Computer underground Digest Sun May 17, 1992 Volume 4 : Issue 22
Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
Associate Editor: Etaion Shrdlu, Jr.
Arcmeisters: Brendan Kehoe and Bob Kusumoto
CONTENTS, #4.22 (May 17, 1992)
File 1--Some Corrections to '90 Bust Story in CuD 4.21
File 2--The Defense of Entrapment (Reprint)
File 3--COCOTS and the Salvation Army (Follow-up)
File 4--Chaos Computer Club France's hackers bibliography
Issues of CuD can be found in the Usenet alt.society.cu-digest news
group, on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of LAWSIG,
and DL0 and DL12 of TELECOM, on Genie in the PF*NPC RT libraries, on
the PC-EXEC BBS at (414) 789-4210, and by anonymous ftp from
ftp.eff.org (192.88.144.4), chsun1.spc.uchicago.edu, and
ftp.ee.mu.oz.au. To use the U. of Chicago email server, send mail
with the subject "help" (without the quotes) to
archive-server@chsun1.spc.uchicago.edu. European distributor: ComNet
in Luxembourg BBS (++352) 466893.
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views. CuD material may be reprinted as long as the source
is cited. Some authors do copyright their material, and they should
be contacted for reprint permission. It is assumed that non-personal
mail to the moderators may be reprinted unless otherwise specified.
Readers are encouraged to submit reasoned articles relating to
computer culture and communication. Articles are preferred to short
responses. Please avoid quoting previous posts unless absolutely
necessary.
DISCLAIMER: The views represented herein do not necessarily represent
the views of the moderators. Digest contributors assume all
responsibility for ensuring that articles submitted do not
violate copyright protections.
----------------------------------------------------------------------
Date: Tue, 12 May 92 01:14:12 CST
From: anonymous@anon.edu
Subject: File 1--Some Corrections to '90 Bust Story in CuD 4.21
The following clarifications should be noted in reference to the
article in Cu Digest, #4.21, in the Steve Jackson Games section:
>In July of 1989, Secret Service agents were examining electronic
>mail records of a privately-owned computer system in Illinois
>owned by Rich Andrews. Those records, which contained the
>computer equivalent of a list of all mail sent through a
>particular post office, showed that a copy of a newsletter called
>"Phrack" had been sent to Loyd Blankenship, the managing editor
>at Steve Jackson Games, Loyd Blankenship, in late February of
>1989.
Actually, the records showed that Loyd Blankenship *sent* a copy of
Phrack 24 to someone on Jolnet. He received his own copy directly
from Craig. The source was not Jolnet.
>1/90: Bell Communications Research security manager Henry M.
>Kluepfel dials into Loyd Blankenship's home BBS, the Phoenix
>Project, under his real name.
Mr. Kluepfel was never on Phoenix Project under his real name,
according to userlogs from the day the system was taken down. He
certainly would have been *welcome* on -- The Phoenix Project had
several phone security officers and law enforcement agents already.
CuD moderators reportedly possess userlogs from TPP during its
history and can verify that there is no "Kluepfel" among the users on
any of those logs.
>2/90: Search warrants are given for the residences of Bob Izenberg
>(2/20), Loyd Blankenship (2/28) and Chris Goggans (2/28), and at
>the office of Steve Jackson Games (2/28). The SJG warrant is
>unsigned; the other warrants are signed by U.S. Magistrate
>Stephen H. Capelle on the day that they're served.
Bob Izenberg was raided in 2/90. Goggans, Loyd Blankenship and SJG
were raided in 3/90. The warrant for Loyd was also unsigned, as was
(if previous reports are correct) the warrant for Chris.
>Three hours after the raid at another, Secret Service agents have
>called Austin computer store owner Rick Wallingford at home, to
>verify that he sold a pinball machine to one of the warrant
>subjects.
It was a PacMan machine.
>CHRIS GOGGANS: Former employee of Steve Jackson Games.
>Unavailable for comment.
Chris Goggans was never an employee of Steve Jackson Games.
These may seem trivial corrections, but because of the rumors and
inaccurate information about the case and its particulars, we should
assure that even minor details are correct.
------------------------------
Date: 10 May 92 20:48:10 EDT
From: Gordon Meyer <72307.1502@COMPUSERVE.COM>
Subject: File 2--The Defense of Entrapment (Reprint)
The Defense of Entrapment
As it Applies to Bulletin Board System Operators
By Randy B. Singer, Esq.
For now, it is unclear how the law applies to protect speech
communicated through electronic bulletin boards. There are hundreds,
maybe thousands, of enthusiast-run bulletin boards across the country
provided for the free use of the public to exchange ideas and publicly
distributable software. The system operators of these bulletin boards
are providing a wonderful public service, out of the goodness of their
hearts, usually for no monetary gain (in fact, often at a considerable
loss). These sysops cannot afford to fall into a gray area of the law
and find themselves having to defend an expensive criminal suit or
having to do without their computer equipment because it has been
confiscated by the police as evidence.
