said.
Then on Thursday, a program from a site in London
jammed the trib.com network and slowed service to
a crawl. The "denial of service attack" flooded the
system with thousands of information requests.
"It's kind of like a water main that is split into lots of
smaller pipes," said trib.com programmer Steve
Claflin. "If one person draws all the water, no one
else can get any."
The trib.com system was so tied up processing the
information and repairing itself after the break-in that
it could not respond as quickly to regular tasks.
Star-Tribune publisher Rob Hurless said trib.com
staff were still checking computer logs Thursday to
find out exactly what happened during the break-in.
The network was nearly back to normal operating
speed Thursday afternoon, he said.
Miller said the trib.com break-in was among an
increasing number of computer-related crimes DCI
has looked into recently.
He said the agency, in cooperation with federal and
local law enforcement agencies, has investigated
18 reports of computer crimes in Wyoming,
including seven in the last month.
"It's pretty crazy right now," Miller said. "I don't know
if hacking is increasing or people are just identifying
it more rapidly and reporting it."
Updated: Saturday, December 4, 1999
Copyright � The Billings Gazette, a division of Lee Enterprises.
@HWA
09.0 DoD Offers Military Docs to Surfers
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
The Department of Defense has made available over
100,000 documents on categories ranging from nuclear
technology to explosives to communications security.
There also seems to be a good chunk of information on
TEMPEST. It is unknown how long this site will remain
publicly available. Grab it while you can.
Defense Automation and Production Service
http://assist.daps.mil
(Site appears locked up when I tried it... -Ed)
@HWA
10.0 NSA Funds Supercomputer Upgrade
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by biggranger
The National Security Agency is funding the upgrade of
the San Diego Supercomputer Center from a Tera
MTA-8 system to a MTA-16 system made by Tera
Computer Company. The MTA-16 is based on a
multithreaded architecture and retails for between 7 and
10 million dollars.
Tera Computer Company
http://www.tera.com/www/press/mta16.html
Tera Press Release;
Tera Computer Company Receives First Purchase Order for a
Tera MTA-16 System
Funding Provided by National Security Agency
Contacts:
Lippert/Heilshorn & Assoc.
Lillian Armstrong/David Barnard, CFA
lillian@lhai-sf.com,david@lhai-sf.com
415/433-3777
Keith Lippert
212/838-3777
Tera Computer Company
Ken Johnson/Jim Rottsolk, 206/701-2000
ken@tera.com,jim@tera.com
or
Terren S. Peizer, Chairman: 310/444-3222
SEATTLE, WASHINGTON, November 10, 1999 - Tera Computer
Company (NASDAQ NM: TERA) today announced that it has received
its first purchase order for a Tera MTA-16 system. This order represents
an upgrade to the existing 8-processor Multithreaded Architecture (MTA)
supercomputer now in use at the San Diego Supercomputer Center
(SDSC). This upgrade, which doubles the size of SDSC's MTA system
from 8 processors and 8 gigabytes of shared memory to 16 processors
and 16 gigabytes of shared memory, is specially priced at $2.5 million.
Initial purchases of Tera MTA-16 systems are typically priced at $7-10
million, depending upon configuration. Delivery of the SDSC MTA-16 is
expected by year-end 1999.
This order follows SDSC's successful evaluation of the MTA-8, which
was initially funded by the National Science Foundation and the Defense
Advanced Research Projects Agency. Funding for the MTA-16 upgrade
is being provided by the National Security Agency (NSA). The MTA-16
system will be used to run computationally demanding applications of
interest to users, including medical researchers, graphics experts and
computational chemists.
"Tera's multithreaded approach to parallel processing is of great interest
not only to SDSC, but also to the entire high-end computing community,"
said Sid Karin, Director of SDSC. "The performance achieved on our
eight-processor MTA supports the argument that hardware multithreading
will be the future of high-end computing. By doubling the size of our MTA,
we expect to run some applications on it faster than on any other machine
at SDSC. We further expect that this will allow us to transition some of our
production workload to the MTA."
Jim Rottsolk, President and CEO of Tera Computer concluded, "The sale
of an MTA-16 represents another significant milestone in our push toward
full-scale commercialization of the MTA technology. The benefits of this
transaction go beyond the purchase alone, as we will have access to the
SDSC MTA-16 system, and plan to use it to demonstrate
high-performance applications of interest to the industrial customer base,
such as MSC NASTRAN and LS-DYNA3D. The currently installed base
of vector processing supercomputers represents an attractive and timely
market opportunity for the Tera MTA-16."
According to the International Data Corporation, there are approximately
200 SGI/Cray Research vector supercomputers installed worldwide,
constituting a large portion of the customer base of industrial
supercomputing users. With an average selling price of approximately $10
million each, this installed base is valued at $2 billion. Of those 200
systems, about 60 T90s have been installed in the last three years, with the
balance of that installed base representing previous generation systems
such as the Cray C90.
Tera also announced that its Progress Report: Summer 1999 video is now
available on VHS or CD-copies can be requested by visiting the Tera
website at www.tera.com. Among those interviewed on this video are Sid
Karin, SDSC's Director; Wayne Pfeiffer, SDSC's Deputy Director;
Richard Charles, Greg Johnson, and Allan Snavely, three SDSC scientists;
and Professor David McQueen, a medical researcher at New York
University's Courant Institute.
About Tera Computer Company
Tera Computer Company designs, builds and sells high performance
general-purpose parallel computer systems. Tera believes its Multithreaded
Architecture system represents the next wave in supercomputer technology
because of its unique ability to provide high performance, broad
applicability and ease of programming in a single system. For more
information about Tera and its MTA systems, contact Tera at 411 First
Avenue South, Suite 600, Seattle, WA 98104-2860. Phone:
206/701-2000. Fax: 206/701-2500. E-mail: info@tera.com, or
www.tera.com.
Safe Harbor Statement
This press release contains forward-looking statements, among other
things, Tera's plans to build larger MTA systems and the successful running
of key applications on the MTA-16. There are certain factors that could
cause Tera's execution plans to differ materially from those anticipated by
the statements above. Among such factors are risks associated with
building larger MTA systems, necessary modifications to software and
hardware systems, timely availability of commercially acceptable
components from third party suppliers and successful porting of third party
applications. For a discussion of such risks, and other risks that could
affect Tera's future performance, please see "Risk Factors" in Tera's most
recent SEC Form 10-Q.
@HWA
11.0 "I was a teenage nmapper"
~~~~~~~~~~~~~~~~~~~~~~~~~
http://geekmafia.dynip.com/~xm/
I was a teenage nmapper.
Perhaps the best place to start this story is with a disclaimer. Because
of possible legal implications and verbal agreements between the
sysadmin of an organization I am affiliated with, the companies involved
and myself, I am not going to disclose any real information.
The story begins at a large organization. I am a voluntary network /
network security consultant at times here. However, I am legally
forbidden to "attempt to bypass security restrictions on the network ...
or to aid others in doing so by providing information (logins,
passwords, etc.) to do so with." However, the very nature of my informal
position involves me violating this agreement, with the permission of
the network admins. In the past, I have scanned the entire external
address block from my own personal network with permission. I recently
uncovered an unprotected webserver containing a network informational
chart listing unprotected netbios shares containing extremely sensitive
data. I attempted to see if these were exploitable without touching any
sensitive materials. After reporting my findings to the network admins,
I was given a little lecture about how I should have contacted them
before attempting something that potentially volatile.
The organization where these events took place currently relies on a
filtering Internet proxy to provide web access to its ~1000 users. The
company that manufactures the proxy maintains the machine it runs on (an
UltraSPARC IV running SunOS 5.7). Previously they have been given
some security alerts by me through the admin at my school. The proxy
maker was once a small startup but was recently acquired by a fairly
prominent software maker, so they have become increasingly corporate
since they began work with our organization.
One day in mid/late November (1999), I was doing a little halfhearted
blackbox audit of one of the cgis in the package. I discovered a serious
vulnerability that could allow anyone to read any file on the system (by
transversing up directories using "../../../../etc/motd" as a
parameter to a file argument in the cgi). I quickly reported this to my
sysadmin who passed in on to the company. I wanted to report the bug on
BugTraq but I was warned that this would be a violation of the agreement
I had signed (So I didn't).
Meanwhile, I head home that day (Friday) and casually fire up nmap (nmap
-sS -O -v -v www.company.com) to see what they're running (out of
curiosity). On Monday afternoon, the sysadmin calls me into his office.
Apparently, the company freaked out when they saw me scanning
them. During the code audit of the hole, they realized that the scope of
the bug was far greater than I had uncovered (I assume a buffer overflow
but the engineer I spoke to couldn't comment). They were about to email
me a thank-you when they saw the incoming scan. The company responded by
basically scanning me back and probing a few key services: sendmail
(actually postfix), finger and web. They realized that the "attack"
against their network was coming from a machine belonging to the guy who
had just discovered a huge hole in their network. Not knowing if I
realized the total potential of the hole in their system, they pulled
the plug on their network connection and made hard copies of all
relevant info. They consulted their legal counsel in their parent
company.
Under Rhode Island, Massachusetts and federal law, my benign, simple
stealth port scan was perfectly legal. However, since the webserver I
scanned was located in Virginia (home of ambiguous anti-spam laws), I
may have violated the Virginia Internet Policy Act (or some other
AOL/NSI-backed civil-liberty violating,
anti-freespeach^H^H^H^H^H^H^H^H^H^Hspam law). To quote CNET:
"... Aiming in part to ease congestion on networks owned by Internet
service providers such as AOL and MCI WorldCom, the commission wants
unsolicited bulk email or communication that is "fraudulent,
unauthorized, or otherwise illegal [to be] prosecuted just as it
would in any other medium." Virginia's "computer trespassing" law, which
means using an ISP's equipment without permission, also should be
updated, the Act states."
Anyway, I was informed about this on Monday afternoon. I was quickly on
the phone with Russell, a very friendly Cisco / TCPIP-oriented guy at
the company. He said they had decided not to pursue legal action and we
discusses security issues. He was quite friendly and even invited
me to visit the proxy maker's offices if I was in the area.
What did we learn?
Nmap -D www.microsoft.com,www.aol.com,www.yahoo.com,ME
Corporate takeovers of small guys suck Don't disclose information
except through BugTraq.
If anyone has comments on the technical accuracy, legal accuracy, content
or wants to point me at some resources email xm@geekmafia.dynip.com.
@HWA
12.0 NIST Meeting Open To The Public
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
The next meeting of the Computer System Security and
Privacy Advisory Board of the National Institute of
Standards and Technology will be open to the public.
The meeting will be held from December 7, thru
December 9, 1999. The meeting will be held in Lecture
Room B of the NIST Administration Building in
Gaithersburg, Maryland.
Computer System Security and Privacy Advisory Board
http://csrc.nist.gov/csspab/
Federal Register: December 2, 1999 - via Crytome
http://cryptome.org/csspab120299.txt
@HWA
13.0 NT Passes Government Security Certifications
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench and KnobDicker
Windows NT has been certified as compliant with
Federal Information Processing Standard 140-1 (FIPS
140-1) and the C2 level of the Trusted Computer
System Evaluation Criteria (TCSEC). Windows 95, 98
and 2000 have also received FIPS 140-1 certification.
The C2 certification only applies to stand-alone,
non-networked machines. Operating systems used by
the Department of Defense are supposed to carry a
security rating of C2 or higher, despite the fact that
DoD has used NT since 1996. This ends a long battle for
Microsoft to achieve this security certification. (We still
say "C2 my ass.")
Government Executive Magazine
http://www.govexec.com/dailyfed/1299/120699j1.htm
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2404702,00.html?chkpt=zdnntop
HNN Archive for January 13, 1999
http://www.hackernews.com/arch.html?011399
NW Fusion - NT Failed FIPS a Year Ago
http://www.nwfusion.com/news/1999/0222fips.html
L0pht Heavy Industries - More Info Regarding Government Certifications
http://www.l0pht.com/cyberul.html
December 6, 1999
DAILY BRIEFING
Microsoft wins government
security certifications
By Joshua Dean
jdean@govexec.com
Microsoft Corp.'s Windows NT Server and desktop operating
systems�products that are heavily used at many federal
agencies�last week received two important security
certifications from the federal government.
The Windows NT 4.0 network operating system was certified
as compliant with Federal Information Processing Standard
140-1 (FIPS 140-1) and the C2 level of the Trusted
Computer System Evaluation Criteria (TCSEC). The desktop
operating systems Windows 95 and Windows 98 and the
forthcoming Windows 2000 also won FIPS 140-1
certification.
"FIPS 140-1 is the certification which is more important," said
Rick Therrien, leading edge services deputy in the Office of the
Navy's Chief Information Officer. "FIPS 140-1 deals with
information interchange on computers that are networked, as
well as secure e-mail, authenticating onto a network and
accessing secure Web sites."
Therrien estimates that the Navy uses Windows NT on more
than 400,000 computers globally. In addition, the Marine
Corps just converted from Banyan Systems Inc.'s Vines
network software to Windows NT 4.0.
FIPS 140-1 was created by the National Institute of Standards
and Technology. It lays out security requirements for the
cryptography module within an operating system.
Windows NT 4.0 was also tested by a private laboratory and
certified by the National Computer Security Center, a unit of
the National Security Agency, as achieving the C2 level of
security. C2 products have demonstrated they can:
Identify and authenticate system users
Limit data access to only approved users
Audit system and user actions
Prevent access to files that have been deleted by others
Therrien cautioned that while certification for Windows NT 4.0
is reassuring, "no operating system is 100 percent secure. What
you have now is a way to calculate risks. We now have a way
to quantify where our risks are. Without certification, there
would be much more guesswork involved."
Microsoft's new operating system, Windows 2000, is
scheduled to be released in February.
The network configuration used in evaluating the security of the
NT 4.0 network operating system, as updated with Service
Pack 6a consisted of single- and multi-processor Proliant
servers from Compaq Computer Corp., along with Compaq
PCs and printers and storage subsystems from
Hewlett-Packard Co.
-=-
ZDnet;
Microsoft wins high-level security rating
After more than a year, Microsoft obtains the
NSA's key C2 rating for NT 4.0.
By Mary Jo Foley, Sm@rt Reseller
UPDATED December 6, 1999 4:18 PM PT
As Microsoft closes in on completing development of
its next-generation Windows 2000 operating system,
it finally has managed to receive the elusive C2
security rating for its NT 4.0 operating system.
On Dec. 2, Microsoft Corp. (Nasdaq:MSFT) announced it
had received the C2 rating for NT 4.0 Server and
Workstation. Prior to last Friday, Microsoft had received
the C2 rating only for NT 3.5.
C2 is a basic security rating that
is one of several evaluations
awarded by the National Security
Agency, based on its Trusted
Computer System Evaluation
Criteria, or "Orange Book" criteria.
Information systems purchased
by the Department of Defense are
supposed to carry at least a C2 rating.
Microsoft has been in pursuit of the C2 rating for NT 4 for
more than a year. Originally, Microsoft had hired an
independent contractor named Edward Curry to help the
company obtain a C2 rating for NT 3.5 in the mid-1980s.
But in 1995, Microsoft ended Curry's contract for reasons
the company declined to divulge publicly.
Curry brought to the
Department of Defense's
attention late last year the fact
that Microsoft had not
obtained C2 certification for
any release of NT beyond 3.5.
In March of this year, while continuing to make known his
concerns regarding Microsoft's alleged lack of
operating-system security, Curry died suddenly of a
stroke.
Prior to Curry's death, Microsoft hired Science
Applications International Corp. (SAIC) to continue its C2
certification efforts. A year ago, SAIC was predicting
Microsoft would pass its first C2 milestone within weeks.
Microsoft officials have said they expect to be able to
submit immediately Windows 2000 for evaluation under a
newly merged U.S./U.K. security evaluation process,
called Common Criteria Consolidation.
@HWA
14.0 Mitnick's Codefendant Sentenced
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Ryan
Lewis DePayne has been sentenced by US District Judge
Mariana Pfaelzer to six months of home detention with
five years of probation, 225 hours of community service
and a fine of $2,500. DePayne pleaded guilty earlier this
year to a single count of wire fraud for his involvement
in a scheme with Kevin Mitnick to defraud Nokia of
proprietary software for mobile phones.
ZD Net
http://www.zdnet.com/zdtv/cybercrime/news/story/0,3700,2404937,00.html
Mitnick Codefendant Sentenced
Accused hacker faces probation,
community service, and fine.
By Iolande Bloxsom December 6, 1999
Kevin Mitnick's codefendant, Lewis
DePayne, was sentenced today in federal
court in Los Angeles. Unlike the imprisoned
hacker, DePayne was not restricted in his
use of computers.
US District Judge Mariana Pfaelzer
sentenced DePayne to five years of
probation, which includes six months of
home detention. He will also be required
to serve 225 hours of community service
(to be determined by the probation office)
and to pay a $2,500 fine and the cost of
any home detention.
DePayne pled guilty on April 16 of this
year to a single count of wire fraud.
According to the plea agreement, in May
of 1994 he and Mitnick participated in a
scheme to defraud Nokia of proprietary
software for mobile phones. DePayne
admitted to placing a call to a Nokia office
in Florida pretending to be a Nokia
supervisor named K.P. Wileska.
In the plea agreement, the approximate
value of the software was set at
$240,000. However, the judge ordered
DePayne to pay only about one tenth of
that amount as a fine. In Mitnick's case,
Judge Pfaelzer set the fine higher, at
$4,125, but still significantly lower than
the prosecution's suggested restitution of
$1.5 million.
@HWA
15.0 Videon Suffers Second Intrusion
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by r@ven
Videon Internet, based in Winnipeg Canada, has
suffered its second major intrusion in one week.
Sensitive account information, including e-mail
passwords, evidently were compromised. A complaint
has been filed with the Winnipeg Police Service's
commercial crimes unit. The company has has shut
down their email server "for the security of Videon
customers".
Winnipeg Free Press
http://205.200.191.20/cgi-bin/LiveIQue.acgi$rec=4241?local
Videon security blown again
Customers without e-mail after latest hack attack
Sun, Dec 5, 1999
By Paul McKie
Staff Reporter
THOUSANDS of Videon customers who pay a premium price for high-speed
Internet access are without e-mail today after another hacker broke into
the system.
Videon general manager Debra Jonasson-Young confirmed the company was once
again the victim of a hacker who had access to sensitive account
information, including e-mail passwords.
"We were hacked last week. This is a different hack. I want to make it
perfectly clear -- we were hacked both times," said Jonasson-Young.
The second security breach was discovered Friday afternoon and a complaint
has been filed with the Winnipeg Police Service's commercial crimes unit,
Jonasson-Young said. A decision was made to shut down the @Home e-mail
server at 1:30 a.m. yesterday for the security of Videon customers.
Jonasson-Young said she didn't know how long the server would be down.
Customers still have web access, however, and can continue to surf the
Internet.
She said Videon is continuing to work with an outside security agency to
remedy the situation and has been advised not to bring the server back up
until it is secure. She couldn't say when the e-mail server would be
operational again.
One Videon customer, who requested anonymity, said he was astounded when
he discovered the Videon Internet system had been hacked again and he
hadn't been warned.
"A week ago when it happened, they promised it would never happen again,"
he said. The customer, one of 2,700 who use the service, called Videon
yesterday to get his new password after his old password was compromised.
"The lady said she was sorry, another breach had happened," he said.
"There are just too many things Videon does wrong . . . they're pretty
screwed up over there."
Jonasson-Young said cable-modem customers were informed of the latest
breach when they called in yesterday. But she said Videon was also
beginning a call-out campaign to affected users. She said that last week
the company e-mailed customers, but that wasn't an option this time
with the mail server down.
She noted the Internet is a public-domain area that presents a myriad of
security problems. "There's always a risk that something can happen, no
matter what kind of line you're on," Jonasson-Young said .
Videon's competitors beg to disagree. Reg Parkin, corporate security
manager for Manitoba Telecom Services, agreed that when word gets out that
a site has been hacked, others will always try it again.
However, Parkin said that at MTS, where Internet access is through phone
lines, personal information is kept in a different site not accessible
through the Internet.
He said the trick to security is having several layers, like an onion
skin, so that if any one layer is stripped away, there's still protection
in place. "I don't recall there ever being a breach. There have been
attempts," he said.
Videon isn't the only victim of hackers. Last summer, the mighty Microsoft
had its Hotmail system, with 50 million users, infiltrated.
Parkin said that because of such incidents, security has to be constantly
evolving. "It's more vigilance. If you wait for something to happen and
react to it, you're in trouble," he said.
Jonasson-Young said she's aware of the knocks against Videon and the
company is trying to correct them. "We're under the spotlight right now;
we recognize that."
But she said people must also recognize that both the company and the
customers are victims.
"It's been a crime perpetrated against us," she said.
@HWA
16.0 GSM Phones No Longer Secure
~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by C0nd0r
Alex Biryukov and Adi Shamir two Israeli researchers
have discovered design flaws in the algorithm A5/1
which is present in digital GSM phones. This algorithm is
used in phones made by Motorola, Ericsson, and
Siemens. Over 330 million GSM phones are in use around
the world. While this research does indicate how the
encryption may be broken, actually intercepting that
signal is not explained.
Wired
http://wired.lycos.com/news/print/0,1294,32900,00.html
Cell Phone Crypto Penetrated
by Declan McCullagh
10:55 a.m. 6.Dec.1999 PST
Israeli researchers have discovered design flaws that allow the
descrambling of supposedly private conversations carried by hundreds of
millions of wireless phones.
Alex Biryukov and Adi Shamir describe in a paper to be published this week
how a PC with 128 MB RAM and large hard drives can penetrate the security
of a phone call or data transmission in less than one second.
The flawed algorithm appears in digital GSM phones made by companies such
as Motorola, Ericsson, and Siemens, and used by well over 100 million
customers in Europe and the United States. Recent estimates say there are
over 230 million users worldwide who account for 65 percent of the
digital wireless market.
Although the paper describes how the GSM scrambling algorithm can be
deciphered if a call is intercepted, plucking a transmission from the air
is not yet practical for individuals to do.
James Moran, the fraud and security director of the GSM Association in
Dublin, says that "nowhere in the world has it been demonstrated --an
ability to intercept a call on the GSM network. That's a fact.... To our
knowledge there's no hardware capable of intercepting."
The GSM Association, an industry group, touts the standards as "designed
to conform to the most stringent standards of security possible from the
outset [and] unchallenged as the world's most secure public digital
wireless system."
Not any more.
Shamir says the paper he co-authored with a Weizmann Institute of Science
colleague in Rehovot, Israel, describes a successful attack on the A5/1
algorithm, which is used for GSM voice and data confidentiality. It builds
on the results of previous attempts to attack the cipher.
"It's quite a complex idea, in which we fight on many fronts to accumulate
several small improvements which together make a big difference, so the
paper is not easy to read or write," Shamir, a co-inventor of the RSA
public key crypto system in 1977, said in an email to Wired News.
A group of Silicon Valley cypherpunks has organized previous efforts to
highlight what they view as the poor security of GSM encryption standards.
In April 1998 they reported that it was possible to clone a GSM phone,
which the US Cellular Telecommunications Industry Association dismissed as
more theoretical than practical. The North American GSM Alliance similarly
dismissed cloning as a serious threat in a statement.
Earlier this year, the group, which includes Marc Briceno, Ian Goldberg,
and David Wagner, described how to penetrate the less-secure GSM A5/2
algorithm used in some Pacific rim countries in less than a second. In May
1999 they released the source code to A5/1, which the Weizmann
Institute computer scientists used in their analysis of the cipher.
"Because of Biryukov and Shamir's real-time attack against A5/1 and our
group's 15 millisecond attack against A5/2, all the GSM voice privacy
ciphers used worldwide can be broken by an attacker with just a single PC
and some radio hardware," Briceno said.
"Since the voice privacy encryption is performed by the handset, only
replacing the handset would address the flaws found in the recent
attacks," he said.
The GSM Alliance's Moran said he needed time to review the paper, which
has not yet been released. But he said it would be a topic of a discussion
at the next GSM security working group meeting on 16 December.
Previously the GSM encryption algorithms have come under fire for being
developed in secret away from public scrutiny -- but most experts say high
security can only come from published code.
Moran said "it wasn't the attitude at the time to publish algorithms" when
the A5 ciphers was developed in 1989, but current ones being created will
be published for peer review.
@HWA
17.0 DARPA Looks At Face Recognition Technology
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Face recognition technology has been around for a
while. Cameras mounted on street lamps in a few British
cities have been picking faces out of the crowd for over
a year. Now DARPA is interested in using this technology
in conjunction with other biometric technology such as
thermal signature of the blood vessels in the head and
the shape of a person's ear to create a more accurate
and complete system.
Scientific American
http://www.sciam.com/1999/1299issue/1299techbus5.html
HNN Archive for October 20, 1998
http://www.hackernews.com/arch.html?102098
Defense Technology
SEEN BEFORE
To guard against terrorism, the Pentagon looks to image-recognition
technology
In the East London borough of Newham, a surveillance network of more than
200 cameras keeps watch on pedestrians and passersby, employing a
facial-recognition system that can automatically pick out known criminals
and alert local authorities to their presence. Not surprisingly, civil
liberties groups oppose the system--Privacy International, a human-rights
group, gave the Newham council a "Big Brother" award last year on the 50th
anniversary of the publication of George Orwell's famous novel. The
council, however, claims overwhelming support from citizens who are more
concerned about crime than about government intrusions. It could count as
one of its supporters the U.S. Department of Defense, which is keeping
tabs on the Newham system as well as on other, related technologies. The
department hopes that some combination of "biometrics" will vastly improve
its ability to protect its facilities worldwide.
For the military, biometrics usually means technologies that can identify
computer users by recognizing their fingerprints or voices or by scanning
their irises or retinas. But after a terrorist truck bomb blew up the
Khobar Towers U.S. military barracks in Saudi Arabia in 1996, killing 19,
the Pentagon elevated to the top of its priority list the need for "force
protection"--namely, keeping troops abroad safe from attack. That spurred
the Defense Advanced Research Projects Agency, essentially a Pentagon
hobby shop, to action. Building on some ongoing work with video
surveillance and modeling techniques, as well as on commercial (but still
experimental) technologies such as those used to identify automatic-teller
machine customers by scanning their faces, DARPA set out to investigate
the potential for a network of biometric sensors to monitor the outsides
of military facilities.
The result is a program known as Image Understanding for Force Protection
(IUFP), which the agency hopes to get started in 2001. Described by the
Pentagon as "an aggressive research and development effort," IUFP is
supposed to improve site surveillance capabilities by "creating new
technologies for identifying humans at a distance."
Biometric systems in use with ATM machines and computers have two
advantages over what DARPA has in mind: proximity and cooperation. For
military purposes, biometric sensors and networks must be able to "see"
and identify subjects from distances of between 100 and 500 feet--subjects
who probably don't want to be identified. In addition, they must be
capable of picking faces out of crowds in urban environments, keeping
track of repeat visitors who, according to DARPA's George Lukes, "might be
casing the joint," and alerting users to the presence of known or
suspected terrorists. Databases could even be shared by different
facilities, informing security officials, for example, that the same
person is showing up repeatedly near different potential targets.
The software behind Newham's anticrime system that has drawn DARPA
interest is called FaceIt, from New Jersey�based Visionics Corporation.
FaceIt scans the visages of people and searches for matches in a video
library of known criminals. When the system spots one of those faces, the
authorities are contacted. A military version might work the same way.
Over the past year, according to a DARPA document recently sent to
Congress, "several new technical approaches have been identified" that
could provide improved face recognition at longer distances, as well as
extend the range of iris-recognition systems.
