[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= ========================================================================== = <=-[ HWA.hax0r.news ]-=> = ========================================================================== [=HWA'99=] Number 28 Volume 1 1999 Aug 7th 99 ========================================================================== [ 61:20:6B:69:64:20:63:6F:75: ] [ 6C:64:20:62:72:65:61:6B:20:74:68:69:73: ] [ 20:22:65:6E:63:72:79:70:74:69:6F:6E:22:! ] ========================================================================== Like all religions, the Holy Religion of the Invisible Pink Unicorn is based upon both Logic and Faith. We have Faith that She is Pink; and we Logically know that She is Invisible, because we can't see Her. - http://www.ozemail.com.au/~ksolway/athquot.html */ char x [5] = { 0xf0, 0x0f, 0xc7, 0xc8 }; main () { void (*f)() = x; f(); } New mirror site :http://www.ducktank.net/hwa/issues.html. HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net and www.digitalgeeks.com thanks to p0lix for the digitalgeeks bandwidth and airportman for the Cubesoft bandwidth. Also shouts out to all our mirror sites! tnx guys. http://www.csoft.net/~hwa http://www.digitalgeeks.com/hwa HWA.hax0r.news Mirror Sites: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.ducktank.net/hwa/issues.html. ** NEW ** http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT ** http://www.csoft.net/~hwa/ http://www.digitalgeeks.com/hwa. http://members.tripod.com/~hwa_2k http://welcome.to/HWA.hax0r.news/ http://www.attrition.org/~modify/texts/zines/HWA/ http://archives.projectgamma.com/zines/hwa/. http://www.403-security.org/Htmls/hwa.hax0r.news.htm For many, faith is a suitable substitute for knowledge, as death is for a difficult life. SYNOPSIS (READ THIS) -------------------- The purpose of this newsletter is to 'digest' current events of interest that affect the online underground and netizens in general. This includes coverage of general security issues, hacks, exploits, underground news and anything else I think is worthy of a look see. (remember i'm doing this for me, not you, the fact some people happen to get a kick/use out of it is of secondary importance). This list is NOT meant as a replacement for, nor to compete with, the likes of publications such as CuD or PHRACK or with news sites such as AntiOnline, the Hacker News Network (HNN) or mailing lists such as BUGTRAQ or ISN nor could any other 'digest' of this type do so. It *is* intended however, to compliment such material and provide a reference to those who follow the culture by keeping tabs on as many sources as possible and providing links to further info, its a labour of love and will be continued for as long as I feel like it, i'm not motivated by dollars or the illusion of fame, did you ever notice how the most famous/infamous hackers are the ones that get caught? there's a lot to be said for remaining just outside the circle... @HWA =-----------------------------------------------------------------------= Welcome to HWA.hax0r.news ... #28 =-----------------------------------------------------------------------= We could use some more people joining the channel, its usually pretty quiet, we don't bite (usually) so if you're hanging out on irc stop by and idle a while and say hi... ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** *** *** *** please join to discuss or impart news on techno/phac scene *** *** stuff or just to hang out ... someone is usually around 24/7*** *** *** *** Note that the channel isn't there to entertain you its for *** *** you to talk to us and impart news, if you're looking for fun*** *** then do NOT join our channel try #weirdwigs or something... *** *** we're not #chatzone or #hack *** *** *** ******************************************************************* =-------------------------------------------------------------------------= Issue #28 =--------------------------------------------------------------------------= [ INDEX ] =--------------------------------------------------------------------------= Key Intros =--------------------------------------------------------------------------= 00.0 .. COPYRIGHTS ...................................................... 00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC ....................... 00.2 .. SOURCES ......................................................... 00.3 .. THIS IS WHO WE ARE .............................................. 00.4 .. WHAT'S IN A NAME? why `HWA.hax0r.news'?.......................... 00.5 .. THE HWA_FAQ V1.0 ................................................ =--------------------------------------------------------------------------= Key Content =--------------------------------------------------------------------------= 01.0 .. GREETS .......................................................... 01.1 .. Last minute stuff, rumours, newsbytes ........................... 01.2 .. Mailbag ......................................................... 02.0 .. From the Editor.................................................. 03.0 .. Debunking the debunked by route.................................. 04.0 .. DefCon 7 by AgentX............................................... 05.0 .. Hacking Faq by ben-z 5/14/99..................................... 06.0 .. Group approves controversial software law ....................... 07.0 .. Falun Gong Web Sites Attacked by China? ......................... 08.0 .. Super Computer Almost Gets Away ................................. 09.0 .. Symantec's website hacked........................................ 10.0 .. New virus due to hit town "New virus spills your beans " - BBC... 11.0 .. New York Times Debunked - FIDNet Moves Ahead as Planned ......... 12.0 .. Computer `crackers' set sights on .gov for chaos................. 13.0 .. IIS Server 'hackproof'? ......................................... 