Running a public bulletin board can expose a system operator (sysop)
to all sorts of legal problems that have yet to be adequately defined.
For instance: What happens if one user posts slanderous/libelous
information about another user? Is the sysop liable? Is a bulletin
board more like a newspaper in this regard or is it more like a
meeting hall? What happens if a user uploads something clearly
illegal, like child pornography, which other users download before the
sysop has a chance to review the material? Is the sysop liable? What
is the liability of the sysop if he runs a bulletin board in his/her
back room and he/she almost never monitors the activity on it? Is the
sysop required to constantly monitor the goings-on on their board to
prevent illegal activity?
It is therefore understandable that sysops have tried to protect
themselves legally the best that they have known how. Unfortunately,
there has been a lot of misinformation spread about what the law is
and how it pertains to the community of bulletin board users and
operators. Hopefully this text file will clear up one of the most
common legal misconceptions that is going around.
I have often seen posts that evidence a complete misunderstanding of
what constitutes the defense of entrapment. As an attorney I would
like to explain this law and its application, especially as it
pertains to electronic bulletin board operators.
Entrapment is a complete defense to a crime that a person has been
charged with. It varies in how it is interpreted in each state, and on
the federal level, but generally it is as I have defined it here.
Entrapment only exists when the crime involved is the creative product
of the police. (That is, the idea to commit this crime came from a
police officer, or an agent of the police. The alleged criminal never
would have thought of committing this crime if it hadn't been
suggested to him by the police, or if the means to commit the crime
had not been offered to the alleged criminal by the police.) AND the
accused was not otherwise predisposed to commit the crime involved.
(That is, the accused probably wouldn't have committed this or any
other similar crime if the police had never been involved.) BOTH
elements must exist for the defense of entrapment to apply.
For instance: When John DeLorean, owner of the (then about to fail)
DeLorean Motor Company, was arrested and tried for selling cocaine, he
was found not guilty by reason of the defense of entrapment because,
the jury determined, the police took advantage of the fact that his
failing company made him a desperate individual. The police sent in an
undercover officer to offer him a bag of cocaine to sell to raise
money to save his company. The entire idea for the crime came from the
police; they provided the instrumentality (the coke); and John
DeLorean probably would never in his life have sold drugs to anybody
if the police hadn't shown up to offer him the drugs to sell at the
exact right time.
The reason for the law is obvious: we don't want the police setting up
desperate people to get busted just because those people are
unfortunate enough to find themselves in desperate situations. In
fact, we don't want the cops to set up any law abiding citizens, even
if they are not desperate. Tempting people who would not ordinarily
commit a crime is not what we want police officers to do.
Now that you have the definition of entrapment, let's talk about what
entrapment is NOT. I've read a lot of posts from people on boards who
think that entrapment exists when a police officer goes undercover and
does not reveal his true identity when asked. This is NOT covered by
the defense of entrapment per se. The defense of entrapment does NOT
require a police officer to reveal himself when asked. Going
undercover is something that the police do all the time, and there is
nothing that prohibits them from doing so.
If you are predisposed to commit a crime (e.g., you are already
engaged in illegal activity before an undercover police officer comes
on the scene), and an undercover police officer simply gathers
evidence to convict you, the defense of entrapment does not apply.
So, for instance, if an undercover police officer logs onto a bulletin
board and lies and says that he/she is not a police officer when
asked, and he/she finds illegal material or goings-on on this bulletin
board, then whatever he/she collects and produces against the system
operator as evidence towards a criminal conviction is not precluded
from being used against the sysop in court. At least it is not
excluded by the defense of entrapment, because in this instance the
defense of entrapment does not apply. The police officer is allowed to
act undercover, and the illegal acts were not the creative product of
the police.
Also remember that the defense of entrapment is a COMPLETE defense.
So it does not act to exclude evidence, but rather it acts towards one
of three things: having a grand jury find that there is not sufficient
evidence that a conviction could be obtained to proceed to a criminal
trial against the sysop; having the case dismissed before trial; or a
finding of 'not guilty' after a criminal trial.
The defense of entrapment also doesn't necessarily apply if the police
officer simply asks the system operator to do something illegal and he
does it. In this case the district attorney would argue that the sysop
was predisposed to commit the illegal act, especially if the illegal
act was already going on in one form or another on the board. For
instance, if the police officer asks the sysop to download to him some
commercial software, the defense of entrapment will not apply if there
is already commercial software available in the files section of the
bulletin board.
What would probably be required for the defense of entrapment to apply
would be for the police officer to have enticed or misled the system
operator into doing the illegal act, and it would have had to have
been an illegal act that wasn't already going on on this bulletin
board. This MAY allow the use of the defense of entrapment. I say
"may" because it depends on the facts in each individual situation to
see how closely they meet the requirements for the defense of
entrapment to apply. You may surmise from my reticence to commit to
saying that the defense of entrapment definitely WOULD apply that the
defense of entrapment is not a defense that I recommend that you rely
on.