DARPA believes, however, that combining several types of technologies
could form a network that is more capable than a single system. New
concepts it is exploring include the thermal signature of the blood
vessels in the head, which some researchers suspect is as unique to a
person as his or her fingerprints; the shape of a person's ear; and even
"the kinetics of their gait," in DARPA's words. "There are some unique
characteristics to how people move that allow you to recognize them,"
explains DARPA's David Gunning. After conducting a "thorough analysis" of
existing technologies, the agency says it is "ready to begin immediately
with the new developments." The Pentagon hopes to spend $11.7 million in
2000 on the IUFP program--a good deal of money for a DARPA effort.
The potential for an integrated network of identification techniques has
understandably generated significant interest among defense and
intelligence agencies that are prime targets for terrorists. "There's a
lot of enthusiasm," Gunning says--after all, through the marriage of
recognition systems and surveillance technologies, DARPA thinks it has a
handle on how to keep track of "one of the few detectable precursors" to
terrorist attacks.
--Daniel G. Dupont
@HWA
18.0 More Info On the Phonemasters Revealed
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Maggie
They were arrested almost five years ago but the
massive inroads made into the nations
telecommunications systems is only now becoming fully
clear. The Phonemasters coordinated what is being
called one of the largest computer intrusion schemes in
U.S. history. As the case finnally draws to a close and
the various members of the group receive their
sentences a few new tidbits of information are coming
out. (We are still amazed at how little press coverage
this case has gotten.)
Union Tribune
http://www.uniontrib.com/news/uniontrib/sun/news/news_1n5hacker.html
(Story has moved, couldn't locate it online - Ed)
HNN Archive for October 4, 1999
http://www.hackernews.com/arch.html?100499
@HWA
19.0 Proactive AntiVirus Software Now Available
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Finjan Software has introduced a proactive first-strike
security solution, SurfinShield Corporate, claims to block
worms and other malicious code by monitoring the
behavior of programs rather than relying on a known
virus signature. By using a proactive monitoring
technique to 'sandbox' programs and monitor their
behavior SurfinShield can instantly block programs that
violate a security policy, such as attempting to delete a
user's files.
PR Newswire
http://library.northernlight.com/FB19991206040000127.html?cb=0&dx=1006&sc=0#doc
Finjan Software
http://www.finjan.com/
TROJAN WORM ATTACKS CLOUD THE FUTURE OF REACTIVE ANTI-VIRUS SOFTWARE
FINJAN'S PROACTIVE FIRST-STRIKE SECURITY SOFTWARE STOPS MALICIOUS CODE By
Monitoring Code Behavior and Requires No Database Updates
Story Filed: Monday, December 06, 1999 7:30 AM EST
SAN JOSE, Calif., Dec 6, 1999 /PRNewswire via COMTEX/ -- As last week's
MiniZip worm proved, current anti-virus software technology is not able to
protect users from first-strike attacks by malicious code in the Internet
age. Compression or "packer" tools such as NeoLite can be used to
change the signature of known Trojan horse programs, making them invisible
to anti-virus software. Finjan Software's proactive first-strike security
solution, SurfinShield Corporate, blocks worms such as MiniZip by
monitoring the behavior of programs rather than relying on a known virus
signature.
"If you take the ten-thousand plus known Trojans multiplied by the ten or
more available compressor utilities, you're looking at more than 100, 000
Trojan horses that can pass right through anti-virus software today
-- without writing a single new attack," said Bill Lyons, president and
CEO of Finjan Software, Inc. "Without a doubt, whether it's MiniZip 2 or a
new Trojan worm, more of these types of attacks are coming."
Compression Tools Packers are legitimate compression tools that can
compress windows executable (."EXE") files, much like how people use the
well-known WinZip product to compress document or graphics files before
e-mailing. However, with these packer tools, the resulting
compressed executable will bypass any static anti-virus scanning engine
because the virus signature is changed and the anti-virus software will
not recognize it.
There are dozens of commercial and free compression tools that can be used
to hide known Trojan horses and worms from anti-virus software, including
AS-pack, PECompact, Petite, PKLite, NeoLite, Shrinker and WWpack32.
The real risk is that anyone now can take one of these packer tools and
easily develop new attacks with known Trojan horse programs. With easy to
use "point and click" interfaces, there is no more need for programming
skills. One simply takes an old attack, compresses it with the
packer tool of choice and creates a brand new attack.
Why Anti-Virus is Not Enough Millions of dollars can be lost due to
deleted files and lost productivity in the first 24 hours when a malicious
code attack first strikes. Anti-virus companies and security experts agree
that anti-virus software cannot stop these new types of attacks:
"The problem with anti-virus software is that it's inherently reactive,"
said Dan Schrader, vice president of new technology at Trend Micro Inc.
"We have artificial intelligence for identifying viruses, but virus
writers are good at getting around heuristics." (source:
Computerworld)
Sal Viveros, Network Associates, Inc. marketing manager insisted no
available anti-virus product could have detected MiniZip. "It is
impossible to detect beforehand all the different variables out there they
use to write a malicious attack," said Viveros. (source:
Computerworld)
"We're at a turning point right now," said Carey Nachenberg, chief
scientist for the Symantec Anti-virus Research Center. "We need to
re-examine our anti-virus software, and companies need to re-examine their
anti-virus strategies." (source: ZDNet News)
"The pattern matching security offered by most anti-virus software
providers is antiquated. It's akin to practicing medicine with leeches,"
said Dr. Gary McGraw, vice president of corporate technology at Reliable
Software Technologies. "To be truly effective, modern security
approaches must be proactive, not reactive."
New Approach Needed: First-Strike Security Finjan's SurfinShield Corporate
software uses a proactive monitoring technique to "sandbox" programs and
monitor their behavior and instantly block programs that violate a
security policy, such as attempting to delete a user's files.
Finjan's product acts as a filtering mechanism between a PC's operating
system and the program, to monitor and block malicious behavior.
"By itself, anti-virus software is not an effective defense against new
attacks because of its reactive nature," said Donna Slattery, security
analyst with The Hurwitz Group. "Companies should supplement their
anti-virus protection with proactive solutions like Finjan's
first-strike security software."
Finjan educated its customers and partners this morning about compression
tools (alert is below).
About Finjan Software Finjan Software is the leader in First-Strike
Security(TM) software, delivering proactive security solutions that
protect companies and computer users from first-strike malicious code
attacks. Finjan allows companies to conduct e-business and
e-commerce safely with best-of-breed security products that enforce
multiple lines of defense and protect critical data. Finjan is a privately
held company based in San Jose, Calif. For more information, visit
www.finjan.com.
Finjan Software, Inc.
Compression Tools Alert 12/6/99
Finjan customers and partners,
As MiniZip showed us last week, compression and packer tools are now being
used to pass Trojan executable files through anti-virus software and
successfully launch new attacks. We thought it might be helpful to show
you what we've found out about these tools.
Compression Tools (aka "Packers")
OVERVIEW Compression tools or "packers" can compress windows executable
(."EXE") files much like the well-known WinZip product. The resulting
compressed executable will bypass any static anti-virus scanning engine
(because the virus signature is compressed). However, these programs
allow a compressed file to decompress and run automatically without
requiring the same utility to open it.
MiniZip Worm was a "packed" version of the ExploreZip worm that struck in
June 1999. The only difference is that MiniZip was compressed with a
commercial utility called NeoLite. NeoLite is a publicly available "point
and click" software program ($25) that can be used to "cloak" known
Trojan executables.
There are many different commercial and free packers available on the Web,
including:
ASPack Cexe PECompact PE-Pack Petite PKLite Shrinker UPX
WWpack
With an estimated 10,000-plus known Trojan horses, times a minimum of 10
packer tools, hackers can select from more than 100,000 Trojans to create
new attacks that may bypass your anti-virus software. And with these easy
to use compression tools, it no longer requires programming
experience to create new attacks.
It appears that the immediate reaction by anti-virus vendors to stop
MiniZip is to block the NeoLite pattern. Finjan believes that there may be
legal issues with regards to blocking commercial applications from
operating at the desktop. Unfortunately, the only approach that is
plausible, based on present AV technology, may be to spot the NeoLite or
other compression pattern, decompress, and compare the result to the
original pattern (e.g., ExploreZip). A major problem, however, comes from
recursive attacks; that is, wrappers around wrappers, where a Trojan worm
is packed multiple times with other packers. The negative affect of
resolving and analyzing such files is a massive performance hit. That's
why we believe that behavior blocking is the more appropriate answer.
HOW TO PROTECT YOURSELF Supplement your anti-virus software with
first-strike security solutions. Finjan's SurfinShield Corporate will
protect users from new "packed" Trojan executables through its proactive
monitoring technology that "sandboxes" executables and blocks any
executable program that violate security policies.
By monitoring actual code behavior, Finjan's SurfinShield Corporate
protects PCs without requiring users to download any software patch or
pattern update.
SOURCE Finjan Software (C) 1999 PR Newswire. All rights reserved.
http://www.prnewswire.com
CONTACT: Sharon Sim-Krause of Shandwick International, 650-596-5880,
ext. 4278, or skrause@shandwick.com, for Finjan Software; or Dave Kroll of
Finjan Software, 408-324-0228, ext. 307, or dave@finjan.com
WEB PAGE: http://www.finjan.com GEOGRAPHY: California
INDUSTRY CODE: CPR MLM
Copyright � 1999, PR Newswire, all rights reserved.
@HWA
20.0 South African Web Pages Defaced
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Zilly
The website of the SA Police Service (SAPS) along with
a dozen other local sites was defaced last Sunday. The
SAPS said it believed security measures were sufficient
to prevent access to confidential information. The
South African Law Commission is working on a new
computer crimes act which is expected to have
proposals for this sort of crime.
Business Day
http://WWW.BDAY.CO.ZA/99/1206/news/news2.htm
Hackers deface police
website with
obscenities
Simphiwe Xako
COMPUTER hackers claiming responsibility for two
recent attacks on Statistics SA's website have vandalised
several other internet pages, including the website of the
SA Police Service (SAPS).
The hackers, operating under the name "B1nary
Outlawz", alerted newspapers to their most recent
attacks with e-mail messages yesterday, one of which
contains obscenities directed at Telkom. These messages
characterised the attacks on the Stats SA website.
"SA Police website hacked by B10Z - www.saps.co.za.
Another high-profile hack by the B10Z crew �
www.statssa.gov.za, www.eskom.co.za,
www.saps.co.za," one e-mail said.
Text and links on the default page of the SAPS website
were replaced by obscenities directed at the police. The
SAPS insignia was distorted and the hackers' insignia
superimposed on it.
About a dozen other locally-based websites were
targeted in a similar way.
A Telkom representative, who asked not to be named,
said she did not believe the hackers had anything against
Telkom in particular, but targeted large companies in
general. "This is a case of juvenile (delinquents seeking)
approval. You can even see (it in) the type of language
they use," she said.
The SAPS could not confirm the extent of the attack on
its website last night, but said it believed security
measures were sufficient to prevent access to confidential
information.
Supt Welma Nortje of the SAPS's management services
said: "We have a daily backup system to ensure that
information remains highly confidential."
Detectives would investigate the attack and trace the
culprits.
The SA Law Commission is working on a discussion
document on a new computer crimes act which is
expected to include proposals on ways of dealing with
computer hackers.
@HWA
21.0 Not Just a Game Anymore
~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Brian Martin
The response to Brian Martin's previous article Is it
Worth It proved so overwhelming that a more thorough
article was warranted. This time Mr. Martin takes an in
depth look at just what laws apply and who investigates
web page defacements.
Buffer Overflow
http://www.hackernews.com/orig/buffero.html
Not Just a Game Anymore
By: Brian Martin
This is a followup to a previous article titlted Is it worth it?
Dispelling the myths of law enforcement and hacking, released on
November 22, 1999 via Hacker News Network.
Included with this article are several sanitized copies of various
documents pertaining to computer crime investigations. Names,
dates and locations have been changed.
Some of the information in this article may be a bit redundant
from the last article, but is done in order to present a self
standing article that is as complete as possible. Some of the links
to agency homepages have been changed to point to their true
home page, not just the system hosting the page.
Topics:
More on Search and Seizure
The Search
The Seizure
Statute of Limitations
What exactly is illegal?
More on Punishment
Investigating Agencies:
Federal Bureau of Investigations (FBI)
Defense Criminal Investigative Service (DCIS)
NASA Office of the Inspector General (NASA OIG)
Naval Criminal Investigative Service (NCIS)
U.S. Army Criminal Investigation Command (USACIDC)
Royal Canadian Mounted Police (RCMP)
Defense Computer Forensic Laboratory (DCFL)
Appendix and Additional Information
A - Search and Seizure Warrant
B - Search and Seizure Warrant, Attachment A (apartment)
C - Search and Seizure Warrant, Attachment A (colocated
machine)
D - Search and Seizure Warrant, Attachment C
E - Warrant for Arrest>
F - Indictment
G - USDOJ Press Release
More on Search and Seizure
Before any Law Enforcement (LE) officer/agent may step foot in
your place of living, they must obtain a search warrant that gives
them explicit permission to do so. The warrant will list the
physical address of the premises to be searched, a description of
the establishment, a time frame for the search and seizure, and a
list of acceptable material that may be seized. The warrant is
likely to be issued by your District Court to the agent in charge of
the investigation.
Rather than explain each part of the search and seizure warrant,
I have included a sanitized vrsion of one with this article. From
my experience and communication with others, the warrant
included can be taken as a very typical and standard version
used throughout the U.S. Appendix A includes the first page of
the warrant which details the premisis to be searched, dates,
who will conduct the seizure and more. Appendix B is a copy of
Attachment A which is a wordy description of the premises to be
searched. Appendix C is a copy of Attachment C which lists all
material covered under the search and seizure guidelines.
Appendix A - Search and Seizure Warrant
Appendix B - Search and Seizure Warrant, Attachment A
(apartment)
Appendix C - Search and Seizure Warrant, Attachment A
(colocated machine)
Appendix D - Search and Seizure Warrant, Attachment C
Some notes and observations about the material contained in
Appendix A. Outlined on the warrant, the agents may conduct
the search and seizure either between the hours of 6:00am -
10:00pm, OR "at any time in the day or night as I find reasonable
cause has been established". One of the two options should be
struck through and initialed by the Judicial Officer. Also included
is a date that the search must be executed by.
The Search
Being subjected to an FBI search and seizure is an interesting
experience to say the least. No official wording on any warrant
can come close to explaining the experience. Typically arriving at
your residence between 6:00 and 8:00am, almost a dozen agents
are ready to toss your apartment to fufill the warrant. After being
greeted at gunpoint and your residence secured, the agents will
mark each room with a postit note and number. These numbers
correspond to the receipt they leave you detailing what material
was taken from each room.
In keeping with standard search and seizure practice, not much is
left unturned. Some of the places you can expect the agents to
search:
Under the bed, between the sheets, between the
frame/box
Behind each and every hanging picture, especially framed
Under/Behind dressers and furniture
In the reservoir of your toilet
Any attic or crawl space
Every drawer, cupboard, container, shelf or other storage
area
Inside the refridgerator/freezer
Under/Inside any cushion with removable insides
Between the pages of books
In air vents or other commonly used places to conseal
items
If this does not help paint a picture that agents are rather
thorough, let me clear it up. They are quite thorough. Do they
find everything? Not all the time. In some cases agents even miss
items out in the open that they might normally take. To balance
this, they almost always take a considerable amount of material
that is completely irrelevant or esoteric.
For the most part, you can also dismiss any notions you may
have about hiding items before the raid. When they knock on the
door, they will not give you time to do anything short of opening
the door and complying with their demands. If they have any idea
that you may be destroying evidence, they are empowered with
the ability to forcibly enter your residence, physically detain you,
and carry on.
The search and seizure will not be short by any means. You can
expect it to last anywhere from a few hours to a full day. During
this time you will be questioned by a number of agents regarding
anything and everything they might think to ask. I don't know if it
is intentional and designed to throw you off, but they may ask
extremely bizarre questions that lead you to wonder about their
intelligence. During this questioning do one of two things.
Refuse to answer ALL questions until your lawyer is
present.
Answer questions honestly.
Lying to law enforcement agents may seem like a clever thing to
do at the time, but it is much more likely to hurt you in the long
run. If caught in a single lie during questioning, it will further
encourage the agents to question you more. They also have the
option of charging you with obstruction of justice if so inclined.
When an agent gets it through their head that you are guilty, bad
news for you regardless of your guilt or innocense.
It is extremely important that you realize your rights. UNDER NO
CIRCUMSTANCE do you have to answer questions without the
presence of your lawyer. No matter what the LE agent says,
suggests, or implies, this is a fundamental right. In many cases,
raid victims are not being charged with a crime. Because of this,
their rights are not read to them. Just because you aren't under
arrest does not mean those rights are waived! The courts have
recently found that police can be sued if they discourage raid
victims from consulting a lawyer. More on this ruling can be found
in this Washington Post article.
The Seizure
What can LE Agents take from you? EVERYTHING. You can't
argue about it either. While they may take material that is not
explicitly covered under the warrant and may later be forced to
give it back to you, that doesn't help you when they are
rummaging through your house. Re-read the list of material that
are covered under Attachment C again and think about how
broad it is.
It is safe to say that absolutely anything remotely computer
related is covered under the warrant. There are a few things that
are also covered under the guidelines that tend to surprise people
when confiscated.
"electronic organizers": these include ones with mini
keyboards like the Sharp organizers, as well as touch
screen like Palm Pilots.
"personal diaries": even your little black journal detailing
sexual exploits, or a notepad with poetry.
"books, newspaper, and magazine articles concerning
hacking": this includes ANY computer book in your
residence. Newspapers or magazines that have security or
hacker articles are included.
"cassette tapes, video cassette tapes, and magnetic
tapes": If it isn't a store bought tape, it is subject to
seizure. Doesn't matter if it contains episodes of the
Beavers or pornography.
"fax machines": despite a fax machine typically not having
the ability to store information long term, it is fair game.
"indicia of occupancy or tenancy..": Any paperwork or proof
that you own or rent your place. Any sales receipts, billing
records or anything else close.
"other items ... in violation of Title 18..": Perhaps the worst
listing of them all, this allows them to take just about
anything else they may deem necessary.
Statute of Limitations
Another often asked question is how long the feds can
investigate you. As long as they want. For most cases, LE can
investigate a crime for up to five years after it was committed.
This is known as the Statute of Limitations and means how long
they can investigate and press charges against you for the crime.
Hypothetically that is. If the crime is serious, several agents have
assured me that the U.S. Government will find a way to stretch
that timeframe.
Regardless, if the agents have not made a case against you, the
government attorney's will not press charges. Even so, you can
expect them to hold onto any seized equipment until the
conclusion of their investigation. If they go so far as seizing
equipment and not pressing charges, you can expect to get your
stuff back 1,825 days after it was taken, just to spite you.
What exactly is illegal?
Thanks to the vague (or was it intentional?) wording of the Title
18 laws, several actions you may consider harmless could fall into
murky legal territory. As a DCIS agent recently said in a
conversation about the last article, "Even if you telnet to a
machine and type anything in, that can be attempted intrusion!".
As fascist as that may sound, it is true. Any activity or
connections to a remote machine without authorization may be
illegal. Because it is partially based on intent and partially based
on your activities, this is still somewhat uncharted territory. While
it is highly unlikely you will be charged for portscanning a
machine, repeated poking at an open port could be enough to
spark interest in your activities.
Another term often used by agents and lawyers is "illegal access
device" (IAD). What has turned into another all encompassing
term, this can be used for a wide variety of things in a case
against you. Some of the few things that fall into this category:
login/passwd: Any login and password for any type of
system be it unix, VAX/VMS, voice mail or something else.
ESN/MIN: Cloning cell phones is illegal as you know, but
each ESN/MIN pair counts as one IAD.
CC/Exp: Each Credit Card w/ Expiration Date. Remember, it
takes both pieces to purchase anything.
Access keycard: Find an access device in the dumpster?
Pick it up after someone dropped it? This allows access
(illegally) into a building.
Employee ID: Like an access keycard, these are often used
to bypass controlled access points or visual checks at
guard desks.
Consider that when some hackers are busted, they are caught
with a list of thousands of logins and passwords to systems
around the world. Disturbing to think that each one can be used
as a felony charge against you. When federal agents hold up to a
thousand felony charges over your head, it is often enough to
make you want to cut a deal. This is one reason that strong
encryption is the friend of hackers.
More on Punishment
The punishment for hacking crimes is growing. Convicted hackers
five years ago could expect a light slap on the wrist, a few hours
of community service, and not much else. These days, a single
felony count of computer hacking can lead to 15 months in jail
along with restitution in the tens of thousands of dollars.
Looking at a verbose list of restrictions placed on Kevin Mitnick,
examine them closely and consider what they really entail.
While the following restrictions may not be applied to every case,
consider that they have been applied to one convicted hacker.
Further consider that as such, these restrictions may be used as
case law in future court hearings. The following restrictions are
taken from a larger document concerning Kevin Mitnick and the
restrictions.
http://www.kevinmitnick.com/081898writ.html#release_conditions
A. Absent prior express written approval from the Probation Officer,
the Petitioner shall not possess or use, for any purpose, the
following:
1. any computer hardware equipment;
2. any computer software programs;
3. modems;
4. any computer related peripheral or support equipment;
5. portable laptop computer, 'personal information assistants,'
and derivatives;
6. cellular telephones;
7. televisions or other instruments of communication equipped with
on-line, internet, world-wide web or other computer network
access;
8. any other electronic equipment, presently available or new
technology that becomes available, that can be converted to
or has as its function the ability to act as a computer system
or to access a computer system, computer network or
telecommunications network (except defendant may possess a
'land line' telephone);
B. The defendant shall not be employed in or perform services for any
entity engaged in the computer, computer software, or
telecommunications business and shall not be employed in any
capacity wherein he has access to computers or computer related
equipment or software;
C. The defendant shall not access computers, computer networks or other
forms of wireless communications himself or through third parties;
D. The defendant shall not acts as a consultant or advisor to
individuals or groups engaged in any computer related activity;
E. The defendant shall not acquire or possess any computer codes
(including computer passwords), cellular phone access codes or other
access devices that enable the defendant to use, acquire, exchange
or alter information in a computer or telecommunications database
system;
F. The defendant shall not use any data encryption device, program or
technique for computers;
G. The defendant shall not alter or possess any altered telephone,
telephone equipment or any other communications related equipment.
For a period of THREE years, being subjected to these
restrictions. Not only does your primary hobby go away, your
means for stable income are at serious risk. Think of every job
you could hold with these restrictions and life does not look so
pleasant. Even working at Taco Bell requires the use of
computerized registers. Telemarketing and other menial tasks that
once were viable methods of income also go away. Jobs that
consist mostly of physical labor become about the only option left
to you. Don't forget, many companies will not hire convicted
felons, even for physical labor.
Court ordered restitution will be a new world of difficulty. Many
people fail to realize that not only are restitution amounts fairly
significant, but they must be paid back in a timely fashion. Oh
yeah, remember that you are not likely to hold a job that pays
more than six bucks an hour. So how much is US$50,000 when it
comes down to it? Consider that you might be able to earn
US$25,000 a year if you are fortunte. Giving up your entire salary
would allow you to pay it off in two years. If you can live off of
US$15,000 (poverty level), you could then pay back the
restitution in only five years. Five years of living at a poverty
level.
Is defacing a web page and putting up a message "hackerX 0wnz
j00" REALLY worth it?Not Just a Game Anymore
By: Brian Martin
This is a followup to a previous article titlted Is it worth it?
Dispelling the myths of law enforcement and hacking, released on
November 22, 1999 via Hacker News Network.
Included with this article are several sanitized copies of various
documents pertaining to computer crime investigations. Names,
dates and locations have been changed.
Some of the information in this article may be a bit redundant
from the last article, but is done in order to present a self
standing article that is as complete as possible. Some of the links
to agency homepages have been changed to point to their true
home page, not just the system hosting the page.
Topics:
More on Search and Seizure
The Search
The Seizure
Statute of Limitations
What exactly is illegal?
More on Punishment
Investigating Agencies:
Federal Bureau of Investigations (FBI)
Defense Criminal Investigative Service (DCIS)
NASA Office of the Inspector General (NASA OIG)
Naval Criminal Investigative Service (NCIS)
U.S. Army Criminal Investigation Command (USACIDC)
Royal Canadian Mounted Police (RCMP)
Defense Computer Forensic Laboratory (DCFL)
Appendix and Additional Information
A - Search and Seizure Warrant
B - Search and Seizure Warrant, Attachment A (apartment)
C - Search and Seizure Warrant, Attachment A (colocated
machine)
D - Search and Seizure Warrant, Attachment C
E - Warrant for Arrest>
F - Indictment
G - USDOJ Press Release
More on Search and Seizure
Before any Law Enforcement (LE) officer/agent may step foot in
your place of living, they must obtain a search warrant that gives
them explicit permission to do so. The warrant will list the
physical address of the premises to be searched, a description of
the establishment, a time frame for the search and seizure, and a
list of acceptable material that may be seized. The warrant is
likely to be issued by your District Court to the agent in charge of
the investigation.
Rather than explain each part of the search and seizure warrant,
I have included a sanitized vrsion of one with this article. From
my experience and communication with others, the warrant
included can be taken as a very typical and standard version
used throughout the U.S. Appendix A includes the first page of
the warrant which details the premisis to be searched, dates,
who will conduct the seizure and more. Appendix B is a copy of
Attachment A which is a wordy description of the premises to be
searched. Appendix C is a copy of Attachment C which lists all
material covered under the search and seizure guidelines.
Appendix A - Search and Seizure Warrant
Appendix B - Search and Seizure Warrant, Attachment A
(apartment)
Appendix C - Search and Seizure Warrant, Attachment A
(colocated machine)
Appendix D - Search and Seizure Warrant, Attachment C
Some notes and observations about the material contained in
Appendix A. Outlined on the warrant, the agents may conduct
the search and seizure either between the hours of 6:00am -
10:00pm, OR "at any time in the day or night as I find reasonable
cause has been established". One of the two options should be
struck through and initialed by the Judicial Officer. Also included
is a date that the search must be executed by.
The Search
Being subjected to an FBI search and seizure is an interesting
experience to say the least. No official wording on any warrant
can come close to explaining the experience. Typically arriving at
your residence between 6:00 and 8:00am, almost a dozen agents
are ready to toss your apartment to fufill the warrant. After being
greeted at gunpoint and your residence secured, the agents will
mark each room with a postit note and number. These numbers
correspond to the receipt they leave you detailing what material
was taken from each room.
In keeping with standard search and seizure practice, not much is
left unturned. Some of the places you can expect the agents to
search:
Under the bed, between the sheets, between the
frame/box
Behind each and every hanging picture, especially framed
Under/Behind dressers and furniture
In the reservoir of your toilet
Any attic or crawl space
Every drawer, cupboard, container, shelf or other storage
area
Inside the refridgerator/freezer
Under/Inside any cushion with removable insides
Between the pages of books
In air vents or other commonly used places to conseal
items
If this does not help paint a picture that agents are rather
thorough, let me clear it up. They are quite thorough. Do they
find everything? Not all the time. In some cases agents even miss
items out in the open that they might normally take. To balance
this, they almost always take a considerable amount of material
that is completely irrelevant or esoteric.
For the most part, you can also dismiss any notions you may
have about hiding items before the raid. When they knock on the
door, they will not give you time to do anything short of opening
the door and complying with their demands. If they have any idea
that you may be destroying evidence, they are empowered with
the ability to forcibly enter your residence, physically detain you,
and carry on.