14.0 .. Latest CWD Pokes at AntiOnline .................................. 15.0 .. High Profile Sites Defaced ...................................... 16.0 .. Off The Hook Goes Shortwave ..................................... 17.0 .. Feds Stop Satellite Biz due to WireTaps ......................... 18.0 .. InfoCriminals Should Face Reasonable Penalties .................. 19.0 .. L0pht Professional Plugin Pack For BO2K ......................... 20.0 .. MS Wants Free Publicity?......................................... 20.1 .. MS: a crashed site is hard to hack!.............................. 21.0 .. China Seeks to Develop Infowar Capabilities ..................... 22.0 .. Online Banking Still Risky Congress Says ........................ 23.0 .. NIPRNet Access Restricted ....................................... 24.0 .. Gov Employees Personal Privacy at Risk .......................... 25.0 .. Other Security Challenges Offered ............................... 25.1 .. Software developer offers hacker challenge....................... 26.0 .. CCC Camp About to Get Under Way ................................. 27.0 .. Hackers... Those Who Would Be Gods .............................. 28.0 .. European Crypto Mailing List .................................... 29.0 .. "Ya Wanna Be Hackers, Code Crackers, or just AOL Chat Room Yackers?" 30.0 .. WHO DO YOU WANT TO BE TODAY?..................................... 31.0 .. NAI GROUPSHIELD FOR EXCHANGE BUG................................. 32.0 .. How the blackhats work........................................... 33.0 .. ADMINS ASLEEP ON WATCH?.......................................... 34.0 .. THEFT HURTS THE WELL............................................. 35.0 .. MICROSOFT SECURITY FLAWS......................................... 36.0 .. CHINESE CYBER WARRIORS........................................... 37.0 .. MICROSOFT AND SECURITY (AGAIN)................................... 38.0 .. THE ENEMY WITHIN................................................. 39.0 .. DRUNKEN HACKERS ON JERRY SPRINGER................................ 40.0 .. DATA PROTECTION NOT TO BE IGNORED................................ 41.0 .. WIRELESS ENCRYPTION HANDHELDS.................................... 42.0 .. Y2K TO AID IN CYBERDEFENSE....................................... 43.0 .. BUGTRAQ:Yet Another ODBC Bugged ASP Sample Page.................. 44.0 .. New mailing lists offered by www.securityfocus.com............... 45.0 .. Beyond Virtual Vaccinations...................................... 46.0 .. Forgot your password? Try 'way2many' ......................... 47.0 .. A Former Network Administrator Faces Felony Charges in Hacker-Site Case 48.0 .. Kevin's life now, and happy birthday Kevin....................... 49.0 .. Cybercrime up 43%................................................ 50.0 .. Canada Can't Keep Up With CyberCrime ............................ 51.0 .. Germans hold bank liable for using 56 bit encryption............. 52.0 .. GPS Date Rollover on Aug 22 ..................................... 53.0 .. NY Police Face Possible Copyright Violations .................... 54.0 .. Chaos Computer Club: Happy Hacker Campers........................ 55.0 .. Hackers and Cyberwar "The Threat of Chaos " ................. 56.0 .. Lockdown 2000.................................................... 57.0 .. The SMURF attack and smurf amplifiers............................ =--------------------------------------------------------------------------= AD.S .. Post your site ads or etc here, if you can offer something in return thats tres cool, if not we'll consider ur ad anyways so send it in. ads for other zines are ok too btw just mention us in yours, please remember to include links and an email contact. Corporate ads will be considered also and if your company wishes to donate to or participate in the upcoming Canc0n99 event send in your suggestions and ads now...n.b date and time may be pushed back join mailing list for up to date information....................................... Current dates: Aug19th-22nd Niagara Falls... ................. Ha.Ha .. Humour and puzzles ............................................ Hey You!........................................................ =------=........................................................ Send in humour for this section! I need a laugh and its hard to find good stuff... ;)........................................... SITE.1 .. Featured site, ................................................. H.W .. Hacked Websites ............................................... A.0 .. APPENDICES...................................................... A.1 .. PHACVW linx and references...................................... =--------------------------------------------------------------------------= @HWA'99 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ). Important semi-legalese and license to redistribute: YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE APPRECIATED the current link is http://welcome.to/HWA.hax0r.news IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL ME PRIVATELY current email cruciphux@dok.org THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS: I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE AND REDISTRIBUTE/MIRROR. - EoD Although this file and all future issues are now copyright, some of the content holds its own copyright and these are printed and respected. News is news so i'll print any and all news but will quote sources when the source is known, if its good enough for CNN its good enough for me. And i'm doing it for free on my own time so pfffft. :) No monies are made or sought through the distribution of this material. If you have a problem or concern email me and we'll discuss it. cruciphux@dok.org Cruciphux [C*:.] 