Computer underground Digest Sun Aug 2, 1998 Volume 10 : Issue 44 ISSN 1004-042X Editor: Jim Thomas (cudigest@sun.soci.niu.edu) News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu) Archivist: Brendan Kehoe Shadow Master: Stanton McCandlish Shadow-Archivists: Dan Carosone / Paul Southworth Ralph Sims / Jyrki Kuoppala Ian Dickinson Field Agent Extraordinaire: David Smith Cu Digest Homepage: http://www.soci.niu.edu/~cudigest CONTENTS, #10.44 (Sun, Aug 2, 1998) File 1--S1482 (Bill to amend Comm Act - June 25 '98 version) File 2--GORE ANNOUNCES STEPS TOWARD ELECTRONIC BILL OF RIGHTS File 3--"HACKER MYTH CRUMBLE" (DEFCON VI Report (from NYT)) File 4--Teens Who Hacked Into U.S. Computers Plead Guilty File 5--E-mail Security Flaw Information (NYT & Knight/Ridder) File 6--Regarding the "ClearZone" proposal. File 7--Cu Digest Header Info (unchanged since 25 Apr, 1998) CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION ApPEARS IN THE CONCLUDING FILE AT THE END OF EACH ISSUE. --------------------------------------------------------------------- Date: Mon, 3 Aug 1998 23:49:56 -0500 From: jthomas@VENUS.SOCI.NIU.EDU(Jim Thomas) Subject: File 1--S1482 (Bill to amend Comm Act - June 25 '98 version) ((MODERATORS NOTE: In the past few issues, we've run commentary and snippets of text from S 1482, which many observers find a danger to Net freedom. Here again is the latests version of the Senate Bill)). To amend section 223 of the Communications Act of 1934 to establish a prohibition on commercial distribution on the World Wide Web of material that is harmful to minors, and for other... (Reported in the Senate) S 1482 RS Calendar No. 436 105th CONGRESS 2d Session S. 1482 [Report No. 105-225] To amend section 223 of the Communications Act of 1934 to establish a prohibition on commercial distribution on the World Wide Web of material that is harmful to minors, and for other purposes. IN THE SENATE OF THE UNITED STATES NOVEMBER 8, 1997 Mr. COATS introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation JUNE 25, 1998 Reported by Mr. MCCAIN, without amendment _________________________________________________________________ A BILL To amend section 223 of the Communications Act of 1934 to establish a prohibition on commercial distribution on the World Wide Web of material that is harmful to minors, and for other purposes. Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1. PROHIBITION ON COMMERCIAL DISTRIBUTION ON THE WORLD WIDE WEB OF MATERIAL THAT IS HARMFUL TO MINORS. (a) PROHIBITION- (1) IN GENERAL- Section 223 of the Communications Act of 1934 (47 U.S.C. 223) is amended-- (A) by redesignating subsections (e), (f), (g), and (h) as subsections (f), (g), (h), and (i), respectively; and (B) by inserting after subsection (d) the following new subsection (e): `(e)(1) Whoever in interstate or foreign commerce in or through the World Wide Web is engaged in the business of the commercial distribution of material that is harmful to minors shall restrict access to such material by persons under 17 years of age. `(2) Any person who violates paragraph (1) shall be fined not more than $50,000, imprisoned not more than six months, or both. `(3) In addition to the penalties under paragraph (2), whoever intentionally violates paragraph (1) shall be subject to a fine of not more than $50,000 for each violation. For purposes of this paragraph, each day of violation shall constitute a separate violation. `(4) In addition to the penalties under paragraphs (2) and (3), whoever violates paragraph (1) shall be subject to a civil fine of not more than $50,000 for each violation. For purposes of this paragraph, each day of violation shall constitute a separate violation. `(5) It is an affirmative defense to prosecution under this subsection that the defendant restricted access to material that is harmful to minors by persons under 17 years of age by requiring use of a verified credit card, debit account, adult access code, or adult personal identification number or in accordance with such other procedures as the Commission may prescribe. `(6) This subsection may not be construed to authorize the Commission to regulate in any manner the content of any information provided on the World Wide Web. `(7) For purposes of this subsection: `(A) The term `material that is harmful to minors' means any communication, picture, image, graphic image file, article, recording, writing, or other matter of any kind that-- `(i) taken as a whole and with respect to minors, appeals to a prurient interest in nudity, sex, or excretion; `(ii) depicts, describes, or represents, in a patently offensive way with respect to what is suitable for minors, an actual or simulated sexual act or sexual contact, actual or simulated normal or perverted sexual acts, or a lewd exhibition of the genitals; and `(iii) lacks serious literary, artistic, political, or scientific value. `(B) The terms `sexual act' and `sexual contact' have the meanings assigned such terms in section 2246 of title 18, United States Code.'