The search and seizure will not be short by any means. You can
expect it to last anywhere from a few hours to a full day. During
this time you will be questioned by a number of agents regarding
anything and everything they might think to ask. I don't know if it
is intentional and designed to throw you off, but they may ask
extremely bizarre questions that lead you to wonder about their
intelligence. During this questioning do one of two things.
Refuse to answer ALL questions until your lawyer is
present.
Answer questions honestly.
Lying to law enforcement agents may seem like a clever thing to
do at the time, but it is much more likely to hurt you in the long
run. If caught in a single lie during questioning, it will further
encourage the agents to question you more. They also have the
option of charging you with obstruction of justice if so inclined.
When an agent gets it through their head that you are guilty, bad
news for you regardless of your guilt or innocense.
It is extremely important that you realize your rights. UNDER NO
CIRCUMSTANCE do you have to answer questions without the
presence of your lawyer. No matter what the LE agent says,
suggests, or implies, this is a fundamental right. In many cases,
raid victims are not being charged with a crime. Because of this,
their rights are not read to them. Just because you aren't under
arrest does not mean those rights are waived! The courts have
recently found that police can be sued if they discourage raid
victims from consulting a lawyer. More on this ruling can be found
in this Washington Post article.
The Seizure
What can LE Agents take from you? EVERYTHING. You can't
argue about it either. While they may take material that is not
explicitly covered under the warrant and may later be forced to
give it back to you, that doesn't help you when they are
rummaging through your house. Re-read the list of material that
are covered under Attachment C again and think about how
broad it is.
It is safe to say that absolutely anything remotely computer
related is covered under the warrant. There are a few things that
are also covered under the guidelines that tend to surprise people
when confiscated.
"electronic organizers": these include ones with mini
keyboards like the Sharp organizers, as well as touch
screen like Palm Pilots.
"personal diaries": even your little black journal detailing
sexual exploits, or a notepad with poetry.
"books, newspaper, and magazine articles concerning
hacking": this includes ANY computer book in your
residence. Newspapers or magazines that have security or
hacker articles are included.
"cassette tapes, video cassette tapes, and magnetic
tapes": If it isn't a store bought tape, it is subject to
seizure. Doesn't matter if it contains episodes of the
Beavers or pornography.
"fax machines": despite a fax machine typically not having
the ability to store information long term, it is fair game.
"indicia of occupancy or tenancy..": Any paperwork or proof
that you own or rent your place. Any sales receipts, billing
records or anything else close.
"other items ... in violation of Title 18..": Perhaps the worst
listing of them all, this allows them to take just about
anything else they may deem necessary.
Statute of Limitations
Another often asked question is how long the feds can
investigate you. As long as they want. For most cases, LE can
investigate a crime for up to five years after it was committed.
This is known as the Statute of Limitations and means how long
they can investigate and press charges against you for the crime.
Hypothetically that is. If the crime is serious, several agents have
assured me that the U.S. Government will find a way to stretch
that timeframe.
Regardless, if the agents have not made a case against you, the
government attorney's will not press charges. Even so, you can
expect them to hold onto any seized equipment until the
conclusion of their investigation. If they go so far as seizing
equipment and not pressing charges, you can expect to get your
stuff back 1,825 days after it was taken, just to spite you.
What exactly is illegal?
Thanks to the vague (or was it intentional?) wording of the Title
18 laws, several actions you may consider harmless could fall into
murky legal territory. As a DCIS agent recently said in a
conversation about the last article, "Even if you telnet to a
machine and type anything in, that can be attempted intrusion!".
As fascist as that may sound, it is true. Any activity or
connections to a remote machine without authorization may be
illegal. Because it is partially based on intent and partially based
on your activities, this is still somewhat uncharted territory. While
it is highly unlikely you will be charged for portscanning a
machine, repeated poking at an open port could be enough to
spark interest in your activities.
Another term often used by agents and lawyers is "illegal access
device" (IAD). What has turned into another all encompassing
term, this can be used for a wide variety of things in a case
against you. Some of the few things that fall into this category:
login/passwd: Any login and password for any type of
system be it unix, VAX/VMS, voice mail or something else.
ESN/MIN: Cloning cell phones is illegal as you know, but
each ESN/MIN pair counts as one IAD.
CC/Exp: Each Credit Card w/ Expiration Date. Remember, it
takes both pieces to purchase anything.
Access keycard: Find an access device in the dumpster?
Pick it up after someone dropped it? This allows access
(illegally) into a building.
Employee ID: Like an access keycard, these are often used
to bypass controlled access points or visual checks at
guard desks.
Consider that when some hackers are busted, they are caught
with a list of thousands of logins and passwords to systems
around the world. Disturbing to think that each one can be used
as a felony charge against you. When federal agents hold up to a
thousand felony charges over your head, it is often enough to
make you want to cut a deal. This is one reason that strong
encryption is the friend of hackers.
More on Punishment
The punishment for hacking crimes is growing. Convicted hackers
five years ago could expect a light slap on the wrist, a few hours
of community service, and not much else. These days, a single
felony count of computer hacking can lead to 15 months in jail
along with restitution in the tens of thousands of dollars.
Looking at a verbose list of restrictions placed on Kevin Mitnick,
examine them closely and consider what they really entail.
While the following restrictions may not be applied to every case,
consider that they have been applied to one convicted hacker.
Further consider that as such, these restrictions may be used as
case law in future court hearings. The following restrictions are
taken from a larger document concerning Kevin Mitnick and the
restrictions.
http://www.kevinmitnick.com/081898writ.html#release_conditions
A. Absent prior express written approval from the Probation Officer,
the Petitioner shall not possess or use, for any purpose, the
following:
1. any computer hardware equipment;
2. any computer software programs;
3. modems;
4. any computer related peripheral or support equipment;
5. portable laptop computer, 'personal information assistants,'
and derivatives;
6. cellular telephones;
7. televisions or other instruments of communication equipped with
on-line, internet, world-wide web or other computer network
access;
8. any other electronic equipment, presently available or new
technology that becomes available, that can be converted to
or has as its function the ability to act as a computer system
or to access a computer system, computer network or
telecommunications network (except defendant may possess a
'land line' telephone);
B. The defendant shall not be employed in or perform services for any
entity engaged in the computer, computer software, or
telecommunications business and shall not be employed in any
capacity wherein he has access to computers or computer related
equipment or software;
C. The defendant shall not access computers, computer networks or other
forms of wireless communications himself or through third parties;
D. The defendant shall not acts as a consultant or advisor to
individuals or groups engaged in any computer related activity;
E. The defendant shall not acquire or possess any computer codes
(including computer passwords), cellular phone access codes or other
access devices that enable the defendant to use, acquire, exchange
or alter information in a computer or telecommunications database
system;
F. The defendant shall not use any data encryption device, program or
technique for computers;
G. The defendant shall not alter or possess any altered telephone,
telephone equipment or any other communications related equipment.
For a period of THREE years, being subjected to these
restrictions. Not only does your primary hobby go away, your
means for stable income are at serious risk. Think of every job
you could hold with these restrictions and life does not look so
pleasant. Even working at Taco Bell requires the use of
computerized registers. Telemarketing and other menial tasks that
once were viable methods of income also go away. Jobs that
consist mostly of physical labor become about the only option left
to you. Don't forget, many companies will not hire convicted
felons, even for physical labor.
Court ordered restitution will be a new world of difficulty. Many
people fail to realize that not only are restitution amounts fairly
significant, but they must be paid back in a timely fashion. Oh
yeah, remember that you are not likely to hold a job that pays
more than six bucks an hour. So how much is US$50,000 when it
comes down to it? Consider that you might be able to earn
US$25,000 a year if you are fortunte. Giving up your entire salary
would allow you to pay it off in two years. If you can live off of
US$15,000 (poverty level), you could then pay back the
restitution in only five years. Five years of living at a poverty
level.
Is defacing a web page and putting up a message "hackerX 0wnz
j00" REALLY worth it?
@HWA
22.0 Y2K Fix Really An Extensible Worm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
W95.Babylonia seems to be a breakthrough in
virus/worm technology. It is the first known 'extensible
worm' which allows the author, or anyone else, to
remotely change the capabilities of the software after
infection. According to Symantec, the virus was
authored by a group calling itself the 29A (666 in hex)
virus writing group. The primary means of infection so
far has been through IRC where it poses as a fix to the
Y2K bug. More than 20 instances of infection have been
reported so far. There have been four plug-ins
discovered that the worm can download to extend its
capabilities.
Wired
http://wired.lycos.com/news/technology/0,1282,32956,00.html
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2405495,00.html?chkpt=zdnntop
Wired;
Virus Masquerades as Y2K Fix
Wired News Report
2:25 p.m. 7.Dec.1999 PST
Virus fighters warned Tuesday of a new
virus that is spreading in online chat
rooms disguised as a Y2K bug fix.
Computer Associates and other antivirus
software companies said W95.Babylonia is
the first "extensible worm" computer virus
of its kind and attacks users of Internet
Relay chat (IRC) rooms.
More Infostructure in Wired News
Experts said the virus is uniquely
dangerous because its author can alter
the damage or data-theft inflicted on a
daily basis.
"It is particularly dangerous due to the
virus writer's ability to change the virus'
payload remotely and after infection,"
Simon Perry, business manager for CA
Security Solutions, said in a statement.
"This virus represents a new level of virus
capability."
To become infected a user of IRC
software need only visit a chat room
where the virus is being spread.
The virus infects Windows-based
computers and can be spread by
executing a downloaded file or by another
infected machine via MIRC software, an
application used to participate in IRC chat
rooms.
According to a description on the
Computer Associates Web site, the virus
begins polling a Web site in Japan every
60 seconds, looking for updates the
author has written to extend the
capabilities of the virus. The virus can
download the updates to infected
computers, where it can reformat a hard
drive, delete files, or collect sensitive
information.
The companies report there are currently
four plug-ins that the virus can download
to extend its capabilities.
Once a user's machine is infected,
Babylonia will attempt to infect every
executable and help file in the user's
Windows environment, said Computer
Associates.
Companies offering fixes to prevent the
virus from infesting include Computer
Associates and Symantec.
According to Symantec, the virus was
authored by a group calling itself the 29A
virus writing group. More than 20
instances of infection have been
submitted to Symantec, the company
said in a statement.
-=-
ZDNet;
Experts warn of new, updatable virus
W95.Babylonia uses the Web to upgrade
itself -- and could pave the way for smarter
viruses with heavy payloads.
By Robert Lemos, ZDNet News
UPDATED December 8, 1999 7:57 AM PT
Anti-virus firms are warning of a new computer virus
that spreads through Internet chat rooms and
updates itself automatically with files from the Web.
"This is the tip of the iceberg," on
Tuesday said Eric Chien, senior
researcher for anti-virus software
maker Symantec Corp., who
stressed that the virus' capacity to
upgrade itself makes it a concern.
"Virus writers again are using
more network-centric ideas to
create viruses."
Symantec (Nasdaq: SYMC) has only encountered two
dozen reports of the virus, dubbed W95.Babylonia, since
it was discovered on Friday, Dec. 3. Another security
firm, Computer Associates Inc. (NYSE: CA), has only
encountered 15 reports so far. Currently, the virus infects
executible (.EXE) and help (.HLP) files.
While the computer virus has not spread widely and
currently has no dangerous payload, anti-virus experts
fear that a better-written clone could be more effective in
the future.
Or, just as bad for users, the virus writer could decide to
add a new payload to the virus. Unique in that it looks at
a virus-exchange Web site in Japan for updates,
Babylonia is actually just an 11KB program that spreads
itself when an infected file is opened and transfers
updates from the Web when the host machine is online.
Virus downloads four modules
The current version downloads four modules from the
Japanese virus-exchange site. The first module is just
another copy of the virus, which could update the virus.
The second module is a text file that replaces the
autoexec.bat file on the host computer with a new one
containing the message:
W95/Babylonia by Vecna (c) 1999
Greetz to RoadKil and VirusBuster
Big thankz to sok4ever webmaster
Abracos pra galera brazuca!!!
---
Eu boto fogo na Babilonia!
The text identifies the writer as Vecna, which Symantec
claims is a member of a Latin America virus group known
as 29A (or 666 in hexadecimal). The Bubbleboy virus was
allegedly created by Zulu, another member of the 29A
group.
The third module sends an
e-mail message to a Hotmail
account established to count
the number of computers
infected by Babylonia. And the
fourth module contains code
that causes infected users
who use mIRC chat software
to send a copy of the virus to
everyone in the chat room
using the DCC file transfer
feature of mIRC.
In most cases, the chat
software will notify the
recipients that someone is
sending them a file. However,
users that have DCC
downloading set to
"automatic" will receive no notification. Unless the file,
which parades as a Y2K bug fix (not coincidentally called
Y2k bug fix.exe), is run, the user's computer will not be
infected with the virus.
However, any or all of these aspects of the virus could
change. The writer could add a new set of updates to the
Web to change the copies of the virus already infecting
users' machines, tweak the methods the virus uses to
spread, or even add a destructive payload.
"Tomorrow, it could be using Outlook to spread," said
Symantec's Chien, referring to a number of recent
viruses, including Melissa and ExploreZip, that have
spread by sending themselves using Microsoft (Nasdaq:
MSFT) Outlook and its address book.
Ironically, the ability to update a virus resembles the
LiveUpdate technology that Symantec uses to keep its
virus scanner in touch with the times. The ability to
upgrade is one that has been used by the software
industry for a few years to fix applications over the Net.
Problematic for home users
"At this point, it is a proof of concept," said Narender
Mangalam, director of security products for Computer
Associates. "It spreads through chat rooms, it will mainly
be a problem for home users, who tend to be more lax
about security."
The current form of the virus can be detected by
searching for a file called Babylonia.exe on any
questionable computer. In addition, computers that show
the aforementioned message at start up should be
considered infected.
Just remember, however: Tomorrow, all bets are off -- the
symptoms could change.
@HWA
23.0 Distributed DoS Attacks Becoming Popular
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
New Denial of Service tools, such as Trinoo and TFN,
have security experts concerned. These new tools can
launch a crippling attack on an Internet server with an
overwhelming number of requests from several machines
at once. CERT plans to release a report on this
'distributed attack' method later this week. Currently
there is no simple fix or patch.
USA Today
http://www.usatoday.com/usatonline/19991207/1723034s.htm
(Document not found - Ed)
@HWA
24.0 FBI to Remain on Alert Over Y2K
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Turtlex
Michael Vatis, director of the FBI's National
Infrastructure Protection Center (NIPC), has said that
the FBI would be on alert during the new year
changeover. He explained that agents would be looking
for malicious activities directed against Internet sites
although they had no hard evidence of any planned
attacks. (Hmmm, I think the key words here are "no
hard evidence".)
Reuters - Via Excite News
http://news.excite.com/news/r/991207/11/net-internet-fbi
FBI Official Says Primed for Y2K Internet Malice
Updated 11:29 AM ET December 7, 1999
LONDON (Reuters) - U.S. federal agents are prepared for malicious attacks
on Internet web sites under cover of any broader confusion during the
transition to the new millennium, a senior official said Tuesday.
Michael Vatis, director of the FBI's national infrastructure protection
center, told a meeting of international business representatives and legal
officials the bureau would be on the alert although it had no hard evidence
of any planned attacks.
"It's natural to expect there might be people doing stupid things with
computers," he said, discussing concerns that computer confusion generated
by the date change may provide cover for attacks on Internet computers.
Some devices risk crashing if their internal programming does not enable
them to recognize 2000 as part of the next century. Fears have also been
voiced that computer hackers could exploit that confusion, especially with
viruses.
@HWA
25.0 IOPS Sets Up Y2K Watch Center
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
The Internet Operators Group (IOPS.ORG) is planning to
coordinate real-time communications between major
global ISPs, equipment vendors and government officials
to handle any Y2K Internet problems that may arise.
IOPS will sponsor a telephone conference bridge to keep
major ISPs in continuous contact in order to report on
and resolve any Internet related incidents. The
telephone conference bridge initiative, named "Silent
Night," will begin before midnight on December 31, New
Zealand time and stay open for at least 48 hours.
PR Newswire
http://library.northernlight.com/FB19991207640000071.html?cb=0&dx=1006&sc=0#doc
INTERNET OPERATORS PREPARE FOR 'SILENT NIGHT' ON THE INTERNET DURING
MILLENNIUM ROLLOVER IOPS.ORG SPONSORS UNIQUE YEAR-END TWO-DAY Worldwide
Telephone Bridge And 'Trouble-Ticket System' to Provide Early Warning and
Technical Assistance On Y2K Internet Incidents
Story Filed: Tuesday, December 07, 1999 10:23 AM EST
RESTON, Va., Dec 7, 1999 /PRNewswire via COMTEX/ -- As the millennium
unfurls around the globe starting December 31, 1999 in New Zealand, The
Internet Operators Group (IOPS.ORG) will coordinate real-time
communications between major global Internet Service Providers,
equipment vendors and government officials to handle any Y2K Internet
problems and facilitate resolving them before they have a significant
impact, especially in the United States, where a majority of the world's
160 million Internet users reside.
IOPS will sponsor a telephone conference bridge to keep Internet operators
in continuous contact in order to report on and resolve any Internet
incidents. The telephone conference bridge initiative, named "Silent
Night," will begin before midnight on December 31, New Zealand time
(early morning EST on December 31 in the US) and stay open for at least 48
hours with ports directly to 20-25 Internet service providers, equipment
vendors and other entities.
"Although we don't expect problems, by midnight on December 31 in the US
we should be well aware of any issues that will impact the Internet,"
stated IOPS Executive Director, Ira Richer. "This is the first time that
so many major global Internet networks and equipment vendors have
cooperated in real-time to identify and resolve potential Internet
outages, security hacks and other incidents around the world."
IOPS also will use its Web-based shared "trouble-ticket" system as an
alternative communications path, should Y2K issues affect the telephone
system. An open "trouble ticket" -- a continuously updated information
form accessible to authorized users via the Web -- can provide
real-time status information and document Internet incidents and responses
among providers.
IOPS.ORG is a group of Internet Service Providers that fosters industry
cooperation in the public interest on joint technical problems and
operations concerning the global Internet ( http://www.iops.orq). Its
executive director, Richer, is an employee of Corporation for
National Research Initiatives; which hosts IOPS. Members have tested their
own Internet systems for Y2K readiness, but are preparing for possible
problems beyond the scope of their own systems.
The IOPS conference bridge and trouble ticket system will be coordinated
with the President's Council on Year 2000 Conversion's Information
Coordination Center (ICC) -- the Federal Government's central point for
monitoring system operations during the Y2K rollover. The ICC will
share information among the different economic sectors, coordinate with
international entities and provide reports to the public.
"This unprecedented cooperation between competing Internet networks and
providers will be enormously helpful to ensure United States preparedness
to meet any technical problem that could result from Y2K-related network
and telecommunication failures around the world," said John
Koskinen, Chair of the President's Council on Year 2000 Conversion. "We
are pleased to partner with IOPS members who are committed to ensuring
that US Internet users and businesses can count on a reliable Internet
infrastructure."
G. Mark Hardy, Director of Professional Services at Secure Computing
Corp., a premiere security software and consulting firm, commented,
"Script-kiddies will be trying to take advantage of Internet and software
weaknesses during the millennium cross-over, but the real hacker
pros will be out enjoying the millennium parties. Initiatives like the
IOPS "Silent Night" hotline could be extended to real-time linkups on
demand, so that Internet operators can quickly respond to major system
problems in the future, such as a massive outbreak of a new type of
virus."
IOPS' Internet Service Provider members include AT&T, BroadWing
Communications Inc., Cable&Wireless, Conxion, EarthLink, GTE
Internetworking, ICG, Qwest, and Sprint. Besides IOPS members, additional
Silent Night participants include: AboveNet, America Online, MCI
WorldCom's UUNET and its east and west coast Metropolitan Area Ethernets
(MAEs), ISPs from the North American Network Operators' Group (NANOG) and
equipment vendors including Cabletron, Cisco, Juniper Networks, Lucent
Technologies, and Marconi. IOPS also will coordinate its activities with
cooperating operators of the Domain Name System and of Internet traffic
exchange points.
About IOPS IOPS.ORG is a group of Internet service providers who work
together in the public interest to resolve and prevent network integrity
problems and address other issues that require technical coordination and
information sharing
IOPS members, for example, worked with the Internet Engineering Task Force
(IETF), the Computer Emergency Response Team (CERT), equipment suppliers
and customers to cut down on so-called "smurf" denial-of-service attacks.
Such attacks can cause a "packet storm" that could impair or disable
the target ISP's network. IOPS provided information on how networking
equipment can be configured to prevent these attacks.
SOURCE Conxion Corporation (C) 1999 PR Newswire. All rights reserved.
http://www.prnewswire.com
CONTACT: Megan O'Reilly-Lewis of Conxion Corporation, 408-566-8546,
or
megan@conxion.net; or Ira Richer of IOPS.ORG, 617-621-7152, or
Richer@cnri.reston.va.us
WEB PAGE:
http://www.iops.orq
@HWA
26.0 IDs Embedded In All Color Copies
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Dr. Mudge
Rumors regarding color copier IDs have been circulating
for a long time. While it has been well known fact for
years that invisible IDs are inprinted on all color copies it
has not been widely reported and has even reached the
status of myth in some laymen circles. A recent report
in the PRIVACY Forum Digest indicates that every color
photocopier and printer does in fact include a unique
identifier stegonagraphicly embedded into the image as
background noise.
PRIVACY Forum Digest, December 6, 1999
http://www.vortex.com/privacy/priv.08.18
PRIVACY Forum Digest Monday, 6 December 1999 Volume 08 : Issue 18
(http://www.vortex.com/privacy/priv.08.18)
Moderated by Lauren Weinstein (lauren@vortex.com)
Vortex Technology, Woodland Hills, CA, U.S.A.
http://www.vortex.com
===== PRIVACY FORUM =====
-------------------------------------------------------------------
The PRIVACY Forum is supported in part by
the ACM (Association for Computing Machinery)
Committee on Computers and Public Policy,
Cable & Wireless USA, Cisco Systems, Inc.,
and Telos Systems.
- - -
These organizations do not operate or control the
PRIVACY Forum in any manner, and their support does not
imply agreement on their part with nor responsibility
for any materials posted on or related to the PRIVACY Forum.
-------------------------------------------------------------------
CONTENTS
IDs in Color Copies--A PRIVACY Forum Special Report
(Lauren Weinstein; PRIVACY Forum Moderator)
*** Please include a RELEVANT "Subject:" line on all submissions! ***
*** Submissions without them may be ignored! ***
-----------------------------------------------------------------------------
The Internet PRIVACY Forum is a moderated digest for the discussion and
analysis of issues relating to the general topic of privacy (both personal
and collective) in the "information age" of the 1990's and beyond. The
moderator will choose submissions for inclusion based on their relevance and
content. Submissions will not be routinely acknowledged.
All submissions should be addressed to "privacy@vortex.com" and must have
RELEVANT "Subject:" lines; submissions without appropriate and relevant
"Subject:" lines may be ignored. Excessive "signatures" on submissions are
subject to editing. Subscriptions are via an automatic list server system;
for subscription information, please send a message consisting of the word
"help" (quotes not included) in the BODY of a message to:
"privacy-request@vortex.com". Mailing list problems should be reported to
"list-maint@vortex.com".
All messages included in this digest represent the views of their
individual authors and all messages submitted must be appropriate to be
distributable without limitations.
The PRIVACY Forum archive, including all issues of the digest and all
related materials, is available via anonymous FTP from site "ftp.vortex.com",
in the "/privacy" directory. Use the FTP login "ftp" or "anonymous", and
enter your e-mail address as the password. The typical "README" and "INDEX"
files are available to guide you through the files available for FTP
access. PRIVACY Forum materials may also be obtained automatically via
e-mail through the list server system. Please follow the instructions above
for getting the list server "help" information, which includes details
regarding the "index" and "get" list server commands, which are used to access
the PRIVACY Forum archive.
All PRIVACY Forum materials are available through the Internet Gopher system
via a gopher server on site "gopher.vortex.com". Access to PRIVACY Forum
materials is also available through the Internet World Wide Web (WWW) via
the Vortex Technology WWW server at the URL: "http://www.vortex.com";
full keyword searching of all PRIVACY Forum files is available via
WWW access.
-----------------------------------------------------------------------------
VOLUME 08, ISSUE 18
Quote for the day:
"It's not the heat, it's the humanity!"
-- Jeff Douglas (Van Johnson)
"Brigadoon" (MGM; 1954)
----------------------------------------------------------------------
Date: Mon, 6 Dec 99 13:31 PST
From: lauren@vortex.com (Lauren Weinstein; PRIVACY Forum Moderator)
Subject: IDs in Color Copies--A PRIVACY Forum Special Report
Greetings. We've recently seen a tirade of stories about "hidden"
identification codes and what many would consider to be surreptitious
centralized information flowing from various popular Internet products and
packages. These have tended to highlight an important truth--whether or not
users really would be concerned about the particular identifiers or data
involved, they tend to get the most upset when they feel that an effort was
made to perform such functions "behind their backs." While it can be argued
how routine, intrusive, or even mundane and innocent a particular case may
be, it's certainly true that people feel a lot better when they know what's
going on.
This issue isn't restricted only to the Internet world. A case in point--
the recurring rumors floating around regarding the presence or absence of
identification codes in color copies (or color prints xerographically
generated from computer output systems).
A recent story involved a customer who was refused permission to make a
color copy of his driver's license (to deal with an identification problem
with his local telephone company). A Kinko's (copying center) worker
reportedly told him that such a copy was "illegal," and could be traced back
to the store through a "hidden ID."
Regardless of whether or not the Kinko's employee was being overzealous in
his interpretation of the rules, what's really going on here regarding a
so-called hidden ID code?
In fact, rumors about this, often chalked up as an "urban legend," have been
circulating for a long time. This is a bit ironic, given that in the
copier/printer industry it's been well known for years--no secret--that
"invisible" IDs *are* imprinted on virtually all color xerographic output,
from (apparently) all of the manufacturers. But for persons outside of
"the trade," this hasn't been as widely known (even though the issue goes
back to the early 90's, and the topic has appeared in publications such as
the Wall Street Journal). However, it does not appear that the
privacy-related aspects of this technology have ever been subject to
significant public discussion.
In an effort to pin down the current state of the art in this area, I had a
long and pleasant chat with one of Xerox's anti-counterfeiting experts, who
is the technical product manager for several of their color-copying
products. The conversation was quite illuminating. Please note that the
details apply only to Xerox products, though we can safely assume similar
systems from competing manufacturers, although their specific policies may
differ.
Years ago, when the potential for counterfeiting of valuable documents on
color copiers/xerographic printers became apparent in Japan (where such
machines first appeared) manufacturers were concerned about negative
governmental reaction to such technology. In an effort to stave off
legislative efforts to restrict such devices, various ID systems began being
implemented at that point. At one stage for at least one U.S.
manufacturer, this was as crude as a serial number etched on the underside
of the imaging area glass!
Modern systems, which are now reportedly implemented universally, use much
more sophisticated methods, encoding the ID effectively as "noise"
repeatedly throughout the image, making it impossible to circumvent the
system through copying or printing over a small portion of the image area,
or by cutting off portions of printed documents. Effectively, I'd term this
as sort of the printing equivalent of "spread spectrum" in radio technology.
To read these IDs, the document in question is scanned and the "noise"
decoded via a secret and proprietary algorithm. In the case of
Xerox-manufactured equipment, only Xerox has the means to do this, and they
require a court order to do so (except for some specific government
agencies, for whom they no longer require court authorizations). I'm told
that the number of requests Xerox receives for this service is on the order
of a couple a week from within the U.S.
