💾 Archived View for gemini.spam.works › mirrors › textfiles › magazines › CRISNEWS › cnews-1.018 captured on 2022-06-12 at 10:43:04.
-=-=-=-=-=-=-
-----BEGIN PGP SIGNED MESSAGE----- Submitted to Crisnews By: James Lipshultz, Esquire Computer Specialist/Computer Security Officer/ Computer Forensics Specialist United States Federal Government, Law Enforcement Branch - ---------------------------- Start of Article ------------------------------- "Treasury Department doing an excellent job on educating U.S. Government Security Officers, Professionally jealous mystery person causes weak willed government management to crumble at his vaporous words." The actual headline in the Washington Post was: "Treasury Told Computer Virus Secrets, Whistleblowers Halted Display Available to Anyone With a modem." Please, give me a break! COMPUTER VIRUSES ARE A SECRET ONLY TO COMPUTER ILLITERATES! The article in the Washington Post on Saturday June 19, 1993 was a myopic, yellow journalistic piece designed to malign the reputation of Kim Clancy who is an outstanding U.S. Government's Security Officer working for the Treasury's Bureau of Public Debt., AIS Branch. Washington's alternative newspaper, "The Washington Post", appears to have been manipulated by Paul Ferguson (an apparent Anti-Virus Sycophant Groupie) who supports and echoes the extreme self-righteous, pious, whimpering of a coward who posted an anonymous message in the risks forum which condemns the BBS run by the Treasury Department. Ferguson's comments appear to mentored by a corpulent self serving British Anti-Virus vendor whom I will refer to as possibly being Paul's "Stromboli". (The Puppet Master in Pinocchio who makes the marionettes magically dance.) +<|:) The quote in the Post by Ferguson was incredibly muddled, obtuse, and boorish. It is a globally known fact that in any debate analogy is not valid because it has nothing to do with the subject matter. As a computer consultant who thinks a computer virus is, as quoted in the Post,".... like leaving a loaded gun around and people saying: 'It's not my fault if someone picks it up and shoots himself in the head with it.'". Who are you kidding Paul? Do you really think that source code is the same as a hand gun? Viruses have no relationship to handguns at all. If this comparison was valid, wouldn't it have been enjoyable to have heard that when the riots broke out in South Central L.A., that the rioters held up store owners with floppy disks containing virus source code in ASCII format or were seen pointing printouts of virus source code. +<|:) If you need education in computer source code versus handguns, allow me to direct you to the nearest University for an education in computer programming, the NRA for handgun enlightenment, and G. Gordon Liddy to learn how to correctly form a sentence as well as use a handgun. Is it ethical or moral for you to own the Trident Polymorphic Engine that you got from a virus BBS? Do you consider yourself two-faced for engaging in this practice of downloading viruses from virus BBS's? Perhaps you should take a closer look at your own ethics before you venture opinions about a respected security officer in the Federal Government. Do you now see how ridiculous you sound? Do you believe that anyone who owns virus source code is immoral or unethical? If so, then when does it become ethical and moral to own source code? Another statement by Paul Ferguson on computer viruses sounds like an advertisement for an Anti-Virus (AV) vendor. "The potential for virus damage has increased geometrically as big isolated mainframe computers are abandoned in favor of networks of small PCs--some worldwide in scope--through which the viruses can migrate. Because of the distributed nature of the network, a virus can now reach thousands of machines, requiring hundreds of thousands of dollars of man-hours to clean up once infected.' " Let's examine this statement. What is the basis of this statistical claim? Is it real or is it Memorex? Hmmm...... Geometrically?.... Are you sure? How about exponentially or is it linear? Maybe you should have said "To obtain the proper potential for virus damage we multiplied the growth rate based on The Theory of Relativity which we then divide by the Gamma Factor, which, as we all know, is the inverse of the square root of one, minus Planck's Constant divided by C squared, C being the speed of light which as we all know is an absolute." Whooo Weee, next time baffle the press with heavy duty BS, Paul. +<|:) <G> On what type of network operating system does the situation you describe occur? On networks with at least a C2 level of security? Is it because everyone is allowed physical and write access to the server, or because the System Administrator is a