Computer underground Digest Thu Jan 28, 1993 Volume 5 : Issue 08
ISSN 1004-042X
Editors: Jim Thomas and Gordon Meyer (TK0JUT2@NIU.BITNET)
Archivist: Brendan Kehoe
Shadow-Archivists: Dan Carosone / Paul Southworth
Ralph Sims / Jyrki Kuoppala
Copy Editor: Etaion Shrdlu, Junoir
CONTENTS, #5.08 (Jan 28, 1993)
File 1--Response to "Resistance at Shopping Mall" (CuD 5.07)
File 2--Offworld BBS Raided (StLPD
File 3--Colonel Guilty of Sending Computer Porn
File 4--ISPTS Organizing Information
File 5--New case for EFF, ACLU, and CPSR
File 6--Public Service for Cornell Hackers
File 7--CFP Special Issue on Security [Change in Due Date]
File 8--Talking with the Underground
Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost from tk0jut2@mvs.cso.niu.edu. The editors may be
contacted by voice (815-753-6430), fax (815-753-6302) or U.S. mail at:
Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115.
Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL0 and DL12 of TELECOM; on GEnie in the PF*NPC RT
libraries and in the VIRUS/SECURITY library; from America Online in
the PC Telecom forum under "computing newsletters;" on the PC-EXEC BBS
at (414) 789-4210; in Europe from the ComNet in Luxembourg BBS (++352)
466893; and using anonymous FTP on the Internet from ftp.eff.org
(192.88.144.4) in /pub/cud, red.css.itd.umich.edu (141.211.182.91) in
/cud, halcyon.com (192.135.191.2) in /pub/mirror/cud, and
ftp.ee.mu.oz.au (128.250.77.2) in /pub/text/CuD.
European readers can access the ftp site at: nic.funet.fi pub/doc/cud.
Back issues also may be obtained from the mail server at
mailserv@batpad.lgb.ca.us.
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views. CuD material may be reprinted for non-profit as long
as the source is cited. Some authors do copyright their material, and
they should be contacted for reprint permission. It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified. Readers are encouraged to submit reasoned articles
relating to computer culture and communication. Articles are
preferred to short responses. Please avoid quoting previous posts
unless absolutely necessary.
DISCLAIMER: The views represented herein do not necessarily represent
the views of the moderators. Digest contributors assume all
responsibility for ensuring that articles submitted do not
violate copyright protections.
----------------------------------------------------------------------
Date: Wed, 27 Jan 93 16:59:26 EST
From: ims@beach.kalamazoo.mi.us
Subject: File 1--Response to "Resistance at Shopping Mall" (CuD 5.07)
Overall, this was a well-written and accurate article. As Ron stated,
his article gives suggestions on how to deal with private individuals;
my stance will be on how to deal with gov't agents. I promise to keep
the quoting to a minimum.
>You may be able to fight city hall and win, but fighting with people
>in uniforms (even on a verbal level) is almost always a disaster.
This is 100% true. Gov't cannot break the law, by definition, for in
Brookfield Co. v Stuart, 234 F. Supp. 94, it was recognized that
"an...officer who acts in violation of the Constitution ceases to
represent the government." However, individual representatives of
gov't can and do break the laws pertaining to them, which is nothing
less than treason, being a violation of their oath of office.
Remember, though, as Mr. Carolina has stated, that this applies to
gov't, and not to anyone else. If at all possible, you should always
avoid confrontations with officers low on the totem pole.
>...guards, cops, and other "uniforms" get really nervous around
>organized groups. The more inexperienced the uniform, the more
>nervous they get. Second, when a uniformed person starts a
>confrontation with anyone, he or she is trained to assert control
>over the situation as quickly as possible. Any perceived challenge
>to his authority, including "mouthing off", will produce a harmonic
>disturbance at least double in intensity to the perceived
>non-acquiescence.
That's why we have the three rules for dealing with gov't officials:
Don't say anything, be quiet, and SHUT UP! There's plenty of time to
talk later in court, where it counts.
>Money awarded by a court is a poor substitute for missing teeth.
Perhaps, but it may be the only substitute possible in some cases.
Ideally, we would never be assaulted by gov't. But when we are, it is
our right and duty to extract compensation for damages.
>Third, recognize that a mall IS private property and the mall
>operators can throw you out for little or no reason.
To be totally accurate, they can throw you out for NO REASON AT ALL.