00.1 CONTACT INFORMATION AND MAIL DROP ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Wahoo, we now have a mail-drop, if you are outside of the U.S.A or Canada / North America (hell even if you are inside ..) and wish to send printed matter like newspaper clippings a subscription to your cool foreign hacking zine or photos, small non-explosive packages or sensitive information etc etc well, now you can. (w00t) please no more inflatable sheep or plastic dog droppings, or fake vomit thanks. Send all goodies to: HWA NEWS P.O BOX 44118 370 MAIN ST. NORTH BRAMPTON, ONTARIO CANADA L6V 4H5 WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are ~~~~~~~ reading this from some interesting places, make my day and get a mention in the zine, send in a postcard, I realize that some places it is cost prohibitive but if you have the time and money be a cool dude / gal and send a poor guy a postcard preferably one that has some scenery from your place of residence for my collection, I collect stamps too so you kill two birds with one stone by being cool and mailing in a postcard, return address not necessary, just a "hey guys being cool in Bahrain, take it easy" will do ... ;-) thanx. Ideas for interesting 'stuff' to send in apart from news: - Photo copies of old system manual front pages (optionally signed by you) ;-) - Photos of yourself, your mom, sister, dog and or cat in a NON compromising position plz I don't want pr0n. - Picture postcards - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250 tapes with hack/security related archives, logs, irc logs etc on em. - audio or video cassettes of yourself/others etc of interesting phone fun or social engineering examples or transcripts thereof. Stuff you can email: - Prank phone calls in .ram or .mp* format - Fone tones and security announcements from PBX's etc - fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities) - reserved for one smiley face -> :-) <- - PHACV lists of files that you have or phac cd's you own (we have a burner, *g*) - burns of phac cds (email first to make sure we don't already have em) - Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp* If you still can't think of anything you're probably not that interesting a person after all so don't worry about it Our current email: Submissions/zine gossip.....: hwa@press.usmc.net Private email to editor.....: cruciphux@dok.org Distribution/Website........: sas72@usa.net @HWA 00.2 Sources *** ~~~~~~~~~~~ Sources can be some, all, or none of the following (by no means complete nor listed in any degree of importance) Unless otherwise noted, like msgs from lists or news from other sites, articles and information is compiled and or sourced by Cruciphux no copyright claimed. News & I/O zine ................. http://www.antionline.com/ Back Orifice/cDc..................http://www.cultdeadcow.com/ News site (HNN) .....,............http://www.hackernews.com/ Help Net Security.................http://net-security.org/ News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/ NewsTrolls .(daily news ).........http://www.newstrolls.com/ News + Exploit archive ...........http://www.rootshell.com/beta/news.html CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest News site+........................http://www.zdnet.com/ News site+Security................http://www.gammaforce.org/ News site+Security................http://www.projectgamma.com/ News site+Security................http://securityhole.8m.com/ News site+Security related site...http://www.403-security.org/ *DOWN* News/Humour site+ ................http://www.innerpulse.com News/Techie news site.............http://www.slashdot.org +Various mailing lists and some newsgroups, such as ... +other sites available on the HNN affiliates page, please see http://www.hackernews.com/affiliates.html as they seem to be popping up rather frequently ... http://www.the-project.org/ .. IRC list/admin archives http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk alt.hackers.malicious alt.hackers alt.2600 BUGTRAQ ISN security mailing list ntbugtraq <+others> NEWS Agencies, News search engines etc: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.cnn.com/SEARCH/ http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0 http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack http://www.ottawacitizen.com/business/ http://search.yahoo.com.sg/search/news_sg?p=hack http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack http://www.zdnet.com/zdtv/cybercrime/ http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column) NOTE: See appendices for details on other links. http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm http://freespeech.org/eua/ Electronic Underground Affiliation http://ech0.cjb.net ech0 Security http://axon.jccc.net/hir/ Hackers Information Report http://net-security.org Net Security http://www.403-security.org Daily news and security related site Submissions/Hints/Tips/Etc ~~~~~~~~~~~~~~~~~~~~~~~~~~ All submissions that are `published' are printed with the credits you provide, if no response is received by a week or two it is assumed that you don't care wether the article/email is to be used in an issue or not and may be used at my discretion. Looking for: Good news sites that are not already listed here OR on the HNN affiliates page at http://www.hackernews.com/affiliates.html Magazines (complete or just the articles) of breaking sekurity or hacker activity in your region, this includes telephone phraud and any other technological use, abuse hole or cool thingy. ;-) cut em out and send it to the drop box. - Ed Mailing List Subscription Info (Far from complete) Feb 1999 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~ ISS Security mailing list faq : http://www.iss.net/iss/maillist.html THE MOST READ: BUGTRAQ - Subscription info ~~~~~~~~~~~~~~~~~~~~~~~~~~~ What is Bugtraq? Bugtraq is a full-disclosure UNIX security mailing list, (see the info file) started by Scott Chasin . To subscribe to bugtraq, send mail to listserv@netspace.org containing the message body subscribe bugtraq. I've been