total incompetent or computer illiterate? Is it correct to assume that most Sysops are so ignorant about viruses that most networks are not running Anti-Virus software? Paul, once again I think you have overstated yourself. I believe you should have said: "If a network sysop is a secretary with no computer skills and the network has no security whatsoever and everyone on the LAN is allowed to bring foreign software and execute it on the server, then a virus that is specific to the network operating system has a chance of remaining undetected and traveling." (Notice I kept your sentence structure so that it would look like your words.) +<|:) <Did you understand the symbol to the left yet? Get it, (Pope Paul)> <G> Coming in at a very close second in my hit parade of insipid comments was Bruce Sterling, the author of the mostly dry and mildly entertaining "Hacker Crackdown...Bla Bla Bla". Bruces's equally ridiculous quote appears to have been made to get his vanishing name in print. He made virus source code "the equivalent of how to commit arson, or hot-wire cars." Would you be willing to submit to a drug test Bruce? Maybe you should return to writing fiction since you have such a wonderful imagination. Would you please cite the instances were a house was burned down and the fire marshal attributed the cause to virus source code? Have you ever heard of a police officer who said a thief has been starting cars with virus source code? I am so impressed by your brilliant quote: "Every maladjusted sociopath with Coke-bottle-bottom glasses has no trouble finding this stuff. The police are the only ones not allowing themselves to look at this stuff." Wow, I'm having trouble understanding why you did not seek a career in law enforcement. It is apparent that you would know the Bad Guys because they are the ones with the close-set beady eyes. Bruce, if maladjusted sociopaths exist, are there any adjusted sociopaths? As a "professional" writer I would assume that your verbal and writing skills to be better than most. May I make the following suggestion? Look in the dictionary and learn the meaning of the word malapropism before you write anything else. By your quote, are you saying that all sociopaths wear coke-bottle-bottom glasses and thus have gravitated to fulfilling the quest of the unholy grail by seeking out people with virus source code? Why not type cast people by race? Take a good look at the people who code Anti-Virus products. Some of them have thick glasses, though we both know that they would never spread a virus? (Yea, Right!) As for the police not looking at this stuff, I have to assume that you imply all law enforcement officers, County, State, and Federal. Law Enforcement knowledge regarding computer crimes is far better than you ever dreamed and we do gather knowledge from virus BBS's. As a brotherhood, we share knowledge to help fight the war on crime, so don't ever sell us short. It is apparent that you are unaware of the skills of computer specialists in the federal government, especially in federal law enforcement agencies. I will give you credit for conveying the idea that Kim Clancy was very good at her job, though you give it an edge that leaves one feeling that she is brilliant but somehow demonically twisted. (Oh help me Obiwan, she is succumbing to the dark side of the force.) :) Kim Clancy is a decent hard working person who attained her knowledge and status by intense work and study. She is respected because she knows, understands, and can articulate computer security subject matter in a concise clear manner, something beyond the ability of you and your ilk. What you have done is to sensationalize an event that has been blown totally out of proportion. Your choice of words is the type that sells publications such as the Washington Post and the National Enquirer. Do you understand why your comments are ludicrous? In the future stay away from analogy and please take some courses in English before you write your next book, or at least talk to Mr. Liddy. Dial 1-800-G-G-LIDDY Monday through Friday, right after the lovely and talented Howard Stern. :) I was further upset by the way in which the Washington Post sensationalized what was on the board. Where, oh where, did the Washington Post get their all their info? Mmmmm? "The board also made available hundreds of "hackers' tools"--The cybernetic equivalent of safecracking aids. They included "password cracker " software."