I've seen some bulletin boards say something to this effect in their
logon screen: "Access restricted. Police officers must identify
themselves, and are forbidden from gaining entry to this bulletin
board." This type of message not only does not protect a bulletin
board from the police (assuming that there is something that might be
interpreted as illegal going on on this board), but it actually alerts
any police officer who may casually log on to this board to
immediately suspect the worst about this board and its system
operator. There is nothing that I know of that would keep an agent of
the police from lying about his/her status and logging on as a new
user and gathering evidence to use against the sysop. In fact, I'm
not sure, but I would not be surprised to find in the current legal
climate that such a logon message is enough evidence to get a search
warrant to seize the computer equipment of the system operator of this
bulletin board to search for evidence of illegal activity!
At some future date I hope to write a file that will detail how sysops
can protect themselves from legal liability. (That is, by avoiding
participating in arguably illegal activity, and by avoiding liability
for the uncontrollable illegal acts of others. I have no interest in
telling sysops how to engage in illegal acts and not get caught.) But
for now, I hope that this file will give sysops a better understanding
of the law and how one aspect of it applies to them.
Disclaimer: The information provided in this document is not to be
considered legal advice that you can rely upon. This information is
provided solely for the purpose of making you aware of the issues and
should be utilized solely as a starting point to decide which issues
you must research to determine your particular legal status, exposure,
and requirements, and to help you to intelligently consult with an
attorney. No warrantees, express or implied, are provided in
connection with the information provided in this document. This
document is provided as is, and the reader uses the information
provided here at their own risk.
(Sorry for the necessity of covering my behind! Just remember, you get
what you pay for, so I cannot guarantee anything I have written here.
If you want legal advice that you can take to the bank, you should
hire an attorney. Besides, just like everyone these days, we need the
work!)
About the Author:
Randy B. Singer is an attorney in the San Francisco bay area. He does
business law, personal injury, computer law, and Macintosh consulting. He
also gives seminars at the Apple offices in downtown San Francisco for
attorneys and others who are interested in learning about the Macintosh
computer. He can be reached at 788-21st Avenue, San Francisco, CA 94121;
(415) 668-5445.
Copyright (C) 1992 Randy B. Singer. All rights reserved. This document
may be freely distributed as long as it is not for monetary gain or as
part of any package for sale. This work may not be modified in any way,
condensed, quoted, abstracted or incorporated into any other work, without
the author's express written permission.
This reprint taken from ST Report #8.19, used with permission
------------------------------
Date: Fri, 15 May 92 16:41:38 CST
From: moderators <tk0jut2@mvs.cso.niu.edu>
Subject: File 3--COCOTS and the Salvation Army (Follow-up)
In Cu Digest 4.20, we related the problems of a COCOT (Coin-operated,
Customer-owned Telephone) installed at the Salvation Army Freedom
Center in Chicago. In brief, The SAFC, a community release center for
recently-released state and federal prisoners, had installed COCOTS
that were charging prisoners, who generally come from low-income
populations, significantly higher rates than conventional carriers.
The COCOTS utilize long distance carriers that are demonstrably not in
compliance with federal law (PL 101-435). In the next issue, we will
provide a follow-up to the lack of responsiveness of the carriers
(U.S. Long Distance) and the billing agents (Zeroplus Dialing and
GTE). This note summarizes the response of the Salvation Army, which
was the only organization that took the problem seriously and acted
upon it.
When we summarized events in 4.20, we had been unable to obtain
consistent information from the telecos because of multiple layers of
billing accountability and significant contradictions in information
that we were given. We were also, at that time, unable to reach
anybody at the SAFC who could provide us with information. So, we
expressed our frustration by raising questions that we would have
asked SAFC officials. Since then, we have talked with several SAFC
personnel, and without exception they were deeply concerned about the
problem. They had received numerous complaints from ex-offender
customers about the technical service of the COCOTS, but they were not
aware of the long distance tolls until we brought it to their
attention. They emphasized that it was neither their intent nor their
practice to profit from telephone services. The information they
provided supports their community reputation as a viable and dedicated
organization committed to helping ex-offenders return to the
community. In response to our questions, we were told the following:
The SAFC *does not* itself own the COCOTS, and the COCOTS there are
fairly new. The Salvation Army recently signed a contract with a
company that promised to deliver services identical to the previous
system, Illinois Bell, at no extra cost to the users. The SAFC signed
a contract when told they would receive a better commission with equal
service and no increased rates. Some sources indicated that the COCOT
phones did not, in fact, provide better service, and there was some
concern expressed by ex-offenders and others that the COCOT was, in
fact, *more expensive* for users than the previous carrier. Our own
experience suggested that, for long distance rates at least, this
complaint has substance.
The SAFC center does receive a monetary return from COCOT use. The
return is accumulated for the residents' benefit fund. This fund is
used to replace equipment, provide amenities (such as tv sets),
defray costs for special events such as the annual Christas part, and
provide modest resources for indigent prisoners in emergencies. The
profits from the COCOT are ultimately returned directly to the
prisoners, and the SAFC itself does not profit.
SAFC personell emphasized that there are still alternative (RBOC)
telephones available, and at least one telephone is available at no
charge for important calls such as obtaining job interviews.