archiving this list on the web since late 1993. It is searchable with glimpse and archived on-the-fly with hypermail. Searchable Hypermail Index; http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html Link About the Bugtraq mailing list ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following comes from Bugtraq's info file: This list is for *detailed* discussion of UNIX security holes: what they are, how to exploit, and what to do to fix them. This list is not intended to be about cracking systems or exploiting their vulnerabilities. It is about defining, recognizing, and preventing use of security holes and risks. Please refrain from posting one-line messages or messages that do not contain any substance that can relate to this list`s charter. I will allow certain informational posts regarding updates to security tools, documents, etc. But I will not tolerate any unnecessary or nonessential "noise" on this list. Please follow the below guidelines on what kind of information should be posted to the Bugtraq list: + Information on Unix related security holes/backdoors (past and present) + Exploit programs, scripts or detailed processes about the above + Patches, workarounds, fixes + Announcements, advisories or warnings + Ideas, future plans or current works dealing with Unix security + Information material regarding vendor contacts and procedures + Individual experiences in dealing with above vendors or security organizations + Incident advisories or informational reporting Any non-essential replies should not be directed to the list but to the originator of the message. Please do not "CC" the bugtraq reflector address if the response does not meet the above criteria. Remember: YOYOW. You own your own words. This means that you are responsible for the words that you post on this list and that reproduction of those words without your permission in any medium outside the distribution of this list may be challenged by you, the author. For questions or comments, please mail me: chasin@crimelab.com (Scott Chasin) Crypto-Gram ~~~~~~~~~~~ CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on cryptography and computer security. To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a blank message to crypto-gram-subscribe@chaparraltree.com.  To unsubscribe, visit http://www.counterpane.com/unsubform.html.  Back issues are available on http://www.counterpane.com. CRYPTO-GRAM is written by Bruce Schneier.  Schneier is president of Counterpane Systems, the author of "Applied Cryptography," and an inventor of the Blowfish, Twofish, and Yarrow algorithms.  He served on the board of the International Association for Cryptologic Research, EPIC, and VTW.  He is a frequent writer and lecturer on cryptography. CUD Computer Underground Digest ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This info directly from their latest ish: Computer underground Digest    Sun  14 Feb, 1999   Volume 11 : Issue 09                             ISSN  1004-042X        Editor: Jim Thomas (cudigest@sun.soci.niu.edu)        News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)        Archivist: Brendan Kehoe        Poof Reader:   Etaion Shrdlu, Jr.        Shadow-Archivists: Dan Carosone / Paul Southworth                           Ralph Sims / Jyrki Kuoppala                           Ian Dickinson        Cu Digest Homepage: http://www.soci.niu.edu/~cudigest [ISN] Security list ~~~~~~~~~~~~~~~~~~~ This is a low volume list with lots of informative articles, if I had my way i'd reproduce them ALL here, well almost all .... ;-) - Ed Subscribe: mail majordomo@repsec.com with "subscribe isn". @HWA 00.3 THIS IS WHO WE ARE ~~~~~~~~~~~~~~~~~~ Some HWA members and Legacy staff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cruciphux@dok.org.........: currently active/editorial darkshadez@ThePentagon.com: currently active/man in black fprophet@dok.org..........: currently active/IRC+ man in black sas72@usa.net ............. currently active/IRC+ distribution vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black dicentra...(email withheld): IRC+ grrl in black eentity ...( '' '' ): Currently active/IRC+ man in black Foreign Correspondants/affiliate members ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Qubik ............................: United Kingdom D----Y ...........................: USA/world media HWA members ......................: World Media Past Foreign Correspondants (currently inactive or presumed dead) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ N0Portz ..........................: Australia system error .....................: Indonesia Wile (wile coyote) ...............: Japan/the East Ruffneck ........................: Netherlands/Holland Please send in your sites for inclusion here if you haven't already also if you want your emails listed send me a note ... - Ed Spikeman's site is down as of this writing, if it comes back online it will be posted here. http://www.hackerlink.or.id/ ............ System Error's site (in Indonesian) ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** ******************************************************************* :-p 1. We do NOT work for the government in any shape or form.Unless you count paying taxes ... in which case we work for the gov't in a BIG WAY. :-/ 2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news events its a good idea to check out issue #1 at least and possibly also the Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ... @HWA 00.4 Whats in a name? why HWA.hax0r.news?