It may sound cruel and unfair, but without the concept of private
property, we'd still be scratching in the dirt just worrying about
bare survival. If you really want to have a secure meeting, order
takeout and meet at someone's house -- which is also private property,
and cannot be lawfully entered without a valid 4th Amendment warrant.
Now when a gov't agent violates your rights, he loses his immunity
from prosecution -- IF IT'S HANDLED CORRECTLY. Of course, you have to
know what those rights are, or you'll never know if they're being
violated.
When a gov't agent is stepping outside the bounds wherein he would be
protected by "sovereign immunity", and he is violating your right, you
ARE REQUIRED to tell him, to give him "constructive notice" of his
violation of law, just as he would inform YOU of some of your rights
if he were to arrest YOU. If you don't do that, the courts will not
entertain your lawsuit for damages later. You have to tell him what
rights he is violating, what laws he is breaking, what the penalties
are that he is risking, and what action is open to him so that he
doesn't break the law. If on giving him notice, he corrects his
error, then there is no need to take him to court over any damages.
We all are required to behave so as to minimize damages to ANYONE,
including ourselves.
>Fourth, mall cops are not gov't agents, and as such, their
>conduct is (mostly) not governed by the Constitution.
Their conduct is not governed AT ALL by the Constitution, since it only
applies to the gov't and its agents.
>If you are confronted by a group of threatening looking mall cops and
>they hassle you, ask if you are being ejected from the mall.
When dealing with gov't agents, NEVER ask, "Am I under arrest?".
Rather, ask, "Am I free to go?".
>If the mall cop tries to detain you, ask if you are under arrest.
See above. This is a preferable strategy no matter who you are dealing
with.
>If you are physically blocked from leaving (no scuffles please), OR if
>they have the guts to claim that you are under arrest, then YOU ask for
>the police on the grounds that you wish to file a criminal complaint
>for wrongful imprisonment. The strategy here is to escalate by
>demanding the presence of lawful authority.
Again, this is the preferable method of handling gov't officials as
well. The lower an officer is in the hierarchy, the more likely he is
to violate the laws which restrain him from rights violations, usually
because he is more likely to be ignorant of them. It's always a good
idea to politely request that he call for a superior officer, and not
bother trying to explain yourself until the superior arrives.
>if the real cops actually do show up, you are once again fully
>protected by the Constitution. For this reason, real cops tend to be
>a little more cautious in these encounters and can often defuse
>problems like this.
Even "real cops" are usually ignorant of the laws which govern their
conduct. You may be "protected by the Constitution", but that won't do
you any good if you're not willing to fight to the last to defend those
rights. You are the only one who can protect your rights, in the end.
See my comments below regarding lawyers.
>If the mall cops look like they might get physical, tell them that
>anything silly on their part will draw a complaint of criminal assault,
>and will force your father, the lawyer, to sue everyone in sight.
The minute you rely on a lawyer, you've pissed away your rights. You
lose your powers as a sovereign over government. You can't claim all
rights at all times. For example, a lawyer cannot claim your right to
remain silent:
"The right of a person under the 5th Amendment to refuse to incriminate
himself is purely a personal privilege of the witness. It was never
intended to permit him to plead the fact that some third person might
be incriminated by his tesimony, even though he were the agent of
such person." Hale v. Henkel, 201 U.S. 43.
Not only that, but if you allow anyone to "represent you", instead of
being "the belligerent claimant in person" (Hale v Henkel, i.s.c.), you
become a "ward of the court". Why? Because obviously, if someone else
has to defend your rights for you, you must be incompetent! Clients are
called "wards" of the court in regard to their relationship with their
attorneys. See a copy of "Regarding Lawyer Discipline & Other Rules",
as well as Canons 1 through 9.
Also, see Corpus Juris Secundum (CJS), Volume 7, Section 4, Attorney
& client: "The attorney's first duty is to the courts and the public,
NOT TO THE CLIENT, and wherever the duties to his client conflict with
those he owes as an officer of the court in the administration of
justice, THE FORMER MUST YIELD TO THE LATTER." (emphasis mine) I trust
this needs no further explanation.
Corpus Juris Secundum assumes courts will operate in a lawful manner. If
you make this assumption, you may learn, to your detriment, through
experience, that certain questions of law, including the question of
personal jurisdiction, may never be raised and addressed, especially if
you are represented by the bar. (Sometimes "licensed counsel" appears to
take on the characteristics of a fox guarding the hen house. Send me
e-mail if you would like more info regarding "licenses to practice
law".)
