27-Jul-87 17:52:22-PDT,17791;000000000000
Return-Path: <NEUMANN@f4.csl.sri.com>
Received: from csl.csl.sri.com (CSL.SRI.COM) by F4.CSL.SRI.COM with TCP; Mon 27 Jul 87 17:42:36-PDT
Received: from F4.CSL.SRI.COM by csl.csl.sri.com (3.2/4.16)
id AA21529 for RISKS-LIST@f4.csl.sri.com; Mon, 27 Jul 87 17:21:09 PDT
Message-Id: <8707280021.AA21529@csl.csl.sri.com>
Date: Mon 27 Jul 87 17:17:55-PDT
From: RISKS FORUM (Peter G. Neumann -- Coordinator) <RISKS@csl.sri.com>
Subject: RISKS DIGEST 5.18
Sender: NEUMANN@csl.sri.com
To: RISKS-LIST@csl.sri.com
RISKS-LIST: RISKS-FORUM Digest Monday, 27 July 1987 Volume 5 : Issue 18
FORUM ON RISKS TO THE PUBLIC IN COMPUTER SYSTEMS
ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator
Contents:
Its Barcode is NOT worse than its Byte; Rooting for AT&T PC truffles
(Elizabeth Zwicky)
Too much security? (Richard Schooler)
"Hacker Program" -- PC Prankster (Sam Rebelsky)
Pittsburgh credit card hackers (Chris Koenigsberg)
Hacking and Criminal Offenses (David Sherman)
911 Surprises (Paul Fuqua)
Re: Taxes and who pays them (Craig E W)
Statistics as a Fancy Name for Ignorance (Mark S. Day)
Supermarkets (Chris Koenigsberg, Jon Mauney)
The RISKS Forum is moderated. Contributions should be relevant, sound, in good
taste, objective, coherent, concise, nonrepetitious. Diversity is welcome.
Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM.
FTP back issues Vol i Issue j from F4.CSL.SRI.COM:<RISKS>RISKS-i.j.
Volume summaries for each i in max j: (i,j) = (1,46),(2,57),(3,92),(4,97).
----------------------------------------------------------------------
Date: Mon, 27 Jul 87 11:27:38 EDT
From: Elizabeth Zwicky <zwicky@tut.cis.ohio-state.edu>
To: RISKS@csl.sri.com
Subject: Its Barcode is NOT worse than its Byte; Rooting for AT&T PC truffles
Organization: The Ohio State University, CIS Dept.
Two security notes:
First, on the discussion about scanner errors in grocery stores. The chance
that these are actually scanning errors is so small as to be ignorable. The
UPC barcode they use is incredibly reliable, and includes two separate check
digits encoded in different ways. What is very likely to go wrong is the
shelf labels. Usually, the system is that the computer database is updated,
and automatically prints revised shelf labels. There then is a considerable
lag while the labels are actually put on the shelves. Of course, sometimes
they forget to update the database, especially for sales.
Second, on actual computer security. We have 40 AT&T PC7300s that are used
to teach an introductory computing course. We have had notable problems with
them (our current favorite causes students with output loops to end up losing
the lab they're working on, source code and all), but were surprised when
the root passwords started to mutate. One of us asked the monitor in the
lab, who offered to break root for him so he could change it back. It seems
that with two mouse clicks, and two presses of the enter key, you can get a
root shell. There's a bug in the shutdown procedure, causing it to give you
all its warnings, push a root shell (complete with window system that says
"Office of root", just in case you don't know you're root), and then stop.
Most of the students don't know enough about UNIX to make any use of this
trick, but some of them seem to find changing the passwords around amusing.
Elizabeth Zwicky
[Suns reportedly have a similar feature! PGN]
------------------------------
Date: Mon, 27 Jul 87 11:48:12 EDT
From: schooler@inmet.inmet.com (Richard Schooler)
To: risks@csl.sri.com
Subject: Too much security?
A mainframe system that we have occasion to use retires passwords every 28
days and does not allow any of the four previous passwords to be re-used.