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Well what does HWA stand for? never mind if you ever find out I may have to get those hax0rs from 'Hackers' or the Pretorians after you. In case you couldn't figure it out hax0r is "new skewl" and although it is laughed at, shunned, or even pidgeon holed with those 'dumb leet (l33t?) dewds' this is the state of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you up and comers, i'd highly recommend you get that book. Its almost like buying a clue. Anyway..on with the show .. - Editorial staff @HWA 00.5 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Also released in issue #3. (revised) check that issue for the faq it won't be reprinted unless changed in a big way with the exception of the following excerpt from the FAQ, included to assist first time readers: Some of the stuff related to personal useage and use in this zine are listed below: Some are very useful, others attempt to deny the any possible attempts at eschewing obfuscation by obsucuring their actual definitions. @HWA - see EoA ;-) != - Mathematical notation "is not equal to" or "does not equal" ASC(247) "wavey equals" sign means "almost equal" to. If written an =/= (equals sign with a slash thru it) also means !=, =< is Equal to or less than and => is equal to or greater than (etc, this aint fucking grade school, cripes, don't believe I just typed all that..) AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21) AOL - A great deal of people that got ripped off for net access by a huge clueless isp with sekurity that you can drive buses through, we're not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the least they could try leasing one?? *CC - 1 - Credit Card (as in phraud) 2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's CCC - Chaos Computer Club (Germany) *CON - Conference, a place hackers crackers and hax0rs among others go to swap ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk watch videos and seminars, get drunk, listen to speakers, and last but not least, get drunk. *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker speak he's the guy that breaks into systems and is often (but by no means always) a "script kiddie" see pheer 2 . An edible biscuit usually crappy tasting without a nice dip, I like jalapeno pepper dip or chives sour cream and onion, yum - Ed Ebonics - speaking like a rastafarian or hip dude of colour also wigger Vanilla Ice is a wigger, The Beastie Boys and rappers speak using ebonics, speaking in a dark tongue ... being ereet, see pheer EoC - End of Commentary EoA - End of Article or more commonly @HWA EoF - End of file EoD - End of diatribe (AOL'ers: look it up) FUD - Coined by Unknown and made famous by HNN - "Fear uncertainty and doubt", usually in general media articles not high brow articles such as ours or other HNN affiliates ;) du0d - a small furry animal that scurries over keyboards causing people to type weird crap on irc, hence when someone says something stupid or off topic 'du0d wtf are you talkin about' may be used. *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to define, I think it is best defined as pop culture's view on The Hacker ala movies such as well erhm "Hackers" and The Net etc... usually used by "real" hackers or crackers in a derogatory or slang humorous way, like 'hax0r me some coffee?' or can you hax0r some bread on the way to the table please?' 2 - A tool for cutting sheet metal. HHN - Maybe a bit confusing with HNN but we did spring to life around the same time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper noun means the hackernews site proper. k? k. ;& HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d MFI/MOI- Missing on/from IRC NFC - Depends on context: No Further Comment or No Fucking Comment NFR - Network Flight Recorder (Do a websearch) see 0wn3d NFW - No fuckin'way *0WN3D - You are cracked and owned by an elite entity see pheer *OFCS - Oh for christ's sakes PHACV - And variations of same Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare Alternates: H - hacking, hacktivist C - Cracking C - Cracking V - Virus W - Warfare A - Anarchy (explosives etc, Jolly Roger's Cookbook etc) P - Phreaking, "telephone hacking" PHone fREAKs ... CT - Cyber Terrorism *PHEER - This is what you do when an ereet or elite person is in your presence see 0wn3d *RTFM - Read the fucking manual - not always applicable since some manuals are pure shit but if the answer you seek is indeed in the manual then you should have RTFM you dumb ass. TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0 TBA - To Be Arranged/To Be Announced also 2ba TFS - Tough fucking shit. *w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions from the underground masses. also "w00ten" 2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers) *wtf - what the fuck, where the fuck, when the fuck etc .. *ZEN - The state you reach when you *think* you know everything (but really don't) usually shortly after reaching the ZEN like state something will break that you just 'fixed' or tweaked. @HWA -=- :. .: -=- 01.0 Greets!?!?! yeah greets! w0w huh. - Ed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks to all in the community for their support and interest but i'd like to see more reader input, help me out here, whats good, what sucks etc, not that I guarantee i'll take any notice mind you, but send in your thoughts anyway. * all the people who sent in cool emails and support FProphet Pyra TwstdPair _NeM_ D----Y Dicentra vexxation sAs72 Spikeman p0lix Ken Williams/tattooman of PacketStorm, hang in there Ken...:( & Kevin Mitnick (Happy Birthday) kewl sites: + http://www.securityportal.com/ NEW + http://www.securityfocus.com/ NEW + http://www.hackcanada.com/ + http://www.l0pht.com/ + http://www.2600.com/ + http://www.freekevin.com/ + http://www.genocide2600.com/ + http://www.packetstorm.harvard.edu/ ******* DOWN (THANKS JP) ****** + http://www.hackernews.com/ (Went online same time we started issue 1!) + http://www.net-security.org/ + http://www.slashdot.org/ + http://www.freshmeat.net/ + http://www.403-security.org/ + http://ech0.cjb.net/ @HWA 01.1 Last minute stuff, rumours and newsbytes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "What is popular isn't always right, and what is right isn't always