Lawyers will NEVER do the necessary things before arraignment to get a
case dismissed. They will guarantee that you are locked into a criminal
proceeding from the start by entering a "not-guilty" plea for you, and
will give the government all the time it needs to win the case by
waiving the speedy-trial time limits. With a lawyer as a friend, you
don't need any enemies!
>first make it clear that you protest the action, and then let them
>take it from you. The trick here is to make sure that you have not
>"consented" to the search -- however, you must give in to a claim of
>authority from a police officer.
An officer has no authority until he proves it. If you let this strange
person do whatever they want without having determined their lawful
authority and their true identity, you have "consented", no matter how
much you may verbally protest.
>(And no, you do not get to argue the Fourth Amendment search and
>seizure issue right there on the spot. Your lawyer will do that later
>at your criminal trial...
No lawyers, unless you want to lose.
>A really smart cop might say to the guard, "I will not make the search,
>but I won't stop you if you search." Stand your ground at this point.
>Tell the real cop that you REFUSE to allow the search unless the real
>cop orders the search to take place.
Excellent suggestion, but be sure to take the above precautions
regarding true identity and lawful authority before you think about
"consenting".
>The only words you should utter after being arrested are "I want to
>speak with a lawyer."
Change this to, "I demand counsel of my choice." The 6th Amendment
is your authority. If the court tries to force you to use a "licensed
lawyer" or a "public defender", it is not counsel of your choice.
>ROBERT A. CAROLINA
>Member, Illinois State Bar Association
Your advice is surprisingly good, for a member of the bar. :-) Not all
lawyers are ignorant and lawless, but the 99% that are give the other
1% a bad name. I'm glad to see we have a few of the good ones reading
CuD.
Finally, let me leave you with one of the most eloquent statements
ever by the Supreme Court:
"Decency, security and liberty alike demand that government officials
shall be subjected to the same rules of conduct that are commands to
the citizen. In a government of laws, existence of the government will
be imperiled if it fails to observe the law scrupulously. Our
government is the potent, the omnipresent teacher. For good or for ill,
it teaches the whole people by its example. If the government becomes a
lawbreaker, it breeds contempt for the law; it invites every man to
become a law unto himself; it invites anarchy. To declare that in the
administration of the criminal law the end justifies the means...would
bring terrible retribution...[and] against that pernicious doctrine,
this court should resolutely set its face."
Olmstead v U.S., 277 U.S. 348 (1928)
Justice Brandeis, dissenting
------------------------------
Date: 20 Jan 93 16:31:22 GMT
From: mc/G=Brad/S=Hicks/OU=0205925@MHS.ATTMAIL.COM
Subject: File 2--Offworld BBS Raided (StLPD
St. Louis Post-Dispatch
Tuesday, January 19, 1993
Pages 1A, 10A
COMPUTER OPERATOR DENIES PORN MENU
By Christine Bertelson
Of the Post-Dispatch Staff
The owner of a St. Louis computer bulletin board that was shut down
by the FBI last week denied Monday that he is responsible for the
pornographic images seen by some users.
On Friday night, the FBI confiscated more than $40,000 worth of
computer equipment at Offworld, a computer company owned and operated
by Joey Jay. Jay, 28, ran the business from his residence in the
basement of his father's house on Tecumseh Drive in Chesterfield.
Jay was not arrested, and no charges have been filed against him.
Jay said his father threw him out of the house after the raid.
"Everyone assumes we are some kiddie porn ring," Jay said. "We are
not. We are a nonprofit community service."
A spokesman for the FBI said that someone had reported that Offworld
had images available showing bestiality, as well as child pornography.
It is a federal offense to have child pornography, and any property
used to promote it is subject to being seized and forfeited to law
enforcement authorities, an FBI spokesman said.
"We get all kinds of files across the system, and one or two at most
showed up in terms of a private conversation," Jay said. "When I
found them, I deleted them immediately."
Offworld began operating in St. Louis last June, and is free to its
4,300 users. Jay said it cost him $1,800 a month to operate the
system, using money from family inheritance.
About 100 people showed up Monday morning in Chesterfield at a rally
in support of Offworld, Jay said. He said he was soliciting
contributions of computer hardware, or cash, to get his system up and
running again.