The ID is encoded in all color copies/prints from the Xerox color
copier/printer line. It does not appear in black and white copies. The
technology has continued to evolve, and it is possible that it might be
implemented within other printing technologies as well (e.g. inkjet). At
one time there were efforts made to also include date/time stamps within the
encoded data, but these were dropped by Xerox (at least for now) due to
inconsistencies such as the printer clocks not being set properly by their
operators, rendering their value questionable.
It's interesting to note that these machines also include other
anti-counterfeiting measures, such as dumping extra cyan toner onto images
when the unit believes it has detected an attempt to specifically copy
currency. These techniques have all apparently been fairly successful--the
Secret Service has reported something on the order of a 30% drop in color
copying counterfeiting attempts since word of such measures has been
circulating in the industry. The average person might wonder who the blazes
would ever accept a xerographic copy of money in any case... but apparently
many persons are not very discerning. I'm told that the Secret Service has
examples in their files of counterfeit currency successfully passed that was
printed on *dot matrix* printers. So counterfeiting is certainly a genuine
problem.
OK, so now you know--the IDs are there. The next question is, what does
this really mean? Obviously the vast majority of uses for color copies are
completely innocuous or even directly beneficial to the public good (e.g.
whistleblowers attempting to expose a fraud against the public). Is it
acceptable for an ID to be embedded in all color copies just to catch those
cases? The answer seems to be, it depends.
In some cases, even having an ID number doesn't necessarily tell you who
currently owns the machine. While some countries (e.g. China) do keep tight
reign on the ownership and transfer of such equipment, there is no
"registration" requirement for such devices in the U.S. (though the routine
servicing realities of large units might well create something of a de-facto
registration in many situations).
Xerox points out that non-color copies (at least on their machines) have no
IDs, and that most copying applications don't need color. It is however also
true that as the prices of color copiers and printers continue to fall, it
seems only a matter of time before they become the "standard" even for home
copying, at which time the presence of IDs could cover a much vaster range
of documents and become increasingly significant from a routine privacy
standpoint.
It's also the case that we need to be watchful for the "spread" of this
technology, intended for one purpose, into other areas or broader
applications (what I call "technology creep"). We've seen this effect
repeatedly with other technologies over the years, from automated toll
collection to cell phone location tracking. While there is currently no U.S.
legislative requirement that manufacturers of copier technology include IDs
on color copies, it is also the case that these manufacturers have the clear
impression that if they do not include such IDs, legislation to require them
would be immediately forthcoming.
It is important to be vigilant to avoid such perceived or real pressures
from causing possibly intrusive technology creep in this area. In the
copier case, that ID technology being used for color copies *could* be
adapted to black and white copies and prints as well. The addition of
cheap GPS units to copiers could provide not only valid date/time stamps,
but also the physical *locations* of the units, all of which could be
invisibly encoded within the printed images.
Pressures to extend the surveillance of commercial copyright enforcement
take such concepts out of the realm of science-fiction, and into the range of
actual future possibilities. What many would consider to be currently
acceptable anti-counterfeiting technology could be easily extended into the
realm of serious privacy invasions. It would only require,
as Dr. Strangelove once said, "The will to do so."
Perhaps the most important point is that unless we as a society actively
stay aware of these technologies, however laudable their initial
applications may often be, we will be unable to participate in the debate
that is crucial to determining their future evolution. And it's in the
vacuum of technology evolving without meaningful input from society that the
most serious abuses, be they related to the Internet or that copy machine
over on your desk, are the most likely to occur.
--Lauren--
lauren@vortex.com
Lauren Weinstein
Moderator, PRIVACY Forum - http://www.vortex.com
Co-Founder, PFIR: People for Internet Responsibility - http://www.pfir.org
Member, ACM Committee on Computers and Public Policy
------------------------------
End of PRIVACY Forum Digest 08.18
************************
@HWA
27.0 Valiant of Halcon Speaks
~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Mark
Recently blamed for for a massive attack on the
Australian Republican Movement website the long time
underground group Halcon Technologies has remained
unusually quiet. Now one of the groups members Valiant
has offered the first interview from the group to explain
just what the hell went on down under.
QuadCon #1
http://the.wiretapped.net/security/textfiles/quadcon/quadcon-1.txt
****************************************************************************
***************************<-=- QuadCon -=->********************************
****************************************************************************
*************The Newsest Zine To Hit Australia And The World****************
*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/
*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/*/
============================================================================
December 1999 - Issue 1
============================================================================
Whats In This Issue:
# Halcon Hacker Valiant Gives QuadCon An Exclusive Interview And Some
Special Tips In Trying To Prevent Your Machine From Being Hacked
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Interview Of Valiant The Leader Of Halcon. | http://www.halcon.com.au
----------------------------------------------
BackGround:
Halcon was founded in 1993 as a Bulletin Board System and by 1996 had grown
to atleast ten members. Still growing, in October 1996 the group took on
the name Halcon Technologies and in 1997 Valiant registered a business name,
allowing them to register the halcon.com.au domain name. Although the group
was not widely known, on 22nd October 1999, Halcon was blamed for a massive
hack on the Australian Republican Movement website. Despite denials and
misquotations, the story was covered by news outlets, an example of which is
at the following URL:
http://www.halcon.com.au/arm0001.html
Following this incident, Halcon received massive amounts of publicity (most
of it was unwanted) and Valiant claims that Halcon has become the most
popular hacking group in Australia. It currently has 24 members and thousands
of supporters.
Having been misquoted once, Valiant has since denied all interviews to the press,
including an offer from Channel Nine. QuadCon is therefore proud to present
an exclusive, uncut interview with Valiant.
-------------------------------------------------------------------------------
The Interview
-------------
QuadCon: If you were a system administrator of a newly installed slackware
linux machine and you had 20 minutes to secure it what would you do?
Valiant: Go to all the available sites (www.halcon.com.au/links.html) that
cater for that, and quickly grab and install as many patches for
your software available. Close all services (especially fingerd)
that arn't needed, relocate telnet to a different port (I know it
breaches RFC's, but fuck it.) and make sure that you don't
adduser lamers. :)
QuadCon: What is the most common thing to hack to gain access to?
Valiant: Fingerd is the most exploitable feature on machines, the good old
crackers highway. Allthough these days it's neglected as a mode of
system penetration, also alot of sysadmins don't understand the point
of finger anymore and remove it anyway. As for hacking, the best
method available that I remember overusing would be a buffer overflow
in a certain software which makes calls to root. Flood the software,
bang, down it goes and you have root. :)
QuadCon: Does the name Halcon have any relavence to you and why did you choose
it for the name of the group?
Valiant: Halcon .. well, I chose that many years ago, so I can't really
remember why it was chosen, other than that it sounds funky. :P
QuadCon: How would you characterize the media coverage of you?
Valiant: Trivial and biased. They just want an 'evil hacker genious' who
brags about how he hacked NASA, they don't really like me as
basically I won't brag, and I prefer to explain how idiotic the
consumers are for purchasing fucked computers, etc, and other
consumer related problems.
QuadCon: What do you think about hacks done in your name--for instance, the
Australian Republican Movement hack?
Valiant: I wasn't expecting such media coverage on that topic, however they
have no evidence against me, and I have yet to admit to even being
born at this point in time. So fuck 'em all. :)
QuadCon: What's the biggest misconception perpetuated by Hollywood
cybermovies?
Valiant: There is no such thing as a hot female hacker named Acid Burn who has
pert tits and lips that would look very nice wrapped around my hard
disk. :)
QuadCon: In your own words, define hacker.
Valiant: There's two meanings. I fall into both. The code hacker, who lives
to program and does it the hard way, and the system hacker, who loves
finding exploitable features in systems to gain access, does so,
notifies the sysadmin and patches the hole.
QuadCon: What is your technical background. (Which platform do you prefer
PC/MAC? What is your online background? Do you do networking? Do you
know programming languages,etc.)
Valiant: At the moment my prefered operating system is Windows 98 due it's
usability and comprehensive system architecture, when it comes to
personal use, for industrial things such as networking, I prefer any
linux distribution. I am a PC user, allthough I have a few old Apple
Classics in my computer collection. I've been using the internet
through BBS gateways for ten or more years. I network when I have
to, but I used to work as a network engineer. As for programming
languages, I have a bad memory and generally have to 'relearn' things
when I need them, however it's more a refresh than a relearn. :)
QuadCon: I understand that hackers assume an online nickname to become known
by - how did you acquire your nickname?
Valiant: I was seven years old when I logged onto a BBS using an audio coupler
900 bps modem at a friends place. It asked for a handle, Valiant was
my current dungeons and dragons charracter, so I typed it in
sheepishly. I've been known by it ever since. :)
QuadCon: What do you portray system administrators are like?
Valiant: Fail-safe devices that take care of systems, that if programmed
correctly would never need human assistance. :)
QuadCon: What do you think of ALOC, another aussie hacking group?
Valiant: Who? :)
QuadCon: What currently is Halcon working on?
Valiant: Currently working on? We're currently working on the ultimate
encyclopeadia of how to be slothenly and lazy. :)
QuadCon: What would you like Halcon to be in the future?
Valiant: I don't know, that's a hard question really. I never wanted it to be
anything to begin with, time has just made it bigger than I ever
expected. Back when I was a kid and it first started, I never really
thought it would exceed a BBS group of users who were of the same
interests. Now it's allmost like a religious cult for some. :)
QuadCon: Who in the world do you dislike most?
Valiant: Anyone with an IQ under 110. :) 100 is average, so I like people a
tad over. The others should be neutered and shot. :)
QuadCon: Any last comments?
Valiant: I like being a cunt-rag.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Special Thanks
--------------
Valiant of Halcon http://www.halcon.com.au
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Support Us
----------
Please support us - we are looking for a fast permanent unix box to host
a website with all our zines on. If you believe you can help see the contact
section below. Also if you know anyone who wants or deserves to be interviewed
also see the contact section below.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Contact
-------
I can be contacted on IRC irc.wiretapped.net or on the email address
marena@iinet.net.au
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Copyright 1999 QuadCon
-=-
http://www.halcon.com.au/arm0001.html
Hackers deny Republican attack
From AAP
22oct99
AN underground computer hacking group blamed for today's
sabotage of the Australian Republican Movement's head office has
denied responsibility.
The group, known both as Halcon and as the Australian Underground
and Empire Loyalist Movement, was blamed for jamming phones and
e-mails into ARM and shutting down its computer system.
Halcon hacker "Valiant" tonight denied the group was responsible for
the incident.
He said the sabotage was probably done by a "scriptkiddy", a young
teenager working alone trying to get the group's attention.
"You only need a modem and a computer, a 12-year-old could do it,"
Valiant told AAP.
"We are anti-republican, but we wouldn't take that sort of action,
we consider that lame."
ARM was also faxed a list containing 200 names of ARM staff and
supporters along with threats of violence.
Halcon is Australia's oldest underground hacking group, formed in
1993.
It has 24 current members and thousands of supporters.
@HWA
28.0 Scholarships for Surfing
~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Fran
2500 one and two person teams will once again be able
to compete for scholarships to Florida State University
by Surfing the Web. Registration for is now open for the
third annual Florida State University Online Scholar
Challenge. The competition pits teams of high school
students against one another in finding answers to
tough questions online.
FSU Online Scholar Challenge
http://www.fsu.edu/~unicomm/challenge.html
High School Juniors and Seniors!
Are You an Online Scholar?
If you're a high school junior or senior, and you're good at finding information online, you
can win a four-year tuition scholarship to Florida State University, along with other great
prizes.
Florida State University's Online Scholar Challenge is an "online information scavenger
hunt."
The Challenge, now in its third year, pits high school juniors and seniors against one
another in seeking information and answering tough questions on a wide variety of topics
through the LEXIS�-NEXIS� Scholastic Universe information service.
Qualifying rounds are conducted on the Internet. The five top-scoring teams will receive
all-expense-paid trips to Florida State University April 7-8, 2000, for the FSU Online
Scholar Challenge finals.
Act Today! Registration is limited to the first 2500 teams (a team may have one or two
students).
(Follow link for further info and rules etc - Ed)
@HWA
29.0 Dec 8th HNN Rumours
~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Valiant
We aren't sure what to make of this but it would appear
that the Australian government is out to silence certian
individuals. While we have nothing to go on for
verification of this story, other than this web page, we
are hoping that some more resourceful individuals can
gather additional information.
Big Brother -is- Watching!
http://www.halcon.com.au/bigbrother.html
Big Brother -is- Watching!
This is a true story, only the names and other identifying details
have been changed to protect the innocent. The person this story is
about, who we shall name Citizen X, is still on the run from the
powers that be, even though he is innocent.
This story will be updated when-ever Citizen X can contact us.
6th of December, 1999 - Introduction to The Machine.
As I sit here writing this, I realise that out there I am on the 'most
wanted' list of Australia. I am Citizen X, for years I have been in the
Australian underground, and I am probably one of the highest profile
political hackers in Australia. Telstra and Optus have been wanting me
out of the scene for years.
My crime is that I tell the truth, my crime is that I seek the truth. For
this I am marked as a dangerous criminal mastermind by 'them'. Who
-is- Big Brother I hear you ask?
Big Brother is what we call them, the conglomeration of the
government, the federal bodies, the police (state and federal, aswell
as all the little spook divisions on the side) and also into 'them' goes
the corporations. The corporations -do- have power in the 'system'
because they have the money. We all know the government loves
them and will back them to the hilt.
Six months ago Big Brother had no idea who I was, except I made one
mistake. I trusted Australia's privacy laws and a corporation. I was
asked to call a mates school and make a bomb threat just to get him
out of class, which is pretty lame, I agree, however I wanted to see
whether our privacy existed, or whether Australia is as bad as
America when it comes to monitoring the populace and controlling
them.
A few weeks ago I was called up by a spook, he said that the call
was traced to my cellular phone and that due to the fact I gave a
fake address for the account, I am on the most wanted list. He said
that my options are to turn myself in, or be hunted down practically.
Now normally a prank call is let go of, however, when the police got
to the school they said, in their over ambitious way, that they found
'seven potentially explosive devices' in the premises. Mind you there
was nothing in the school, however the moronic police made that
statement and lo, they have to stick to it. Now they need someone
to crucify so they don't lose face in front of Big Brother, they need to
find the Xibomber.
Some spook in his corporate office in Big Brother's bedroom spotted
the links between me and my political hacks, even though my hacks
promoted morals and lawful upholding of Australian citizens freedom,
they persist that now, I, Citizen X, am a dangerous criminal. I must
be caught and punished for my crimes against 'them' and for planting
seven explosive devices in a school on the other side of Australia I've
never heard of nor seen.
Don't trust the government, don't trust the system. They want to
control us, they want to keep us as mindless zombie-like consumers
who work, raise kids to follow in our footsteps, consume, and die. All
telecommunications companies are also in with 'them', I know this
now because of this situation. I cannot explain it perfectly, as it is
I've given away too much information and am risking even more
trouble from Big Brother. But let me say that, at this moment in time,
they will never catch me.
Due to their own fuck up, they now have the need to find a sacrificial
lamb to publically crucify to make them seem 'right'. Why don't I go
public? Why don't I tell the Australian Associated Press? Simple,
because they are part of the system also. There's no escape once
the government have it in for you, other than making a new identity,
getting fake ID's made up for it, and living as the other being.
I am Citizen X, an unlawful evil sadistic serial killer hacker with
attitude, I must be caught, and I must be punished for my crimes
against society. What a crock of shit, I am a lawful hacker who likes
to tell the truth about the conspiracy behind Australia's 'system', but
hey, I may aswell be a serial killer in 'their' eyes.
This story will be updated when Citizen X can contact us.
Welcome to the Machine!
@HWA
30.0 Alleged Melissa Creator May Plead Guilty
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Alex
The accused creator of the Melissa virus, David Smith,
is scheduled to appear in Monmouth County NJ Superior
Court on Thursday. He is also scheduled to appear in
the US District Court in Newark, New Jersey later the
same day. Insiders believe that he will plead guilty to
charges of interruption of public communication, theft of
computer service, and wrongful access to computer
systems.
ZD Net
http://www.zdnet.com/zdtv/cybercrime/news/story/0,3700,2344196,00.html
(Note: There is an audio/video report that accompanies this article on
ZDNet - Ed)
Accused Melissa Author to
Plead Guilty
Sources close to law enforcement say
David Smith will plead guilty to state
and federal charges on Thursday.
By Alex Wellen and Luke Reiter
December 8, 1999
3:25 a.m. EST
(UPDATED 3 p.m.)
Paul Loriquet, a spokesman for the New Jersey
attorney general's office, confirmed that
accused Melissa author David Smith was
scheduled to appear before Judge John
Riccardi in Monmouth County Superior
Court at 10 a.m. EST on Thursday.
Loriquet would not comment on the
reason for Smith's appearance.
A second Smith appearance is scheduled
in the US District Court in Newark, New
Jersey, at 1:30 p.m. Smith is set to
appear before Federal District Court Judge
Joseph A. Greenway, Jr. Court documents
indicate Smith will enter a plea at that
time, according to a staff member at the
federal courthouse.
The New Jersey attorney general's office
plans to release a media advisory
regarding Smith's appearance at 4:30 p.m. on
Wednesday, Loriquet said. The advisory is
expected to contain only logistical
information on the appearances.
Edward Borden, Smith's attorney, would
not confirm the appearance or a plea late
Tuesday.
The slow road to resolution
Smith, a 31-year-old former computer
programmer, was charged in New Jersey
with interruption of public communication,
theft of computer service, and wrongful
access to computer systems in early April.
According to a source close to law
enforcement and familiar with the
investigation, New Jersey faced difficulty
prosecuting the case because companies
hit by Melissa were unwilling to step
forward and publicly admit they were
victimized by the virus.
Federal investigators were involved in this
case from its inception, but to date have
not filed formal federal charges. Among
other offenses, Smith could be charged
under the Computer Fraud and Abuse Act,
Federal Statute Title 18, USC Sec.
1030(a)(5)(A), which makes it illegal to
send code that causes damage to a
"protected" computer.
On Melissa's trail
Smith, of Aberdeen, New Jersey, was
arrested on April 1, 1999, on charges he
created and distributed the Melissa
virus-- a Word macro that swept through
the email systems of thousands of
computers in late March and brought
down mail servers around the world.
Although the virus does not corrupt files,
it resulted in significant server slowdowns,
and forced the shutdown, in some
companies, of entire email systems.
Smith reportedly admitted to investigators
at the time of his arrest that he created
the Melissa virus, according to court
papers filed by the New Jersey attorney
general's office.
Worst security breach since 1988
The virus, which authorities said was
named after a topless dancer in Florida,
spread via Microsoft's Outlook email
program and could instantly generate
dozens of outgoing email messages.
It affected tens of thousands of
workstations, propagating itself into
commercial, government, and military
email gateways and systems. An analyst
from Panda Software said Melissa caused
the worst security breach since the Morris
Worm, which took down the entire
Internet in November, 1988.
A user would contract Melissa by opening
an infected Word attachment in Office 97
or Office 2000, which would then execute
the macro.
From there, the swift-moving macro would
prompt Outlook to send an infected
document to the first 50 names in a user's
address book, with the subject line
"Important Message From [the sender's
name]." The message itself said, "Here is
that document you asked for, don't show
anyone else. ;-)."
Once the email had been sent to the first
50 names, each person who opened the
document would then send it on to 50
more and so on. The result was rapidly
overloaded servers.
In the first 48 hours alone, both Microsoft
and Intel were forced to shut down mail
servers due to Melissa. Other major
companies, including Lucent, Motorola,
Dupont, and Compaq were hit.
The VicodinES connection
Investigators looked for a link between
the Melissa author and a virus writer who
goes by the name of VicodinES who has
been considered a source of the code.
In late March, a CyberCrime investigation
revealed that Smith and VicodinES were
both linked to the same Internet service
provider in New Jersey. Further research
indicated that Smith and VicodinES shared
a number of similarities, including the
same age, location, and profession.
Smith's attorney would not respond to
that allegation. However, the New Jersey
attorney general's office said that Smith is
not VicodinES.
@HWA
31.0 Non-Anonymous Internet Violates First Amendment
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Weld Pond
Anonymity on the Internet should be protected and
deserves to be treated no differently than anonymous
pamphlets or other speech, according to a study
released today by the Cato Institute. U.S. and foreign
law enforcement officials regard anonymity as a threat
to public order and talk about limiting anonymity online.
Proposals to limit anonymous communications on the
Internet would violate free speech rights long
recognized by the Supreme Court. Anonymous and
pseudonymous speech was used to great extent by the
founding fathers such as Thomas Paine, Alexander
Hamilton, John Jay, James Madison, Samuel Adams, and
others. Today, human rights workers in numerous third
world countries have reestablished anonymity and free
speech. Given the importance of anonymity as a
component of free speech, the cost of banning
anonymous Internet speech would be enormous. It
makes no sense to treat Internet speech differently
from printed leaflets or books. (Finally some sanity in
the anonymity debate.)
Nameless in Cyberspace: Anonymity on the Internet - PDF
http://www.cato.org/pubs/briefs/bp-054es.html
@HWA
32.0 OSU Charges Two With Illegal Access
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by boomer
Oklahoma State University has charged students in
connection with an illegal entrance into a computer
system owned by General Atomics, a company based in
San Diego. General Atomics initiated the investigation on
October 18 when they noticed an OSU Internet address
illegally accessing their system.
The O'Colly
http://www.ocolly.okstate.edu/issues/1999_Fall/991208/stories/hack.html
Published: Wednesday, December 8, 1999
Two OSU students suspected of hacking
From Staff Reports
An intrusion into a Department of Energy subcontractor's computer system
has two Oklahoma State University students charged in suspicion of the crime.
Maxwell Evan Mishkin, 18, and his roommate, Gary Steven Holmes, 19, were
arrested Nov. 18, in connection with an illegal entrance into a computer
system owned by General Atomics, a company based in San Diego, according
to a press release.
Mishkin is charged with two counts of violating the Oklahoma Computer Crimes
Act. Holmes is charged as an accessory to a felony.
Both were arraigned at Payne County Courthouse Nov. 18, the release said.
Mishkin was released on $5,000 bond, and Holmes was released on $2,500 bond.
General Atomics, according to its website, is one of the world's leaders in
high technology systems development and nuclear technology.
The press release states that both students will also face disciplinary
action through the university because of violating OSU policy.
The investigation began Oct. 18, when an General Atomics security analyst
alerted OSU's Computing and Information Services that someone with an OSU
Internet address illegally accessed the General Atomics system.
The 1998 Oklahoma Computer Crimes Act states that any person gaining access,
or attempting to gain access to computer systems without authorization can
be convicted of a misdemeanor punishable by up to 30 days in county jail
and a $5,000 fine.
@HWA
33.0 Microsoft Files Lawsuit Against Online Pirates
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
Microsoft has filed lawsuits against auction Web sites or
online software sellers in six states that frequently use
spam to advertise. Microsoft says that it was made
aware of these illegal activities through its anti-piracy
hotline.
Wired
http://www.wired.com/news/technology/0,1282,32985,00.html
Microsoft Sues Online Pirates by Wired News Report
1:55 p.m. 8.Dec.1999 PST Microsoft has filed lawsuits against
businesses in six states to stop allegedly counterfeit sales of the
company's software.
Microsoft said it investigated the companies, which are either auction Web
sites or online software sellers that frequently use spam to advertise.
The company said it had received thousands of tips about the questionable
sales activities on its anti-piracy hotline.
The lawsuits, which sought to obtain injunctions to prevent the sellers
from continuing to offer the software, were filed Wednesday.
The organizations alleged to have counterfeited copies of Microsoft
Office, Windows, and Office Professional include Abu Salahuddin in
Morgantown, West Virginia; Capital One CDRom Warehouse, aka Internet
Marketing in Corpus Christi, Texas; KT Services, aka Vantage
Software and Pacific Ventures, in Los Angeles; Martin Johns in Fond Du
Lac, Wisconsin; NC Software in Wilmington, North Carolina; and Software
Blowouts in Hackettstown, New Jersey.
Microsoft said in a statement that by filing the suits, it hopes to help
"make holiday Internet shopping safer for millions of consumers."
According to the Business Software Alliance estimates there are 840,000
Internet sites selling counterfeit software as genuine product.
In addition to being illegal, counterfeit software also has the potential
to include viruses and miss key software codes, and it renders customers
ineligible for technical support, warranties, and upgrades, according to
the company.
"Internet piracy is growing nearly as rapidly as the Internet itself, and
it is severely harming consumers and their confidence in feeling safe to
conduct legitimate business online," said Tim Cranton, corporate attorney
in charge of Microsoft's Internet piracy efforts, in a statement.
"There is a possibility that this problem could spiral out of control, and
we need consumers to help us hold back the floodgates by being knowledgeable
online shoppers."
@HWA
34.0 CERT Releases Distributed Attack Paper
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by jgrasett
The Computer Emergency Response Team has released
the paper mentioned on HNN yesterday regarding
distributed DoS attacks. The paper examines the use of
distributed-system intruder tools and notes that better
forensic techniques and training are needed.
Results of the Distributed-Systems Intuder Tools Workshop - PDF
http://www.cert.org/reports/dsit_workshop.pdf
(CERT should be commended for using the word
'intruder' throughout this document as opposed to the
word 'hacker')
@HWA
35.0 PWC Finds Serious Weaknesses in Pension Fund Company
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Mr Man
It appears that during an audit the security auditors of
Price Waterhouse Coopers were able to break into
computers at The Pension Benefit Guaranty Corporation
in Washington using dial up lines. Once inside, the
auditors had the ability to not only create fictitious
beneficiaries and send them money, but they could also
edit or delete files and information on individuals in the
systems. Pension Benefit Guaranty Corp. is owned by
the federal government and guarantees the retirement
checks of 42 million Americans. (Hmmm, I wonder how
long those lines where vulnerable before the audit? And
how many other companies have modems dangling off
their network behind the firewall?)
NY Times
http://www.nytimes.com/library/tech/99/12/biztech/articles/08pension.html
(Subscription required to retrieve this article - Ed)
@HWA
36.0 Freaks Macintosh Archives CD
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Freaky
Freaks Macintosh Archives has produced a CD that
contains all the Macintosh underground files known to
exist. The CD also contains edited versions of Freaks
talk at Defcon VII where Space Rogue officially directs
users of the Whacked Mac Archives to Freaks Macintosh
Archives. The CD is ready for pre-orders, this will assure
that you get the low 20.00 price. To Pre-Order send a
email to freaky-order@staticusers.net
Freaks Macintosh Archives
http://freaky.staticusers.net/
@HWA
37.0 Nortell Releases Personal Hardware Firewall
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by AlienPlaque
Users of Cable modems, DSL, ISDN and even dedicated
dial up connection are rapidly discovering the hazards of
being online all the time. To help protect these users
Nortel has introduced the personal hardware firewall
that will sit on the line between your modem and
computer. Currently 'Secure Cable' is only available for
cable modem users but other bandwidth types will be
available soon. (I hope this thing does an auto update
or it will be out of date very quickly.)
Associated Press - via Yahoo
http://dailynews.yahoo.com/h/ap/19991208/tc/cable_internet_security_1.html
PR Newswire - via Yahoo
http://biz.yahoo.com/prnews/991208/nortel_sec_1.html
Wednesday December 8 3:13 PM ET
Device Protects Internet Cable Users
NEW YORK (AP) - Nortel Networks today introduced a new device that cable
operators can use to protect their Internet subscribers from computer
hackers.