. (2) CONFORMING AMENDMENT- Subsection (g) of such section, as so redesignated, is amended by striking `(e), or (f)' and inserting `(f), or (g)'. (b) AVAILABILITY ON INTERNET OF DEFINITION OF MATERIAL THAT IS HARMFUL TO MINORS- The Attorney General, in the case of the Internet web site of the Department of Justice, and the Federal Communications Commission, in the case of the Internet web site of the Commission, shall each post or otherwise make available on such web site such information as is necessary to inform the public of the meaning of the term `material that is harmful to minors' under section 223(e) of the Communications Act of 1934, as amended by subsection (a) of this section. Calendar No. 436 105th CONGRESS 2d Session S. 1482 [Report No. 105-225] A BILL To amend section 223 of the Communications Act of 1934 to establish a prohibition on commercial distribution on the World Wide Web of material that is harmful to minors, and for other purposes. _________________________________________________________________ JUNE 25, 1998 ------------------------------ Date: Sun, 2 Aug 1998 14:16:49 -0500 From: jthomas@VENUS.SOCI.NIU.EDU(Jim Thomas) Subject: File 2--GORE ANNOUNCES STEPS TOWARD ELECTRONIC BILL OF RIGHTS THE WHITE HOUSE BRIEFING ROOM July 31, 1998 VICE PRESIDENT GORE ANNOUNCES NEW STEPS TOWARD AN ELECTRONIC BILL OF RIGHTS Message Creation Date was at 31-JUL-1998 12:01:00 THE WHITE HOUSE Office of the Vice President ____________________________________________________ For Immediate Release Contact: Friday, July 31, 1998 (202) 456-7035 VICE PRESIDENT GORE ANNOUNCES NEW STEPS TOWARD AN ELECTRONIC BILL OF RIGHTS New Efforts Will Protect Americans , in Four Key Areas Washington, DC -- Vice President Gore announced new steps toward an Electronic Bill of Rights, an effort to protect one of the oldest and most basic American values -- privacy -- with the rise of new technology. "We need an electronic bill of rights for this electronic age," Vice President Gore said in an event in the Roosevelt Room at the White House. "You should have the right to choose whether your personal information is disclosed; you should have the right to know how, when, and how much of that information is being used; and you should have the right to see it yourself, to know if it's accurate." Following a major address at New York University this May, the Vice President renewed the call for an Electronic Bill of Rights by asking everyone to do their part to protect individual privacy -- relying on private sector leadership where possible, on legislation when necessary, on responsible government handling of personal information, and on an informed public. The Vice President announced new action in four key areas: Protecting sensitive personal information. Taking new executive action and calling for tough new legislation to protect personal information such as medical and financial records -- and ensuring that existing privacy laws are strong enough to protect privacy as technology grows and changes; Stopping identity theft. Calling for strong new penalties for so-called "identity theft"; Protecting children's privacy on-line. Calling for strong new measures to protect children's privacy on-line -- by ensuring that data is not collected from children without their parents , consent; and Urging voluntary private sector action to protect privacy. Challenging the private sector to continue to take effective voluntary steps to protect privacy on-line. ### PROTECTING AMERICANS , PRIVACY IN THE INFORMATION AGE: AN ELECTRONIC BILL OF RIGHTS "Privacy is a basic American value -- in the Information Age, and in every age. And it must be protected. We need an electronic bill of rights for this electronic age. You should have the right to choose whether your personal information is disclosed; you should have the right to know how, when, and how much of that information is being used; and you should have the right to see it yourself, to know if it's accurate." -- Vice President Gore In a major address at New York University this May, Vice President Gore called for an Electronic Bill of Rights to protect one of the oldest and most basic American values -- privacy -- with the rise of new technology. Today at the White House, the Vice President will announce a series of measures that represent the latest step toward making