Computer bulletin board systems, or BBSs, as they are known, allow
users to chat electronically, and share information on a variety of
subjects. Offworld has bulletin boards that feature job listings,
book and movie reviews, restaurants and clubs, and discussion groups
for people with "diverse lifestyles."
Jay said that any time illegal material appears on a bulletin board
--whether it is child pornography, offers of sex for sale, or drugs
--it is purged and the people who posted such messages are kicked off
the system.
"Unfortunately, that doesn't prevent them from coming back and using
another fictitious name," Jay said.
FBI seizures of electronic bulletin board systems are "quite common,"
said Mike Godwin, a lawyer at the Electronic Frontier Foundation. The
foundation is a civil liberties group based in Washington for those in
computer communications.
Godwin said that pornography is widely available on the thousands of
electronic bulletin boards in use across the country. New computer
users often use their scanners to recreate sexy pictures, much the
same as children who delight in using a newly acquired dirty word.
"Usually the novelty wears off," Godwin said.
Child pornography is relatively rare, Godwin said. When it shows up,
the operator of the system is faced with a choice: delete it
immediately, or keep it on the system and report it to the police.
The FBI finds raids effective because they are punitive in and of
themselves, whether or not a computer systems operator is ever charged
with a crime.
But even the most conscientious systems operator cannot keep all
pornography off a bulletin board, Godwin agreed.
Jay had previous conversations with the St. Louis County Police about
his system, he said.
"I told them I would simply try to use responsibility and common
sense and ... keep the system legal," Jay said. "I extend the First
Amendment right to all aspects of the system, unless it violates the
law."
Jay said he was seeking legal advice to help him get his computer
equipment back.
+++++++++++++++
St. Louis Post-Dispatch
Tuesday, January 19, 1993
Page 10A
GIF GETS BULLETIN BOARD IN A JIFF
'We Celebrate Human As Art Forum,' One Manager Says of Nude Issue
By Daniel R. Browning (Of the Post-Dispatch Staff)
Dirty pictures transmitted over the telephone to your home computer?
It had to happen.
Computer bulletin board systems, called BBSs, proliferate not only
locally, but nationally and internationally. The biggest ones call
themselves "information services," and the granddaddy is CompuServe.
It has nearly 1.2 million members from China to Chile.
St. Louis Computing, a free monthly computing newspaper, publishes a
list of local bulletin boards and their phone numbers.
Within these bulletin boards people interested in particular topics
go to chat, share information, and yes, show their favorite slides.
The pictures are transmitted in a special computer code called GIF
(pronounced jif), which is short for Graphics Interchange Format. To
see them, you need the special "viewers" included in some
communications software.
To capture an image, you have your computer's modem dial the bulletin
board, then search for whatever you find interesting.
In the giant databases, that means logging on to a special-interest
section within the information service or bulletin board. CompuServe
calls these "forums."
A forum exists for just about any professional interest or hobby.
Journalists, lawyers, doctors, aerospace workers, artists,
photographers, beer and wine enthusiasts, automobile buffs -- you'll
find them all in the forums.
Within these, you can find thousands of pictures ranging from NASA
space shots, to great works of art, to travel photos, to The Girl (or
Boy) Next Door in a birthday suit.
A wary technician overseeing the forum warns members that they had to
be older than 18 to get nude images.
But practically speaking, there's no way to prevent a minor from
capturing a nude photo on CompuServe, said Dave Kishler, a company
spokesman. The Federal Communications Commission does not regulate
BBSs, he said. So the BBSs have worked up their own sets of rules and
regulations.
Dave Shaver, operations manager of CompuServe's Fine Arts Forum, said
all the images are screened for content before they are made available
to the members. That's why you'll find hundreds of nudes under a
category called "Plain Brown Wrapper," but no XXX-rated pictures, he
said. "We celebrate the human as an art form."
Some bulletin boards are free. The big ones charge a flat monthly
fee of $5 to $8. Certain activities within the databases may also
include hourly surcharges, which vary in price to about $15 an hour.
Joining a special interest forum and capturing pictures would fit in
that category on most information services.
That cost -- and the requirement that members have a credit card or a
checking account -- helps limit memberships to adults, Shaver said.