Because the SAFC is bound by contract to their current COCOT owner,
they are not sure of their options for the long run. Over the short
run, however, they indicated that they will address the problem in two
ways. First, they will discuss the problems with the owner and attempt
to assure that the terms of the contract--equal service at no higher
costs--are met. Second, they will emphasize "consumer literacy" and
assure that their clients are aware of the differences in especially
long distance rates between the various long distance service
providers and explain that users are legally entitled to place calls
to alternative carriers if the one to which they initially connect is
not to their liking. We have sent them a copy of PL 101-435 to assist
them in their discussions with the COCOT owner and to provide their
consumers with adequate information.
We commend the SAFC for its handling of the situation. Salvation Army
officials were concerned that our previous post would communicate
erroneous information about the nature of the SAFC and its operation.
Both they, and others, affirmed that the SAFC is a successful,
exceptionally beneficial, and highly reputable program with only one
end in mind: To help ex-offenders. If our previous remarks were
excessively strident, we apologize. They have displayed both honor
and initiative in protecting prisoners from exploitation, and we thank
them for their concern. It is unfortunate that GTE, USLD, and Zeroplus
cannot follow their example.
------------------------------
Date: Wed, 6 May 92 07:27 GMT
From: Jean-Bernard Condat <0005013469@MCIMAIL.COM>
Subject: File 4--Chaos Computer Club France's hackers bibliography
Enclosed one bibliography that all the CCCF's members read all the
time in France...
Sincerely yours,
Jean-Bernard Condat
Chaos Computer Club France [CCCF]
B.P. 8005
69351 Lyon Cedex 08, France
Phone: +33 1 47 87 40 83, Fax.: +33 1 47 87 70 70.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
File x: Chaos Computer Club France's hackers bibliography
Nelson, B. [Univ. of Southern California, Los Angeles, CA, USA]:
"Straining the capacity of the law: the idea of computer crime in
the age of the computer worm
In: Computer/Law Journal (April 1991) vol.11, no.2, pp.299-321
Considers whether traditional justifications for the
criminalization of conduct are adequate to encompass new forms of
'criminal' behavior arising out of advanced computer technology.
Describes the reactions of legislator, computer designers and
users, and members of the general public who have opposed Robert
Tappan Morris's trial a nd conviction. Two prominent and
competing theories, retribution and utilitarianism,are useful in
helping understand the conflict between two sets of social values:
those we seek to protect by means of a criminal justice system and
those associated with the basic principles of freedom. Nonetheless,
neither traditional retributive nor utilitarian theory provides a
clear justification for the imposition of
criminal punishment in the case of the 'crime' that Morris committed when
he introduced the Internet worm. (61 Refs)
Spafford, E.H.[Dept. of Comput. Sci., Purdue Univ., West Lafayette, IN,
USA]: "Are computer hacker break-ins ethical?"
In: Journal of Systems and Software (Jan. 1992) vol.17, no.1; pp.41-7
Recent incidents of unauthorized computer intrusion have brought about
discussion of the ethics of breaking into computers. Some individuals have
argued that as long as no significant damage results, break-ins may serve a
useful purpose. Others counter that the break-ins are almost always harmful
and wrong. This article lists and refutes many of the reasons given to
justify computer intrusions. It is the author's contention that break-ins
are ethical only in extreme situations, such as a life-critical emergency.
The article also discusses why no break-in is 'harmless'. (17 Refs)
Kluepfel, H.M.: "In search of the cuckoo's nest-an auditing framework for
evaluating the security of open networks"
In: EDP Auditor Journal (1991) vol.3; pp.36-48
In Clifford Stoll's best-selling book "The Cuckoo's Egg" he describes the
pursuit of a computer hacker who, like the cuckoo, left something in the
computing nests of other users. The paper provides a perspective on
auditing networked systems to find the nest which may have an extra 'egg'
in it or is inviting one because of a breakdown in security design or
practice. It focuses on: the security implications for an increasingly
open network architecture; the lessons learned from performing intrusion
post-mortems; the need for architecture plans and systems engineering
for security; an audit framework for evaluating security. (26 Refs)
Raymond, E.S.: "New Hacker's dictionary"
Publisher: MIT Press, London, UK (1991); xx+433 pp.
From ack to zorch (and with hundreds of other entries in between) The New
acker's Dictionary is a compendium of the remarkable slang used by today's
computer hackers. Although it is organized in reference form, it is not
a mere technical dictionary or a dry handbook of terms; rather, it offers
the reader a tour of hackerdom's myths, heroes, folk epics, in-jokes
taboos, and dreams-an unveiling of the continent-spanning electronic
communities that knit hackers together.Appendixes include a selection of
classic items of hacker folklore and humor, a composite portrait of 'J.