the core principles of the Electronic Bill of Rights a reality. His plan calls on everyone to do their part to protect individual privacy -- relying on private sector leadership where possible, legislation when necessary, responsible government handling of personal information, and an informed public. The Vice President will announce new action in four key areas: Protecting sensitive personal information. Taking new executive action and calling for tough new legislation to protect personal information such as medical and financial records -- and ensuring that existing privacy statutes are strong enough to protect privacy as technology grows and changes; Stopping identity theft. Calling for strong new penalties for so-called "identity theft"; Protecting children's privacy on-line. Calling for strong new measures to protect children's privacy on-line -- by ensuring that data is not collected from children without their parents , consent; Urging voluntary private sector action to protect privacy. Challenging the private sector to continue to take effective voluntary steps to protect privacy on-line. Sensitive Personal Information Medical Records. Currently, Americans have stronger privacy protections for their video rentals than they do for their medical records. The Administration believes this is unacceptable. The Administration has proposed strong medical privacy recommendations and urged Congress to pass legislation that gives Americans the privacy protections they need. If Congress does not pass strong medical privacy legislation, the Administration fully intends to implement privacy protections consistent with the authority given to us by the law. For example, next week the Administration is releasing a proposed rule to establish standards for the security of health information used by health care providers, health plans, and others (e.g. security and confidentiality practices, access controls, audit trails, physical security, protection of remote access points, etc.) In 1996 Congress directed HHS to develop standards for unique health identifiers under the Health Insurance Portability and Accountability Act of 1996. However, because the availability of these identifiers without strong privacy protections in place raises serious privacy concerns, the Administration is committed to not implementing the identifiers until such protections are in place. It is also important to note that the privacy provisions passed in the House Republicans patients , rights legislation last week certainly do not pass this test, as this provision permits far too much disclosure of patient information without consent. Financial records: The Administration will direct Treasury and the banking regulators to strengthen the enforcement of the Fair Credit Reporting Act with respect to the sharing of information between banks and their affiliates and "opt-out" notices for consumers. The Administration will also ask that Congress give bank regulators the authority to examine financial institutions for compliance with the Fair Credit Reporting Act. Profiling: The Administration will work with the Federal Trade Commission to encourage companies that build dossiers about individuals by aggregating information from a variety of database sources to implement effective self-regulatory mechanisms. If industry attempts at self-regulation are not successful, the Administration will consider other means to ensure adequate privacy protection. Government information: The Administration will launch a "privacy dialogue" with state and local governments. This dialogue will include considering the appropriate balance between the privacy of personal information collected by governments, the right of individuals to access public records, and First Amendment values. For example, the digitization and widespread availability of public records has raised serious privacy concerns. Identity Theft Identity theft: The Administration will urge the Congress to pass legislation sponsored by Senators Kyl and Leahy to crack down on "identity theft," which is the fraudulent use of another person's identity to facilitate the commission of a crime, such as credit card fraud. According to law enforcement officials, the incidence of identity theft is increasing rapidly, and current federal and state laws do not provide sufficiently comprehensive privacy protection. Theft of personal financial information: The Administration will work with Congress to pass legislation sponsored by Representatives Leach and LaFalce that will make it a federal crime to obtain confidential customer information from a bank by fraudulent means. In some cases, people are obtaining information illegally