------------------------------
Date: Wed, 27 Jan 1993 00:32:04 -0600 (CST)
From: joe@DOGFACE.AUSTIN.TX.US(Joe Zitt)
Subject: File 3--Colonel Guilty of Sending Computer Porn
Colonel guilty of sending porn over computer
Associated Press
SAN ANGELO -- The former commander of Goodfellow Air Force Base was
convicted in a court martial Monday of sending obscene material via
his home computer.
A jury of four men and one woman, all Air Force colonels, deliberated
about two hours before returning guilty verdicts on all counts again
Col. James Maxwell.
He was convicted of transmitting obscene material via home computer,
of transmitting child pornography through his computer and using
indecent language with a junior Air Force officer.
Maxwell, a 26-year Air Force veteran, now faces a possible 16-year
prison sentence and loss of his military retirement benefits.
Charges were filed against Maxwell after the FBI found his name among
users of an on-line computer network who accessed computer-generated
pornographic images of children.
Maxwell also was said to have used the computer network to inquire
about the location of homosexual meeting places.
Maxwell's attorney had sought to have the charges dropped on grounds
his transmissions on the computer from the privacy of his home were
protected under the constitution.
But the trial judge, Col. Donald Weir of Randolph Air Force Base,
allowed the charges to stand last week, ruling that freedom of speech
can be limited when it involves conduct unbecoming an officer.
"That the writings were private between consenting adults, that they
may have been welcome doesn't place them under the judicial umbrella
of a constitutional protected condition," Weir had ruled.
Weir dismissed a count alleging Maxwell had disgraced the Air Force by
allegedly using electronic mail to ask about homosexual bars and child
pornography.
Maxwell, 48, was removed from command at the Goodfellow Air Force Base
training center last summer after the charges were filed.
+++++++++++++++++++++
COMMENT: Looks to me like this thing is full of red flags. Isn't it
coincidental that the story breaks just as there's a flap over gays in
the military?!
And where it says "the FBI found his name among users of an on-line
computer network who accessed computer-generated pornographic images
of children", one might ask what network? what was the FBI doing
there? how did the images get there? how did the FBI think to track
them? who else is getting snared? civilians? were the images really
"computer-generated" or just scanned?
It's enough to restore one's healthy paranoia...
------------------------------
Date: Wed, 13 Jan 93 21:09:00 -0600
From: cylinder@news.weeg.uiowa.edu (Cylinder)
Subject: File 4--ISPTS Organizing Information
The International Society for the Philosophy of Tools & Space
We are an interdisciplinary organization, small but growing, dedicated
to thoughtful discussion about and research into issues concerning
tools and space. Currently, we maintain a membership list and
circulate a short newsletter. Our future plans call for expansion - a
regular journal and a number of conferences are possible in the coming
year.
Our membership list includes philosophers, artists, computer
programmers, scientists, graphic designers, architects, teachers - as
well as those whose professions are still unnamed. We are not a
school or a sect or party because we are not in agreement over
particular doctrines. Our society is bound by an implicit faith in
the silent potency of tools, space, meaning and metaphor, in a wide
range of seemingly unrelated fields. Within the scope of our talks to
date, members have raised diverse and fascinating issues for
consideration:
- A phenomenology of humor, tools and toys
- Space and the banality of cause and effect
- Rhetoric and metaphor: language as tool/toy
- The iconology of computers
- Speed and annihilation
- Victimless crimes and crimes of trespass
- The mechanics of the dreamwork in psycho-analysis
- Architectural theory and practice
- Political theories of reterritorialization
- Viruses: information systems and genetic engineering
- Media theory
- Virtual Reality: the emergence of simulacra in social space
- Transit technology and urban planning
- Infrastructure catastrophes
The thematic study of tools and space forces us to reconsider and
sharpen the boundaries separating the various specialties of our
members. Many of us are involved in concrete and ongoing projects
which undo customary lines of inquiry and uncover fruitful new
questions in what was formerly considered "obvious" and explained. We
seek to move beyond conventional genres without abandoning meaning and
beauty for the sake of novelty.
For more information about Cylinder, including membership materials,
please write us with your name and address.
CYLINDER
c/o Graham Harman, Secretary
Philosophy Dept., DePaul University
Chicago, IL 60614 USA
email: cylinder@uiowa.edu
(If you have already written to Cylinder, please refrain from doing so
a second time. Your name and address have been added to our mailing
list and you should be expecting membership materials in the coming
months.)