While cable TV modems provide speedier Internet service than dial-up
connections through a telephone wire, the cable link is more vulnerable
to hackers because it is usually on all the time.
Some cable-Internet subscribers protect their computers from hacker
intrusions with special software or ``firewall'' hardware.
Secure Cable, a feature of a new network connection box developed by Nortel,
is a firewall that's designed to block hacker attacks in the network, before
they reach subscriber computers.
Nortel has introduced similar devices for dial-up service and digital
subscriber line, or DSL, a high-speed link over a telephone wire that
shares the vulnerabilities of cable.
``Having these types of solutions ... makes a lot of sense,'' said Lisa
Pierce, analyst at the Giga Information Group, noting that more than 10
percent of high-speed Internet users have experienced security problems.
``The average user shouldn't have to think about these technical issues.''
The new Nortel firewall is part of its Shasta 5000 Broadband Service Node.
A node is the part of a cable network that connects a group of neighboring
subscribers to the Internet. It also enables users to subscribe to different
Internet service providers.
Nortel, based in Ontario, is one of the largest suppliers of network
hardware. It had sales of $17.6 billion last year.
-=-
PR Newswire;
Wednesday December 8, 9:01 am Eastern Time
Company Press Release
SOURCE: Nortel Networks Corporation
Nortel Networks Launches 'Secure Cable' Anti-Hacking Protection for
Residential and Small Business PC Users
On-Line Security Critical as U.S. Operators Open Their Cable Networks For
Internet Access
BOSTON, Dec. 8 /PRNewswire/ - Personal computer users subscribing to
`always-on` cable Internet access can now be protected from hackers -- an
increasing problem as cable modems become more and more popular -- thanks
to a new, mass market security solution being launched by Nortel
Networks (NYSE/TSE: NT), the company announced today.
Nortel Networks and its Shasta IP Services division are launching Secure
Cable, which offers anti-hacking protection for Internet cable subscribers
by securing each cable connection with network-based firewalls.
Because cable Internet connections are always on, personal computers
linked to cable are exposed to hacker attacks. And, as broadband becomes
more widely deployed here and abroad and cable and telecommunications
companies offer high-speed Internet access through cable or Digital
Subscriber Line (DSL), more consumers are reporting hacker attacks on
their PCs, sometimes leading to copying or destruction of sensitive data.
And the problem could get worse.
It is predicted that by 2003, more than 30 million U.S. households will be
eligible for high-speed access cable. Furthermore, more than 12 million
U.S. households will have high-speed Internet access over cable or DSL by
2003, according to industry analyst firm, The Strategis Group (Cable
Trends, June 1999). This represents a massive increase from today's 1.4
million cable and DSL Internet access subscribers throughout the country.
`At least one out of 10 high-speed Internet users will experience or be
victimized in a hacker attack,` said Ron Westfall, senior analyst, Current
Analysis. `We see an increased demand for a basic, secure access solution
for high-speed connections like cable and DSL. A basic 'door lock'
solution from Internet Service Providers would help protect customers from
simple hacker attacks and help speed the adoption of broadband. Nortel
Networks addresses the problem with a network-based firewall solution in
its Shasta 5000.`
Nortel Networks' Shasta 5000 Broadband Service Node (BSN) also provides
cable operators with an IP services platform to provide for wholesale
access to their high-speed cable networks, allowing subscribers the choice
of Internet service providers. It is the latest in a suite of
enhanced broadband services provided by Nortel Networks, which earlier
this year, launched its Secure Dial and Secure DSL solutions that are now
being used by service providers around the world.
`Nortel Networks is at the heart of the Internet revolution and is a
global leader in the cable, Internet and telephony market,` said Anthony
Alles, president and general manager of the company's Shasta IP Services
business unit. `Besides building a faster, more reliable Internet,
it also means enhancing broadband security for Internet users of DSL,
cable and other high-speed technologies, and we're achieving that for our
customers.`
Nortel Networks has a major presence in the cable industry, providing high
speed optical networks, switches and routers, head-end equipment, cable
telephony systems, cable modems, and the Shasta Broadband Services Node
for value-added cable internet services. The company and its Arris
Interactive joint venture with Antec supplies cable solutions to major
customers such as AT&T BIS, Time Warner, GTE, Comcast, Cox, Cablevision,
Rogers Communications, UPC, SPTA, Csii and Mitsui.`
Nortel Networks is a global leader in telephony, data, wireless and
wireline solutions for the Internet. The Company had 1998 revenues of
US$17.6 billion and serves carrier, service provider and enterprise
customers globally. Today, Nortel Networks is creating a
high-performance Internet that is more reliable and faster than ever
before. It is redefining the economics and quality of networking and the
Internet through Unified Networks that promise a new era of collaboration,
communications and commerce. For more information, go to
www.nortelnetworks.com.
@HWA
38.0 Interview with dap from sSh
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exclusive by Sla5h
Dap has since disbanded sSh (Sesame Street Hackers) the EFNet irc channel
#sesame is still in operation but has suffered several takeovers as is the
way with 'scriptkiddy/cracker' channels these days. This interview was done
when sSh was still active, a few weeks ago, and didn't make it to these
pages until now due to connectivity problems between the interviewer and
myself. Dap dropped the ftp info for http://www.sShackers.com/ in several
channels inviting people to 'deface' the site, which of course happened
readily. The current state of the site has this message:
ALL OF YOU GIMPS THAT SO CALLED "HACKED" THIS SITE ARE STUPID!%$@^
IF YOU HIT THIS PAGE... ITS CAUSE I GAVE YOU THE FUCKIN' FTP INFO
ALL YOU GUYS ARE GIMPS... NOT HACKERS... IT WAS SUPOSED TO BE A BIG JOKE...
NOT ANOTHER DEFACED SITE TO ADD TO YOUR ATTRITION SHIZM...
AND SEEIN' AS I WAS A MEMBER OF gH, GH IS DEAD, YOU STUPID COCK SUCKIN' MUTHER FUCKER..
GO BACK TO WHERE YOU CAME FROM... AND TRY AND CONVINCE SOMEONE YOU ARE ELITE QUOTE UN-QUOTE SOMEWHERE ELSE!
GOT IT?????
STUPID PIECE OF SHIT...
sSh IS GAY... I KNOW THAT... THAT HAS TO MEAN A LOT COMIN' FROM THE EX-FOUNDER.
GO ./HACK A BOOK.
IDIOTS.
- DAP
sSh/dap interview with Sla5h:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Session Start: Sun Nov 28 14:53:06 1999
Session Ident: slash- (slash@ad5-m80.tel.hr)
<slash-> ---start interview---
<dap> sup?
<slash-> sup G
<slash-> well
<dap> nadda.
<slash-> thanx for taking the time for this interview
<dap> pleasure is all mine
<dap> :D
<slash-> Can U tell us who came up with the idea to start sSH ?!?
<dap> well.. the idea came to me while I was a member of gH.
<dap> gH had recently went legit, and a lot of the members still wanted to do penetration
<dap> but seeing as a few of the members got raided..
<dap> hacking under the name of gH was like a death wish.
<slash-> ..so U started sSH
<dap> yes.
<slash-> How many members sSH counts today ?!?
<dap> about 20
<dap> we've grown rapidly since our media hype with ytcracker.
<dap> and fuqrag
<slash-> I heard they got raided ?!
<slash-> is that true !?
<dap> they haven't got raided...
<dap> yet
<slash-> :)
<slash-> U aint afraid to get raided ?!
<dap> I was told that rackmount, ytcracker and fuqrag will be raided soon.
<dap> well... if you look at most of my defacements... only a few are .mil's and .gov's
<dap> I dont target the government as much as the other members do
<dap> seeing as im not into the IIS4 shit.
<dap> only government boxes I hit are running an operating system unix based.
<slash-> Will sSH end like gH ?
<dap> I hope not...
<dap> y'see... sSh is always excepting new members...
<dap> we will always exist...
<dap> if 5 members get raided...
<dap> they'll prolly be another 6 joining.
<dap> within the next month or so
<dap> I dont want the group to be to big... but I dont want it to die out
<slash-> Why do You deface ?
<dap> well...
<dap> hmm...
<dap> :)
<dap> Ok ..
<dap> the thing is...
<dap> most of the systems I deface, I've had root on for a while...
<dap> about a month or so...
<slash-> So they had the time to fix the holes
<dap> and the funny thing is... they didn't even know til I defaced the site...
<dap> they had more then enuf time.
<slash-> but still...
<slash-> Someone once said that hackers do it to satisfy their ego
<dap> I have gotten a few job offers from sites that I have defaced.. and they have contacted me for technical support etc.
<dap> I like that attitude in an admin.
<dap> slash.. thats somewhat true...
<dap> some due it for the media hype. i.e (ytcracker)
<slash-> Yeah
<slash-> yt really hit the media
<dap> yah ...
<slash-> You don't do it for fame !?
<dap> its not really hard to get into the media like that.
<dap> but... ytcracker needs to take a reality check.
<slash-> did real hacking loose sense ?!?
<dap> he is a good friend... and whatever he wants to do, I got his back.
<slash-> is it all about fame these days
<slash-> ?
<dap> but he thinks he is in a dream world and that he wont get raided.
<dap> did real hacking loose sense...
<dap> thats another one of the reasons I started sSh ..
<dap> I have been in the 'scene' for some time now.
<dap> and the ethics sure have changed since 4 years ago.
<dap> (when I was 12)
<dap> nobody did it for the media...
<dap> cept for LOU
<dap> a lot of people just wanna be known...
<dap> now a days
<dap> nobody cares about ethics anymore... it just turned into a big popularity contest
<slash-> U plan to retire some day !?
<dap> well... im sure I will just say fuck it.. and stay off irc for good.
<dap> but..
<dap> seeing as I do penetration testing for a living, I gotta stay ontop of security
<slash-> So we'll be seeing you in the future as an individual or U'll do defacments for sSH ?1
<dap> if you wont see me defacing for sSh, you prolly wont see me at all..
<slash-> Is there anyone in this scene truly the king?
<dap> hold?
<slash-> k
<dap> talking to a fed on the fone...
<dap> ;\
<slash-> :(
<slash-> can we continue now ?
<dap> hold
<dap> hello?
<dap> yah
<dap> sup?
Session Close: Sun Nov 28 15:38:48 1999
Session Start: Mon Nov 29 15:49:30 1999
Session Ident: slash- (slash@ad9-m74.tel.hr)
<slash-> hi
<slash-> sorry about yestrday
<slash-> I got disconnected
<dap> ok
<dap> sup?
<dap> you wanna finish the interview?
Session Close: Mon Nov 29 15:53:17 1999
Session Start: Tue Nov 30 14:37:12 1999
Session Ident: slash- (slash@ad11-m107.tel.hr)
<slash-> what's the key for sesame
<dap> FBEYE
<dap> whats the url for HWA
<dap> and the interview
<slash-> the interview isn't out yet
<slash-> we have to finish it
<dap> ok..
<dap> continue
<slash-> k
<slash-> --------------------------------
<slash-> Is there anyone in this scene truly the king?
<dap> there is people i give mad respect to...
<dap> like
<dap> xdr
<dap> prym
<dap> soupnazi
<dap> not really a king, more like pros
<slash-> In what category do U sort to !?
<dap> I dont possition myself in any category ...
<dap> I like to learn different things...
<dap> I'd rather know a little about everything then a lot about one thing
<slash-> Can U tell us more about sSH members ?
<slash-> like
<slash-> how skilled they are
<slash-> etc.
<dap> sSh members skilled in different areas...
<slash-> like
<slash-> ..
<dap> we got members aging from 12 to the 30's
<slash-> 12 !??!
<slash-> w0w
<dap> we have a female
<slash-> w0000wwww
<slash-> who is she ?!
<dap> Mya
<slash-> She defaces !?
<dap> she defaced 2 sites so far ...
<dap> she just started.
<dap> ;\
<dap> we got about 27 members
<slash-> kewl
<slash-> that's alot
<dap> http://www.sShackers.com/members.html
<dap> site is fucked, but the guy cant do html for shit
<dap> :|
<slash-> (checking the site up)
<dap> ok .
<slash-> it isn't bad
<dap> yes it is
<dap> if you view it in IE
<dap> its ok
<slash-> dap dude
<dap> sup?
<slash-> I'mm be back in 1/2 hour
<slash-> I'll be back
<dap> ok
<dap> whats the url?
<dap> for the HWA site
<dap> or whatever
<dap> it is
<slash-> welcome.to/HWA.hax0r.news
<slash-> l8r
<dap> ok
<dap> bye
<slash-> bye
Session Close: Tue Nov 30 15:22:03 1999
@HWA
39.0 Melissa Creator Pleads Guilty
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by nvirb
David L. Smith, who was arrested for creating and
releasing the Melissa virus in April, plead guilty on
Thursday to a second-degree charge of computer theft.
The charge covers intercepting computer
communications and damages to computer systems or
data and is punishable by 5 to 10 years in jail and up to
a $150,000 fine.
"Yes, I admit those events occurred as a result of the
spread of the Melissa virus. But I did not expect or
anticipate the amount of damage that took place. When
I posted the virus, I expected that any financial injury
would be minor and incidental. In fact, I included
features designed to prevent substantial damage. I had
no idea there would be such profound consequences to
others." - David Smith (quote taken from ZD Net)
ZD Net
http://www.zdnet.com/zdnn/stories/news/0,4586,2406592,00.html?chkpt=zdnntop
Reuters
http://www.nandotimes.com/technology/story/body/0,1634,500140419-500165810-500604970-0,00.html
Associated Press - via ABC News
http://abcnews.go.com/sections/tech/DailyNews/virus_melissa991209.html
Smith pleads guilty to Melissa virus
Melissa infected hundreds of thousands of
computers -- now its creator faces 10 years
in prison and a $150,000 fine.
By Robert Lemos, ZDNet News
UPDATED December 9, 1999 12:40 PM PT
David L. Smith, who was arrested for creating and
releasing the Melissa virus in April, plead guilty on
Thursday to a second-degree charge of computer theft.
The Melissa macro computer virus hit companies on March
26 after being released to a Usenet newsgroup as part of
a list of porn sites contained in a Word document infected
with the virus.
The virus, which mailed itself out to the first 50 addresses
listed in the address book of Microsoft's Outlook e-mail
client, caused a massive spike in e-mail traffic, flooding
corporate e-mail servers. Companies such as Microsoft
Corp. (Nasdaq: MSFT), Intel Corp. (Nasdaq:INTC),
Lockheed Martin Corp. (NYSE: LMT), and Lucent
Technologies Inc. (NYSE:LU) shut down their gateways
to the Internet in the face of the threat.
After Judge John Riccardi outlined the events, a
nervous Smith read the following statement:
"Yes, I admit those events
occurred as a result of the spread of the Melissa virus.
But I did not expect or anticipate the amount of damage
that took place. When I posted the virus, I expected that
any financial injury would be minor and incidental. In fact,
I included features designed to prevent substantial
damage. I had no idea there would be such profound
consequences to others."
'I certainly agree'
When the judge again asked if Smith agreed that it
caused significant damage to computer systems
nationwide, Smith replied, "I certainly agree. It did result
in those consequences, without question."
The crime -- which covers intercepting computer
communications and damages to computer systems or data -- is
punishable by 5 to 10 years in jail and up to a $150,000 fine.
As part of the plea agreement, Smith has
agreed to the maximum penalty for the crime, but the presiding
judge could ignore the recommendation.
Smith appeared in Monmouth County, N.J., Superior Court at 10
a.m. ET. He has another appearance scheduled in the
U.S. District Court in Newark later today to answer to
federal charges in the case.
According to law enforcement sources close to the case,
Smith will enter a guilty plea in federal court as well.
Edward Borden, Smith's attorney in the case, could not
be reached for comment.
Court papers filed in August stated that Smith confessed to
writing the virus. Smith had admitted his guilt at the time
of the arrest, said Paul Loriquet, a spokesman for the
New Jersey Attorney General's office, in a ZDTV interview.
"There was a statement made
at the time of the arrest from Mr. Smith to our
investigator... that, in fact, at the time of the arrest, he
had admitted to creating the virus and had said that he
had destroyed the personal computers that he had used
to post it on the Internet," Loriquet said in the report.
-=-
Reuters/Nandotimes;
Computer programmer pleads guilty to creating 'Melissa' virus
Copyright � 1999 Nando Media
Copyright � 1999 Associated Press
By JEFFREY GOLD
NEWARK, N.J. (December 9, 1999 11:59 a.m. EST http://www.nandotimes.com) -
A computer programmer admitted Thursday to creating and distributing the
"Melissa" virus. David L. Smith acknowledged caused millions of dollars of
damage by disrupting e-mail systems worldwide.
Smith pleaded guilty to a state charge of computer theft. He was expected
to plead guilty in federal court in Newark later Thursday.
The virus, believed to be named for a topless dancer Smith knew when he
lived in Florida, wreaked havoc at the end of March.
"I did not expect or anticipate the amount of damage that took place,"
Smith read from a statement after answering a series of questions from his
lawyer. Smith said he believed any damage would be minor.
Smith, 31, is believed to be among the first people ever prosecuted for
creating a computer virus. He was arrested April 1 at his brother's home
in nearby Eatontown in Monmouth County and freed on $100,000 bail the next
day.
Smith said he created the virus on computers in his Aberdeen apartment and
used a stolen screen name, "Skyroket," and password to get into America
Online. In the online service's alt.sex newsgroup, he posted a file called
"list.zip," a listing of adult web sites and passwords, which
contained the virus.
Asked by his lawyer, Edward F. Borden Jr., if that was designed to entice
people to download the file, Smith said, "Yes."
"Melissa" struck thousands of e-mail systems on March 26. Disguised as an
"important message" from a friend or colleague, the virus spread around
the world like an electronic chain letter.
The virus was designed to lower security settings on computers with
Microsoft Word 97 and Microsoft Word 2000, making them vulnerable to other
viruses so that any document created would be infected. It also was
designed to send infected mail to the first 50 names in a computer
user's address book through the Microsoft Outlook e-mail program.
Under his plea bargain, Smith could face five to 10 years on the state charge
and up to five years in prison on a federal charge. Sentencing for the state
charge was tentatively set for Feb. 18.
-=-
Associated Press;
Virus Guilty Plea Entered
Suspected Creator of �Melissa� in Court
David L. Smith, center, and his attorney Ed Borden, left, talk to a court official in
the courtroom after Smith's hearing at the Monmotuh County Courthouse in
Freehold, N.J., on Thursday, April 8, 1999. (Daniel Hulshizer/AP File Photo)
By Jeffrey Gold
The Associated Press
N E W A R K, N.J., Dec. 9 � A computer
programmer admitted today he created and
distributed the �Melissa� virus that he
acknowledged caused millions of dollars of
damage by disrupting e-mail systems worldwide.
David L. Smith pleaded guilty to a state charge of
computer theft and later to a federal charge of sending a
damaging computer program. In the federal plea, both sides
agreed the damage was greater than $80 million.
The virus, believed to be named for a topless dancer
Smith knew when he lived in Florida, wreaked havoc at the
end of March. However, authorities said today they could
not confirm the origin of the name of the virus.
Claims Did Not Anticipate Effects
�I did not expect or anticipate the amount of damage that
took place,� Smith read from a statement after answering a
series of questions from his lawyer. Smith said he believed
any damage would be minor.
Smith, 31, is believed to be among the first people ever
prosecuted for creating a computer virus. He was arrested
April 1 at his brother�s home in nearby Eatontown in
Monmouth County and freed on $100,000 bail the next day.
Smith said he created the virus on computers in his
Aberdeen apartment and used a stolen screen name,
�Skyroket,� and password to get into America Online. In
the online service�s alt.sex newsgroup, he posted a file
called �list.zip,� a listing of adult web sites and passwords,
which contained the virus.
Downloading was Expected
Asked by his lawyer, Edward F. Borden Jr., if that was
designed to entice people to download the file, Smith said,
�Yes.�
�Melissa� struck thousands of e-mail systems on March
26, disguised as an �important message� from a friend or
colleague, and spread around the world like an electronic
chain letter.
Melissa was designed to lower security settings on
computers with Microsoft Word 97 and Microsoft Word
2000, making them vulnerable to other viruses so that any
document created would be infected. It also was designed
to send infected mail to the first 50 names in a computer
user�s address book through the Microsoft Outlook e-mail
program.
Under his plea bargain, Smith could face five to 10
years on the state charge and up to five years in prison on a
federal charge. Sentencing for the state charge was
tentatively set for Feb. 18.
@HWA
40.0 Privacy of US Military Officers Breached
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
It has been standard practice of the Department of
Defense to report the names and social security
numbers of officers getting promoted to the US Senate.
This information is then entered into the Federal
Register for all to see. Several of these officers have
become victims of credit card fraud. The Secret Service
is investigating. The Pentagon said it is no longer
providing Social Security numbers to Congress. (Thats
just brillant. Any foriegn power can now run credit
checks on high ranking military personel. Wonderful.)
Nando Times
http://www.nandotimes.com/technology/story/body/0,1634,500140349-500165712-500603813-0,00.html
Public Sources for SSNs
http://www.glr.com/ssnpub.html
Credit scam hits military officers
Copyright � 1999 Nando Media
Copyright � 1999 Associated Press
WASHINGTON (December 9, 1999 8:27 a.m. EST http://www.nandotimes.com) -
The Pentagon said Wednesday that hundreds of military officers, including
some of the nation's top officers, have become victims of credit card
fraud after their names and Social Security numbers were published in the
Congressional Record and on the Internet.
The Secret Service, which has jurisdiction over credit card fraud, has
taken the lead in the investigation.
"It's something the Defense Department has been concerned about for some
time," Pentagon spokesman Bryan Whitman said Wednesday after reports that
one Web site listed the names and Social Security numbers of 4,500
military officers. The information was culled from the pages of the
Congressional Record.
Whitman said the Pentagon no longer provides Social Security numbers to
Congress.
Self-styled Pennsylvania privacy expert Glen L. Roberts, who acknowledges
putting the names and numbers on his Web site, said he was merely trying
to underscore how easy it is to obtain such information.
"People in the Pentagon are outraged that I would be so bold as to quote
the Congressional Record," Roberts said.
In 1968, the military services began using Social Security numbers as
general identification numbers for all military personnel. Until recently,
these numbers were routinely carried in the Congressional Record every
time military promotions were reported to the Senate.
Roberts said he has not posted any new Social Security numbers on his Web
site since the Congressional Record stopped publishing them and that there
is no way to tell whether identity crooks obtained the names from his site,
or from the Congressional Record itself.
@HWA
41.0 Commerce Dept. Introduces New Security Initiative
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Code Kid
Yet another government/industry partnership focusing
on Internet security has been introduced, this time by
the Commerce Department. This one hopes to spread
information security best practices throughout the
private sector. There are 65 companies and associations
from almost every industry segment involved in the
Partnership for Critical Infrastructure Security. (Sounds
familiar. Ummm does Infraguard or FidNET ring a bell?
How many of these taxpayer funded organizations do
we need?)
Federal Computer Week
http://www.fcw.com:80/pubs/fcw/1999/1206/web-security-12-09-99.html
Yahoo News
http://dailynews.yahoo.com/h/nm/19991209/tc/tech_security_2.html
DECEMBER 9, 1999 . . . 14:31 EST
Feds, industry join forces on info security
BY DIANE FRANK (diane_frank@fcw.com)
NEW YORK -- The Commerce Department on Wednesday introduced a
new government/industry partnership that will help spread information security
best practices throughout the private sector and will improve the overall security
of U.S. critical infrastructure.
The Partnership for Critical Infrastructure Security is the latest initiative under
Presidential Decision Directive 63, which requires agencies to protect their
critical information systems and infrastructures against cyberattack. PDD 63
has led to the creation of government security organizations, including the
Critical Infrastructure Assurance Office and the National Infrastructure
Protection Center.
But much of the nation's infrastructure is built and run by industry and not
controlled by government, so the private sector must take an active roll in the
protection, said Commerce Secretary William Daley.
"We are, based on the President's directive, extremely concerned about the
nation's infrastructure...but the federal government alone can't protect it; it's in
the hands of the private sector," he said.
There are 65 companies and associations from almost every industry segment
involved in the partnership. Part of the mission of the partnership will be to
encourage participation by more small businesses and state and local
government groups and to enhance information sharing on security knowledge
and expertise, Daley said.
"This cross-sector work is very important," said Harris Miller, president of the
Information Technology Association of America, a partnership member
organization. "Information security has not yet permeated the consciousness of
boardrooms and suites across the country."
The partnership has set five issues to focus on: education; work force
development; awareness and training; best practices; and research and
development. Another issue that the partnership plans to study is globalization.
Although the Clinton administration mainly is concerned about U.S. national
security issues, many of the companies in the partnership are global, Miller said.
The structure of the partnership is still under development, but Commerce will
be serving in an advisory and enabling role, providing personnel, advice and
other resources when needed, not regulation or federal requirements, Daley
said. And as the leaders for the group, industry sees this as a way to forestall
potential legislation or regulation from Congress, Miller said.
-=-
Thursday December 9 1:29 AM ET
US Companies, Commerce Dept Meet on Tech Security
By Bill Rigby
NEW YORK (Reuters) - Commerce Secretary William Daley met representatives
from major corporations on Wednesday to seek ways to protect America's
banks, electrical grids, phone lines and other key services from
breakdowns caused by computer hackers or technological glitches.
On hand to kick start the new government-private sector forum were
representatives from about 80 companies, including Microsoft Corp.,
(NasdaqNM:MSFT - news) Citigroup, (NYSE:C - news) AT&T Corp. (NYSE:T -
news) and Consolidated Edison Inc. (NYSE:ED - news), among others.
They agreed to hold a summit early next year to find ways federal
government and businesses could work together to guard against major
disruptions from technology breakdowns or security lapses.
The Partnership for Critical Infrastructure Security was created after a
1998 government white paper called for a bridge between federal agencies
and companies in technology-reliant sectors such as finance and banking,
transport, energy and public emergency services.
Daley said Y2K computer problems were not a prime concern of the forum. He
said the government and companies were already in a good position to
counter any inconveniences in services that may follow the millennium date
change, which some computers may not recognize correctly because of
outdated software.
Daley told reporters after the meeting that the federal government alone
could not protect privately controlled technology infrastructure systems
such as the Internet or utility power grids.
He said there was a close tie between economic and national security which
made a public-private partnership crucial. He said the fast expansion of
business conducted electronically left the country vulnerable to various
threats including hostile computer hackers.
Corporate representatives said they hoped to establish industry standards
for security of electronic data, and increase awareness of
``cyber-ethics''.
Kenneth Watson, representing computer networking giant Cisco Systems
(NasdaqNM:CSCO - news), said the nascent forum had identified education,
workforce development, research and development and the establishment of
best practices in technology security as the key areas the forum
would look at.
Microsoft representative Howard Schmidt said the forum marked an important
shift in which companies would become more proactive in working with
government to ensure security standards.
Harris Miller, representing the Information Technology Association of America
trade group, said one of the forum's chief aims was to get companies to give
information security practices the same priority as physical security.
@HWA
42.0 Attrition Celebrates One Year Birthday
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by hero
Attrition.org is celebrating one year of free service to
the net. Attrition is well known for its
crypto/text/denial/advisory archives as well its errata
sections. It is probably most well known for the
excellent work they do on the Attrition Defacement
mirror.
Attrition.org Birthday Message
http://www.attrition.org/news/content/99-12-10.001.html
ttrition's One Year Birthday Rant
And the folks at Attrition are quite strange. So strange as to run a weird
web site that goes against the grain of all things deemed 'good web
design'. No graphics, use of dark colors, no advertising or self promotion
of services. Everything people associate with an evil hacker site. Despite
this, we offer more information and more services than almost any other
security site out there. Because of the red text on black background, our
ethics and morals are constantly assumed and maligned.
