The Hacker Quarterly Volume Eighteen, Number One! Spring 2001 $5.00 US, $7.15 CAN “Why is it perfectly legal to post a diagram of how to build a bomb on the net, but you can’t post a code that de- scrambles DVDs?” - The March 3, 2001 edition of “Boon- docks,” a daily comic strip written and drawn by Aaron McGruder and seen in newspapers all over the county. It devoted three days to the DeCSS controversy and, unlike virtually all news reports, got the story right. Editor-in-Chie f Emmanuel Goldstein Layout and Design ShapeShifter Cover Concept and Photo Bob Hardy, Ben Sherman Cover Design The Chopping Block Inc. Office Manager Tampruf Writers: Bernie Billsf, Blue Whale, Noam Chomski, Eric Corley, John Drake, Paul Estev, Mr. French, Thomas Icom, Javaman, Joe630, Kingpin, Miff, Kevin M it nick. The Prophet, David Ryder man, Seraf, Silent Switchman, Scott Skinner, Mr. Upsetter Webmaster: Ely knight Web Assistance: Fearfree, Kerry Network Operations: CSS, Phiber Optik Special Projects; mlc Broadcast Coordinators: Juintz, Cnote, Silicon, AbsoluteO, RFmadman, BluKnight, Monarch, Fearfree, Mennonite, jjjack IRC Admins: Autojack, Khromy, Kozik, Muted, Tprophet inspirational Music: Terry Draper, Sentridoh, LKJ Shout Outs: Rachel Barr, Janice Bryant, Dave Burstein, Bob Fass, Juan Gonzalez, Amy Goodman, Stiaran Harper, Patty Hefdey, Robert Knight, Al Lewis, Errol Maitland, Mario Murillo, Ken Nash, Mimi Rosenberg, Anthony Sloan, Scott Sumer, Carol Spooner, Eileen Sutton, Valerie Van Isler, Bill Weinberg, Bernard White 26001 ISSN 0749-3851 ) is published (juurtcrly by 2600 Enterprises hu 7 Strong's Lane, Setauket, NY 11733.' Second class postage permit paid at Setauket, New York. POST MAS! ER: Send address changes to 2600 , P.0. Box 752, Middle Island. NY 1 1953-0752. Copyright (c) 2001 2600 Enterprises, Inc. Yearly subscription: U.S. and Canada * $ 1 8 individual, $50 corporate (U.S. funds). Overseas - S26 individual, $65 corporate. Back issues available for 1984- 1 999 at $20 per year, S25 per year overseas. Individual issues available from 1988 on at S5 each. S6.25 each overseas. ADDRESS ALL SUBSCRIPTION CORRESPONDENCE TO: 2600 Subscription Dept., l’.O. Box 752. Middle Island, NY 1 1953- 0752 (subs@2600.com). * FOR LETTERS \M> ARTICLE SUBMISSIONS, WRITE TO: 2600 1 dltoriitl 1 >cpl,. P.O. Box 99, Middle I d anti N't 11953-0099 < letteis@2600.com, unities*" .'MHi.com). 2mn < Mllt< Line: 631-751-2600 2MM I V \ Line: 631-474-2677 t * Sl 8 ns 0 f Hope As our appeal of Iasi ye at DeCSS case draws closer (at press time it w;i *ri b < b< h .in l by the Second Circuit Court ol \pjn U in earl\ May ), we realize how mud vv e ' \ .u . . mi| 1 I 1 .1 u d since this whole ordeal started and hm mia h other people with half a clue have eon " Join too. That’s not to s:l> that a lot ot hud lul l ha n i happened - we know loo well about ill a! lut New bad laws, new threats, more stifling “I tec h nology and speech throughout the world, lint de- spite all that, we’re going into this with a i il feeling of optimism. As time passes, more people seem to mili/c the true motives of groups like the Mot Pit ture Association of America and the Kecordim Industry Association of America, fliev n m>t about protecting the rights of struggling artist bolstering creativity, or giving consumer a I m deal. They’re about maxi mi zing profit plain .uni simple, And as things continue to go the ir wav thanks to laws tike the Digital Millennium < ■ p right Act. people slowly start waking up to the reality that maybe then best interests haw been completely ignored. Perhaps the most dramatic display ot this overdue realization came in remarks made by Rep. Rick Boucher {D-VAi m early March he fore a Consumer bdeetronics Association Confer- ence where he seemed to actually realize the true dangers of the DMCA: "The time , in my opinion. has ft one for the Congress to reaffirm the 1 air Use Doctrine ami to holster specific fair use riff his, which are e o i ann . atom for the purpose of in fring t • nit • m Perth ip \ 1 1 t> i . - re t in i bed a mend - men t could b, iut(u d to custire the con tinned ex- ercise th fait use right-, of libraries and in a ( 1 htdt tstu \ett in ye m an it h landing the provi- sions of Section 1201. " And t flunk then - are other challenges. I am i otn e tried by the apparent attempt of some in the Page 4 2600 Magazine content community to seek to protect their copy- right interests in material contained in television programs by insisting that the TV signal quality be degraded, or by insisting on the use of set-top box technology which prohibits all copying. The reasonable expectations of teh vision viewers to be able to make afn of programs for time shifting and other hisfotu ally accepted purposes must be honored and must he fulfilled. " We suspect that ti re are many others in Congress who I eel die same unease but are hesi- tant to speak i M.u mist such powerful lobbies as the M PA \ .nut tin K1AA. We must encourage them to list* n to ihe people who elected them, not the special inkiest groups who use intimida- tion and money to get what they want. In anothei wry public display in early Match, cartoonist. Aaron McGruder devoted hi s popular ci inn strip