------------------------------
Date: Fri, 22 Jan 1993 13:52:48 -0500
From: Shari Steele <ssteele@EFF.ORG>
Subject: File 5--New case for EFF, ACLU, and CPSR
On the evening of November 6, 1992, approximately 30 computer
enthusiasts, who had gathered for a meeting of 2600 magazine readers
at the food court at Pentagon City Mall in Arlington, VA, were
detained and searched and had some of their possessions seized by
about half a dozen mall security guards acting under the direction of
the Secret Service. Somewhere between two and five officers from the
Arlington County Police were there, as well, having responded to a
call about fraud.
Several of the attendees are interested in suing the mall, police and
Secret Service, and EFF and CPSR have done some preliminary research
into the case to determine what, if any, civil liberties violations
were involved. After interviewing about a dozen people who were
there, we have determined that the Secret Service does seem to have
been involved (a county police officer on the scene confirmed that),
and we are ready to proceed with the case.
We contacted the Virginia ACLU, which has found a litigator in
Northern Virginia who wants to litigate the case. EFF, the ACLU and
CPSR are currently doing research on the legal theories we will need
to pursue. EFF is very committed to standing up for the civil
liberties of those who attended this open, publicized and
nondisruptive meeting.
Shari Steele, Staff Attorney, Electronic Frontier Foundation
------------------------------
Date: 14 Jan 93 22:19:52 PST
From: Kpro-Madness <unknown@domain>
Subject: File 6--Public Service for Cornell Hackers
The following should be of interest to CuD readers. It originally
appeared in RISKS Digest ( V. 14 #27).
++++
Date--Wed, 13 Jan 93 09:56:50 -0700
From--dclawson@clipr.colorado.edu
Subject--Public Service for Cornell Hackers
"Public Service for Hackers" by John Marcham
_Cornell_Alumni_News_ magazine
Two former [Cornell] students will develop a computer program to make
it easier for a quadraplegic man in Tennessee to use a computer he
owns, as part of their punishment for launching a computer virus that
damaged programs and caused hard drive crashes last February.
David Blumenthal '96 and Mark A. Pilgrim '94 were sentenced by a
Tompkins County Court judge to pay restitution to users whose
computers were jammed by the men's virus, at and near Stanford
University and in Japan, and to perform ten hours of community service
per week for a year.
A computer buff who knew the quadraplegic and heard of the Cornell
virus case wrote the judge in Ithaca, and asked if the students'
public service could be worked off developing a less expensive and
cumbersome program for the disabled man, who uses a mouthstick and
outdated software to operate his McIntosh computer.
The judge and the former students agreed to the proposal: the students
start work in November. A third former student, found guilty of a
lesser infraction, was asked by not required to do public service, and
declined.
------------------------------
Date: Mon, 18 Jan 93 08:04:30 -0500
From: Matt Bishop <bishop@WINDSOR.DARTMOUTH.EDU>
Subject: File 7--CFP Special Issue on Security [Change in Due Date]
[NOTE CHANGE IN SUBMISSIONS DUE DATE: IT IS NOW JUNE 1, 1993]
Matt Bishop will be Guest Editor of a special issue of the journal
"Computing Systems" to be published in 1993. The issue will be
devoted to "Security and Integrity of Open Systems." Papers on all
aspects of policy, issues, theory, design, implementation, and
experiences with security and integrity in open systems are solicited
for the issue. The deadline for submissions is June 1, 1993; papers
submitted after this deadline will not be considered. Prospective
authors should send five copies of their papers to:
Professor Matt Bishop
Mathematics and Computer Science
Dartmouth College
6188 Bradley Hall
Hanover, NH 03755-3551
(603) 646-3267
Matt.Bishop@dartmouth.edu
Submissions should not have appeared in other archival publications
prior to their submission. Papers developed from earlier conference,
symposia and workshop presentations are welcome.
"Computing Systems" is a journal dedicated to the analysis and
understanding of the theory, design, art, engineering and
implementation of advanced computing systems, with an emphasis on
systems inspired or influenced by the UNIX tradition. The journal's
content includes coverage of topics in operating systems,
architecture, networking, interfaces, programming languages, and
sophisticated applications.
"Computing Systems" (ISSN 0895-6340) is a refereed, quarterly journal
published by the University of California Press for the USENIX
Association. Usenix is a professional and technical association of
individuals and institutions concerned with breeding innovation in the
UNIX tradition.