Random Hacker' assembled from the comments of over one hundred respondents,
and a bibliography of nontechnical works that have either influenced
or described the hacker culture. (12 Refs)
Arnold, A.G.; Roe, R.A.[Dept. of Philosophy & Tech. Social Sci., Delft Univ
of Technol., Netherlands]: "Action facilitation; a theoretical concept and
its use in user interface design"
In: Work With Computers: Organizational, Management, Stress and Health
Aspects. Proceedings of the Third Conference on Human-Computer Interaction.
Vol.1, pp.191-9
Editor(s): Smith, M.J.; Salvendy, G.; Elsevier, Amsterdam; xii+698 pp.
The concept of action facilitation, derived from Hacker's theory of
goal-directed action, can be defined as an improvement or maintenance
of performance under conditions of decreasing mental and/or physical
effort. This concept applies to any kind of work, including work with
computers. A method for operationalizing this concept in the context of
human-computer interaction is discussed, and it is shown how this method
can be applied to the evaluation and design of user interfaces for office
systems. (20 Refs)
Menkus, B.: "'Hackers': know the adversary"
In: Computers & Security (Aug. 1991) vol.10, no.5; pp.405-9
Abstract: Confusion appears to continue among many of those concerned
about computer security about who hackers are, what they do and why they
are doing it. The author clarifies some of the terms, concepts, and motives
involved in the hacker phenomenon. The author discusses the hackers'
objectives and their methods. He discusses some of the problems that need
to be resolved to in order to tackle hackers' activities. Implementing an
effective counter hacker strategy rests on the recognition that access to
information is only granted to aid in tasks of value to the organizatio
and that an organizatio does have the right to own and use legitimate
information. He concludes that three tactics should be employed: initiation
of active lobbying by the targets of hacker activity; improved personnel
attribute verification on access; and tracing system use activity on a
real-time basis. (3 Refs)
Cook, W.J.: "Costly callers: prosecuting voice mail fraud"
In: Security Management (July 1991) vol.35, no.7; pp.40-5
Abstract: On August 17, 1990, Leslie Lynne Doucette was sentenced to 27
months in prison. Her sentence, one of the most severe ever given to a
computer hacker in the United States, was based on her role as the head of
a nationwide voice mail computer fraud scheme and her unauthorized
possession of 481 access codes as part of that scheme. Evidence developed
during the investigation and disclosed in pretrial proceedings, revealed
that the case was part of a broader trend toward voice mail computer abuse
by hackers. This article examines the telecommunication technology involved
and the ways computer hackers use and abuse that technology, and it
summarizes the investigation that led to Doucette's conviction and the
convictions of other hackers in her group.
Myong, A.M.; Forcht, K.A.[James Madison Univ., Harrisonburg, VA, USA]: "The
computer hacker: friend or foe?"
In: Journal of Computer Information Systems (Winter 1990-1991) vol.31,
no.2; pp.47-9
Abstract: To most people, the hacker seems somewhat harmless but the
reality is quite the contrary. Quite often, extremely sensitive data is
accessed by hackers and tampering of any kind can cause irreversible
damage. Although this situation is causing great concern, the hacker is not
seen as the hardened criminal, and laws dealing with this kind of
'technological trespass' poses the question: 'is the hacker a friend or
foe?' Obviously, these hackers violate the security and privacy of many
individuals, but by doing so, vulnerabilities in the systems are showcased,
alerting the need for increased security. Paradoxically, by committing
computer crimes, these 'hackers' could be doing society an indirect favor.
The authors give a profile of a hacker and explain how some users and
systems make it easy for one to break into their system. Various actual
hacks are also presented. (13 Refs)
Koseki, J.: "Security measures for information and communication networks"
In: Data Communication and Processing, (1991) vol.22, no.4; pp.38-46
Abstract: The causes of interruptions of the information/communication
system can be classified roughly into accidents and crime. The factors of
disturbing system operations include reduction of system functions due to
traffic congestion. While accidents occur due to unexpected natural
phenomena or human errors, crimes are failures based on intentional human
behavior, unjust utilization and destruction of the system involving the
hacker and computer virus. In order to complete the security for
information and communication networks and eliminate the risk of accidents
and crime, it is necessary to improve system functions and take harmonious
measures viewed from human and legal factors as well as a technological
standpoint.
Zajac, B.P., Jr.[ABC Rail Corp. Chicago, IL, USA]: "Interview with Clifford
Stoll (computer crime)"
In: Computers & Security (Nov. 1990) vol.9, no.7; pp.601-3
Abstract: Concerns the trials of Clifford Stoll, tracking a hacker that
was looking for US military information and then trying to convince the
Federal Bureau of Investigation that he had an international computer spy
on his hands. As the system manager, he was to track down a $0.75
discrepancy in one of the accounting systems. In his quest Stoll discovered
that this was not the simple theft of some computer time but was something
far greater-international computer espionage aimed at US military
computers.
"IT security"
In: Wharton Report (Aug. 1990) no.144; pp.1-8
Abstract: As our reliance on computer systems increases so too does the
risk of data loss. A computer can be insecure in many ways: a clever
hacker, a virus, a careless employee or a vandal can steal, destroy, alter
or read data with relative ease. In addition to this, the proliferation of
networks and the increasing number of tasks given over to a company's
central computer have, while helping us achieve higher degrees of output,
made our data even more insecure. The trend towards open systems will also
bring us security problems.