We're quite used to that these days. Let the stuffy dogmatic atavistic
twerps dare to evolve. While they are sitting at home enjoying their
string beans and meat loaf, eating dinner with their significant other and
2.4 kids, we are enjoying our hedonistic lifestyles. Oh yeah!
While it isn't quite that extreme, the staff here are constantly reminded
of this picture. Unfortunate that a few detractors tarnish the picture
painted by millions of viewers of our site. I guess that is the nature of
the pessimistic beast. Onward...
To be honest and up front with you, this article has no real value to the
hardcore info-whore. Instead, we offer nothing more than a fun rant as a
reward to ourselves for a job well done. We'll even include some choice
quotes about Attrition and her staff that should provide a well
rounded view of what type of degenerates run this thing.
Eleven months ago, Attrition was little more than a unix system with a
handful of accounts that provided a stable place for email. Originally a
quick web page with a handful of files carried over from Jericho's
personal web page and not much more. Every day that passed, some new
element of the web page begun. We quickly picked up a few more users and
opted to focus on offering new sources of information.
Early on, there were ten to fifteen users on the system. You were either a
shell user, or not. Eventually, questions were asked about who ran the
system, who owned it, the meaning of life and more. At that point the
designation 'staff' was brought about. 'Staff' is probably not the
best word as it implies some greater sense of responsibility or
obligation. What it really means is the person has the ability to change
things (root), or is trusted to speak on behalf of the system. Not much
more.
With the advent of the Attrition Mirror, the site has grown in exposure
considerably. At first, mirrors were taken using wget followed by half a
dozen commands to make them accessable to viewers. The past few weeks have
seen considerable development in a custom tool called aget
(Attrition Get) that automates about 90% of the mirroring tasks. It is our
hopes that the next few months will see a finished version of aget that
automates everything, including doing the laundry.
Perhaps the most consistant but low-key sections of Attrition are the text
archive and crypto library. Receiving attention on a near daily basis,
Modify and Wrlwnd spend considerable time and effort to bring viewers a
well organized and comprehensive collection. Utilized by thousands
of people a day, these two sections bring utilities and information to the
masses.
Today, Attrition is udpated by less than ten people, in their spare time.
A labor of love so to speak, Attrition is not a business or a requirement.
Where it goes tomorrow is uncharted territory.
Voila! Here we are. Yes, that is the short history of things.
Technically and statistically, what is Attrition, and what does it do?
Wonders. The main system is a P166 with 64 megs of RAM. The simple fact
that the machine has not been reduced to a smoldering pile of plastic and
circuits is simply amazing. 'forced' handles a considerable amount
of traffic each day. Our busiest days see over 100,000 pieces of mail
transfered and over 750,000 HTTP requests served. This makes for over 5
million hits per month on the web server, serving over 4 million different
people. Not bad for a little pentium hosting a hobby site.
Things I Learned From Attrition
For the most part, net users are stupid, shallow, and petty. I know I
know, that is not a nice thing to say, but being the negative person I am
combined with the assault of stupidity we receive, it is difficult to
think otherwise.
Net etiquette is dead. People can't seem to deal with their problems any
more. Even hiding behind their monitor and keyboard, they still refuse to
confront someone they think they have a problem with. Nine out of ten
complaints about Attrition were sent to our upstream provider
without even copying us on the mail as a general courtesy. Our upstream
dutifully forwards the mail to us to get our side of things and goes on
from there. Eight of those nine complaints are unfounded or we deal with
them without the aid of our upstream. People could save so much time by at
least giving us a chance to address any issues.
If I didn't know better, I would swear the net consists of almost fifty
percent of cheap bastard lawyers that know as much law as they read on the
back of a cereal box. We have been threatened with almost two dozen
lawsuits so far. Not a single one made it to a phone call or
paperwork. Each and every time it takes a few minutes to quote some
relevant law, or explain things very clearly and the ignorant/hostile
party backs down without much to say. In case it isn't clear, a threat of
lawsuit will only make us treat you like shit. Grow up.
To the handful of people who have written in thanking us for our work, we
thank you in return. It is those few shreds of appreciation that make us
realize our work is appreciated. To the rest of you primates, if you don't
like something about the site, you have two things you can do. The
first is to give constructive criticism so that we may try to improve if
we agree with you. To clue you in, constructive criticism does not include
"fucking stupid", "wtf is that", or like comments. The second thing you
can do is kindly fuck off and quit viewing our site. Don't like it? Don't
look. End of story. We are not a business, we do not make money off you
visiting, we do not need you.
Future
One of the most often asked questions these days is something akin to
"Where is Attrition going next?" To answer this once and for all, without
equivocation, We do not know! Attrition has no grand plan or well defined
map. Day to day we make decisions or brainstorm new ideas that lead
to an overall picture of what the site is. We believe it is this lack of
plans that helps construct what Attrition is.
Attrition exists for the users and viewers. Anyone who has contacted
attrition staff in the past should realize this. We respond to almost
every piece of email, regardless of content. If nothing else, we send
acknowledgement that we received the email so that readers know we
care about their comments. Pointers to typos or errors go answered in
hours. Features or suggestions are almost always implemented, sometimes in
a day or less. Thanks to our readers, serious refinement has been done to
several pages. Our aget utility has receied many enhancements at the
suggestions of our readers, and we thank you for it.
On top of the staff and viewers of Attrition, there exists another special
group of degenerates that deserve special thanks and recognition. These
are the individuals that have helped bring our name to the masses. First
and foremost, we thank the Hacker News Network (HNN) for being the
first to give daily links to our mirror, as well as special segments
devoted to other sections of Attrition. Yes, that blue haired freak of
nature Space Rogue is constantly helping us out in many ways. We love you!
Others like the 'skinhead' degenerate Netmask at Mindsec, our 'media
darling' (barf) Ender at OSALL, and the foreign folks at Net-Security and
403 Security all deserve a round of thanks/beer. In recent months,
professional sites like SecurityFocus and NTSecurity.net have also
begun linking to us. Their links add a sort of professional validation to
the work we do.
To finish this piece, we look to readers, detractors and staff for final
comments. We asked people what they thought of Attrition, or what came to
mind when they thought of it. To be fair, we sort of encouraged more
obscure or esoteric answers. No, we can't be normal.
We'll start with the true foundation of Attrition. Asking the mothers of
the staff members. What do you think of Attrition, or what does it mean
to you?
"The first time I looked at it, I thought you were
all disturbed." - Punkis' Mother
"Attrition.org has changed my life - not in the way you
might think - you see, attrition.org is my grandchild in a
bizarre sort of way. Attrition.org was conceived by my son
and just as for any mother the journey into the role of
grandmother is quite unique. This grandchild, attrition.org.,
has opened many doors for me. This child shows me things I
have never seen. Sometimes it scares me with where it goes in
the world of cyberspace. Sometimes it brings me to tears with
laughter. It never ceases to amaze me. Like any one year old
I believe it is still finding its way. Attrition.org is the
image of its father. It is a brilliant star, a myriad of emotions,
a wealth of knowledge, a whirlwind of activity. I hope I am
around for many years to come to enjoy attrition.org., this one
of a kind offspring who has come so far in just 365 days.
Happy Birthday!!!" - Jericho's Mother
Turning to the Attrition staff, we get the most.. disturbing answers.
"'What does attrition mean to me....' I was recently asked to
comment on this by cult_hero for attrition's 1 year aniversary
piece and I have been racking my brains as to how I wanted to
answer that, in my usual smart ass fashion or actually being a
little serious for once. Mabey I will try a little of both.
Attrition means a lot of things to me. For example ever since
we have started mirroring web page defacements I have found myself
saying "punkis, you picked the wrong year to quit sniffing glue..."
Although it can be a giant pain in the ass to maintain I have
always beleived it is a good resource. I guess thats a good way
to sum up what attrition is all about, a great resource covering
a very broad range of topics. Where else can you go to read
security advisories, browse en excellent text archive, read
music reviews, even read calimari reviews. We now even have
pages demonstsrating how to properly and safely clean a variety
of weapons.
Attrition is a strange mix of freeks, geeks, hippies, poets,
drunks, gun nuts, computer crime advocates (snicker) and generally
unruly and rude people. Considering the site has always been a
"hobby site" I think we have done a pretty good job of keeping
the content fresh which can't be said about many sites. Like
sites that have venture capital. I don't think I need to name names
here...We have a lot of ideas on where we'd like to see attrition
go so I think the site will grow to be more and more diverse as
time goes on.
We are the ones our parents warned us about. At night when you
can't sleep and hear someone scratching on the wall, its us.
Remember that time you went camping and saw those wierd lights
in the sky? Yes, it was us. Read about that small government that
was recently overthrown? We were probably involved. Roswell? We
aren't that old....well except for cancer omega."
- punkis
Being with Attrition is like being in a rock band. We have a tendency
to cause a stir whereever we go, even though we're trying to be
inconspicuous. We travel a great deal and always have our equipment in
tow. Our best work is when we all sit down together, just pickin' and
grinnin' like the old times. Seems like someone's always trying to spy on
us so they can get some kind of inside scoop on us; like they're trying to
figure us out and can't quite wrap their brain around what we really are.
People either absolutely love us or absolutely hate us. The people who
love us sometimes hate us for the different things we do, and those who
already hate us will continue to hate us no matter what we do. The only
difference is we don't have roadies or near as many groupies. And at last
count, nobody's rushed the stage when we gave a show.
That being said, there is nothing more to say. Viva Attrition!
- Cancer Omega
"I wish I could explain in words what Attrition has meant to
me but that's rather impossible. However I've never been involved
in a project that allowed me to immerse myself in a culture in
less than 10 months.
Being involved with Attrition is quite an experience. I love
how none of the staff take any shit and each person adds their
own perspective to the site.
Of course, the minute I send this I'll have the Pulitzer-winning
speech of a lifetime.
Suffice it to say that I'm proud and honored to have some great
friends like you guys, it really is great."
- McIntyre
The quasi-grandfather of Attrition (so said because he is two days older
than dirt) came up with a few great quotes to mock the rest of staff.
"Before I found attrition, I was all messed up on drugs. Now
that I've found attrition, I'm all messed up on attrition."
- McIntyre
"Since I joined attrition, I'm my own hero. And hers, too!"
- cOmega
"I didn't know what to make of attrition until I visited Jericho
and he showed me that he'd spelled out 'Have a Nice Day' with
the skulls of Happy Hackers he'd decapitated. Now I'm sold."
- Punkis
"Attri-what?" - Modify
"Go AWAY! I'm BUSY!" - Jericho
Some of those seem to be quite accurate once you get to know the staff
members! What are other members of Attrition saying?
"Attrition.org is turning a year old....my my my...what can one
say about such an occasion? Well, from the beginning....wait..
hold up..Attrition.org turning a year old and the millennium
approaches? Is there a connection? Oh *cripes*....there must be.
Why else would the government hold mal_vu hostage? They're
working TOGETHER!! Okay...this information must get out into
the general populas...wait...there's a knock at the door....
*bang*" - WrlWnd
"Attrition is a [joke/comedy] [played on/performed before]
an audience too afraid to laugh."
- Munge
"Where people with no friends hangout, doing weird shit, from
warped minds and not giving a toss what others think. Where we
get whipped and you get shit. The folks at Attrition once had
social lives, were once popular, even had potential. Now they
have minds of their own. Like we really care what you think?
One year on: and getting stranger by the day. As time goes on the
voice of attrition only gets loder, conforming to no society,
having no real direction, just going with the flow of daily life.
Finding a new freedom, pushing the boundries of each path it
choses to partake in." - Blaise
Yes, they seem more thoughtful and well read than we do! How about
our affiliates? What kind words can they bestow upon us?
"Attrition.org? One of us owes the other beer I think."
- Space Rogue [HNN]
"Attrition.org? Blergh. It's esoteric, it's prostate,
lamentable and regrettable. In a word? Love. I love it."
- Ender Wiggin [OSALL]
"Even though attrition uses the letters "FUCK" on its main
page, i still link it from my "try to be" professional site.
So maybe I am a hypocrite. whatever. Attrition has given me
data to use as a filler on my main site, something to do when
my boss says I should be working. Some of the staff members make
me realise that EverQuest is an evil game, and will eat your
life away. This is why when I talk to jericho, he is always
talking about killing spammers with his sword, and how they
should know not to mess with any level 21 player. Honestly,
Attrition went from a 'whats the point' type of thing to me, to
a site that i respect, after I started to understand the actual
point. It has also lead me to remember that some people, no matter
how much you shit on them, and how many times you stabbed them in
the back, they can throw together a "one more chance" type
of deal (Yes.. It is true.. Jericho and I haven't always been so
intimate^H^H^H^H^H^H^H^H friendly. Either way, ill end with.. The
site rocks, the work is good, these people are just like me, they
have no lives.. and they are doing something without pay or profit."
- Erik Parker [Mindsec]
"If this is Attrition at one year, I can't wait till it
reaches the 'terrible two' stage"
- C. Fennelly
"Screw Attrition, them fools still owe me $50 for that
last rock!" - Bronc Buster
"Your site is unique in its own right, and despite
what other egotisticle, idiotic, narrow-minded fools out
there think, sites like yours are wonderful for the folks
out there like me... who dont neccessarily take what we
learn from your site and use it to our personal gain or
anything else, but just for the simple reason of the
knowledge of it all." - Nan
"Because of the high dollar lobbyist donations to undisclosed
members of the Senate, we are still non profit!"
- Mal Vu
Spammers have quickly learned that unsolicted commercial email is frowned upon.
How anti-spam are we?
"People who send spam to Attrition Staff, beware!
They say that there's a room where they keep the skulls
of spammers, lined up in a row on a shelf. They say
that, late at night, they go there, and talk to them...
They say the members of the Attrition Staff ask them,
"Now tell us again, how *do* you make money fast?"
- Jay Dyson, de-spammer for NASA JPL
In conclusion, in case it wasn't readily apparent and beating you senseless...
if you don't like what you see, don't look. Expect less and you will be
disappointed less. That and a million other
cliches.
As Mcintyre always says, "keep your sheep warm at night."
That is it. Until next year...
ATTRITION Staff (staff@attrition.org)
Copyright 1999
About Attrition: http://www.attrition.org/attrition/about.html
Attrition Staff: http://www.attrition.org/attrition/staff/
Why (quasi-faq): http://www.attrition.org/attrition/why.html
What's Attrition: http://www.attrition.org/news/content/99-09-10.001.html
Our Disclaimer: http://www.attrition.org/attrition/warn.html
@HWA
43.0 Russian Echelon?
~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by AlienPlaque
The successor to the KGB, the Federal Security Service
(FSB), has set up a network of data links connected to
every major Russian Internet service provider that
allows unlimited monitoring of private emails and
electronic banking. The System for Operational
Investigative Activities (SORM) was introduced quietly
late last year by government regulations that needed no
parliamentary approval.
The Times
http://www.the-times.co.uk/news/pages/tim/99/12/08/timfgnrus01004.html?1124027
December 8 1999
RUSSIA
Now Big Brother keeps eye on e-mail
BY GILES WHITTELL
BIG BROTHER is no longer watching Russia's citizens at
every turn, but many of them fear he is reading their
e-mails. The successor to the KGB has set up a network of
data links connected to every major Russian Internet
service provider that allows unlimited monitoring of private
e-mails and electronic banking.
Activists claim that the network is already being abused for
profit, theft and blackmail. The System for
OperationalInvestigative Activities (SORM in Russian) was
introduced quietly late last year by government regulations
that needed no parliamentary approval. Considered one of
Russia's most ambitious internal espionage programmes
since the fall of the Soviet Union, it is now in full force,
according to an investigation in yesterday's Moscow Times.
It allegedly has the co-operation of 350 Internet companies,
who had to pay for its construction .
Russia's unloved Federal Security Service (FSB), which
took over the KGB's domestic duties, is able to monitor
electronic communication without the need for search
warrants.The FSB and its defenders in parliament insist
that this is merely a cost-effective means of surveillance on
crime in cyberspace, but few doubt that the FSB is not
above selling its information to the highest bidder.
Westerners and middle-class Russians in Moscow who
increasingly rely on e-mail for cheap long-distance
communication were alarmed by yesterday's report.
@HWA
44.0 Russian Bug Did Frequency-Hopping
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
From HNN http://www.hackernews.com/
contributed by Evil Wench
The technical details of the listening device recently
found at the US State Department is starting to
beavailable. The devices was battery operated and
voice activated. It was about the size of a quarter, and
used a frequency-hopping mechanism to which made it
harder to detect. The device was located inside the
chair rail, a piece of molding mounted on the walls at
waist level. (Wow, thats pretty neat.)
ABC News
http://www.abcnews.go.com/sections/world/DailyNews/russia991209.html
Russian Suspected of Spying
Diplomat Allegedly Caught Monitoring a �Bug� in State Department
A listening device was found in the State Department building, near
U.S. Secretary of State Madeleine Albright's office.
Federal authorities have ordered the expulsion of a Russian diplomat
suspected of monitoring the device. (State Department)
ABCNEWS.com
W A S H I N G T O N, Dec. 9 � A Russian diplomat
suspected of listening to a �bug� planted in a
sensitive State Department conference room will
be expelled from the United States, officials said
today.
The diplomat, attach� Stanislav
Borisovich Gusev, was apprehended by
agents of the FBI and the State
Department�s Diplomatic Security
Service at 11:39 a.m. Wednesday, while
smoking a cigarette on a park bench a
few blocks away from the State
Department, according to Neil Gallagher,
assistant director for national security at
the FBI.
Nearby was his car, in which agents found equipment
apparently used to monitor the listening device planted
within a seventh-floor conference room of the building,
officials said.
The conference room belongs to the bureau of Oceans
and International Environmental Scientific Affairs. It is
located on the opposite side of the building from the
executive offices. Today, the wooden door to the room was
locked, and the hallway nearby was quiet.
The conference room
is within a few steps of
the office of Newly
Independent States, which
covers Russia, and the
office of Special Middle
East Coordinator Dennis
Ross, as well as the
Office of Nuclear Energy
Affairs. The seventh floor
houses all major
department heads at
State, including Secretary
of State Madeleine
Albright, as well as the
24-hour Operations
Center, a communications
hub connected via secure satellite to all American
embassies. U.S. officials said that an investigation is still
ongoing as to who may have used that room, but they said
that sensitive conversations certainly took place there. It
isn�t clear if officials from any of these offices used this
conference room, but it is certainly available for their use.
The Associated Press reports that security officials are
interviewing �hundreds� of department employees to
produce a damage assessment.
Tracking the Device
It was not clear who may have planted the bug. There is no
record that Gusev was ever in the State Department
headquarters.
The device was detected over the summer and located
several weeks ago, but it was kept in place during the
inquiry to avoiding tipping off the Russian diplomat, said
Gallagher. Security teams swept the department for other
devices and were careful to make sure sensitive
conversations didn�t take place near the bug, he added.
The bug was removed Wednesday.
A number of surveillance specialists said it wasn�t a
very powerful device. It was about the size of a quarter,
they said, and it was voice-activated, which saves on
battery time. They added the device had a
frequency-hopping mechanism, which made it harder to
detect.
A senior official told ABCNEWS the device was
located inside the chair rail, a piece of molding mounted on
the walls at waist level. The molding is used to keep chairs
from scuffing the wall.
There was no sign of inspections at the State
Department today. Officials said in a briefing that there had
been an aggressive sweep and there were no other bugs
found.
Hit the Road
Gusev, who had been in the United States since March,
was temporarily detained by the FBI but, because he
claimed diplomatic immunity, was not charged with a crime.
He was turned over to Russian officials almost three hours
after being seized, Gallagher said.
Gusev was declared persona non grata by the State
Department and handed over to the Russian Embassy for
expulsion within 10 days, State Department spokesman Jim
Foley said in a statement.
Undersecretary of State Thomas Pickering called on
Russian Ambassador Yuriy Ushakov Wednesday afternoon
to �firmly protest� Gusev�s actions, Foley said.
Other Russian diplomats were also being investigated,
officials said.
Gusev came under suspicion when officials noted his
unusual movement patterns, the official said. Then the FBI
used sophisticated technological gear to figure out what he
was doing. (See related story.)
FBI Was Eager to Act
FBI officials were keen on acting Wednesday because they
felt their catch might slip away, leaving them unable to
locate the bug.
The bug was activated by the sensitive gear seized from
the diplomat�s car and it could only be found when
activated, sources said.
FBI officials feared the diplomat would be pulled back
from his alleged eavesdropping duties and the bug would
soon go dormant, because the Russians felt there would be
American retaliation for the detainment last week in
Moscow of the U.S. Embassy staffer.
Now, with the monitoring equipment in hand, officials
said they can home in on other possible bugs.
ABCNEWS� Martha Raddatz, Beverly Lumpkin and Eric
Wagner, ABCNEWS.com�s David Ruppe and the
Reuters news service contributed to this report.
Tit for Tat?
Russia�s Foreign Intelligence Service reacted with
indignation at the allegations.
�I think there is a certain sequence here,� Boris
Labusov, spokesman for SVR Foreign Intelligence
Service, told Reuters. It is extremely unusual for the SVR
to comment on spying cases and Labusov was careful
not to confirm or deny Gusov was an agent.
�We think this detention and the further expulsion of
the Russian diplomat from the United States can be
regarded as a reaction of the American side to the latest
events in Moscow connected with the detention and
expulsion of an American diplomat,� Labusov said.
�If it is a reaction � we can only be sorry about it,� he
said. �As far as the Russian side is concerned, we gave
up the principle of an eye for an eye long ago.�
On Nov. 30, Russian authorities said they caught a
U.S. diplomat in the act of trying to obtain sensitive
military information from a Russian citizen.
Russian security officials said the U.S. diplomat,
Cheri Leberknight, a second secretary in the U.S.
Embassy�s political section, was a CIA agent and was
caught carrying invisible ink and a pocket-sized
electronic spy device to prevent eavesdropping when she
was detained.
Leberknight, who claimed diplomatic immunity, was
turned over to the embassy and asked to leave within 10
days.
Gusev�s expulsion is the latest in what has become a
series of seemingly tit-for-tat spy allegations. (See
interactive graphic, above, for some incidents involving
Russia and the West.)
�I do hope all these incidents will not hamper progress
in bilateral relations,� Labusov said.
RIA news agency quoted an unnamed senior
government official as saying there could be more
expulsions of Russians.
�The clear and crude fabrication of allegations against
a Russian diplomat is reminiscent of the Cold War era,�
RIA quoted the source as saying.
@HWA
45.0 Security Focus Newsletter #18
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Security Focus Newsletter #18
Table of Contents:
I. INTRODUCTION
1. Announcing the new Microsoft Focus area
II. BUGTRAQ SUMMARY
1. SCO UnixWare 'xauto' Buffer Overflow Vulnerability
2. Symantec Mail-Gear Directory Traversal Vulnerability
3. Microsoft IE5 Offline Browsing Pack Task Scheduler
Vulnerability
4. qpop Remote Buffer Overflow Vulnerability
5. Microsoft Windows 9x Plaintext Credential Cache Vulnerability
6. Solaris kcms_configure
7. Multiple Vendor CDE dtmail/mailtool Buffer Overflow
Vulnerability
8. NT Subst.exe Vulnerability
9. FreeBSD gdc Buffer Overflow Vulnerability
10. FreeBSD gdc Symlink Vulnerability
11. Solaris arp/chkprm Vulnerabilities
12. FreeBSD Seyon setgid dialer Vulnerability
13. FreeBSD xmindpath Buffer Overflow Vulnerability
14. FreeBSD angband Buffer Overflow Vulnerability
15. RSAREF Buffer Overflow Vulnerability
16. IBM Websphere Installation Permissions Vulnerability
17. Endymion Mailman Default Configuration Vulnerability
18. Microsoft IE5 WPAD Spoofing Vulnerability
19. Netscape Enterprise & FastTrack Authentication Buffer Overflow
Vulnerability
20. SCO UnixWare '/var/mail' permissions Vulnerability
21. SCO UnixWare 'pkg' commands Vulnerability
22. SCO UnixWare 'coredump' Symlink Vulnerability
III. PATCH UPDATES
1. Vulnerability Patched: Symantec Mail-Gear Directory Traversal
2. Vulnerability Patched: Microsoft IE5 Offline Browsing Pack Task
Scheduler
3. Vulnerability Patched: qpop Remote Buffer Overflow
4. Vulnerability Patched: Microsoft Windows 9x Plaintext
Credential Cache
5. Vulnerability Patched: RSAREF Buffer Overflow
6. Vulnerability Patched: Endymion Mailman Default Configuration
7. Vulnerability Patched: Microsoft IE5 WPAD Spoofing
8. Vulnerability Patched: Netscape Enterprise & FastTrack
Authentication Buffer Overflow
9. Vulnerability Patched: Multiple BIND Vulnerabilities
(Slackware)
10. Vulnerability Patched: Linux nfsd Remote Buffer Overflow
(Slackware)
11. Vulnerability Patched: Linux syslogd DoS (Slackware)
12. Vulnerability Patched: Multithreaded SSL ISAPI Filter
13. Vulnerability Patched: RSAREF Buffer Overflow (OpenBSD)
IV. SECURITYFOCUS.COM TOP 6 NEWS ARTICLES
1. NSA Spies Running dry? (November 29, 1999)
2. Staples files suit against Web hacker. (November 30, 1999)
3. Worm Virus Cripples Corporate Computers (December 1, 1999)
4. Novell chief's credit card stolen online (December 2, 1999)
5. Court upholds hacker's death sentence (December 3, 1995)
6. Suspect in huge computer fraud case faces court (December 5, 1995)
V. INCIDENTS SUMMARY
1. Port 98 scans & new 3128/8080 scans (Thread)
2. Strange Web Traffic (Thread)
3. Smurf / "ICMP Echo Reply" logs (Thread)
4. BIND Scanning (Thread)
5. problems from ip69.net247221.cr.sk.ca[24.72.21.69] (Thread)
6. Port scanning (Thread)
7. Network security monitoring tools (Thread)
8. How to Report Internet-Related Crime (Thread)
9. rpc scans and nfs attacks from 210.217.26.15 (Thread)
10. New named attack or what? (Thread)
11. Traffic from 210.163.117.209 (Thread)
12. RunOnceEx
VI. VULN-DEV RESEARCH LIST SUMMARY
1. Cisco NAT DoS (VD#1) (Thread)
2. PHP (Thread)
3. WordPad exploit development: executing arbitary code on Win98
(fin) (Thread)
4. Idiocy "exploit" (Thread)
5. Norton AntiVirus 2000 POProxy.exe (Thread)
VII. SECURITY JOBS
Seeking Staff:
1. Corporate Information Security Officer
VIII. SECURITY SURVEY RESULTS
IX. SECURITY FOCUS TOP 6 TOOLS
1. SecurityFocus.com Pager (Win95/98/NT)
2. SuperScan 2.0.5 (Windows 2000, Windows 95/98 and Windows NT)
3. IDS Alert Script for FW-1 (Solaris)
4. NTInfoScan 4.2.2 (Windows NT)
5. Fragrouter 1.6 (BSDI, FreeBSD, Linux, NetBSD, OpenBSD and
Solaris)
6. Snort 1.3.1 (FreeBSD, HP-UX, IRIX, Linux, MacOS, OpenBSD and
Solaris)
X. SPONSOR INFORMATION - CORE SDI
XI. SUBSCRIBE/UNSUBSCRIBE INFORMATION
I. INTRODUCTION
-----------------
Welcome to the Security Focus 'week in review' newsletter issue 18
sponsored by CORE SDI.
http://www.core-sdi.com
1. Introducing the new Focus on Microsoft area
The Focus Area idea was born out of a realization, reinforced by comments
from our users, that there is an overwhelming amount of security
information "out there" and a limited number of ways to filter and
organize it. Under the 'Focus' umbrella we will be hosting a number of
technology or platform-specific areas, each designed to offer
well-ordered, timely content to those interested in that particular
subject. More than just a new way of presenting the data we already have,
each Focus Area will also include new original content, written by both SF
staff and outside experts on a regular basis.