popular..." - FProphet '99 +++ When was the last time you backed up your important data? ++ SOPHOS WITH OXFAM From www.net-security.org/ by BHZ, Thursday 5th August 1999 on 1:58 pm CET Oxfam (www.oxfam.org), Britain's largest overseas aid charity, which employs over 250000 people, evaluated all anti-virus products on the market and chose Sophos (www.sophos.com) for securing their WANs, servers, workstations and laptops of viruses. ++ MICROSOFT STILL WORKING From www.net-security.org/ by BHZ, Thursday 5th August 1999 on 1:49 pm CET Microsoft is still trying to patch a bug in Office97, that we reported about earlier. Microsoft's group product manager for Office said: "Right now we are thoroughly testing the solution, We take all security issues seriously. To date, we have not heard from any customers on the issue". ++ Y2K IN SCHOOL SYSTEMS From www.net-security.org/ by BHZ, Thursday 5th August 1999 on 1:25 pm CET New draft about Y2K problem in schools and universities, says some very disturbing news - less that one third of all school institutions reported that they are Y2K compliant. Draft concludes that: "a troubling number of institutions, especially in the elementary/secondary area, have not yet completed their assessment of systems and are lagging in remediation and testing." ++ JAPAN WILL HALT TRAINS From www.net-security.org/ by BHZ, Thursday 5th August 1999 on 1:53 pm CET Spokesman from East Japan Railway Co., Japan's largest rail company said that they will halt all trains on the last day of this millennium. It will last just for couple of minutes - last minutes of 1999 and several minutes in the year 2000. This will all be done as a precaution against possible Y2K errors. ++ OUTDOOR GEEKS MAY VANISH SOON (TECH. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/technology/story/21098.html Weekend warriors take to the oceans, forests, rivers, and skies this month, and they'll get back home with the help of GPS. Unless the gear crashes. By James Glave. ++ DROP OUT AND CASH IN (BUS. 9:00 am) http://www.wired.com/news/news/email/explode-infobeat/business/story/21116.html Score one more for the geeks who drop out of school. A 21-year-old from Dallas sells his hardware review Web site to EarthWeb for millions. By Chris Gaither. ++ Y2K CZAR: FEDS IN GOOD SHAPE (BUS. 9:00 am) http://www.wired.com/news/news/email/explode-infobeat/business/story/21114.html In his quarterly report, John Koskinen says things look good at a national level, but some local systems are iffy. Also: Warner Bros. pushes Iron Giant on the Web.... AOL, BigE in Latin American deal.... Everyone wants a robodog.... And more. ++ A NUTS-AND-BOLTS HOUSEKEEPER (TECH. 3:00 am) http://www.wired.com/news/news/email/explode-infobeat/technology/story/21060.html To hell with your Hoover. A new domestic robot will vacuum your floor and carry the dishes for you. But your new housemate is a long way from having a personality. By Lindsey Arent. ++ COURT HAS A NASTY WORD FOR MS (POL. Wednesday) http://www.wired.com/news/news/email/explode-infobeat/politics/story/21096.html As if Microsoft weren't having enough trouble with the courts these days, jurists are upset because Word 97 is doing a lousy job word-counting legal briefs. By Declan McCullagh. ++ A PALM IN THE TOOL BELT (TECH. Wednesday) http://www.wired.com/news/news/email/explode-infobeat/technology/story/21094.html Construction workers are using PalmPilots onsite to download blueprints and help plan for the weather. Staying connected is yielding concrete results. By Lindsey Arent. ++ MICROWORKZ SIGNS ON AT&T (TECH. Wednesday) http://www.wired.com/news/news/email/explode-infobeat/technology/story/21091.html Dumped by Earthlink just days ago, the PC provider smoothes its feathers and turns to AT&T to provide iToaster customers with free Net access. ++ RIAA, DIAMOND SWEEP AWAY SUIT (POL. Wednesday) http://www.wired.com/news/news/email/explode-infobeat/politics/story/21089.html The recording industry makes peace with the MP3 maker, but questions over a new standard raises a new question: Will it last? By Chris Oakes. Thanks to myself for providing the info from my wired news feed and others from whatever sources, also to Spikeman for sending in past entries.... - Ed @HWA 01.2 MAILBAG - email and posts from the message board worthy of a read ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 02.0 From the editor. ~~~~~~~~~~~~~~~~ #include #include #include main() { printf ("Read commented source!\n\n"); /*A mixed bag of nuts in this issue, read on and enjoy..hope you *find something interesting or useful... * issue #28 * * hwa@press.usmc.net * */ printf ("EoF.\n"); } Congrats, thanks, articles, news submissions and kudos to us at the main address: hwa@press.usmc.net complaints and all nastygrams and mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to 127.0.0.1, private mail to cruciphux@dok.org danke. C*:. 03.0 Debunking the debunked by route ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.antionline.com Debunking The Debunked Wednesday, July 28, 1999 at 23:57:30 by Mike D. Schiffman - Reprinted With Permission In a 16-foot wide 9-year old trailer park home in New Mexico, a 52-year old delusional woman sits in front of a computer toiling away on a non-technical "hacking" document fraught with errors. You might remember Carolyn P Meinel as 'The Happy Hacker' from such E-Files as "A Weekend Without My Zoloft" and the underground classic "Has Anyone Seen My Dignity?" Although some people would like to classify Carolyn as 'merely' delusional or talent-less, our research has added 'washed-up crackpot' and 'media charlatan.' Often we wonder how Carolyn has achieved so little over so much time, and with this brief interlude, we peel back the layers of the onion with an exclusive report from DefCon7. As it happened during the weekend of July 9th in Las Vegas, NV at the seventh installment of the DefCon Security