...and Bla Bla Bla. Wow, wake the kids, phone the neighbors, someone has a BBS with files that will hack a password! (Uh-ohhh, Frankenstein is on the loose!) :0 Several things to note here: o Many companies make their living by selling software that returns the password used in the proprietary scrambling of WordPerfect, Lotus, Paradox, Excel and others. o Also, there is software that takes a brute force approach to breaking the password to PKZIP v1.1 encrypted files. The article leads one to believe that the BBS had a piece of software that could crack any type of encryption, possibly endangering National Security. The Washington Post should have specified what type of encryption breaking software was available. Instead, the Post failed to inform the reader that the encryption breaking files on the Treasury board were nothing of any major significance. It's just that encryption breaking sounds good and satisfies the tabloid readers who have "inquiring" minds. :) The catalyst that started this avalanche of Bravo Sierra (BS) appeared from the Risks Forum. The article was submitted by a coward who refuses to reveal his identity. I will restate his words and comment on this trash directly from the RISKS14.58 which I downloaded from The Treasury's AIS BBS. I will not use the direct quote from the Washington Post since they omitted several sentences. (By the way, how can a publication put quotes marks around a statement and then not have it reflect the exact words that were actually written? Can you answer this Joel? Back to English 101 for you Joel.) I will put the Post's quote in CAPS that the reader can see how it was edited. I will include my wonderful and insightful comments, in parenthesis, where appropriate in the text. "This text was forwarded to me by a friend and professional colleague in the UK. I AM DISMAYED THAT THIS TYPE OF ACTIVITY IS BEING CONDONED BY AN AMERICAN GOVERNMENTAL AGENCY. I can only hope that this operation is shut down and the responsible parties reprimanded. I AM EXTREMELY DISTURBED BY THE THOUGHT THAT MY TAX MONEY IS BEING USED FOR WHAT I CONSIDER UNETHICAL, IMMORAL, AND POSSIBLY ILLEGAL ACTIVITIES." ... Insert screen captures from the menu of the Treasury's BBS here... "I submit this text in an anonymous fashion for fear of reprisal. (COWARD!!!) I respectfully request (lick, lick, kiss, kiss...my what a brown nose you have Pinocchio.) that it be posted to both VIRUS-L and RISKS Digests. I think the risks of Government sponsored virus exchange are crystal clear." (To whom, Pinocchio?) Who is this person who so frivolously throws such strong words around but is to afraid to put his name to them? (Like we really don't have a clue, we're so naive.) Mr. Anonymous also states that he is afraid of reprisals from the Treasury Department. Does this person actually believe that the Treasury Department engages in retaliation for negative comments to their polices and procedures? The Treasury Department is staffed by some of the finest law enforcement and non law enforcement personnel, who probably have the finest morals and ethics in the Federal Government. "Anonymous" used all the correct government buzzwords that will send any meek GS management scrambling to cover their ass. The good old boy alarm is activated, memos start to fly and the process of denying knowledge of the activity begins. Weak willed government management cringes at the thought of a memo with the words tax money associated with "unethical, immoral, and illegal". Damage control is enacted and the weak kneed management buckles under to the words of a ghost. What a shame that Kim's BBS was so easily raped and reduced to mediocrity. Peter Hollenbach's words were irresponsible and ill chosen. His first mistake was to state that the Treasury Department had made a mistake which they were scrambling to correct. It implied extreme ignorance on management's part. The paragraph in the Washington Post stated: "The Treasury Department has little idea who has dialed up the bulletin board, and what has been copied out of it", said spokesman Peter Hollenbach. "Hence it is impossible to judge if any damage has been done." Is this the best you can do Peter? Where is your head making these outrageous statements? You answer in the extreme negative and leave out the positive. You should be fired for gross incompetence in handling damage control! The Treasury Department definitely needs a person who will stand up for its people and the Agency. Where the hell is your pride? Kissing ass of the politically correct makes you sound like a roll over wimp and a poor liar. I used the "I didn't know" excuse in grade school. Please ... be a man! A strong willed, organized, management would have admitted that they were aware of, and defended, Kim Clancy's actions. I believe the Treasury Dept. AIS management should have publicly announced that they were putting her up for a performance award and done it! (No Guts, No Glory!) Hollenbach should have said that the board had been running for several years with the full knowledge of the Anti-Virus