Boondocks to the DeCSS controversy i an three days, characters struggled to understand tin hut'll ing ruling of Judge Kaplan this past \ 1 1 g u si which forced 2600 to keep t he source code ofl ot our site and even banned our linking to other sites that contained this material. "Why is it perfectly legal to post a diagram of how to bmld a bomb on the net, but you can’t post a code that descrambles DVDs?” a character asks a teacher. The rest of the strip is blacked out with the wouls ‘‘CENSORED. We just don't like where he’s going w ith this." On a different day. the entire strip was re- placed with the words: “CENSORED, This comic contain* numerous references to the DeCSS code used to bypass the Content Scram- bliiig System of DVDs, which, by order of Judge Lewis Kaplun, ■* illegal to reproduce in any way. We a pot og i a lor the inconvenience, but speech that damages the prolits of our corporate friends is NOT protected hy the First Amendment. Thank you," This biting political commentary accom- plished mi two sentences what virtually every major editorial page has so far failed to do. The sobering cnnsei|Uenees of the ruling against us was laid out concisely loi all to see. Note that the author understood that the code was not de- signed fui copying, a fact dial virtually every news report on the subject got wrong. What this illustrates is that we have allies in places we never even thought of. This one comic strip reached millions ol people who now have some understanding ol what this, ease has been, and continues to be, about. I here are probably a good many more ways of reaching the public that have yet to be utilized. We need to come up with more ideas and those people who can help get the word out need to come forward. And of course, technological rebellion con- tinues, We've seen people come up widi shorter and more creative methods of bypassing CSS - everything from a DeCSS haiku to a 434 byte C program to a seven line Perl script. There’s even a prime number that is identical to the gzip data ( in decimal) of the original C source code minus tables. T-shirts, bumper stickers, even tattoos with such “illegal" code are popping up every- where. And it all serves to illustrate the absurdity Of the whole thing. It’s imperative that w r e keep our sense of hu- mor throughout, no matter how it all turns out. There are many levels on which we could ulti- mately lose - the court case is only one of them. The spirit of the hacker community is what is vi- tal to this and ail future tights. It’s an inspiration to many more outside the scene who can only dream of taking on the fights we do. Destiny has put us in this position at this time in history and we have to continue to stand up for those things we believe in - free speech, free communication, free access to knowledge, and the ability to con- trol and shape technology to suit our individual needs. We're very lucky to be where we are, despite the risks. And we T re fortunate beyond words to have such an amazing support network that is still growing and developing. Because no matter how the DeCSS appeal turns out, you can bet there will be more fights in our future. If they open half as many eyes as this case has, they will be worth the trouble. Spring 2001 Page 5 Police Searches ofm Computers by Todd Garrison Ignorance of Lhe laws (hat govern your everyday life is at your own peril I do not advocate breaking any law, nor do I want to disseminate this article to criminals lor the purpose of making the task of law enforce ment more difficult. 1 cannot help but knowledge that information here can be ol use to criminals, but that is mere coincide m c because all citizens have (he right to protei tion under the various statutes and rules that protect our freedom. Because l am involved with infom auon security I have taken it upon myself to he come familiarized with state arid federal \.w\ that affect computers, lam not a law yci Ido not offer any of this information ,is such* not do I advocate treating any ol what I sa> i authoritative, li you suspect that mi , kl\ hv involved in litigation or tin indictment that in volves computers* get a lawyer Not a lawyer who specializes in real esiau- law, or general criminal defense Retain a lawyer who spe cializes in computer and Internet law. The worst possible situation is a lawyer who doesn't know how the (computer-related) law works and puts you through failed filings w hile taking the wrong approach to your de- fense, The prosecutor involved in your case {assuming it is computer- related) will most likely have received specialized training on computer- related offenses. In lighi of lhe me- dia circus that surrounds hacking and any- thing that even remotely relates to a computer crime, prosecutors want to make examples in cases. So expect that they w ill try for maximum sentence and the harshest punishments for crimes under the guise that future risk can be averted in your case by im- posing a harsh sentence before you graduate to more serious crimes. The inspiration for this article is the re- cent publication of “Searching and Seizing Computers and Obtaining Electronic Evi dencc in Criminal Investigations," a guide published by (he CCIPS {Computer Crime and Intellectual Property Section) ol the United States Department ol Justice, Anyone who has followed the recent computer crime cases in the press knows that much of the computes crime law is still untested. Every day this becomes less true. Events are rapidly changing the interpretation of laws. Legisla- tion such as (he Digital Millennium Copy- right Act has shifted fair use away from the individuals our government is supposed to pro I ec t and has given (he power to large cor- porations. It w ill soon be illegal to even re- verse engineer a product you have bought* and paid for the right to use - whether for the i mended purpose or not. Events such as a. ak and peek" searches are becoming moil- commonplace when encryption is an issue. I here are. however* steps you can take to I >i « iiccl your privacy and make it more diffi- ult to have certain information and computer ’ v h ni , seized as well as have the ability to reciwci your equipment after it has been seized \s I said before, I do not advocate or i i dii i uat l ci participate in crimes. It be- iiiiu's less likely that upon knowing the law r that y i ' 1 1 will be an u n knowing party to a , rime but nol impossible. For instance you owl l In implicated m a crime by the fact all sue dial you know how to use a computer and one of yom friends has committed a crime 1 ho situation i s not only likely* but I iu p pe n n re g u 3 a r I y . Cr in mud in vesti gators only need a suspicion that you may have in- formation pertaining to evidence in a crime to seize your computers - even if you did not commit a crime. There are laws that are sup- posed to protect against this, sure* but it is just a matter of semantics in the affidavit that the criminal investigator presents to a judge when requesting the search warrant, further- more in cases w here you relinquish control (say you drop off your computer at a repair shop) that an affi - davit and warrant are not even neces- sary to seize your equipment, The DOI com- puter search guidelines can be read at www.cy- heu rune gnv /search manuakhtm. So are we really that far aw'ay Page 6 2600 Magazine from Orwell’s 1984? Docs Big Brother have uncontrolled power? No. While you may not be able to prevent the initial show of force - where law enforcement essential I y steals your equipment - there are many avenues to protect y o ursel f , W he 1 1 d oi ng v u I n era b i 1 i ( y research on a computer system it is common to investigate multiple avenues of attack. To enumerate as many as possible and explore each one in an intellectual manner before choosing the avenue of attack. This is a disci- pline gleaned from basic tactics of warfare, it is a tried and proved method of offensive at- tack and, to be cliche, it is also ja great de- fense. This is whai I will attempt to d# in this article. I do nol propose legal defenses* bur merely recognize local inns in the existing laws which may allow more room for a de- fense once you have retained a lawyer. Warrantless Searches Quoting Nancy Reagan, “Just say no!" *4 (“No. officer, you may not search my vehi- cle"; “No* officer, you may not enter the premise without a search warrant*”) It should be noted here that refusal to search may be deemed as suspicious behavior and under ex- treme circumstances may be used against you in an affidavit. Keep your wits about you! Your interaction with the police. FBI. prose- cutors. etc. will be held against you or will be credited to you during any trials, motions, fil- ings, etc ( icner ally if they ask to search something they have a reason. Ask why they warn to search. If for example they w ant to search your vehicle for drugs* get it in writ- ing. While this may be something they do not want to do* insist. Make it the only condition that they may search Why? Because if they are looking for drugs as a guise for looking at your laptop, pager, cellphone* PDA, appoint- ment book. etc. they just plain don ’I have the right. You can’t store drugs on your hard disk’ Now he extremely careful at this point if they say they are searching for “evidence” of drugs they may be warranted to look through other devices. Make them change the wording (o “drugs or drug paraphernalia” in- stead of Vv i deuce" before you agree. Note that if i hey do find drugs, they have the right to sea rc 1 1 e v e ry t h i n g , i nc I ud i n g you r com - puter. etc. Others may consent to search on your be- half, That’s right, even il vou object, it may not matter. When you were a child you were probably taught that sharing was a good thing. This is true and not true at the same time. Later in this article I will explain when it is good, but in the case of warrantless searches it is not only dangerous, hut il is as good as totally relinquishing any control for a search to an officer The basic idea is your roommate can consent to a search of your apartment* It gets worse. Anyone you share your computer with can consent to its search. Your coworkers can consent to a search* a passenger in your vehicle can consent to a search. Essentially anything that is shared be- tween you and another person can be searched w ith the consent of the other person. It gets even worse! If for