Convention, it appears that Carolyn forgot her medicine. And these aren't simple antibiotics or histamine blockers (although she could probably use those too). No dear friends, these are powerful psycho-reactive mind-altering chemicals such as sertaline hydrochloride and diazepam. This woman has serious mental problems that require medication and treatment. We caught up with Carolyn in the hotel bar at the Alexis Park, this interviewer was participating in some lighthearted revelry with friends and cohorts, enjoying the ebb and flow of the convention we've come to know and love... Late into the night we had a great time recounting times past. As the night progressed, we moved the group out of the bar into the hotel foyer where our merriment was abruptly halted. The foul stench of insanity lingered in that part of the hotel, and it was instantly known to all that Carolyn was upon us. Initially, I found myself finding a good deal of humor with her attire, I pondered the drifter's corpse that she absconded her dress from, and focused on my mission at hand. The question on everyone's lips: "Is Virginia here this year?" However, before I could gather my senses, a whirlwind of stupidity was unleashed as Carolyn's disease attempted to spread to another mind. With her gaping maw open, she turned the boring-machine up to 11 and hosed down an unsuspecting convention-goer. With all that had happened, I was stunned. This was the heaviest blow of all. I could find no other recourse but to confront her on one of the numerous topics that burn in the scene. It was, at that time still unclear to me why she had misinformed the FBI that I was involved in HFG, and I decided to question her on that, in the hopes of two results. Intended result #1 was to shut her the fuck up for a minute. Intended result #2 was to get an explanation, apology, or at best a rationalization. However, as she turned to me with the vapid stare of ignorance, I knew no one could win this battle. No good would come from this conversation, and Carolyn made sure of that. Initially, Carolyn feigned stupidity (which was eerily convincing, but even the best lies are peppered with truth) and claimed she didn't know me. Having dealt with this woman numerous times (including a few *shudder* face-to-face meetings) and given she tried to implicate me within the ranks of HFG, the ruse lacked even humor, as the attempt was so weak. After a few hot comments were traded, Carolyn's attempt at throwing down the gauntlet was to challenge myself and my cohorts to 'hack' into her modified Linux box. Now, perhaps Carolyn misunderstands the way the new generation of hacker-types operate. First of all, we don't get out of bed for less than a hundred dollars. And we certainly don't waste our time breaking into a machine that serves no real purpose. Why Carolyn used her box in the capture the flag competition as a challenge is beyond us, as her personal website has been hacked more times than are worth counting. And honestly, at this point, who hasn't received a DCC offer of her mailbox or home directory tarred up? If that is not evidence of her inability to truly secure a box, then I don't know what is. Granted, she wished to rest on her insignificant laurels, and a subtle crack about using finger to break into her box was sufficient to diffuse that portion of the conversation. With her last karate-inept leg kicked out from underneath her, Carolyn attempted to leave with a modicum of respectability, which sadly slipped from her grasp due to her own failings and incompetence... The Granny Hacker from Heck? Hardly (except the older-than-dirt part). The Clown Princess? I suppose this is half true. Clowns are an amusing sort, accustomed to being ridiculed. But I think she missed the princess bit by about 30 years. The Happy Hacker? She didn't seem very happy to us. Especially with the 3 part Antionline article, that starts off attempting to be slightly informational, but ends up being a diatribe of self-promotion and bitter remarks about convention goers. No Carolyn, you're not part of "the club". We're sorry, but you're too crazy, too medicated, too old, and too stupid. Also, Carolyn, you had more than a week between the end of DefCon and the posting of the Antionline article. The best insult you could come up with was to say I `pumped my muscles up with a bike pump`? I mean, what sort of 1940's street-tough book of insults are you consulting? Double dumbass on you Carolyn. Contrary to what she swears up and down, Carolyn Meinel is indeed a confidential informant for the Federal Bureau of Investigation, and her status is listed as "MI" and "PS". MI indicates that the informant suffers from a mental or emotional dysfunction, and all information must be scrutinized as such. PS means that she is a probable suspect. This is why the FBI polygraphed her. Do you trust her? Now, don't get us wrong. We actually like Carolyn Meinel. As Virii makers have a symbiotic relationship with companies that make Anti-Virii software, true hackers and their ilk have a symbiotic relationship with the uninformed vocal nay-sayers that try to misinform the public as to our actions. Without Carolyn, no one would know how great we really are. It is impossible to fully appreciate what `good` is when you have no frame of reference in understanding what `bad` is. For this, we can only thank you Carolyn. Your efforts and misinformation only further our roles as highly paid debunkers of your insanity. When you're 65 and retired, or possibly deceased -- we'll just be entering the prime of our lives and professional careers. If you're still around then and your descent into lunacy hasn't pushed you over the brink, look us up. We love clowns. And, by the way Carolyn, do send Virginia my love. @HWA 04.0 DefCon 7 by Agent X ~~~~~~~~~~~~~~~~~~~ (Thanks to Agent X for permission to reprint this - Ed) Defcon 7 by Agent X Prelude