and then using the information for a legal purpose --e.g., pretending to be a customer in order to trick confidential information out of a bank, and then selling that information to a private investigator or some other third party. Children's Privacy Children's privacy: The Administration will seek legislation that would specify a set of fair information principles applicable to the collection of data from children, such as a prohibition on the collection of data from children under 13 without prior parental consent. The Federal Trade Commission would have the authority to issue rules to enforce these standards. Legislation is needed because children under 13 may not understand the consequences of giving out personally identifiable information. Calling for Private Sector Efforts Privacy online: The Administration will continue to press for industry self regulation with enforcement mechanisms. The private sector continues to respond to the Administration's call for industry self regulation. For example, over 50 major companies and associations engaged in electronic commerce have recently created the "Online Privacy Alliance." The Administration will monitor the progress of online industry self regulation to ensure that the commitments made by companies are implemented, that the enforcement mechanisms are effective, and that the numbers of companies and organizations participating in these efforts expands so that the efforts become sufficiently broad based. Increasing Public Awareness Public education: The Administration will work with the private sector, the privacy and consumer advocacy communities, and non-profit organizations to develop a public education campaign to inform individuals about how to exercise choice with respect to the collection and dissemination of their personally identifiable information, and about the technologies that can make that choice possible. A Coordinated Approach Privacy coordination: OMB will be given responsibility for coordination of privacy issues, drawing on the expertise and resources of other government agencies. This will help improve the coordination of U.S. privacy policy, which cuts across the jurisdiction of many federal agencies. ------------------------------ Date: Mon, 03 Aug 98 23:04 CDT From: Jim Thomas (tk0jut1@mvs.cso.niu.edu) <TK0JUT1@mvs.cso.niu.edu> Subject: File 3--"HACKER MYTH CRUMBLE" (DEFCON VI Report (from NYT)) ((MODERATORS' NOTE: Defcon has come a long way from the early days of the conference. The New York Times ran several stories over the weekend describing events. Here are excerpts from two of them)) Hacker Convention Takes On a Corporate Tone (New York Times, 31 July, 1998) By MATT RICHTEL LAS VEGAS -- "Dark Tangent," the founder of the annual hacker convention known as Defcon, isn't the arch-criminal you might expect, stealthily breaking into corporate America's most private systems. Instead, he's having corporate America over for lunch -- and its managers are paying handsomely for the privilege. The sixth-annual Defcon opens Friday in Sin City, and some 2,000 rowdy hackers and their groupies are expected to attend. But on Wednesday and Thursday, Dark Tangent -- whose given name is Jeff Moss -- hosted a conference and buffet lunches for a different crowd: 350 representatives from Fortune 500 companies, the military and law enforcement. Each paid $1,000 to hear hackers share their technical secrets. "It's very fruitful," said Robin Hutchinson, a serious and clean-cut senior manager of electronic commerce for Ernst & Young, the accounting firm, which sent 11 computer professionals to the conference. "They've pulled together people who really know their stuff." <snip> ============== The Hacker Myth Crumbles at Convention By MATT RICHTEL LAS VEGAS -- Seventeen-year-old Heath Miller has come to his first Defcon hacker convention in full battle array, wearing a black T-shirt depicting a shrieking skull and army-green shorts so baggy they can keep his ankles warm. In short, he looks precisely like the devious computer whiz your mother warned you about. So much for first impressions. Miller is an excellent student, hopes to attend MIT and recently placed third in a national science contest with a project that it is not exactly a nefarious bit of hacking: He built a sensor system that lets school bus drivers monitor whether students are wearing their seat belts. The sixth-annual Defcon is in full swing in Las Vegas, but anyone who came here looking for Public Enemy #1 may want to pack up his dragnets and go home. Turns out that for the most part, this convention doesn't live up to its reputation as a gathering of clandestine, underground hackers plotting