example you don’t share your computer with your roommate but they could access it, then they can authorize ils search too. The search must be limited to what they can access. What this means is that if you must share yoifr computer, do it in a manner that (hey do not have access to your files. Operating systems intended for a single user should not be considered an option in these cases. Use the multiple users feature of Mac OS L J. use a nix operating system writh different accounts* or use different profiles under Windows NT. Make sure (hat when you are done using your computer you log out. Of employ a screen saver w r ith a pass- word. If you give (hem your password, then they haw the right to give h w hoever is con- ducting the seal ch . Be aware also that operat- ing \Y stems like Windows NT and 2000 may have a common cache for things like your web browser, and since it is accessible by others who use the same computer* then it is fair game and admissible evidence. The best advice 1 can give is use encryption for every- thing all the rime. If you can get away with it* encrypt your applications, their temporary di- rec lories* configuration files* The same tech- niques (hat you use lor protecting yourself against break -ins suds as proper registry per- missions can help too. Another reason to employ encryption (and when I say encryption I mean strong en- cryption - always use strong ciphers, not RC2-40bit or DBS - but IDEA, 3DES* or Blowtish) is incidental disclosure. If you have a laptop and it gets ripped off on the bus, at the airport* on the subway, at school, or wherever you may be* and they catch the thief - they can search your laptop! They can- not ask for your encryption keys, but any- thing that the thief could have read (which is everything contained on the laptop), they have the right to read. Now recite this mantra: “Encryption protects me, I will use it everywhere." This type of disclosure opens up a lot of scary questions. Just remember that as long as there are people* there will be people who abuse their power. A criminal in- vestigator may use these circumstance to tar- get you* not that 1 know of any specific case where this has happened but it is still possible* Anyone who is involved in security work Spring 2001 Page 7 knows that passwords, encryption, and physi- cal locks can he overcome. But using these measures, even if you know they are not com- pletely effective are an absolute must. In the eyes of the law even the weakest encryption affords a level of legal protection regarding allowed access (look at the DMCA h II you took steps to disallow another person from accessing something, no matter how basic those steps are, that means that they did not have legitimate access to those items. II you store your computer in a closed cabinet w till a lock and did not give the key to youi on mi mate, they no longer have the right lo audio rize its access to anyone. Password |>u ue i everything, encrypt the most trivial item um physical locks and keys, store youi ini|Hutai removable media in an inexpensive hie .\U- These are all actions that deny act cs i protect your legal rights against wan am I l searches. If you are the only pci urn wlm has legitimate access to an item, then von m ilu only one who can release that hem loi ■ . yiu !i But wait! This doesn't apply at wort u\ul on! There is much debate about v \pcvLiiin w proba h I e cause for a search. It will name what information leads to the conclusion that a search is required, where lliai information was obtained, and the cijLiJirisi.uhvs under which the investigator believes it relevant. The second is the actual warrant. U describes what Is to be searched, what methods will he used, w ho will be pre- Page X 2600 Magazine sent, where the searched items will he stored, what time frame in which it will he executed, and the overall goal of what is being sought. S earc h w arra nts a re ret ju i red to be sped lie . Once again, searching for evidence of a con- traband item is different from searching for an actual contraband item. No matter what happens, cooperate with the search. Resisting will onls make your life difficult. If the wan , ml specifically states that equipment will be seized it will have ad- denda's stating e\ n ll\ what will he seized, a description of what 1 to be seized, and what methods will be u l to search. The investi- gators may opt to look through your com- puter on-site but this, is 1 uiher unlikely. If you have the ability, and (he warrant does not a u th ori zc t h . n uv ol \ 1 deo rec ord i n g equipment, i ivak out 1 lie camcorder and record what they do and say. This may be in- valuable c\ idem c 111 proving that an investi- gator ov erst i pp 1 the boundaries of a search warrant;, it wall also prove as a deterrent for them to ovcistcp the warrant at all. As a ci liver 1 you have certain unalienable rights. I kc these rights to your advantage. Freedom ol , ua . h, attorney -client privilege, pri vaev of tlu ele rg y , free d um o f l he pre s s , and, as a, pro', idcr of network services you have more 11 la than just a citizen by the na- ture of the rights ol those who you provide services to f elk examine how these issues provide