I am happy to announce the opening of our first Focus Area, one devoted to
all aspects of Microsoft security. The majority of our users are involved
with MS security issues in one way or another, and the demand for an
MS-centric subsection made it an obvious choice for our first Focus.
Others will follow. In the meantime, have a look for yourself, at:
http://www.securityfocus.com/focus/
II. BUGTRAQ SUMMARY 1999-11-27 to 1999-12-05
---------------------------------------------
1. SCO UnixWare 'xauto' Buffer Overflow Vulnerability
BugTraq ID: 848
Remote: No
Date Published: 1999-12-03
Relevant URL:
http://www.securityfocus.com/bid/848
Summary:
Certain versions of SCO's UnixWare ship with a version of /usr/X/bin/xauto
which is vulnerable to a buffer overflow attack which may result in an
attacker gaining root privileges.
This is exploitable to gain root privileges even though /usr/X/bin/xauto
is not setuid root. This is due to a system design issue with SCO Unixware
which is discussed in an attached message in the 'Credit' section titled
"UnixWare 7 uidadmin exploit + discussion".
2. Symantec Mail-Gear Directory Traversal Vulnerability
BugTraq ID: 827
Remote: Yes
Date Published: 1999-11-29
Relevant URL:
http://www.securityfocus.com/bid/827
Summary:
Mail-Gear, a multi-purpose filtering email server, includes a webserver
for remote administration and email retrieval. This webserver is
vulnerable to the '../' directory traversal attack. By including the
string '../' in the URL, remote attackers can gain read access to all
files on the filesystem that the server has read access to.
3. Microsoft IE5 Offline Browsing Pack Task Scheduler Vulnerability
BugTraq ID: 828
Remote: Yes
Date Published: 1999-11-29
Relevant URL:
http://www.securityfocus.com/bid/828
Summary:
The Internet Explorer 5 Offline Browsing Pack includes the Task Scheduler
utility. This program is similar to the NT AT service, and on NT systems,
it replaces the AT service. The Task Scheduler will allow unauthorized
users to create AT jobs by modifying an existing, administrator-owned file
and placing it into the %systemroot%\tasks folder.
This vulnerability could only be exploited remotely if the tasks folder
was specifically shared, or through the default C$ share on NT. Task
Scheduler can be made to use any other arbitrary folder by editing the
following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SchedulingAgent\TasksFolder (Changes
will not take effect until after the target has been rebooted.)
The IE5 Offline Browsing Pack ships with IE5, but is not installed by default.
4. qpop Remote Buffer Overflow Vulnerability
BugTraq ID: 830
Remote: Yes
Date Published: 1999-11-30
Relevant URL:
http://www.securityfocus.com/bid/830
Summary:
There is a buffer overflow vulnerability present in current (3.x) versions
of Qualcomm popper daemon. These vulnerabilities are remotely exploitable
and since the daemon runs as root, the host running qpopper can be
completely compromised anonymously. The problem is in pop_msg.c, around
line 68 and is the result of vsprintf() or sprintf() calls without bounds
checking.
5. Microsoft Windows 9x Plaintext Credential Cache Vulnerability
BugTraq ID: 829
Remote: No
Date Published: 1999-11-29
Relevant URL:
http://www.securityfocus.com/bid/829
Summary:
Windows 95 and 98 cache a user's name and password in plaintext in RAM.
This feature was included for backwards compatibility with Windows for
Workgroups, which implemented this mechanism for use with the 'net'
program, which handled most network configuration requirements for the WfW
OS. This feature can be exploited via specific function calls to retrieve
another user's credentials. In order for this to work , the attacker must
have console access to the target machine, and it must not have been
rebooted since the last logout. Only the most recent user's credentials
can be retrieved.
6. Solaris kcms_configure
BugTraq ID: 831
Remote: No
Date Published: 1999-11-30
Relevant URL:
http://www.securityfocus.com/bid/831
Summary:
The binary kcms_configure, part of the Kodak Color Management System
package shipped with OpenWindows (and ultimately, Solaris) is vulnerable
to a local buffer overflow. The buffer which the contents of the
environment variable NETPATH are copied into has a predetermined length,
which if exceeded can corrupt the stack and cause aribtrary code hidden
inside of the oversized buffer to be executed. kcms_configure is installed
setuid root and exploitation will result in a local root compromise.
7. Multiple Vendor CDE dtmail/mailtool Buffer Overflow Vulnerability
BugTraq ID: 832
Remote: No
Date Published: 1999-11-30
Relevant URL:
http://www.securityfocus.com/bid/832
Summary:
There are three buffer overflow vulnerabilities in the CDE mail utilities,
all of which are installed sgid mail by default.
The first is exploited through overrunning a buffer in the Content-Type:
field, which would look something like this:
Content-Type: image/aaaaaaaa long 'a' aaaaaa; name="test.gif"
Mailtool will overflow when email is selected which has a content-type
field like that. It may be possible for an attacker to obtain root
priviliges if shellcode is written appropriately and root selects the
malicious email message.
The second vulnerability is in dtmail, which will crash (and possibly
execute arbitrary code) if a long paramater is passed argumenting the -f
command-line option.
The third is in mailpr, which is vulnerable to a long -f paramater as
well.
The most basic consequence of these being exploited is a compromise of
local email, since all mail data is set mode 660, read and write
permissions granted for members of group mail.
As of November 30, 1999, Solaris 7 is the only known vulnerable platform.
8. NT Subst.exe Vulnerability
BugTraq ID: 833
Remote: No
Date Published: 1999-11-30
Relevant URL:
http://www.securityfocus.com/bid/833
Summary:
The SUBST command is used to map a drive letter to a folder on an existing
drive. This command can be run by any user. After it is run, the mapping
stays in effect until it is deleted, by issuing the subst command again
with the /d option, or until the machine is rebooted. Loggin off does not
remove the mapping. Therefore, it is possible for one console user to map
a drive letter to a a folder of their choosing, and then log off, leaving
the mapping intact for the next user. If the next user tries to manually
map a differnt location to that letter, they will get an error 85, "The
local device name is already in use." However, if the drive letter used is
the same as their network-mapped home drive, the operation will fail
without any error message. From the user's perspective, nothing obvious
will happen to let them know that their 'home drive' is not their usual
home drive t all. This opens the possibility of getting a user to run
trojaned or malicious programs, as well as the possibility of having them
write potentially confidential documents to a publicly-accessible or even
network shared location.
9. FreeBSD gdc Buffer Overflow Vulnerability
BugTraq ID: 834
Remote: No
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/834
Summary:
There is a buffer overflow vulnerability known to be present in the
version of gdc shipped with the 3.3-RELEASE version of FreeBSD. By
default, only users in group wheel have execute access to gdc. The
overflow occurs when the argument passed along with the -t flag (time)
exceeds its predefined buffer length. It is possible to then corrupt the
stack and alter the flow of execution (and execute arbitrary code). With
gdc setuid root by default, this can lead to a local root compromise if
exploited by users who have or gain access of or belong to the wheel group
(or trusted gated group).
10. FreeBSD gdc Symlink Vulnerability
BugTraq ID: 835
Remote: No
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/835
Summary:
It is possible to write debug ouput from gdc to a file
(/var/tmp/gdb_dump). Unfortunately, gdc follows symbolic links which can
be created in tmp and will overwrite any file on the system thanks to it
being setiud root. This does not cause any immediate compromises and is
more of a denial of service attack since it does not change the
permissions of the overwritten files (to say, world writeable or group
writeable). Local users are required to be in group wheel (or equivelent)
to execute gdc.
11. Solaris arp/chkprm Vulnerabilities
BugTraq ID: 837
Remote: No
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/837
Summary:
It is possible to read bin owned files to which read access is not
permitted to local users through exploiting subtle vulnerabilities in arp
and chkperm.
With arp, this is done through specifying a file with the -f parameter .
When arp tries to interpret the contents of this file (opening and reading
it just fine being sgid/suid bin), it will fail and print the "erroneous
lines" of the file along with its error messages. Those "erroneous lines"
are the contents of the file to which you do not normally have read access
(and belong to the user/group bin).
For chkperm, exploitation would be through setting an environment variable
to which chkperm references where to write a file with a known name
(making it possible to supply arbitrary, places - where an attacker would
have write access). The hacker would then make a lib subdirectory beneath
the specified VMSYS path, and a file in lib/ called .facerc, which would
be a symlink to whatever file you wanted to read. chkperm w ould then be
run with the -l flag and the contents of the file pointed to will be
displayed (as seen by bin).
Solaris 2.x are known to be vulnerable.
12. FreeBSD Seyon setgid dialer Vulnerability
BugTraq ID: 838
Remote: No
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/838
Summary:
FreeBSD 3.3-RELEASE ships with Seyon, a communications program which is
known to have several vulnerabilities which can allow for a malicious user
to elevate priviliges. The vulnerability, however, is that seyon is still
installed setgid dialer in FreeBSD. When seyon is exploited, a local user
can grant him/herself priviliges which allow access to the communications
devices or anything else accessable by the group dialer.
13. FreeBSD xmindpath Buffer Overflow Vulnerability
BugTraq ID: 839
Remote: No
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/839
Summary:
The version of xmindpath shipped with FreeBSD 3.3 can be locally exploited
via overrunning a buffer of predefined length. It is possible to gain the
effective userid of uucp through this vulnerability. It may be possible,
after attaining uucp priviliges, to modify binaries to which uucp has
write access to and trojan them to further elevate priviliges), ie: modify
minicom so that when root runs it, drops a suid shell somewhere.
14. FreeBSD angband Buffer Overflow Vulnerability
BugTraq ID: 840
Remote: No
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/840
Summary:
The version angband shipped with FreeBSD 3.3-RELEASE is vulnerable to a
local buffer overflow attack. Since it is setgid games, a compromise of
files and directories owned by group games is possible.
15. RSAREF Buffer Overflow Vulnerability
BugTraq ID: 843
Remote: Yes
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/843
Summary:
A buffer overflow vulnerability exists in the RSAREF cryptographic library
which may possibly make any software using the library vulnerable.
The vulnerability exists in four functions in the rsa.c source file. The
functions are:
int RSAPublicEncrypt()
int RSAPrivateEncrypt()
int RSAPublicDecrypt()
int RSAPrivateDecrypt()
All these function define a local variable called pkcsBlock of 128 byte
length which can be overflowed making it possible to execute arbitrary
code.
This vulnerability, in conbination with BUGTRAQ ID 797, allows versions of
SSHD linked against the RSAREF2 library to be vulnerable to a remote
exploit.
16. IBM Websphere Installation Permissions Vulnerability
BugTraq ID: 844
Remote: No
Date Published: 1999-12-02
Relevant URL:
http://www.securityfocus.com/bid/844
Summary:
The IBM Websphere application server, when installed on Solaris (or
possibly AIX), will create an deinstallation shellscript which is mode 777
in /usr/bin. The script is called by pkgmgr, which is run by root. This
means that an attacker can modify the script and add malicious code to it,
leading to a root compromise once it is run. IBM Websphere also installs
many of its data files with mode 777 permissions.
17. Endymion Mailman Default Configuration Vulnerability
BugTraq ID: 845
Remote: No
Date Published: 1999-12-02
Relevant URL:
http://www.securityfocus.com/bid/845
Summary:
Endymion mailman is a commercial www email suite which is written in perl.
When it is installed, by default it sets permissions which make it
vulnerable to local compromise (666 for files, 777 for directories).
Because of this it is possible for local, unprivileged users to read and
write to aribtrary users email (who use the mailman system) as well as to
files owned by uid webmaster.
18. Microsoft IE5 WPAD Spoofing Vulnerability
BugTraq ID: 846
Remote: Yes
Date Published: 1999-12-02
Relevant URL:
http://www.securityfocus.com/bid/846
Summary:
IE5's automatic proxy configuration feature, WPAD, (Web Proxy
Auto-Discovery) can be fooled into using or attempting to use a
non-authorized server as a proxy server. An attacker on a different
network could use this to read web traffic from the IE5 client.
IE5 will search for a WPAD server by looking for machines named wpad.x.x.x
in the current domain. If none is found, it will proceed up the domain
name structure, until it gets to the third-level domain name.
For example, IE5 running on host a.b.c.d.net would first look for
wpad.b.c.d.net, then wpad.c.d.net, then wpad.d.net.
In certain network configurations, the third-level domain is not
neccessarily a trusted part of the network, and an attacker could set up a
server to cause IE5 clients to use a hostile machine as proxy.
19. Netscape Enterprise & FastTrack Authentication Buffer Overflow Vulnerability
BugTraq ID: 847
Remote: Yes
Date Published: 1999-12-01
Relevant URL:
http://www.securityfocus.com/bid/847
Summary:
Certain versions of the Netscape FastTrack and Enterprise servers for both
Unix and NT contain a remotely exploitable buffer overflow vulnerability.
This vulnerability is present in both the Application and Administration
servers shipped with the respective packages.The problem lies in the HTTP
Basic Authentication procedure for both servers has a buffer overflow
condition when a long username or password (over 508 characters) are
provided. This may result in an attacker gaining root privileges under
UNIX and SYSTEM privileges under NT.
20. SCO UnixWare '/var/mail' permissions Vulnerability
BugTraq ID: 849
Remote: No
Date Published: 1999-12-03
Relevant URL:
http://www.securityfocus.com/bid/849
Summary:
Certain versions of SCO's UnixWare (only 7.1 was tested) ship with the
/var/mail/ directory with permission 777(-rwxrwxrwx) . This in effect
allows malicious users to read incoming mail for users who do not yet have
a mail file (/var/mail/username) present. This may be done by simply
creating the file in question with a permission mode which is readable to
the attacker.
21. SCO UnixWare 'pkg' commands Vulnerability
BugTraq ID: 850
Remote: No
Date Published: 1999-12-03
Relevant URL:
http://www.securityfocus.com/bid/850
Summary:
Certain versions of SCO's Unixware (only version 7.1 was tested) ship with
a series of package install/removal utilities which due to design issues
under the SCO UnixWare operating system may read any file on the system
regardless of their permission set. This is due to the package commands
(pkginfo, pkgcat, pkgparam, etc.) having extended access due to
Discretionary Access Controls (DAC) via /etc/security/tcb/privs. This
mechanism is explained more thoroughly in the original message to Bugtraq
which is listed in full in the 'Credit' section of this vulnerability
entry.
22. SCO UnixWare 'coredump' Symlink Vulnerability
BugTraq ID: 851
Remote: No
Date Published: 1999-12-03
Relevant URL:
http://www.securityfocus.com/bid/851
Summary:
Under certain versions of SCO UnixWare if a user can force a program with
SGID (Set Group ID) to dump core they may launch a symlink attack by
guessing the PID (Process ID) of the SGID process which they are calling.
This is required because the coredump file will be dumped to the directory
in which it is being executed from as './core.pid'. The program dumping
core does not check for the existence of a symlinked file and will happily
overwrite any file which it has permission to do so to. Many SGID binaries
under Unixware are in the group 'sgid-sys' a group which has write
permission to a large number of system critical files.
This attack will most likely result in a denial of service attack, however
if the attacker can provide some provide data to the core file she may be
able to leverage root access. For example is the intruder were able to get
'+ +' into a line of it's own in the core file the intruder could then
overwrite root's .rhosts file.
III. PATCH UPDATES 1999-11-27 to 1999-12-05
-------------------------------------------
1. Vendor: Symantec
Product: Symantec Mail-Gear 1.0
Vulnerability Patched: Symantec Mail-Gear Directory Traversal Vulnerability
BugTraq ID: 827
Relevant URLS:
http://www.securityfocus.com/bid/827
Patch Location:
http://www.symantec.com/urlabs/public/download/download.html
2. Vendor: Microsoft
Product: IE5
Vulnerability Patched: Microsoft IE5 Offline Browsing Pack Task Scheduler
BugTraq ID: 828
Relevant URLS:
http://www.securityfocus.com/bid/828
Patch Location:
IE 5.01 is not susceptible to this vulnerability. The task Scheduler that is
included with 5.01 uses signature verification to check that all scheduled tasks
were created by the administrator of the local machine.
It can be downloaded at:
http://www.microsoft.com/msdownload/iebuild/ie501_win32/en/ie501_win32.htm
3. Vendor: Qualcomm
Product: qpop
Vulnerability Patched: qpop Remote Buffer Overflow
BugTraq ID: 830
Relevant URLS:
http://www.securityfocus.com/bid/830
Patch Location:
The newest version, qpopper3.0b22 (which is patched), is available at:
ftp://ftp.qualcomm.com/eudora/servers/unix/popper/
4. Vendor: Microsoft
Product: Microsoft Windows 9x
Vulnerability Patched: Microsoft Windows 9x Plaintext Credential Cache
BugTraq ID: 829
Relevant URLS:
http://www.securityfocus.com/bid/829
Patch Location:
Microsoft has released a patch to deal with this issue. It is available at:
Windows 95:
http://download.microsoft.com/download/win95/update/168115/w95/en-us/168115us5.exe
Windows 98:
http://download.microsoft.com/download/win98/update/168115/w98/en-us/168115us8.exe
5. Vendor: RSA Data Security
Product: RSAREF
Vulnerability Patched: RSAREF Buffer Overflow
BugTraq ID: 843
Relevant URLS:
http://www.securityfocus.com/bid/843
Patch Location:
RSA Security is no longer support the RSAREF library.
CORE SDI has developed the following fix for RSAREF:
http://www.securityfocus.com/bid/843
6. Vendor: Endymion
Product: Endymion Mailman
Vulnerability Patched: Endymion Mailman Default Configuration Vulnerability
BugTraq ID: 845
Relevant URLS:
http://www.securityfocus.com/bid/845
Patch Location:
Endymion does warn customers to change permissions on software. A
fix for this is to change the permissions to 0600 for the files and 0700
for the directories.
7. Vendor: Microsoft
Product: IE5
Vulnerability Patched: Microsoft IE5 WPAD Spoofing
BugTraq ID: 846
Relevant URLS:
http://www.securityfocus.com/bid/846
Patch Location:
Microsoft has released IE5.01, which is not vulnerable to this attack. IE5.01
can be downloaded from:
http://www.microsoft.com/msdownload/iebuild/ie501_win32/en/ie501_win32.htm
8. Vendor: Netscape
Product: Netscape Enterprise & FastTrack Servers
Vulnerability Patched: Netscape Enterprise & FastTrack Authentication Buffer Overflow
BugTraq ID: 847
Relevant URLS:
http://www.securityfocus.com/bid/847
http://www.iss.net/xforce
Patch Location:
As taken from the ISS Advisory which is listed in full in the 'Credit' secion
of this advisory.
Affected users should upgrade their systems immediately. This
vulnerability affects systems running Administration Server with
password protected areas that rely on Basic Authentication. If you run
any of the affected servers on any platform, upgrade to iPlanet Web
Server 4.0sp2 at:
http://www.iplanet.com/downloads/testdrive/detail_161_243.html.
Netscape has stated that FastTrack will not be patched. Although
Netscape released service pack 3 for Enterprise Server 3.6 that fixes
the vulnerability in the web server, the Administration Server remains
vulnerable.
9. Vendor: Slackware
Product: Linux (Slackware)
Vulnerability Patched: Multiple BIND Vulnerabilities
BugTraq ID: 788
Relevant URLS:
http://www.securityfocus.com/bid/788
Patch Location:
ftp.cdrom.com:/pub/linux/slackware-4.0/patches/bind.tgz
10. Vendor: Slackware
Product: Linux (Slackware)
Vulnerability Patched: Linux nfsd Remote Buffer Overflow Vulnerability
BugTraq ID: 782
Relevant URLS:
http://www.securityfocus.com/bid/782
Patch Location:
ftp.cdrom.com:/pub/linux/slackware-4.0/patches/nfs-server.tgz
11. Vendor: Slackware
Product: Linux (Slackware)
Vulnerability Patched: Linux syslogd Denial of Service Vulnerability
BugTraq ID: 809
Relevant URLS:
http://www.securityfocus.com/bid/802
Patch Location:
ftp.cdrom.com:/pub/linux/slackware-4.0/patches/sysklogd.tgz
12. Vendor: Microsoft
Product:
- Microsoft IIS 4.0
- Microsoft Site Server 3.0
- Microsoft Site Server Commerce Edition 3.0
Vulnerability Patched: Multithreaded SSL ISAPI Filter
BugTraq ID: NONE
Relevant URLS:
http://www.microsoft.com/security/bulletins/MS99-053faq.asp
Patch Location:
- x86:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16186
- Alpha:
http://www.microsoft.com/downloads/release.asp?ReleaseID=16187
NOTE: This and other patches are available from the Microsoft
Download Center (http://www.microsoft.com/downloads/search.asp?
Search=Keyword&Value='security_patch'&OpSysID=1)
13. Vendor: OpenBSD
Product: OpenBSD
Vulnerability Patched: RSAREF Buffer Overflow
BugTraq ID: 843
Relevant URLS:
http://www.securityfocus.com/bid/843/
Patch Location:
ftp://ftp.usa.openbsd.org/pub/OpenBSD/2.6/i386/sslUSA26.tar.gz
ftp://ftp.usa.openbsd.org/pub/OpenBSD/2.6/sparc/sslUSA26.tar.gz
ftp://ftp.usa.openbsd.org/pub/OpenBSD/2.6/hp300/sslUSA26.tar.gz
ftp://ftp.usa.openbsd.org/pub/OpenBSD/2.6/mvme68k/sslUSA26.tar.gz
ftp://ftp.usa.openbsd.org/pub/OpenBSD/2.6/mac68k/sslUSA26.tar.gz
ftp://ftp.usa.openbsd.org/pub/OpenBSD/2.6/amiga/sslUSA26.tar.gz
IV. SECURITYFOCUS.COM TOP 6 NEWS ARTICLES
-----------------------------------------
Due to popular demand we have added a 'Top Six Stories' section to the newsletter. SecurityFocus.com
actually gathers over 100 news articles a week, these 6 before you are those which were the most
read through our site, or those we thought were of special interest.
1. NSA Spies Running dry? (November 29, 1999)
Excerpt:
Spies at the US National Security Agency may be having trouble eavesdropping
on information transmitted through the Internet and fiber optic cables.
URL:
http://www.securityfocus.com/templates/frame.html?adgroup=secnews&url=/external/http%3a%2f%2fwww.wired.com%2fnews%2fpolitics%2f0,1283,32770,00.html
2. Staples files suit against Web hacker. (November 30, 1999)
Excerpt:
Officials at Staples Inc. filed a lawsuit in US District Court in Boston
yesterday charging that ''John Doe,'' the unidentified hacker, illegally accessed
the company's Web site and damaged the company by stealing e-commerce
business.
URL:
http://www.securityfocus.com/templates/frame.html?adgroup=secnews&url=/external/http%3a%2f%2fwww.wired.com%2fnews%2fpolitics%2f0,1283,32770,00.html
3. Worm Virus Cripples Corporate Computers (December 1, 1999)
Excerpt:
A deadly new version of a destructive computer
worm has crippled e-mail systems among
Fortune 500 companies and others, chewed
up files and created havoc among the
corporations that sought to limit the damage
URL:
http://www.securityfocus.com/templates/frame.html?adgroup=secnews&url=/external/http%3a%2f%2fwww.apbnews.com%2fnewscenter%2finternetcrime%2f1999%2f12%2f01%2fvirus1201_01.html
4. Novell chief's credit card stolen online (December 2, 1999)
Excerpt:
Speaking at San Francisco's Digital Economy conference Thursday, Schmidt informed the crowd
that his credit card number had been stolen over the Internet in the past.
Although he isn't sure exactly how his card number was lifted, Schmidt says he believes it was
through a mechanism that reads the cookies-files sitting on a user's desktop and storing personal
information, such as passwords and preferences.
URL:
http://www.securityfocus.com/templates/frame.html?adgroup=secnews&url=/external/http%3a%2f%2fwww.wired.com%2fnews%2fpolitics%2f0,1283,32770,00.html
5. Court upholds hacker's death sentence (December 3, 1995)
Excerpt:
A Chinese court has upheld the death sentence for a man who hacked into the computer system of
a state bank to steal money, the Financial News reported on Saturday.
The Yangzhou Intermediate People's Court in eastern Jiangsu province rejected the appeal of Hao
Jingwen, upholding a death sentence imposed last year, the newspaper said.
URL:
http://www.securityfocus.com/templates/frame.html?adgroup=secnews&url=/external/http%3a%2f%2fwww.wired.com%2fnews%2fpolitics%2f0,1283,32770,00.html
6. Suspect in huge computer fraud case faces court (December 5, 1995)
Excerpt:
He called himself "The Gatsby."
And like F. Scott Fitzgerald's fictional character, he inhabited a world of
power, money and cunning.
That fantasy world abruptly ended Feb, 22, 1995, when FBI agents raided
the bedroom of Jonathan Bosanac, aka The Gatsby, who lived in his parents'
million-dollar home in Rancho Santa Fe.
Federal law enforcers said Bosanac was a ringleader in one of the biggest
computer hacking schemes in U.S. history.
URL:
http://www.securityfocus.com/templates/frame.html?adgroup=secnews&url=/external/http%3a%2f%2fwww.uniontrib.com%2fnews%2funiontrib%2fsun%2fnews%2fnews_1n5hacker.html
V. INCIDENTS SUMMARY 1999-11-27 to 1999-12-05
---------------------------------------------
1. Port 98 scans & new 3128/8080 scans (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=14401.22457.121945.823373@cap-ferrat.albourne.com
2. Strange Web Traffic (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=31933968789DD111BEAB0080C81D384C200F6A@CT_NT
3. Smurf / "ICMP Echo Reply" logs (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-22&msg=19991129075230.6919.qmail@securityfocus.com
4. BIND Scanning (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=19991129165821.19627.qmail@securityfocus.com
5. problems from ip69.net247221.cr.sk.ca[24.72.21.69] (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=SIMEON.9911291006.E470@bluebottle.itss
6. Port scanning (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=Pine.LNX.4.05.9911301616040.1748-100000@marvin.junknet
7. Network security monitoring tools (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=Pine.BSF.4.10.9911302011220.9473-100000@ns1.host.qc.ca
8. How to Report Internet-Related Crime (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=19991201134808.B14851@securityfocus.com
9. rpc scans and nfs attacks from 210.217.26.15 (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=Pine.LNX.4.05.9912020844320.24774-100000@grace.speakeasy.org
10. New named attack or what? (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=Pine.LNX.4.21.9912020737001.12556-100000@ns.ldc.ro
11. Traffic from 210.163.117.209 (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=19991202110508.3958.qmail@securityfocus.com
12. RunOnceEx
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-11-29&msg=357a2b90036f8275f8cc9d935e7020e238481ac3@tripwiresecurity.com
VI. VULN-DEV RESEARCH LIST SUMMARY 1999-11-27 to 1999-12-05
----------------------------------------------------------
1. Cisco NAT DoS (VD#1) (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-22&msg=199911290435.XAA20460@rooster.cisco.com
2. PHP (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-29&msg=Pine.GSO.4.10.9911301431530.16932-100000@kenny.intranet.csupomona.edu
3. WordPad exploit development: executing arbitary code on Win98 (fin) (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-29&msg=19991130191759.43230.qmail@hotmail.com
4. Idiocy "exploit" (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-29&msg=199912011302.IAA22031@mailhost.squonk.net
5. Norton AntiVirus 2000 POProxy.exe (Thread)
Relevant URL:
http://www.securityfocus.com/templates/archive.pike?list=82&date=1999-11-29&msg=Pine.BSF.4.10.9912011816320.12955-100000@shell20.ba.best.com
VII. SECURITY JOBS SUMMARY 1999-11-27 to 1999-12-05
---------------------------------------------------
Seeking Staff:
1. Corporate Information Security Officer
Reply to: Neal Fisher <fishern@ppsinfo.com>
Requirements:
http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-11-29&thread=19991129174646.21886.qmail@securityfocus.com
VIII. SECURITY SURVEY 1999-11-15 to 1999-11-27
----------------------------------------------
The question for 1999-11-15 to 1999-11-27 was:
Whose responsibility is it to notify vendors of security flaws in their products?