community and not one (or say most all) AV vendor had complained. Nor have they received any complaints from the ICSA, NCSA, EICAR, or CARO (once again list the "big" guys who do not complain; do you understand yet, Hollenbach?) who are all fully aware of the boards existence. In fact two members of the Computer Antivirus Research Organization (CARO) actively encouraged Kim to obtain more computer professional programming files (commonly called hacker files by the press neophytes). They did not complain that the BBS distributed because they were among the organizations who downloaded these files. The Anti-Virus industry as a whole did not complain that the board was immoral or unethical and encouraged its existence. Most importantly, the board provided extensive help to security personnel throughout the Federal Government and helped other security officers in their endeavors to achieve outstanding performance in securing their agencies networks. (Period, end of statement!) See how it works Peter, stand up for the Treasury Department and its people. Don't be pushed around. Tell the press how really ethical, moral, and loyal Treasury personnel are, and mean it! The Federal Government is providing you with a fine job. Drop the coffee cup from one hand and the paycheck from the other and get your sorry ass in gear, mister! (Semper Fi!) If you don't know what to say, tell the press that a statement is being prepared which will be released in a few days. By so doing, you've given yourself time to think clearly and form a good plan by talking to people who understand the problem clearly. Thus, you do not embarrass the Federal Government. In addition, never admit ignorance or try and back-pedal, the Washington Post twisted your words to make you look foolish. Remember above all, Peter, the truth is the easiest to remember.(Truth is your shield and knowledge is your weapon. You had both and didn't use them!) On to the next topic, the quote in the Post that states "'...since the complaints began, Treasury officials, while not disciplining Clancy, have shut down the 'underground' portion of her bulletin board.' "It is not consistent with what we originally set out to accomplish", Hollenbach said. "We decided to refocus back to our roots." Since complaints began? How many complaints were lodged against this BBS? I would like to count the complaints. (on the fingers of one hand, I'll bet!) How many letters of support and accolades from competent Federal and private security officers has Kim Clancy received? I would wager that the support letters "geometrically" +<|:) outnumber the holy (two faced) self-righteous letters. Wake up everybody! The AV people trade more source code and viruses than anyone! I know because I trade with them. I have their infected goat files with their Company names in them! Shutting down the Treasury BBS has not vanquished some evil, it is insuring that vendors will control the market place and tell us only what they deem appropriate. You "Pinocchios" not only need a conscience, you need common sense. You are being used as pawns in a game for control of the market place, and your being made into politically correct fools. Third on the chart of laughable Post quotes is Neumann... 'Neumann of Risks Forum, however, is troubled by Clancy's actions. "It is the classical double-edged sword. It might help, and might hinder. (You should have stopped your quote at this point, however you had to step in it by going on. Now your doing that special one shoe tap dance... Ugh!) You're looking at a potential for serious disaster", he added. "If you're talking about life-critical systems --air traffic control, for instance-- it means killing people." Another brilliant thinker? All I can say is if you are stupid enough to run a DOS based network for critical systems such as air traffic control, people will probably die anyway, even if there are no viruses. Have you ever had a DOS system hang due to a conflict with a TSR? (Duh!) --- DOS is a real C2 secure operating system isn't it? Maybe an Apple or an Amiga system would be better for Air Traffic Control. Hmmmmm? Those are at least as secure as MS-DOS ...please spare me your platitudes, Neumann. The Treasury BBS did not have any viruses that would take out the Air Traffic Control System or some other Mission critical system. Let's come back to earth please. Neumann, do you have an understanding of viruses or are you just like the other computer illiterates that hear the word virus and pull out their verbal Excalibur swords to attack? Next time, truly know your enemy before you attack. An interesting experiment by one virus author involved tracking viruses through the AV vendors. The author sent his virus up to one big name AV vendor. Two months