oh 1 u h s to low enforcement offi- cials who w ish to obtain your shiny new 1 computer. Freedom of Speech and Freedom of the Press: You have the right to speak your mind and publish those thoughts. These are inalien- able rights is a US citizen. Take advantage of these tights ( o incidentally, the Internet hap- pens so he (la most available and affordable method to publish your thoughts. Whether it be your business promotions, or social com- mentary -an, h ,is this article, use it! Update it on a regular basis and make sure il is always available I his is important because if it is never updated 01 only available when you are surfing the w oh, the court may dismiss what you have published as not actually being a publication because ol it being only occa- sionally available Replicate it and make sure that the machines arc available as a web server as often us possible use round-robin DNS to make sure truliie actually goes to all of the machines acting as a web server. Any machine that doesn't act as a server for the dissemination of the information should be used to create the information being dissemi- nated, Keep your web design software, image editing software, word processor, and proof that they have been used in the creation of your intellectual property that you publish Lo the Internet on the machines. Are you curious why this is mentioned in an article on search and seizure? Well, you now have the same statutory protections that a newspaper has in regards to search warrants. By seizing tools you use to publish your opinions, they violate many of your rights. Your First Amendment right mostly. These factors will quite possibly cause a search w r arrant to become more lim- ited in scope and add a likelihood of a time limit upon investigators when removing equipment from your premises. Of course, doing this does absolutely nothing for you if they find you have committed a crime! It will just make them angry, and most likely il w ill come up in court that you purposely tried to use constitutional privilege to prevent inves- tigators from performing their duties. Attorney-Client Privilege: Oh boy! This can make an investigator s life difficult. In- vestigators are required by law lo respect documents that contain private attorney- client privileged information. Essentially they can t confiscate them, read them, use them against you, or disclose them to anyone. In case they believe they may inadvertently g ai n ac cess to s uch i n form at i on . I hey will have to have special exceptions written into the warrant and will have to use an uninter- ested third party to assist in reviewing the in- formation. If the third party notes that it is privileged information, the investigators can- not use it. Now this brings up interesting con- sequences. What if the information being sought in the warrant they are executing is actually contained within these documents'? I don't know what the outcome would be. I make no claim as to w hat the result of a legal battle involving steganography hidden infor- mation in scanned images of privileged infor- mation would be. but I assure you it will be something played out in the courts in the fu- ture. In fact, I expect to see it played out in the media too! Privacy of Clergy and Attorneys: There are special laws involved w r hen law enforce- ment may search computers or records be- longing to lawyers and clergy, 11 you share your computer systems with people in either of these occupations, investigators will have to get special approval in a search. Sen ice Providers (at: when sharing your computer is a good thing!): ISPs, phone com- panies, or anyone providing wire communi- cations to anyone else immediately becomes regulated by the EC PA (Electronic Commu- nications Privacy Act) and the procedures that investigators must use are different. While the folks you provide service to are af- forded less privacy by this act f because Spring 200 1 searches of a third party system do not re- quire a warrant, only a subpoena), you are af- forded more protections and even civil relief in the ease of wrongdoing on the part of an investigator. In short, by executing your rights and pro- viding services to others which allow them to execute their rights you make the likelihood of losing your computers and equipment less likely (assuming that those you provide ser- vice for are law abiding as well ). Mere's a formula for making the seizure of your com- puter systems less likely. Make a deal w ith a small local law firm that you will provide them with free web hosting and e-mail ser- vices in exchange for consultation of how in gain nonprofit status for your weekly /month I y/whate ver Internet-based news publication (e-zine). Scan the docu- ments that you used w r hite conversing w it h your attorney and use steganography in hkl< ihe private keys you use for encryption w i th i n those pri v i 1 eged docu me n i \ Give away as many free e-mail accounts m vnur friends and family as possible and cm umugi them to actively use the accounts Host ,i b site and e-mail for a church. Make sure you take the time to show one of the clergy how to use e-mail. Okay, maybe the Iasi sugges Lion sounds kinda Brady Bunchish but