to cripple the Pentagon via modem. Instead, many are here just to party. Others are just young and bright, with creative minds and a passion for understanding computers. Sure, they might spend too many adolescent hours tanning by the light of the monitor, but that doesn't exactly make them the next coming of Hannibal Lecter. <snip> This is not to say that Defcon is devoid of more troubling impulses. Many here would clearly like the bragging rights granted to the discoverer of some new hack (known as an "exploit") that can be used to infiltrate critical corporate or government computers. Defcon founder Jeff Moss said that the convention has its share of "malicious" hackers. Some of what they saw is not likely to change their opinion of hackers. The formal proceedings include talks on "hacking into the travel industry" and creating a false identity, plus an extensive session on how to pick locks. And on Monday, Cult of the Dead Cow, one of the oldest and most respected hacking groups, plans to give out free copies of a program it claims can be used to hack into a Windows 95 or 98 computer from a remote location and essentially take control of it. <snip> For instance, the members of Cult of the Dead Cow defend their exploitation of a security flaw in Windows on the basis that they are pointing out a dangerous problem with the software, and also providing a possible tool. "There is a legitimate use for this as a network management tool," said a Dead Cow founder, who goes by the hacker handle "Death Veggie." <snip> ------------------------------ From: "Jim Galasyn" <blackbox@bbox.com> Subject: File 4--Teens Who Hacked Into U.S. Computers Plead Guilty Date: Thu, 30 Jul 1998 12:14:51 -0700 Teens Who Hacked Into U.S. Computers Plead Guilty By Rajiv Chandrasekaran Washington Post Staff Writer Thursday, July 30, 1998; Page A02 Two Northern California teenagers pleaded guilty yesterday to charges that they hacked into several U.S. government computers earlier this year and installed sophisticated programs to intercept passwords on the machines. In a plea agreement with federal prosecutors, the 16-year-old boys each pleaded guilty to one count of illegally accessing a government computer and one count of wiretapping. In exchange, prosecutors asked U.S. District Judge Maxine M. Chesney in San Francisco to sentence the boys to probation but did not specify for how long. The teenagers, working with other juveniles, were suspected of worming their way into at least 11 sensitive computer systems at U.S. military installations and dozens of systems at other government facilities, including federal laboratories that perform nuclear weapons research. The attacks, which occurred in January and February, were characterized by Deputy Defense Secretary John J. Hamre as "the most organized and systematic attack" on U.S. computer networks to be detected by authorities. <snip> As a condition of their probation, the juveniles have agreed to use a computer with a modem -- which permits communication with other computers -- only under the supervision of a teacher, employer or librarian. While on probation, the teenagers also are not permitted to possess a modem at home or to work in the computer field. <end> ------------------------------ Date: Mon, 3 Aug 1998 23:37:30 -0500 From: jthomas@VENUS.SOCI.NIU.EDU(Jim Thomas) Subject: File 5--E-mail Security Flaw Information (NYT & Knight/Ridder) From the New York Times: Security Flaw Discovered in E-Mail Programs By JOHN MARKOFF SAN FRANCISCO -- A serious security flaw has been discovered in popular e-mail programs published by Microsoft Corp. and Netscape Communications Corp. that would permit a malicious person to send a message containing a virus that could crash a computer, destroy or even steal data. <BR> So far, security tests have shown that the flaw exists in three of the four most popular e-mail programs, used by perhaps tens of millions of people around the world: Microsoft's Outlook Express and Outlook 98 and Netscape's Web browser, Navigator, which is part of its Communicator suite of Internet programs. While Microsoft is already providing fixes, the flaw is particularly worrisome in the Microsoft Outlook 98 program, which combines e-mail with a schedular, contact list, notes and other tasks, because this software allows an illicit program attached to a piece of e-mail to execute without any activity on the part of the person using the target computer. Most computer viruses can only infect a machine when the user opens an infected file or attempts to run an infected program. ================== From the Knight Ridder/Tribune News Service: FLAW COULD LET HACKERS DELIVER DEVASTATING E-MAIL