Now in its fifth year of publication, "Computing Systems" is regularly
distributed to 4900 individual subscribers and over 600 institutional
subscribers (libraries, research labs, etc.) around the world. Some
special-topic issues are often distributed more widely.
The editor-in-chief of "Computing Systems" is Mike O'Dell of Bellcore.
Gene Spafford of Purdue University is Associate Editor, and Peter
Salus of the Sun User Group is the Managing Editor.
------------------------------
Date: 23 Jan 1993 16:14:31 -0700 (MST)
From: <KAPLAN%UABPA@ARIZVMS.BITNET>
Subject: File 8--Talking with the Underground
(Previously published in the Computer Security Institute's newsletter
- The Alert - and the French Chaos Computer Club's Chaos Digest)
Talking with the underground
by Ray Kaplan and Joe Kovara
Information about system and network vulnerabilities is sparse, not
readily available and carefully guarded by those segments of the
security community that collect and control it. Given that the
legitimate security community won't share information about
vulnerabilities with us, isn't it logical that we include outsiders
(the computer underground or ex-computer criminals) in these
discussions. Amid criticism, we decided to let the community ask the
advice of experts the crackers who have successfully cracked computer
networks.
Exploring the details of vulnerabilities
Over 300 participants at 25 sites in US, Canada, Europe and Mexico
joined law enforcement, members of the security community, and former
members of the computer underground as we explored these questions in
the November 24, 1992, audio teleconference entitled System and
Network Security: How You Will Be Attacked and What to do About It.
Our guests included Kevin Mitnick and Lenny DiCicco, who successfully
penetrated a range of networks and telephone systems. They were both
sentenced in federal court after successfully penetrating Digital
Equipment Corporation's computer network in 1988. They stole the
source code to VMS, Digital's widely used operating system. Their
exploits were profiled in the book Cyberpunk: Outlaws and Hackers on
the Computer Frontier, by Katie Hafner and John Markoff (1991, Simon
and Schuster).
Our panelists included Hal Hendershot, head of the FBI Computer Crime
Unit in Washington D.C.; Don Delaney, Senior Investigator with the New
York State Police; Computer security consultant Dave Johnson of Talon
Systems (Los Alto, CA); Robert Clyde, V.P. of the Security Products
Group, RAXCO, Inc.; and Lew, the organizational director of automation
for a medium size company a former cracker.
The panelists shared their considerable experience and discussed
techniques used to break in to computer networks. Among the
penetration techniques discussed were the uses of psychological
subversion, telecommunications monitoring techniques, and the
exploitation of known system and network bugs. Despite the popularity
of these attack techniques, they are little known outside of the
computer underground and the computer security community.
Panelists issue stern warnings about telecommunications security
Don Delaney stated that tremendous loss of money from both toll and
Private Branch eXchange (PBX) fraud is whats happening in the telecom
area. Since the security of a PBX is the responsibility of its owner,
such losses are not being absorbed by the telephone companies
involved. These losses have been known to force the owners of
compromised PBXs into bankruptcy. Delaney joins us in saying that its
not a matter of if you will be hit, but when.
According to DiCicco, compromising the telephone system gave he and
Kevin the ability to attack systems without the fear of discovery -
telco tracebacks were simply ineffective. They could attack networks
at many different points of entry all over the country. This is why
no one could keep them out, even though their victims knew their
systems and networks had been compromised. If all of this does not
scare you, consider Lenny's admission that at one point he and Kevin
had compromised over 50 telco switches in the United States, including
all of California, parts of New Jersey, New York and New Hampshire.
At one point they even controlled all three of the switches that
provided phone service to Manhattan.
Yes, the law is ready to help - but the threat is a tough,
sophisticated, international one.
Threats from abroad? Yes, the threat does exist according to Hal
Hendershot of the FBI. Robert Clyde reports getting many calls from
people trying to solve security problems. In keeping with what we
know of reported computer crimes, most sites see problems from
insiders: employees, consultants and vendors. Robert reports that
two companies publicly spoke of being approached by former East German
agents for hire for as little as $10,000 at a September conference in
Sweden where he spoke in 1992. We appear to be seeing the
criminalization of hacker activity that many have long feared: hackers
and ex-foreign intelligence agents for hire.