Schneider, E.W.[Peacham Pedagogics, Madison, NJ, USA]: "Progress and the
hacker ethic (in educational computing)"
In: Educational Technology (Aug. 1990) vol.30, no.8; pp.52-6
Abstract: A hacker is someone who writes clever code on a small machine
in something very close to machine language so that the small machine does
things that would be impressive on a big time-sharing machine.
Microcomputers were introduced into schools by teachers who were also
electronic hobbyists. Some of these teachers went on to learn programming,
becoming true hackers. Due to unprecedented demand from industry, true
hackers in education are an extinct species. Other teachers developed
skills in keeping the machine running, and ordering the latest and
greatest; they form a group that is peculiar to education: the
pseudo-hackers. Most computer applications in higher education have adopted
a hacker ethic. They act as if educational research and medical research
used the same way of determining needs, funding, and performing research,
and disseminating the results. They expect teachers to be as motivated as
doctors, learning about the latest techniques and adopting them as quickly
as possible. That may well be the way it ought to be, but that certainly
isn't the way that it is.
Cook, W.J.: Uncovering the mystery of Shadowhawk
In: Security Management (May 1990) vol.34, no.5; pp.26-32
Abstract: How can a juvenile infiltrate some of the country's most
classified and secured datafiles? Easy-with his home PC. On February 14,
1989, a hacker was sentenced to nine months in prison, to be followed by
two and a half years' probation, and was ordered to pay restitution
totaling $10000. On February 28, 1989, he started serving his prison term
in a prison in South Dakota. If the hacker had been 18 when he committed
these crimes, he would have faced a possible 13-year prison sentence and
fines totaling $800000. Facts developed during a one-week trial established
that between July and September 1987, the hacker, under the code name
Shadowhawk, used a modem on his home computer to gain unauthorized remote
access to AT&T computers in Illinois, New Jersey, North Carolina, and
Georgia and stole copies of copyrighted AT&T source code worth over
$1,120,000. (7 Refs)
Greenleaf, G.: "Computers and crime-the hacker's new rules"
In: Computer Law and Security Report (July-Aug. 1990) vol.6, no.2; p.21-2
Abstract: The author reflects on the international response to the case
of Robert Morris, a US hacker. He looks at recent Australian legislation on
computer crime and some legal definitions from England.
Kluepfel, H.M. [Bellcore, Morristown, NJ, USA]: Foiling the wily hacker:
more than analysis and containment
Conference Title: Proceedings. 3-5 Oct. 1989 International Carnahan Conf.
Security Technology; pp.15-21
Publisher: ETH Zentrum-KT, Zurich, Switzerland; 1989; 316 pp.
Abstract: The author looks at the methods and tools used by system
intruders. He analyzes the development of the hacker, his motivation, his
environment, and the tools used for system intrusion. He probes the nature
of the vulnerable networking environments that are the target of
intrusions. The author addresses how to turn the tables on these intruders
with their own tools and techniques. He points out that there are many
opportunities to learn from the intruders and design that knowledge into
defensive solutions for securing computer-based systems. The author then
presents a strategy to defend and thwart such intrusions. (16 Refs)
Dehnad, K. [Columbia Univ., New York, NY, USA] : "A simple way of improving
the login security"
In: Computers & Security (Nov. 1989) vol.8, no.7; pp.607-11
Abstract: The login procedure is formulated as a test of hypothesis. The
formulation is used to show that the commonly used procedure provides
valuable information to a hacker which enables him to use trial and error
to gain access to a computer system. A general method for reducing this
information is described and its properties studied. The method introduces
randomness into the procedure, thus denying a hacker the luxury of trial
and error. (6 Refs)
Earley, J.: "Supplier's view-considering dial-up (hacker prevention)"
In: Computer Fraud & Security Bull. (Oct. 1989) vol.11, no.12; pp.15-18
Abstract: Discusses the practicalities of hacker prevention. Password
protection, data encryption algorithms and the combination of data
encryption and access control are briefly considered. The Horatius access
control system and Challenge Personal Authenticator are discussed.
Lubich, H.P.: "Computer viruses, worms, and other animals: truth & fiction"
In: Output (5 April 1989) vol.18, no.4; pp.31-4
Abstract: Computer viruses can be classified according to
characteristics, especially their effects and their propagation mechanisms.
Harmless and destructive viruses and their propagation in computer systems
are discussed. Related definitions of virus, worm, mole, Trojan horse,
trapdoor, logic bomb, time bomb, sleeper, hole, security gap, leak, hacker,
and cracker are explained. System penetration by hackers or viruses has
been aided by lack of system security consciousness, and by security
deficiencies in hardware and software supplied by manufacturers.
Countermeasures discussed include care in software purchase, use of test
programs, use of special security measures, and recourse to legislation.