1. The person/group who discovered and posted the flaw
2. The resource where the information is published (ie Bugtraq, NTBugtraq, etc)
3. Vendors should be responsible for keeping up to date on discoveries about their software.
Results:
1. 40% / 36 votes
2. 1% / 1 votes
3. 56% / 50 votes
Total Votes: 88 votes
IX. SECURITY FOCUS TOP 6 TOOLS 1999-11-27 to 1999-12-05
--------------------------------------------------------
1. SecurityFocus.com Pager
by SecurityFocus.com
URL: http://www.securityfocus.com/pager/sf_pgr20.zip
Platforms: Win95/98/NT
Number of downloads: 1759
This program allows the user to monitor additions to the Security Focus
website without constantly maintaining an open browser. Sitting quietly in
the background, it polls the website at a user-specified interval and
alerts the user via a blinking icon in the system tray, a popup message or
both (also user-configurable).
2. SuperScan 2.0.5
by Robin Keir <robin@keir.net>
URL: http://members.home.com/rkeir/software.html
Platforms: Windows 2000, Windows 95/98 and Windows NT
Number of downloads: 1624
This is a powerful connect-based TCP port scanner, pinger and hostname resolver.
Multithreaded and asynchronous techniques make this program extremely fast and
versatile. Perform ping scans and port scans using any IP range or specify a text file to
extract addresses from. Scan any port range from a built in list or any given range. Resolve
and reverse-lookup any IP address or range. Modify the port list and port descriptions using
the built in editor. Connect to any discovered open port using user-specified "helper"
applications (e.g. Telnet, Web browser, FTP) and assign a custom helper application to any
port. Save the scan list to a text file. Transmission speed control. User friendly interface.
Includes help file
3. IDS Alert Script for FW-1 1.3
by Lance Spitzner
URL: http://www.enteract.com/~lspitz/intrusion.html
Platforms: Solaris
Number of downloads: 1578
Flexible network based IDS script for CheckPoint Firewall-1 installations. Build Intrusion
Detection into your firewall. Features include: Automated alerting, logging, and archiving
Automated blocking of attacking source Automated identification and email remote site
Installation and test script Fully configurable Ver 1.3 Optimized for performance, over 50%
speed increase.
4. NTInfoScan 4.2.2
by David Litchfield
URL: http://www.infowar.co.uk/mnemonix/ntinfoscan.htm
Platforms: Windows NT
Number of downloads: 1417
NTInfoScan is a security scanner designed specifically for the Windows NT 4.0 operating
system. It's simple to use - you run it from a command line - and when the scan is finished it
produces an HTML based report of security issues found with hyper-text links to vendor
patches and further information. NTInfoScan is currently at version 4.2.2. It tests a number
of services such as ftp, telnet, web service, for security problems. Added to this NTInfoScan
will check NetBIOS share security and User account security.
5. Fragrouter 1.6
by Dug Song, Anzen Computing
URL: http://www.anzen.com/research/nidsbench/
Platforms: BSDI, FreeBSD, Linux, NetBSD, OpenBSD and Solaris
Number of downloads: 1043
Fragrouter is a network intrusion detection evasion toolkit. It implements most of the attacks
described in the Secure Networks "Insertion, Evasion, and Denial of Service: Eluding
Network Intrusion Detection" paper of January 1998.
This program was written in the hopes that a more precise testing methodology might be
applied to the area of network intrusion detection, which is still a black art at best.
6. Snort UPDATE 1.3.1
by Martin Roesch <roesch@clark.net>
URL: http://www.clark.net/~roesch/security.html#Download
Platforms: FreeBSD, HP-UX, IRIX, Linux, MacOS, OpenBSD and Solaris
Number of downloads: 826
Snort is a libpcap-based packet sniffer/logger which can be used as a lightweight network
intrusion detection system. It features rules based logging and can perform protocol
analysis, content searching/matching and can be used to detect a variety of attacks and
probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS
fingerprinting attempts, and much more. Snort has a real-time alerting capabilty, with alerts
being sent to syslog, a seperate "alert" file, or as a WinPopup message via Samba's
smbclient.
X. SPONSOR INFORMATION -
------------------------------------------
URL: http://www.core-sdi.com
CORE SDI is an international computer security research and development
company. It's clients include 3 of the Big 5 chartered accountant firms
for whom CORE SDI develops customized security auditing tools as well as
several notable computer security product vendors, such as Network
Associates. CORE SDI also has extensive experiance dealing with financial
and government contracts through out Latin and North America.
XI. SUBSCRIBE/UNSUBSCRIBE INFORMATION
-------------------------------------
1. How do I subscribe?
Send an e-mail message to LISTSERV@SECURITYFOCUS.COM with a message body
of:
SUBSCRIBE SF-NEWS Lastname, Firstname
You will receive a confirmation request message to which you will have
to anwser.
2. How do I unsubscribe?
Send an e-mail message to LISTSERV@SECURITYFOCUS.COM from the subscribed
address with a message body of:
UNSUBSCRIBE SF-NEWS
If your email address has changed email aleph1@securityfocus.com and I
will manualy remove you.
3. How do I disable mail delivery temporarily?
If you will are simply going in vacation you can turn off mail delivery
without unsubscribing by sending LISTSERV the command:
SET SF-NEWS NOMAIL
To turn back on e-mail delivery use the command:
SET SF-NEWS MAIL
4. Is the list available in a digest format?
Yes. The digest generated once a day.
5. How do I subscribe to the digest?
To subscribe to the digest join the list normally (see section 0.2.1)
and then send a message to LISTSERV@SECURITYFOCUS.COM with with a message
body of:
SET SF-NEWS DIGEST
6. How do I unsubscribe from the digest?
To turn the digest off send a message to LISTSERV with a message body
of:
SET SF-NEWS NODIGEST
If you want to unsubscribe from the list completely follow the
instructions of section 0.2.2 next.
7. I seem to not be able to unsubscribe. What is going on?
You are probably subscribed from a different address than that from
which you are sending commands to LISTSERV from. Either send email from
the appropiate address or email the moderator to be unsubscribed manually.
Alfred Huger
VP of Engineering
SecurityFocus.com
@HWA
-=----------=- -=----------=- -=----------=- -=----------=-
0
0
0
o
O O O
0
=----------=- -=----------=- -=----------=- -=----------=- -=----------=-
=----------=- -=----------=- -=----------=- -=----------=- -=----------=-
AD.S ADVERTI$ING. The HWA black market ADVERTISEMENT$.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
_ _ _ _
/\ | | | | (_) (_)
/ \ __| |_ _____ _ __| |_ _ ___ _ _ __ __ _
/ /\ \ / _` \ \ / / _ \ '__| __| / __| | '_ \ / _` |
/ ____ \ (_| |\ V / __/ | | |_| \__ \ | | | | (_| |
/_/ \_\__,_| \_/ \___|_| \__|_|___/_|_| |_|\__, |
__/ |
|___/
ADVERTISING IS FREE, SEND IN YOUR ADS TO CRUCIPHUX@DOK.ORG FOR INCLUSION HERE
.
.
............... .
: : . . . . . .
__:________ : : ___________ . . .
\ < /_____:___ : ( < __( :_______
) : )______:___\_ (___( : /
=====/________|_________/ < | : (________________(======
: (__________________) :wd!
. : : :
- / - w w w . h a c k u n l i m i t e d . c o m - / -
: . . . . . : :
. . . . . :...............:
.
.
*****************************************************************************
* *
* ATTRITION.ORG http://www.attrition.org *
* ATTRITION.ORG Advisory Archive, Hacked Page Mirror *
* ATTRITION.ORG DoS Database, Crypto Archive *
* ATTRITION.ORG Sarcasm, Rudeness, and More. *
* *
*****************************************************************************
When people ask you "Who is Kevin Mitnick?" do you have an answer?
www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi
n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co
m www.2600.com ########################################ww.2600.com www.freeke
vin.com www.kev# Support 2600.com and the Free Kevin #.com www.kevinmitnick.
com www.2600.co# defense fund site, visit it now! . # www.2600.com www.free
kevin.com www.k# FREE EVIN! #in.com www.kevinmitnic
k.com www.2600.########################################om www.2600.com www.fre
ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic
k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre
http://www.2600.com/ http://www.kevinmitnick.com
+-----------------------------------------------------------------------------+
| SmoG Alert .. http://smog.cjb.net/ NEWS on SCIENCE |
| =================== http://smog.cjb.net/ NEWS on SECURITY |
| NEWS/NEWS/NEWS/NEWS http://smog.cjb.net/ NEWS on THE NET |
| http://smog.cjb.net/ NEWS on TECHNOLOGY |
+-----------------------------------------------------------------------------+
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net *
* www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net *
* http://www.csoft.net" One of our sponsers, visit them now www.csoft.net *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV *
* JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD*
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
//////////////////////////////////////////////////////////////////////////////
// To place an ad in this section simply type it up and email it to //
// hwa@press,usmc.net, put AD! in the subject header please. - Ed //
// or cruciphux@dok.org //
//////////////////////////////////////////////////////////////////////////////
@HWA
HA.HA Humour and puzzles ...etc
~~~~~~~~~~~~~~~~~~~~~~~~~
Don't worry. worry a *lot*
Send in submissions for this section please! ............c'mon, you KNOW you
wanna...yeah you do...make it fresh and new...be famous...<sic>
SITE.1
Domain of the week: http://www.icardedthisdomain.com/
No comment.
http://www.nudehackers.com/
Dephile and others
Exploits, tools, zines etc, check it out... - Ed
http://hackadvantage.cjb.net
Run by; SmoG
If you're looking for tips on how to beat the system when it comes to free banners
or paid-to-surf scams this is the place to check out, lots of info, updated
regularily.
http://geekmafia.dynip.com/~xm/
Run by: Ex Machina
I've included the "I was a teenage nmapper" article from this site in this issue
check it out, has some interesting stuff and a security how-to.
You can Send in submissions for this section too if you've found
(or RUN) a cool site...
@HWA
H.W Hacked websites
~~~~~~~~~~~~~~~~
___| _ \ |
| __| _` |\ \ / | | __| _ \ _` |
| | ( | ` < | | | __/ ( |
\____|_| \__,_| _/\_\\___/ _| \___|\__,_|
Note: The hacked site reports stay, especially wsith some cool hits by
groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed
* Hackers Against Racist Propaganda (See issue #7)
Haven't heard from Catharsys in a while for those following their saga visit
http://frey.rapidnet.com/~ptah/ for 'the story so far'...
Hacker groups breakdown is available at Attrition.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
check out http://www.attrition.org/mirror/attrition/groups.html to see who
you are up against. You can often gather intel from IRC as many of these
groups maintain a presence by having a channel with their group name as the
channel name, others aren't so obvious but do exist.
>Hacked Sites Start<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
* Info supplied by the attrition.org mailing list.
Listed oldest to most recent...
Defaced domain: www.mecafrance-sa.fr
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.mecafrance-sa.fr
Defaced by: bansh33
Operating System: BSDI (Apache 1.2.6)
Defaced domain: www.workplacesolutions.org
Site Title: Wider Opportunities for Women
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.workplacesolutions.org
Defaced by: P Y R O S T O R M 6 6 6
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.10.12 and 99.10.11 by unknown and forpaxe
Defaced domain: www.lapsi.org
Site Title: LAPSI
Mirror: http://www.attrition.org/mirror/attrition/1999/12/04/www.lapsi.org
Defaced by: Hacking for Swedish Chicks
Operating System: Linux (Apache 1.3.3)
Defaced domain: www.activedev.net
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.activedev.net
Defaced by: pyrostorm666
Operating System: Windows NT (IIS/4.0)
Defaced domain: www.wnr.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.wnr.com
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.98fm.ie
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.98fm.ie
Defaced by: FM104
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.98fm.ie
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.98fm.ie
Defaced by: FM104
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.zoemorgan.com
Site Title: Colin McPherson
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.zoemorgan.com
Defaced by: w0lf
Operating System: Irix (Rapidsite/Apa-1.3.4)
Defaced domain: www.sshackers.com
Site Title: Sesame Street Hax0rz
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.sshackers.com
Defaced by: cryptic
Operating System: FreeBSD
Potentially offensive content on defaced page.
HWA note: Dap gave out the ftp info for this site and invite defacers to hit it.
Defaced domain: garfield.ir.ucf.edu
Site Title: GroupWise Support At University of Central Florida
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/garfield.ir.ucf.edu
Defaced by: Algorithm Cracker
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: www.asjainternational.com
Site Title: ASJA International
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.asjainternational.com
Defaced by: hV2k
Operating System: BSD/OS
Potentially offensive content on defaced page.
Defaced domain: www.furbay.com
Site Title: Furbay Electric, Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.furbay.com
Defaced by: r00tabega
Operating System: BSDI 3.0 (Apache/1.2.6)
Potentially offensive content on defaced page.
Defaced domain: www.dwhs.org
Site Title: Desert Winds High School
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.dwhs.org
Defaced by: p4riah
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.09.08 by Logik Boyz
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.familyheartbeat.org
Site Title: Family Heartbeat Ministries
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.familyheartbeat.org
Defaced by: Uneek Tech
Operating System: BSDI 3.0 (Apache 1.2.6)
Previously defaced on 99.11.30 by electr0n
Potentially offensive content on defaced page.
Defaced domain: www.mj.gov.br
Mirror: http://www.attrition.org/mirror/attrition/1999/12/07/www.mj.gov.br
Operating System: Windows NT (IIS/4.0)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.bottle-fun.com
Site Title: Comport EDV Service
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.bottle-fun.com
Defaced by: Uneek Tech
Operating System: BSDI 3.0 (Apache 1.2.6)
Potentially offensive content on defaced page.
Defaced domain: garfield.ir.ucf.edu
Site Title: University of Central Florida
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/garfield.ir.ucf.edu
Defaced by: bansh33
Operating System: Solaris
Previously defaced on 99.12.07 by AC
Potentially offensive content on defaced page.
Defaced domain: www.filmworld.com
Site Title: Robert Konop (FILMWORLD-DOM)
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.filmworld.com
Defaced by: #Hack-org Hacking Team
Operating System: Solaris
Potentially offensive content on defaced page.
Defaced domain: www.netsecuresolutions.com
Site Title: NetSecure Solutions
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.netsecuresolutions.com
Defaced by: unknown
Operating System: Linux
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.fightclub.de
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.fightclub.de
Defaced by: kryptek
Operating System: Linux (Apache 1.3.6)
Potentially offensive content on defaced page.
Defaced domain: www.pheta.com
Site Title: pheta.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.pheta.com
Defaced by: RH Crew
Operating System: Linux (Apache 1.3.3)
Potentially offensive content on defaced page.
Defaced domain: www.radicalwheeling.com.br
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.radicalwheeling.com.br
Defaced by: Death Knights
Operating System: Linux (Apache 1.3.4)
Potentially offensive content on defaced page.
Defaced domain: www.bearland.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.bearland.com
Defaced by: n4rfy/Death Knights
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.11.03 by p4riah
Potentially offensive content on defaced page.
Defaced domain: www.sis.net
Site Title: Strategic Information Solutions
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.sis.net
Defaced by: n4rfy/Death Knights
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.09.10 by 139_r00ted
Potentially offensive content on defaced page.
Defaced domain: www.dprf.gov.br
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.dprf.gov.br
Defaced by: inferno.br
Operating System: NT
Defaced domain: www.elpublicista.com
Mirror: http://www.attrition.org/mirror/attrition/1999/12/08/www.elpublicista.com
Defaced by: TH3 G4L4CT1C C0WB0YS
Operating System: BSD/OS
Potentially offensive content on defaced page.
Defaced domain: www.megaadult.com
Site Title: Empire Communications Inc.
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.megaadult.com
Operating System: Windows NT (Netscape-Enterprise/3.6)
Previously defaced on 99.08.27 by Uneek Tech
Potentially offensive content on defaced page.
Defaced domain: www.hawgparts.com
Site Title: P And S, Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.hawgparts.com
Defaced by: Pyrostorm666
Operating System: FreeBSD 2.2.1 - 3.0 (Apache 1.2.6)
Previously defaced on 99.11.19 by Devil-C
Potentially offensive content on defaced page.
Defaced domain: www.aba.gov.au
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.aba.gov.au
Defaced by: Ned R
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.11.27 by Ned R
Potentially offensive content on defaced page.
Defaced domain: www.portaldaserra.com.br
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.portaldaserra.com.br
Defaced by: n4rfy/Death Knights
Operating System: Linux (Apache 1.3.4)
Potentially offensive content on defaced page.
Defaced domain: www.vijya.com
Site Title: Vijya & Associates
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.vijya.com
Defaced by: pr1sm
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.98fm.ie
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.98fm.ie
Defaced by: r4in
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.12.07 by FM104
Potentially offensive content on defaced page.
Defaced domain: www.sshackers.com
Site Title: SSH TECH
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.sshackers.com
Defaced by: ex1t
Operating System: FreeBSD 2.2.1 - 3.0
Potentially offensive content on defaced page.
Attrition comment: 3 hacks in 2 days, no sign of repair. Likely hoax hacks or domain.
HWA note: carnage continues from dap dropping the ftp info...
Defaced domain: seresc.k12.nh.us
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/seresc.k12.nh.us
Defaced by: bansh33
Operating System: Linux (Apache 1.2.4)
Previously defaced on 99.11.14 by h4p
Potentially offensive content on defaced page.
Defaced domain: www.cccpstc.org
Site Title: Public Safety Training Center
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.cccpstc.org
Defaced by: dhc
Operating System: Linux (Apache 1.2.4)
Potentially offensive content on defaced page.
Defaced domain: www.mautzetal.com
Site Title: Mautz Baum & O'Hanlon LLP
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.mautzetal.com
Defaced by: DHC
Operating System: Linux (Apache 1.2.4)
Potentially offensive content on defaced page
Defaced domain: www.petewardtravel.com
Site Title: Pete Ward Travel, Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.petewardtravel.com
Defaced by: DHC
Operating System: Linux (Apache 1.2.4)
Potentially offensive content on defaced page.
Defaced domain: www.potatoflakes.com
Site Title: Oregon Potato Company
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/www.potatoflakes.com
Defaced by: DHC
Operating System: Linux (Apache 1.2.4)
Potentially offensive content on defaced page.
Defaced domain: mail.wetnet.de
Mirror: http://www.attrition.org/mirror/attrition/1999/12/09/mail.wetnet.de
Defaced by: Beezwax
Operating System: WinNT
Defaced domain: www.mustafakemal.org
Site Title: Stichting Dinaar Aan Islam
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.mustafakemal.org
Defaced by: nikobar
Operating System: Linux (Apache 1.3.3)
Potentially offensive content on defaced page.
Defaced domain: www.melissa.com
Site Title: Melissa Computer Systems
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.melissa.com
Defaced by: BouTsen And Flogher
Operating System: Solaris (Apache 1.3.3)
Previously defaced on 99.11.21 99.11.17 99.11.16 99.11.04 by c0de red clobher p4riah p4riah
Potentially offensive content on defaced page.
Defaced domain: www.seokang.ac.kr
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.seokang.ac.kr
Defaced by: burn0ut
Operating System: DG/UX (NCSA/1.4.2)
Potentially offensive content on defaced page.
Defaced domain: www.americanbevel.com
Site Title: American Bevel
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.americanbevel.com
Defaced by: w0lf
Operating System: Irix (Rapidsite/Apa-1.3.4 FrontPage)
Potentially offensive content on defaced page.
Defaced domain: www.sshackers.com
Site Title: SSH Tech
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.sshackers.com
Defaced by: antichrist
Operating System: FreeBSD (Apache)
Previously defaced on by
Potentially offensive content on defaced page.
Attrition comment: This *has* to be a hoax.
HWA note: see previous notes
Defaced domain: www.policiacivil.pi.gov.br
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.policiacivil.pi.gov.br
Defaced by: inferno.br
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.bhv.hn
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.bhv.hn
Defaced by: bean0
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.12.03 by acidklown
Potentially offensive content on defaced page.
Defaced domain: www.usinfo.be
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.usinfo.be
Defaced by: PHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.melissa.com
Site Title: Melissa Computer Systems
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.melissa.com
Operating System: Solaris (Apache 1.3.3)
Previously defaced on 5 previous times by
Potentially offensive content on defaced page.
Defaced domain: www.pira.co.uk
Mirror: http://www.attrition.org/mirror/attrition/1999/12/10/www.pira.co.uk
Defaced by: RoA
Operating System: Solaris 2.5 (Apache 1.2.4)
HIDDEN comments in the HTML.
Potentially offensive content on defaced page.
Defaced domain: www.hwa.net
Site Title: Hoefer WYSOCKI Architects
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.hwa.net
Defaced by: Asysmptote
Operating System: Windows NT (IIS/4.0)
Previously defaced on 4 previous times by
Potentially offensive content on defaced page.
Defaced domain: www.schoolgirlporn.com
Site Title: Adult Web Products
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.schoolgirlporn.com
Defaced by: Hacking 4 Ponies
Operating System: Solaris 2.6 - 2.7 (Apache 1.3.3)
Previously defaced on 99.10.28 by h4p
Potentially offensive content on defaced page.
Defaced domain: www.girard.lib.oh.us
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.girard.lib.oh.us
Defaced by: f1ber
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.cci-inspection.com
Site Title: CCI Inspection Services, Inc
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.cci-inspection.com
Defaced by: f1ber
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.10.19 by s0ften
Potentially offensive content on defaced page.
Defaced domain: www.pittsburg.k12.ca.us
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.pittsburg.k12.ca.us
Defaced by: protokol
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.ntacx.net
Site Title: Ntacx Web-werkes
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.ntacx.net
Defaced by: f1ber
Operating System: Windows NT (IIS/4.0)
Previously defaced on 99.10.22 by DHC
Potentially offensive content on defaced page.
Defaced domain: www.useu.be
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.useu.be
Defaced by: PHC
Operating System: Windows NT (IIS/4.0)
Potentially offensive content on defaced page.
Defaced domain: www.thundercats.co.uk
Site Title: Thundercats UK
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.thundercats.co.uk
Defaced by: DHC
Operating System: Solaris
Defaced domain: www.kingston.com
Site Title: Kingston Technology Corp
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.kingston.com
Defaced by: Einstein
Operating System: Windows NT
Previously defaced on 99.11.25 by fuqrag
FREE KEVIN reference in the HTML
Defaced domain: www.hamilton-university.edu
Site Title: Hamilton University
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.hamilton-university.edu
Defaced by: Einstein
Operating System: Windows NT
Potentially offensive content on defaced page.
Defaced domain: mercurius.isics.u-tokyo.ac.jp
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/mercurius.isics.u-tokyo.ac.jp
Defaced by: eTC
Operating System: Solaris 2.5x (Netscape-Enterprise/2.0d)
Potentially offensive content on defaced page.
Defaced domain: www.tenk.com
Site Title: Tenk Machine & Tool Co.
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.tenk.com
Defaced by: mistuh clean
Operating System: Solaris
Potentially offensive content on defaced pageDefaced domain: www.expoente.com.br
Site Title: Expoente Brazil
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.expoente.com.br
Defaced by: Death Knights
Operating System: Windows NT
Previously defaced on 99.10.19 by OHB
Potentially offensive content on defaced page.
Defaced domain: www.lumitex.com
Site Title: Lumitex
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.lumitex.com
Defaced by: pr1sm
Operating System: Solaris
Defaced domain: www.resconet.com
Site Title: Robert Sweeney Co.
Mirror: http://www.attrition.org/mirror/attrition/1999/12/11/www.resconet.com
Defaced by: pr1sm
Operating System: Solaris
Potentially offensive content on defaced page.
and more sites at the attrition cracked web sites mirror:
http://www.attrition.org/mirror/attrition/index.html
-------------------------------------------------------------------------
A.0 APPENDICES
_________________________________________________________________________
A.1 PHACVW, sekurity, security, cyberwar links
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The links are no longer maintained in this file, there is now a
links section on the http://welcome.to/HWA.hax0r.news/ url so check
there for current links etc.
The hack FAQ (The #hack/alt.2600 faq)
http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html
Hacker's Jargon File (The quote file)
http://www.lysator.liu.se/hackdict/split2/main_index.html
New Hacker's Jargon File.
http://www.tuxedo.org/~esr/jargon/
HWA.hax0r.news Mirror Sites around the world:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://datatwirl.intranova.net ** NEW **
http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/ ** NEW **
http://net-security.org/hwahaxornews ** NEW **
http://www.sysbreakers.com/hwa ** NEW **
http://www.attrition.org/hosted/hwa/
http://www.attrition.org/~modify/texts/zines/HWA/
http://www.hackunlimited.com/zine/hwa/ *UPDATED*
http://www.ducktank.net/hwa/issues.html. ** NEW **
http://www.alldas.de/hwaidx1.htm ** NEW **
http://www.csoft.net/~hwa/
http://www.digitalgeeks.com/hwa.*DOWN*
http://members.tripod.com/~hwa_2k
http://welcome.to/HWA.hax0r.news/
http://www.attrition.org/~modify/texts/zines/HWA/
http://archives.projectgamma.com/zines/hwa/.
http://www.403-security.org/Htmls/hwa.hax0r.news.htm
http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
http://hwa.hax0r.news.8m.com/
http://www.fortunecity.com/skyscraper/feature/103/
International links:(TBC)
~~~~~~~~~~~~~~~~~~~~~~~~~
Foreign correspondants and others please send in news site links that
have security news from foreign countries for inclusion in this list
thanks... - Ed
Belgium.......: http://securax.org/cum/ *New address*
Brasil........: http://www.psynet.net/ka0z
http://www.elementais.cjb.net
Canada .......: http://www.hackcanada.com
Croatia.......: http://security.monitor.hr
Columbia......: http://www.cascabel.8m.com
http://www.intrusos.cjb.net
Finland ........http://hackunlimited.com/
Germany ........http://www.alldas.de/
http://www.security-news.com/
Indonesia.....: http://www.k-elektronik.org/index2.html
http://members.xoom.com/neblonica/
http://hackerlink.or.id/
Netherlands...: http://security.pine.nl/
Russia........: http://www.tsu.ru/~eugene/
Singapore.....: http://www.icepoint.com
South Africa ...http://www.hackers.co.za
http://www.hack.co.za
http://www.posthuman.za.net
Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first
and best security related e-zine.
.za (South Africa) sites contributed by wyzwun tnx guy...
Got a link for this section? email it to hwa@press.usmc.net and i'll
review it and post it here if it merits it.
@HWA
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
� 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t }
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
[45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65]