James Bond is alive and well, thank you
In late 1992 Don Delaney reported the first case he's seen of James
Bond techniques. Remote surveillance can be done by intercepting,
decoding and displaying the Radio Frequency (RF) emanations of various
computing devices such as terminals and network cabling. Delaney
reports that in late 1992, an antenna was put up on the balcony of a
19th floor room in New York's Helmsley building pointing at Chemical
Bank. He indicated that it was being very carefully adjusted before
being locked into position. By the time they were able to
investigate, the antenna and its manipulator had vanished - presumably
having successfully gathered the intelligence that they were after.
This is no longer gee, we knew it was possible, but holy shit, it's
happening now. Imagine someone reading your terminal screen from
across the street.
Management's show me attitude
Dave Johnson insists that his biggest problem when he was at Lockheed
was getting corporate management to understand that there is a
problem. One of the areas in which this type of conference can really
help is understanding the enemy. Management simply doesn't understand
the thinking of hackers. Since it makes no sense to them, they tend
to deny its existence until theres proof. Of course, the proof is
usually very expensive: once a system has been compromised the work of
cleaning it up is a long, hard and complicated. A well-connected
system or network makes an excellent platform from which to launch
attacks on other hosts or on other networks.
A major problem for Digital in securing their network against Kevin
Mitnick and Lenny DiCicco was that only one vulnerable system on
Digitals EASYnet was needed. From there, they were able to penetrate
other systems. Even nodes that were known to have been penetrated and
were secured were penetrated repeatedly by using other vulnerable
nodes to monitor either users or network traffic accessing the secured
nodes. While at Lockheed, Dave Johnson implemented policies,
awareness training and widescale authentication for all external
access, including dialup lines and telnet connections using
challenge-response tokens or smart cards. He does not trust the phone
system and assumes that it has been compromised. Kevin Mitnick and
Lenny DiCicco illustrated just how vulnerable the phone system was in
1988 and the MOD bust in July 1992 shows that things have not
improved. Kevin reminds us that you must assume the telephone system
is insecure: even robust challenge-response systems can be compromised.
You simply have to play the telecommunications game for real. Kevin
reminds us that unless you use encryption, all bets are off. As an
example of how deep, long lived and dedicated a serious attack can be,
consider that Kevin and Lenny were in DEC's network for years. They
knew exactly what DEC and telco security were doing in their efforts
to catch them since they were reading the security personnel's email.
They evaded the security forces for over 12 months and they had a
pervasive, all powerful, privileged presence on DEC's internal
network. I've seen the enemy and them is us (this is a quote from
Pogo).
Mitnick insists that people are the weakest link. According to his
considerable experience, you don't even need to penetrate a system if
you can talk someone on the inside into doing it for you. Why bother
breaking in to a computer system if you can talk someone in accounts
payable into cutting you a check? Using the finely tuned tools of
psychological subversion, practiced social manipulators can get most
anything that they want from the ranks of the generally unsuspecting
(uncaring?) employees that inhabit most of our organizations today.
The only cure is a massive and complete educational program that
fosters loyalty, awareness and proper skepticism in every employee.
In the end
Perhaps the strongest message from everyone was that you can't trust
the phone system. Telephone companies have been, and continue to be,
compromised. While Mitnick & DiCicco's penetration of DEC's internal
network happened in 1988, the 1992 MOD bust showed us that the same
techniques are still being used successfully today. Data and voice,
including FAX transmissions, are subject to eavesdropping and
spoofing. Encryption is absolutely required for secure, trustworthy
communications.
The coupling of social engineering and technical skills is a potent
threat. Most sites that have addressed technical security are still
wide open to penetration from people who have well-practiced social
engineering skills. However, in all, you don't even need social
engineering skills to get into most systems.
Are your systems and networks secure? Are your systems and networks
at risk? What will you do if you are attacked? Although the
questions seem simple, they are not. Future teleconferences will
explore both the questions and the answers in more detail.
++++
Ray Kaplan and Joe Kovara have been independent computer consultants
for more than a decade. They specialize in operating systems, networks
and solving system and network security problems. Ray Kaplan is also
a well known writer and lecturer. He is a regular contributor to
Digital News and Review and other computer trade publications.
Tapes and handout materials for the System and Network Security
teleconference series are available from Ray Kaplan, P.O. Box 42650,
Tucson, AZ USA 85733 FAX (602) 791-3325 Phone (602) 323-4606.
------------------------------
End of Computer Underground Digest #5.08
************************************