Brunnstein, K.: "Hackers in the shadow of the KGB"
In: Chip (May 1989) no.5; pp.14-19
Abstract: The author examines the question of whether hackers are
criminals or idealists. He sketches a profile of a typical hacker (which
turns out to be similar to that of a professional programmer) and looks at
hackers' work methods, clubs and motives. He outlines some of their more
wellknown cases (e.g. the Chaos club, the Hannover hacker, the involvement
of Russia in buying stolen technical secrets) and comments on the measures
being taken to prevent hackers getting in and to make computer systems
'secure'.
Campbell, D.E. [PSI Int., Fairfax, VA, USA]: "The intelligent threat
(computer security)"
In: Security Management (Feb. 1989) vol.33, no.2; pp.19A-22
Abstract: This article is about the hacker as an external threat, a
terrorist, a person who destroys information for spite, revenge, some
get-rich-quick scheme, or some ideological reason-but always with physical
or electronic destruction or modification of data as a possible end result.
The hacker as a destructive force is the external threat all information
systems are faced with, and as a manager of these systems, your job may
depend on how well you defend your data against such a force.
Samid, G.: "Taking uncommon-but effective-steps for computer security"
In: Computers in Banking (March 1989) vol.6, no.3; pp.22, 61-2
Abstract: System managers and security officials should take the time to
familiarize themselves with the hackers job. Only then will they develop a
sense of their system's vulnerability. Such awareness is a prerequisite for
installation of a heavy-duty defense. No computer system is break-safe.
Therefore computer security starts with identifying who will benefit the
most from breaking in. Then the analysis should assess the value of
breaking in for the intruder. That value should be less than the effort or
cost of accomplishing the intrusion. As long as the balance cost/benefit is
kept unfavorable to the would-be intruder, the system is virtually
break-safe.
Wilding, E.: "Security services shaken by UK hacker's claims"
In: Computer Fraud & Security Bulletin; (Jan. 1989) vol.11, no.3; pp.1-5
Abstract: Discusses the case of Edward Austin Singh, the UK hacker
reported in October to have accessed some 250 academic, commercial,
government and military networks worldwide. This case serves as a useful
framework for discussing legal issues related to computer hacking in the
UK.
Gliss, H.: "US research systems attacked by German student"
In: Computer Fraud & Security Bulletin (July 1988) vol.10, no.9; pp.1-3
Abstract: A researcher with 'a hacker's mentality' caught a German
computer science student from Hanover. The researcher, Clifford Stoll from
Lawrence Berkeley Laboratory (LBL), trapped the student by a trace
connection over the US data networks into Bremen University (West Germany)
and from there through DATEX-P to the individual telephone from which the
hacker did his job. The author gives a comprehensive overview about Stoll's
successful approach, and the lessons which LBL management drew from the
case.
Beale, I.: Computer eavesdropping-fact or fantasy
In: EDP Auditor Journal (1988) vol.3; pp.39-42
Abstract: Equipped with a black and white television set, an antenna and
a small amount of electronics equipment it is possible to display the
information from the screen of a terminal located in a building over 300
metres away. This shows how easy eavesdropping can be, how inexpensive the
necessary equipment is and how readable the data received is. Clearly then,
senior management within many companies should be concerned about the
vulnerability of their systems and the information contained within them. A
broad range of information currently processed on computer systems is of a
confidential nature and needs to be stored and processed within a secure
environment. This type of information includes financial data, financial
projections, design data for new products, personnel records, bank
accounts, sensitive correspondence and competitive contract bids. Any of
this information may be valuable to eavesdroppers either for their own use,
or so that they can sell it to a third party. Another interested party in
this technology is the would-be hacker. By using eavesdropping techniques,
the hacker will be able to readily identify user ids and passwords which
are valid on client computer systems. This will be much more efficient than
the techniques currently used by hackers to identify valid user id and
password combinations.
Stoll, C.: "Stalking the wily hacker"
In: Communications of the ACM (May 1988) vol.31, no.5; pp.484-97
Abstract: In August 1986 a persistent computer intruder attacked the
Lawrence Berkeley Laboratory (LBL). Instead of trying to keep the intruder
out, LBL took the novel approach of allowing him access while they printed
out his activities and traced him to his source. This trace back was harder
than expected, requiring nearly a year of work and the cooperation of many
organizations. This article tells the story of the break-ins and the trace,
and sums up what was learned. (49 Refs)
Schechter, H.: "Dial-up network management-more than just security!"
Conference Title: SECURICOM 86. 4th Worldwide Congress on Computer and
Communications Security and Protection; pp.173-8
Publisher: SEDEP, Paris, France; Date: 1986; 476 pp; Date: 4-6 March 1986
Abstract: During the last few years, worldwide data communications
networks have been besieged by terrorist attacks, the personal computer
hacker. As businesses have aggressively pursued the use of the PC and
dial-up services, they have found that they must guard their networks and
data, and at the same time manage this dial-up network like they manage
leased line networks. The paper analyzes the needs and components of
dial-up network management and security.
Troy, E.F.: "Security for dial-up lines"
Issued by: Nat. Bur. Stand., Washington, DC, USA; May 1986; vi+60 pp.