il may be ifie motivation for a judge to deny a search warrant. ni go ahead and say it again despite rec- ognizing that I sound like a broken record: None of this will help you if you have actu- ally committed a crime. Don't use these methods to make investigators' lives more difficult when you are coves mg up a crime. It will reflect poorly on you when you receive sentencing. Besides, if you commit crimes you will most likely end up getting caught re- gardless of what you use your computers to accomplish. Methods Available to Investigators If you arc being investigated For a crime, there is not a w hole lot you can da until you get into a court of 1 aw. According to the law, investigators have a wide variety of Ledi-^fc niques and are allowed to do quite a bit more than you may expect. Let’s look at some of what they can do. Instrumentality of Crime. If some- thing is used during the committing of a crime, it is an instrument of crime. If you use a computer to break into an- other computer then the computer you used is an instrument of the crime. Bul wail - il doesn’t stop there. The net- work you used, the router, the modem, anything that is connected or assists in the function of the system that is the instrument of the crime is considered an in- strumentality as well. This can result in blan- ket seizures of equipment. Generally when searches are conducted against a business, in- vestigators will not seize everything that could be considered an instrumentality. But expect everything computer- related in a search of a private residence to walk out the ilt tor. Thai's just the way it is and the courts support this practice. Once again, our federal gov or i uncut demonstrates that the rights of business are more important than th ose of in- div iihials, GO figure. No knock Warrants. Not Song ago a man v ,i . killed near where I live when the police cxecuU <1 a no- knock warrant at the wrong oiiilrrw The man thought his home was be- ing bioken into and armed himself for de- I i : i he police tilled him with bullets. . kIl I i in die fact i hat I believe this to be a blatant in ini ion of the Fourth Amendment, it i Tin; n»us It puts the lives of law enforce- ment in dan -n md it especially puts the lives ol i mini ui i it Dens at risk. These techniques ■ ilt., i judges si ill approve them. But i in vi s. m the case that the investi- ■,iiii . In Ir ve lh.it \mi may destroy evidence they den i ivquiic i no knock warrant. They can make the determination and just bust the door in without announcing who they are. The land of the free indeed! Sneak and Perk. Welcome to the spy age. The government can t spy on the Soviet com- munist regime anymore, so it has taken to practicing on their ow n citizens. Bugs, wire- taps, keystroke recorders, cameras, and other covert surveillance techniques previously re- served for naiiona! security are now legal and lair game in federal cases. Recently the FBI has used these techniques for capturing key- strokes lor getting PGP keys. One such de- vice < pictured. > connects to the PS/2 port of a computer and looks fairly innoeuous/1 his model is supposed to represent n ferrite coil which disperses electromagnetic fields. This “hug" only stores about 1 20*0(10 keystrokes but there arc smaller devices Iliac can store megabytes worth ol keystrokes. My sugges- tion - if you find one of these on your system, rake it apart and ensure it really is a ferrite coil. If it has anything resembling an inte- grated circuit inside, put it in the microwave for a few seconds and then throw il away, Ann yourself with knowledge. Knowing the law helps us all from becoming victims of both crime and the illegitimate practice of law. Defend yourself. Most of all, if you de- cide to break the law, be prepared for the consequences. Our government no longer is willing to hand out little slaps on the wrist and you can expect to see more extreme measures involved in computer crime. Page 10 2600 Magazine l he t* utuTe of PKI by Elite 158 Public Key Infrastructure, or PKI t is a new system (well, new f to the public) created by the government to ekclrotiicalh idemily yourself. Here I will explain the bask structure of PKL The government uses what’s called High Assurance Smart Cards, a system known as Fortez/a These smart cards arc cki ironic cards made especially for the government fhc cards workers hold con tan th m personal information. Ii has, of course, yom name, your address, credit * aid info. SSN. and the whole works. I he government uses (his system in have authorized workers identify theniscK ■ ■ to m cess classified mater- ial. Basically, clcv ironically identifying yourself is an easy and last way In prove you arc who you say you are Now Forte/ /.i i coming out to the public, but will be known a PKI or Smart Cards. Even though they're nil i ailed Smart Cards, the in- formation will be kept on a more abundant me- dia: the floppy 1 1 I \long with the floppy disk is the laptop fit Mt l A card, and possibly even miniCD These l unis, however, aren’t High As- surance, Instead it s a Medium/Low Assurance, meaning that the most abundant information is used, in sic ul ol pulling in every meticulous de- tail. PKI will be used mostly