Since we use the system mainly for re-hosting (i.e., not "real" work or
personal files), the onerousness of this scheme has driven many of us to
using extremely easy-to-remember passwords on that system, such as the name
of the current month. I find this quite ironic.
Richard Schooler, Intermetrics, Inc. {ihnp4,ima}!inmet!schooler
[This is an old RISKS problem, but worth including for newer readers. PGN]
------------------------------
Date: Mon, 27 Jul 87 11:23:22 cdt
From: Sam Rebelsky <r032@sphinx.uchicago.edu>
To: risks@csl.sri.com
Subject: "Hacker Program" -- PC Prankster
I thought people might be interested in a small article that appeared in
a sidebar of today's Chicago Tribune, Business Section, Monday, 27 July 1987.
"You'd better watch out
A new software program lets anybody with access to an IBM or IBM-compatible
personal computer become a hacker, at least on a small scale. The program,
from Mainland Machine, San Luis Obispo, Calif., is called PC-Prankster.
It wasn't necessarily designed with the idea of making the world a better
place in which to live. An electronic jokester can sneak up and install PC
Prankster on a friend or loved one's ``boot disk,'' (the disk used to fire up
the computer's operating system when it is turned on), whereupon it resides
in memory waiting for its chance to pounce.
As soon as the PC user reaches a certain set number of keystrokes, the
prankster takes over. The work in progress disappears, one of five ugly
creatures fills the screen and blows a kiss, then vanishes, and the screen
returns to where it was before the intrusion. The prank repeats itself
every 5 minutes or so.
Among the characters are a cyclops that blinks and a flasher that flashes.
The only way to get rid of PC-Prankster is to use the delete program
contained on the disk. Or you could drop your PC out the window, timing
it to land on the perpetrator. PC Prankster costs $19.95 and also works
on hard disk systems.
This really bothers me. The article (and the program) imply that fooling
with someone's work on a computer is acceptable and that hacking is just
harmless playing. The article also seems to imply that the program
is otherwise harmless "..and the screen returns to where it was before
the intrustion." I find it unlikely that such a program will be perfectly
harmless in all cases.
I'm sure other people are more qualified to comment on other risks of such
a program, including the similarity of such a program to a trojan horse.
SamR
------------------------------
Date: Sun, 26 Jul 87 23:54:50 edt
From: ckk+@andrew.cmu.edu (Chris Koenigsberg)
To: risks@csl.sri.com
Subject: Pittsburgh credit card hackers
In RISKS 5.16, someone mentioned that a ring of teenaged credit card hackers
was recently broken. What they didn't mention is that the solving of the case
had nothing to do with the computer end of it at all. One of the kids bought
a skateboard with a hot card number, and his mother was so annoyed at his use
of the skateboard that she turned him in!
[The wheels of (mis)fortune! PGN]
------------------------------
Date: Mon, 27 Jul 87 12:36:32 EDT
To: RISKS@csl.sri.com
Subject: Hacking and Criminal Offenses (Re: RISKS 5.15)
From: mnetor!lsuc!dave@seismo.css.gov (David Sherman)
Organization: Law Society of Upper Canada, Toronto
> The dishonest obtaining of access to a computer data bank
> by electronic means is not a criminal offence.
>
>Under the terms of the Act, Gold and Schifreen were charged with "making
>a false instrument on, or in, which information was recorded or stored by
>electronic means, with the intention of using it to induce the Prestel
>computer to accept it as genuine, and by reason of so accepting it to do
>an act to the prejudice of British Telecom plc".
This case is reminiscent of the Supreme Court of Canada decision in
R. v. McLaughlin (1980), 113 DLR(3d) 386-394. In both cases the
authorities attempted to use a statute enacted for other purposes
to prosecute unauthorized computer use.