By David L. Wilson <snip> Since Finnish researchers discovered the flaw last month, tests have established its presence in three programs widely used to read electronic mail: Microsoft Corp.'s Outlook Express and Outlook 98, and Netscape Communication's Corp.'s current Web browser, Communicator. Researchers are still checking to see whether other e-mail programs, such as Eudora, also contain the flaw. Most e-mailed hacker attacks involve "attachments" that are harmless unless the user runs the attached program. that allowed Robert T. Morris, a graduate student at Cornell University, to bring down the entire Internet 10 years ago using an electronic "worm," a bit of software whose only goal was to spread through the system and make copies of itself. <snip> "Now we have the potential for a new Internet-based worm that could be much, much worse than Morris' version," said Eugene Spafford, director of the new Center for Education and Research in Information Assurance and Security at Purdue University. <snip> Exploiting the flaw depends on use of an attachment to an e-mail or USENET message, but the problem does not lie with the attachment itself. In fact, it doesn't matter what's in the attachment: a text file, a song or even a movie. The attack comes from the "tags" that identify the attachment. The attack can be triggered without even opening the message. <snip> ------------------------------ Date: Sat, 1 Aug 1998 08:01:41 -0500 From: peter@LAPUTA.BITNET Subject: File 6--Regarding the "ClearZone" proposal. Regarding the "ClearZone" proposal: >A group of 13 companies lead by Cisco Systems announced on July 13 >that they would develop a product called ClearZone, which would >enable routers to capture e-mail, URLs, and other data before they >are encrypted and sent over the network that could then be given >to law enforcement agencies. I find it hard to understand the benefit to law enforcement agencies from this arrangement, let alone the privacy issue. If you are sending sensitive information over the Internet, surely you're already using end-to-end encryption with something like GPG, PGP, SSL, SSH, or swIPe (depending on the requirements of the transaction) rather than depending on your ISP or other carrier to keep your secrets safe. If you're not you should assume you're already compromised. Surely any reader of the Computer Underground Digest already knows this. Even if you're using a virtual network perimeter (also known as a Virtual Private Network, or VPN), unless you have the source code you have no way to tell where a back door might be hiding. ------------------------------ ------------------------------ Date: Thu, 25 Apr 1998 22:51:01 CST From: CuD Moderators <cudigest@sun.soci.niu.edu> Subject: File 7--Cu Digest Header Info (unchanged since 25 Apr, 1998) Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are available at no cost electronically. CuD is available as a Usenet newsgroup: comp.society.cu-digest Or, to subscribe, send post with this in the "Subject:: line: SUBSCRIBE CU-DIGEST Send the message to: cu-digest-request@weber.ucsd.edu DO NOT SEND SUBSCRIPTIONS TO THE MODERATORS. The editors may be contacted by voice (815-753-6436), fax (815-753-6302) or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115, USA. To UNSUB, send a one-line message: UNSUB CU-DIGEST Send it to CU-DIGEST-REQUEST@WEBER.UCSD.EDU (NOTE: The address you unsub must correspond to your From: line) CuD is readily accessible from the Net: UNITED STATES: ftp.etext.org (206.252.8.100) in /pub/CuD/CuD Web-accessible from: http://www.etext.org/CuD/CuD/ ftp.eff.org (192.88.144.4) in /pub/Publications/CuD/ aql.gatech.edu (128.61.10.53) in /pub/eff/cud/ world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/ wuarchive.wustl.edu in /doc/EFF/Publications/CuD/ EUROPE: nic.funet.fi in pub/doc/CuD/CuD/ (Finland) ftp.warwick.ac.uk in pub/cud/ (United Kingdom) The most recent issues of CuD can be obtained from the Cu Digest WWW site at: URL: http://www.soci.niu.edu/~cudigest/ COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted for non-profit as long as the source is cited. Authors hold a presumptive copyright, and they should be contacted for reprint permission. It is assumed that non-personal mail to the moderators may be reprinted unless otherwise specified. Readers are encouraged to submit reasoned articles relating to computer culture and communication. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Digest contributors assume all responsibility for ensuring that articles submitted do not violate copyright protections. ------------------------------ End of Computer Underground Digest #10.44 ************************************