Abstract: This publication describes the problem of intrusion into
government and private computers via dial-up telephone lines, the so-called
'hacker problem'. There is a set of minimum protection techniques against
these people and more nefarious intruders which should be used in all
systems which have dial-up communications. These techniques can be provided
by a computer's operating system, in the best case. If the computer does
not have the capability to give adequate protection against dialup
intruders, then other means should be used to shore up the system's access
control security. There are a number of hardware devices which can be
fitted to computers or used with their dial-up terminals and which provide
additional communications protection for nonclassified computer systems.
This publication organizes these devices into two primary categories and
six subcategories in order to describe their characteristics and the ways
in which they can be used effectively in dial-up computer communications. A
set of evaluative questions and guidelines is provided for system managers
to use in selecting the devices which best fit the need. A set of four
tables is included which lists all known devices in the four primary
categories, along with vendor contact information. No attempt is made to
perform any qualitative evaluation of the devices individually. (41 Refs)
Roberts, W. [Dept. of Comput. Sci., Queen Mary Coll., London, UK]: "'Re-
member to lock the door': MMI and the hacker"
Conference Title: System Security: Confidentiality, Integrity,
Continuity. Proceedings of the International Conference; pp.107-14
Publisher: Online Publications, Pinner, UK; Date: 1986; xii+232 pp.
Conference Date: Oct. 1986; London, UK
Abstract: Increasing emphasis is being placed on the importance of man
machine interface (MMI) issues in modern computer systems. This paper
considers the ways in which common MMI features can help intruders to
breach the security of a system, and suggests methods for enhancing system
security and data integrity by careful MMI design, aiding both the user and
the system administrator.
Murphy, I. [Secure Data Syst., Philadelphia, PA, USA]: "Aspects of hacker
crime: high-technology tomfoolery or theft?"
In: Information Age (April 1986) vol.8, no.2; pp.69-73
Abstract: Computer crime is an increasingly common problem worldwide.
Perpetrated by a growing band of people known as hackers, it is exacerbated
by the ease with which hackers communicate over clandestine bulletin
boards. The types of information contained in these boards is reviewed, and
a parallel is drawn with the problem of telephone fraud also rampant in the
USA. The author looks at the problem of unauthorized access to telephone
lines and personal data. (1 Ref)
Shain, M.: "Software protection-myth or reality?"
Conference Title: Protecting and Licensing Software and Semiconductor
Chips in Europe; 30 pp.
Publisher: Eur. Study Conferences, Uppingham, Rutland, UK; 1985; 273 pp.
Conference Date: 7-8 Nov. 1985; Amsterdam, Netherlands
Abstract: The article reviews the motives people have for copying
software and estimates the size of the revenue loss due to this. Commercial
software protection schemes are reviewed and an account of microcomputer
fundamentals is given for those with no prior knowledge. The techniques
used by the software hacker are analyzed and a view is taken as to whether
software protection is a myth or reality.
Mullen, J.B.: "Online system reviews: controls and management concerns"
In: Internal Auditor (Oct. 1985) vol.42, no.5; pp.77-82
Abstract: The generally accepted controls for online systems can be
divided into three categories: preventive; detective; and corrective. The
preventive controls include sign-on key and passwords. The periodic
changing of these controls and other preventive access controls may prevent
a hacker from learning the access system via observation. The detective
controls include: line protocol, which defines the method of data
transmission; front-end edits, routines within the online-application
programs to detect errors in critical fields; and authorization files,
online files containing user passwords. Corrective controls include:
transaction logging; online training, security software; audit caveats;
audit procedures and effectiveness.
Rous, C.C. [Cerberus Comput. Security Inc., Toronto, Ont., Canada]: "What
makes hackers tick? A computer owner's guide"
In: CIPS Review (July-Aug. 1985) vol.9, no.4; pp.14-15
Abstract: Harmless pranksters or malicious wrongdoers? A computer
security expert points out the differences and similarities-and offers
preventative tips. A major concern of most data processors today is the
threat of 'The Hacker'. This article attempts to de-mystify the breed by
examining hacker psychology. The focus is on the distinction between
frivolous and serious, or benign and malicious, hackers. While the
distinction is valid, it is equally important to recognize the fundamental
similarities between the two. In addition, no matter how benign the hacker
who penetrates a system, if he or she has done so a more malicious one
presumably could too. The author goes on to list the different types of
hacker and provides a detailed analysis of each one. Finally, some lessons
for owners and operators of computer systems are offered.
Haight, R.C.: "My life as a hacker" Conference Title: ACC '84. Proceedings
of the Australian Computer Conference; pp.205-12 Editor(s): Clarke, R.
Publisher: Austr. Comput. Soc, Sydney, NSW, Australia; 1984; xx+672 pp.
Conference Date: 4-9 Nov. 1984; Location: Sydney, NSW, Australia Abstract:
The author has been programming and supervising programmers since 1961.
His experiences and personal viewpoint are described.
------------------------------
End of Computer Underground Digest #4.22
************************************