In the British case, as outlined above, the Act used was one
which makes forgery and counterfeiting illegal. In the Canadian
case, which involved a University of Alberta student obtaining
unauthorized access to a university computer, the charge was that
of fraudulently using a "telecommunication facility", in violate
of s.287 of our Criminal Code. (That provision is the one used
for people who use blue boxes to make long-distance calls.)
The Supreme Court's decision boiled down to this quote (at p. 394):
Had Parliament intended to associate penal consequences the unauthorized
operation of a computer, it no doubt would have done so in a section of
the Criminal Code or other penal statute in which the term which is now
so permanently embedded in our language is employed.
The result was that Parliament did indeed enact legislation making illegal
the unauthorized use of computers (in 1986). It looks like the British
Parliament will have to do the same. In the context of the quote above, the
decision of the English Court of Appeal is probably correct. I'll be
interested in seeing whether the Court of Appeal referred to the (Canadian)
McLaughlin case.
David Sherman, The Law Society of Upper Canada, Toronto
{ uunet!mnetor pyramid!utai decvax!utcsri ihnp4!utzoo } !lsuc!dave
------------------------------
Date: Mon, 27 Jul 87 14:30:54 CDT
From: Paul Fuqua <pf%islington-terrace%ti-csl.csnet@RELAY.CS.NET>
To: risks@csl.sri.com, telecom@XX.LCS.MIT.EDU
Subject: 911 Surprises
Tarrant County (Fort Worth) is about to start a 911 emergency telephone
service, the second in the state, prompting quite a few newspaper articles
about aspects of their service and that of Harris County (Houston), which
started in January 1986.
The details I found most interesting were the problems that had to be
overcome in both systems. (Quoted without permission from the Dallas Morning
News)
For instance, Harris County found initially that people dialing a
seven-digit number with 911 in it would sometimes reach the emergency
operator by mistake. Telephone company computers were so quick, they
would pick up the 911 and transfer the call before waiting for a fourth
digit. [There are no other magic three-digit calls in this area: for
411, one dials 1411, and all other numbers are seven digits. - pf] ...
In the beginning, 911 operators were deluged by calls from children
trying out the system and from people who put the 911 number on the
speed-dialing function on their telephones and hit the number by mistake.
Misdirected calls also come in from cordless phones whose batteries are
low -- a situation that seems to mistakenly trigger calls to 911 ...
Another problem Tarrant County is working on is establishing street
addresses for rural homes. The [911] district is working with the U.S.
Postal Service and telephone companies to assign street addresses to more
than 9,000 locations in Tarrant County so that a recognizable address
will appear on the screen -- not just a rural route and box number.
[The director] was surprised when the effort met some resistance. ...
"Some people have said, `I'm not going to use 911 so I don't need my
address changed.'"
Tarrant County will start up their system on August 2, despite the failure
of equipment to automatically transfer the address information from the
emergency operator to the appropriate agency. Dallas County (Dallas)
expects to start their own service next April; the goal is that the whole
state will have 911 by 1995.
Paul Fuqua, Texas Instruments Computer Science Center, Dallas, Texas
CSNet: pf@ti-csl UUCP: {smu, texsun, im4u, rice}!ti-csl!pf
------------------------------
To: RISKS@csl.sri.com (RISKS FORUM, Peter G. Neumann -- Coordinator)
Subject: Re: Taxes and who pays them (RISKS DIGEST 5.15)
Date: Mon, 27 Jul 87 11:19:18 PDT
From: cew@venera.isi.edu
This idea of "passing it on" is nonsense. A Company, or any organization
selling a product or service, will charge as much as it can for its product
or service. It does not matter how much the product costs them or how much
it is taxed or how much of the external costs are forcibly internalized by
regulations. The question is simply "Does the amount received sufficiently
cover the cost of production to justify the organization continuing the
process?" If the profit is too small or non-existent then the process is
halted. If the profit is great, others will get into the act.
For the topic that came up in Risks, the question is "How will the companies
providing electronic communications services respond to the added costs of
FCC taxes?" Some possible responses are (1) absorb them (not bloody
likely), (2) Add them to the price for the service (not a "passing on" but a
shift in customer base), (3) Absorb them for a while and add them slowly to
see how the customers react and (4) Get the FCC changed.