later in was in VSUM and it was sent back to him by overseas underground virus BBS's in three months. I call that an interesting experiment with a powerful statement on the propagation of viruses by the AV community itself. Several virus writers have told me that they are coming together in their efforts and are becoming more politically aware in pointing out hypocrisy. One virus author alleges that he created a virus called "SARA" with a unique X-rated graphics as a statement of hypocrisy in a AV groupie who hounded and begged Mark Ludwig at an AV convention for a copy of his book "The Little Black Book of Computer Viruses". Upon finally selling her (What is the name, Hmmmmm?) a copy to get her to leave him alone, she allegedly ran around holding Ludwig's book above her head shouting "He sold me a copy, he lied, see." (Ludwig promised not to sell a copy of this book at the Conference. - If this is true, lame stunt to pull Sara! Shame on you, bad girl, bad girl, Grrrrrrrr.) This same person was later heard saying that she planned to publish a book containing the Sysop name, actual name, addresses and phone numbers of all the virus sysops. (Obviously a money junkie in need of a quick fix. How popular could this possibly be? I believe the author of such an endeavor better be correct, and be able to back it up, otherwise it sounds like a class action libel law suit . Not good for profits.) This allegedly created a big commotion among the sysop community. Virus authors are also attacking the lack of programming skill of some popular AV developers to demonstrate how the public is getting stuck with inferior AV products. For example McOversized Wallet's scanner only catches about sixty percent of the viruses generated by the Phalcon-SKISM Mass Produced Code Generator. In addition, NPOX attacks the lack of internal security checks in CPAV. On the other hand, there are some exceptionally outstanding virus scanners, such as Fridrick Skulason's F-PROT. He has about, if not the best scanner/disinfector on the market. Frisk is truly a person dedicated to stopping the virus problem by making his AV software available for ONE dollar, thus the public can choose quailty protection for their PC that is affordable. Another alleged story in the underground goes like this: a meeting of AV people was held in New York and "Stromboli" was running the show. During the lunch break a computer "criminal" broke into the room and stole the minutes of meeting. The minutes reported the AV organization would deny the existence of their virus collection. Thus they would not have to share them with anyone else. (Squeezing out competition and raising prices later.) Sounds like a Cartel to me. Wow, can this be true? An AV person worrying more about profits and eliminating competition than fighting the war on computer viruses? But when "Stromboli" talks all he can say is how unethical and immoral those people are who possess viruses or even source code. Perhaps the Federal Trade Commission should be notified of unfair competition in the market place. I would also hope that a government agency takes control of a super set of all viruses from all the companies and sets the naming standard (NIST could do this.), as well as keep the viral search strings and algorithmic patterns of ALL anti-virus vendors. Thus any new vendor could apply for a set of viruses from this agency and not be prevented from entering the market because of a lack of test viruses. Every time a vendor at home or overseas updates his product he would then submit the new viruses to this governmental agency, along with recompilable AV product source code. The Federal Government would thus have an accurate comparison of the existing marketed version and would protect consumers from shabby anti-virus products, because these would have government approval. The ethical conflict of vendors controlling source code and viruses while assuring us, with a toothy grin, that their products work, would be solved. I think this idea could work and should be expanded upon. It would seem to be a better idea than trying to keep citizens from owning virus source code or compiled and executable versions for test purposes. Maybe the average citizens should contact their senators about enacting some legislation to enforce standards on AV products that purport to protect our computer disks. I hope the Federal Government would be in control of a complete library of source and compiled, viruses insuring product quality and competition among AV vendors. Thus, the consumer would be relieved of virus fears by superior products and competitive pricing. Thus, ALL individuals who choose to own source code and viruses will maintain this freedom. I am asking for a response from the user community