in banks and on- line. In fuel, there is a very high chance that by the next eld turn in 2004, people will be able to vote through government servers online, using their Smart l ards. It should work just by stick- ing in the disk while on their site. The server will gather the niton nation needed, it will do the hand shake il approved, and your vote will be counted S hese cards frt member that these cards are either the (loppy disks or laptop cards) are given to you by She government. Now I'm not sure what kind of tiles the information is stored on, but it has to be some sort of executable pro- gram. When you open is up. it’ll prompt you for a password. Once typed in and authorized, you have assured yourself that you own that card, You can now use it freely throughout (he Inter- net or wherever the card is applicable. The ap- plication will most likely be run in the background. There is, according to the govern- ment, no way of tampering w ith or editing the information on the Small Card. In fact, to up- date the information (say you moved or changed your phone number), you would have to take it to a facility like a bank. You would give them what you want to up- date and they would change it. These cards are already start- ing to appear. Visa has got a Smart Credit Card out now. It’s a credit card with a microchip on it that contains your personal infor- mation, just as I explained. It comes with its own external port that's plugged into your computer. You just slick it in and it acquires the data. This sort of stuff will be seen more often as time passes by. For right now and not many years ahead, PKI will be voluntary for people to use. Bui it's likely that in the far future, PKI will become mandatory to every one 18 and older. IT 3 1 basi- cally be a new form of ID. the electronic ID. This whole system may sound unreal be- cause, just how hard does the government think it would take for a hacker to break the system? There are possibilities now that could make any hacker become well know n. The potential of people password cracking their own cards and running around claiming to be someone they're not. or hacking the online voting serv ers and getting Nader elected, or even making copies w ith different identities and going wherever they want as whoever they want to be online is remarkahle. In my opinion, this new decade is going to be known as the techno-happy years, where our everyday lives will involve personal usage of technology. Hell, if you think about it, we can already buy our groceries without getting off our asses except n> go to the door and pick up the food. But besides that, PKI is still forming and is still changing. This article was written to give you an idea of what w r e’re in for. Hopefully this new system won't be stupid, hut I have high doubts about that. I hope it leaves opportunities for hackers to learn the structure of it, and even manipulation on it. All in all, 1 hope more peo- ple learn about PKI, I will be trying to get more information on it as it progresses. imdrt . , feE fc i VISA Mr First t 411 123*1 fatjHB mr «* crt/oo v — — - n lAilfTT Km Spring 2001 Page 11 p -ns p fl/y Co® i Vulnerabilities AND ABUSES by L14 PHP is a scripted language pri- marily used with hup servers to cre- ate web sites with dynamic, or changing, content. PHP has many similarities to C and Perl, although it is simplified a bit. This makes PHP a nice language with which to work, since many of the complexities that do not concern web site development are removed. This article will focus on some ol the security issues that I encountered while writing a PHP mailing list and helping people on IRC', Most people I talked to did not even realize that security was an issue, and that how their scripts were eon si rue ted could change how seen re/lam perprool their sites were. The major problem is how vari- ables are passed to PHP from the web browser. Variables and their val- ues are appended to the URL, result- ing in something that looks like this; http: //host/di r/scriptphp ? vari- ed? !e f-s am e va I u e Because the variable names and their values are passed in plain text from the location bar of the browser, the values can easily be changed by the end user to perform different tasks than what the developer origi- nally intended. Some of the possible abuses of this are described below. Since many sites are quite com- plex, and contain scripts that reuse functions, those functions are often put into it standard include file. This means that only one file need be changed to update the entire site. User authentication functions can (and often do) fall into this category. The user is verified once, and there- after a value is passed to tell further scripts that secure content can be ac- cessed, However in sites with both secure and insecure areas, there needs to be a way of deciding whom to authorize. An easy solution is to just pass a variable that specifies ei- i her a secure or insecure mode, de- pending on what is being linked to. The same things may get executed in both modes but that probably doesn't matter. If the mode is secure and the login fails, the script just hails. If the mode is insecure (or the login is valid), the