In my view, the key result of this will be to shift the customer base away
from private individuals to corporate individuals (corporations can more
easily add the extra costs to their products). My question is then "Why is
the FCC using its taxing privileges to manipulate the electronic
communications market to force out the private individual?" That leads us
away from the risks of computers to risks of another kind.
(If people want to argue this view of economics they should send mail to me
directly. No need to clutter Risks with these more general questions.)
Craig
------------------------------
Date: Mon 27 Jul 87 13:32:55-EDT
From: Mark S. Day <MDAY@XX.LCS.MIT.EDU>
Subject: Statistics as a Fancy Name for Ignorance
To: RISKS@csl.sri.com
The risk-assessment numbers put forth to justify nuclear power's safety
remind me of Mark Twain's observation that there are three kinds of lies:
lies, damned lies, and statistics. What real evidence or experience do we
have for these projections and statistics? How can we meaningfully discuss
the "safe" containment of wastes that are dangerous for a time span
comparable to all of recorded history so far? How much do we really know,
and how much of it is based on "plausible" guesses and conjectures?
The fact that nuclear power plants have been run in a generally safe way in
the past tells me very little about the future danger from them. Predicting
the future like that is similar to the statistical fallacy that if a fair
coin has come up "heads" 500 times in a row, it is somehow "more likely" to
come up "heads" the next time that I flip it. [Alternately, some people also
believe that it's "more likely" to come up "tails", since it's "about time".]
Car wrecks and cigarette smoking kill more people than nuclear plants, sure,
but the way that they kill people is very different. Car accidents
generally don't affect a zone of several miles' diameter, forcing evacuation
and abandonment of homes. Cars and cigarette smoke are perceptible, whereas
radiation isn't (I know that carbon monoxide is odorless and colorless, but
you rarely get carbon monoxide from cars or cigarettes without smelly
components, too.). Chernobyl has shown that when an accident occurs, it
doesn't matter that it's a rare event: it's an extremely unpleasant event.
Who cares if a meltdown happens "once in 100,000 years" if it happens
tomorrow? It is perfectly rational to decide that a potential catastrophe
is undesirable, no matter how rare it is.
--Mark
------------------------------
Date: Sun, 26 Jul 87 23:59:38 edt
From: ckk+@andrew.cmu.edu (Chris Koenigsberg)
To: risks@csl.sri.com
Subject: Supermarkets
The Giant Eagle chain of supermarkets in western Pennsylvania has automated
checkout scanners at the bigger stores. But they also have a policy they call
Absolute Minimum Pricing, and as a part of this, they have a strict rule that
you can be ejected from the supermarket if you are caught writing down their
prices from the tags on the shelves (because they want to keep the jump on
the competition)! So I suppose very few people ever manage to catch scanner
price errors at Giant Eagles.
[This is an interesting new twist. PGN]
------------------------------
Date: Mon, 27 Jul 87 09:54:45 EDT
From: mauney@ece-csc.ncsu.edu (Jon Mauney)
To: risks@csl.sri.com
Subject: Grocery store scanners and shelf tags
Re: Cash register prices not agreeing with shelf tags
Don't forget the Hi-Tech creed:
What is fouled up by technology can be fixed by further technological patches.
In the case of computerized cash registers, help is on the way in the form
of radio-updated LCD shelf tags. (This is according to an article in last
week's Sunday News and Observer. I can dig it out, but it is unlikely to
contain any useful facts.)
Of course, this will bring two new risks:
The price may go up while you're waiting in line.
The tags may be affected by teenage vandals who have gotten
bored with breaking into computers.
Jon Mauney
[Recalling the students who spliced themselves into the comm line to the
Rose Bowl scoreboard and took over the display, we can certainly look forward
to someone changing the prices downward just before checking out. PGN]
------------------------------
End of RISKS-FORUM Digest
************************
-------