on these next few questions: o If viruses are illegal in the UK, then why does "Stromboli", in PRIVATE industry, control the largest set? o Why doesn't the British government control access to the viruses? o If it is illegal for a private citizen to own or trade viruses in the UK then why hasn't "Stromboli" been arrested for trading viruses locally and internationally? o "Stromboli's" goat file viruses are showing up on virus BBS's and infecting American PC's. o Is "Stromboli" trading with virus BBS's to get the latest viruses? o Can the U.S. Government hold "Stromboli" responsible for his virus infected goat file infecting any Federal PC's? o Should Americans complain to The State Department to press for action against "Stromboli" for importing viruses into the US, while violating the laws of the UK? (How dare you... you... you... phony internet mail virus Importer/Exporter., P.S. Thanks for my set.) "Stromboli", you and you alone are ultimately responsible for the spread of the viruses with your company logo attached. What did your fellow CARO members say when they received a large set of viruses from an American virus BBS that contained your virus infected goat files? (Holy Moly Dude, the monster you created is coming back to bite you in the ass.) The news media is constantly being manipulated by special interest groups that stand to financially benefit from politically correct views. At the same time, the papers are constantly looking for ways to create cover stories which support their political agenda and enhance stories that sell their publications, making huge profits. (Don't get me wrong I'm all for profit and big business. Go Gates!) However, when it comes to attacking one of the government's most respected Security Officers I feel the news media was fast to move and slow to screen bias in their stories. I also feel that Ferguson, Sterling, Hollenbach, and Neumann should present a written apology to Kim Clancy in an open public forum. Viruses are an overblown phenomenon created by people who make money from the existence of viruses. Remember the Michelangelo virus, a big dud in the real world, except for the AV people's McOversized wallets? Viruses do exist, though they are a very small problem for an ethical and knowledgeable sysop who follows common sense computing practices. Do you bootleg software? Do you download strange software files offered by various BBS's and execute the files on your server? Do you share or trade floppies with your friends at work or home? Do you import software from your home PC? If so, does anyone else (like your college son) operate software from the university on your PC? Is your PC devoid of Anti-Virus Software? If you answer yes to any of the above questions, your own ignorance and laziness will insure you someday get a virus. In conclusion, you moral majority types are neither moral nor in the majority. As a law enforcement computer security officer and computer forensics specialist, I have been told I am not responsible enough to own viruses, by the same AV people who trade viruses among themselves. Since the response was usually, "We don't want to be responsible for spreading viruses", it was all I could do to not speak out and call them hypocrites. It is time that certain vendors stop telling us how to think. and what we can or can not do as regards computer source code, viral in nature or otherwise. AFTER THOUGHT: to Peter S. Tippett, has any anti-virus vendor signed the "Anti-Virus Developers, Publishers and Professionals Code of Ethics" (My Copy is) Draft 1.3, 11/19/91 (a noble attempt by a decent fair minded person with a good idea, brought forth at the NCSA 1st International Anti-Virus Product Developers Conference on 11/25/91). As I recall, not one AV Developer was willing to sign it, and it scared the hell out of most of the AV people. Has it been improved on and has anyone signed it? I would like to see the names published in the Washington Post of the AV people who signed and did not sign an ethics agreement. Will the signature count be greater than two, including yourself? ------------------------------------------------------------ || My message to the coward "anonymous" in the RISKS FORUM. || || || || Quid Pro Quo || || || ------------------------------------------------------------ Author: James Lipshultz, Esquire Computer Specialist/Computer Security Officer/ Computer Forensics Specialist United States Federal Government, Law Enforcement Branch (Special Thanks to Mr. Frank Tirado, US Federal Government, for editing and comments.) -----BEGIN PGP SIGNATURE----- Version: 2.3a iQBVAgUBLNc4fqM4CDusTF+9AQEw8AH+LUu5hrDdEgMgASODbHNJKHxeJR+TEYho ISK524VijuyRYp0C9pcibT2/N1ygoprKfIUKWIO4/NhI8OVB5+wAHQ== =4Whm -----END PGP SIGNATURE-----