same core features gel ex- ecuted. The problem of course is that after looking through the site for a few minutes, a user may realize that they could avoid having to login by just changing the value of the mode variable. They can find out what it should be by simply checking a sec- tion that does not require authoriza- tion, and find out what the mode value is. Then all they have to do is change it in the location bar of the previous page and reload. For a com- pany that has a large audience for its web site or mailing list, this can pose a severe problem: Anyone could change their site with no tools and very little knowledge. Page 12 2600 Magazine h t tp :// f i os i/d i r/pa ge.p hp ?varf - va l! & va r2 - va 12 & mod e — see (user has to login) h tip ://h os i/di r/page. p / ip ? va r 1 = va 1 1 <£ v a r2 - va 12 & mode -ins (use r doesn't have to login, it's magic!) This can be solved by moving code related to authentication to a separate file. This file is included in- stead of the standard include file in documents considered secure, and if the login is valid, the standard file is included as well. This removes the need for a mode variable; removing control is removed from the end- user. Another problem, identical in its root, is that users can change the val- ues being submitted to make the page work differently. Consider a mailing list; A user visits the page, fills in a form, clicks submit, imme- diately receives an e-mail with a link in it, dicks the link, and is added to the list. If that user is malicious, they may realize that they can fool with the system by changing the URL in the link, perhaps adding someone else to the list. While this is not much of a problem if they do it once, if they write a simple JavaScript and the mailing list only checks to see if users exist before sending the confir- mation e-mail, they can potentially add someone hundreds or thousands of times. If the mailing list only checks to see if users exists before adding them, then the confirmation portion can be abused. The confir- mation section, since it sends e- mails immediately, also lias more potential as a mail bombing utility. While trying to abuse my own mail- ing list software, l managed to send 500 e-mails per minute to my ac- count at university, from a remote computer, using an html/JavaScript file that l wrote at that remote com- puter and opened in IE. If several sites that were vulnerable in this way were found, quite an effective attack could be launched against major servers, with almost no chance of be- ing caught. This is also easily fixed. It should be checked both before confirmation and before adding the user whether a given user already exists. There should also be a database of tempo- rary users, which the user subscrib- ing gets added to until they subscribe. This list can be erased pe- riodically, as people may opt to sign up later, but that time should be at least a week. Alternatively, indexes generated from the e-mail addresses themselves could be included in the URL of the confirmation link, so that the address variable and the index variable must match before the user gets added, or a confirmation mes- sage sent. This removes the need for a temporary database but can still be tampered with, so in my software I just added the extra database. I have found this problem in every PHP based mailing list I have looked at, phis several ASP and Perl ones as well. To find vulnerable lists I simply searched for “mail lists" on Yahoo, and if I could manipulate the URL and send my test e-mail ac- count more than one e-mail, I con- sidered it to be vulnerable to attack. To find and test approximately ten, all on reasonably fast servers, took less than 15 minutes, which I feel makes this a legitimate oversight of PUP developers in particular (and CGI developers in general) to look at how program structure can be exploited. Spring 2001 Page 13 I ^ *1 Breaking the Windows Script Encoder by Mr. Brownstone 'flic Windows Script Encoder ( scrcnc.exe i is ;t Micrnsoti tool that can be used to encode your scripts (i,e,* J Seri pt H ASP pages. VBScript), Yes: encode, noi entry pi i in use of this tool is to prevent people from looting at or modifying your scripts. Microsoft recommends using the Scrip! Encoder Its obfuscate your ASP pages, so in case your server is compromised the hacker would Ik- unable to find out how your ASP applications work. You can download the Windows Script i ncoder at hup // m sdn mien iso ft . com/sc ripling/de fault.htm 7/script - i ng/ v bscri pt/dow nload/ v bsdo w n.hi m The documentation already sav^ the following "Note shut this encoding onl\ prevents < a -.in d rim it tg of \ Page with secret inf or mat ion < SCR I PT LANGUAGE = * JS C*ipt * > This page contains secret information,. < /body > — This is what u looks like after run mug Windows Script Encoder Thtml > < TITLE >Pagie with secret inf oi mat Inti- H fl,K < SCRIPT LANGUAGE = ' r JScript , Bnct x I > * < 3 -// , / /** Start Encode * ♦#(£•-* QwAAAA= ■ Ft u , l M OlJfvFY-J kdO 1 W (n , /t.K; V9P4 -V+aY , / nm . nD 1 v 2 1 " e E ft JOG ■ ‘ « • s q I i A A a A ‘ Pt It; /SCRIPT > ■c BODY? This page contains secret information. As you can see. the