Defcon baby, yeah that's the ticket, hackers, computer security consultants, feds, kooks, surveillance geeks, and a whole slew of other weird ass spooky mother fuckers, get drunk, go to titty bars, talk about crypto and network security, fucking with the media, blowing shit up in the desert and generally have a great fucking time in the city of sin all under the guise of a computer security convention. And if they are lucky or sneaky paid for by their respective bosses. I am neither lucky or sneaky so I'm paying for this out of my own pocket, which by the way sucks. But I'm ready the tickets are bought the gear is packed. I have fortified myself for this trip, with a bowl of corn flakes, a cache of CDs, and a hangover. I dry swallow two Alleve as I step out the door. The 3 hour bus ride to the airport was about as exciting as a 3 hour a bus ride can be. In other words deathly boring. But the headache is gone. I'm at the airport lounge, drinking a L.I.T and trying to figure out if 7 buck is to much to pay for a burger. Airports are about the most boring places to be stranded for any length of time as well. The televisions only show 2 things, golf or 5 minute news reels. The food is generic and expensive. And there is no fucking place to check my e-mail. Only another 4 hours till my plane leaves. The Plane: It's a sign when 12 mothers carrying screaming babies get on the flight. We hit the worst turbulence I have ever seen or felt. [the guy beside just used his barf bag for it's intend purpose]. I can see it now the wings snap off and barrrroooooooom! I'm just another flight statistic. Wouldn't that just be the rats asshole to die on the way to Detroit. [Note at this point this article goes into short hand mode, there was just to much happening to quickly for me to mention, remember or talk about] Friday From this point on things be come an insane blur of meeting new people and getting things done. I arrive 3 hours late to the hotel, the people I'm staying with had a hell of a time checking in and I'm exhausted , I have a glass of water and go to bed. Friday First day of con I get up, get dressed and eat some breakfast all by 7:00. To do my part by gooning at the con. Big mistake It's a mad rush after that, from getting a goon badge to working on pre-registration. The List for registration is great except that it's not in any order. So I GREP the whole list a couple of hundred times during the con. I check people in all day long. By the end of the day I know almost everyone at con who is on the list. Naked people count for Friday: 1 guy gets up on a table and strips down to his G-string, 2 naked fat guys jog around the vendor area for free t-shirts 1 babe hops up and a table and gives everybody a show of her tits. I love Vegas. The day is hectic and long. I'm exhaust by the time I sit down at 7:17 to write this before heading out to the MGM grand for some dinner. Vegas is a weird as ass place. New York New York the most disturbing of all. The fake graffiti, the fake manhole cover with fake steam, all in fake NYC it is not right I was just waiting for a fake mugging in a fake dark and dirty alley. After getting back to the hotel I collapsed on the bed. Saturday Slept a hard 8 hours last night, got up and help register people, mad craziness more people then you could possibly images. All of them young white males. Checked out the DJ action, saw my ghetto hacker buddies TDA and Jester 47 spin some mad tunes to Ninja Scroll video. The CDC show rocked ass. Total mayhem, with a revival theme, it doesn't get much better then this. Things slowed down a bit. Checked press badge for the After CDC presentation in the media suite. Went up and talked with some media types. Got to see what the media is like in action. I expected to hear some really probing question that were well researched and insightful. They weren't, nuff said. Finally got to chill about 7 or 8 helped set up for the root suite party. Went back to my room changed and got booze, went back to the root suite and proceed to drop a complete bottle of tequila on the floor. Saturday night Mad partying in the root suite Saturday night. I played bartender for most of the night, pouring DoC beers, serving punch and mixing drinks. Dis Org Crew beer was great. The Strawberry SYN Flood was smooth and sweet, the Brown Box Barley Wine was strong as hell, and the FireWire Stout which is fortified with caffeine is the perfect hacker beer. Congrats to HCF, Wyatt Earp, Pete Shipley and the rest of the DoC who helped for a great beer. Caezar defiantly knows how to throw a party. Towards the end of the night I was getting help from Jennifer Grannick. Left about 4 or 5 went back to the room and slept like the dead. Slept for 2 hours and got back up. I had a English muffin for breakfast it was good. Sunday By Sunday the kinks had been somewhat worked out and things were finally running reasonable smoothly, I helped with this and that. Sold shirt and mugs for the better part of the morning, some guy wanted to trade a rental car for a t-shirt, I told him to get permission from Priest. He ended up trading us some porno passes for a shirt instead. Finally had lunch with some cool people's one of which was with the NSA. After lunch I'm up in the media/goon lounge resting and eating some fruit with Major Malfunction when his radio goes off, "all goons to the NOC" and then "Carolyn is being kicked out" Needless to say Carolyn got kicked out of con.. I'm sure that she will write all about it on her web site. I'm sure she will paint herself as the victim, either way I don't care, she is an adult and she should have known better. After word I wandered around some more. Said good-bye to all the people I could find. Went back to the hotel grabbed my bag want got on a plane fell asleep. Switch planes fell asleep. got off plane got on bus fell asleep, switch busses fell asleep. Got off bus got home fell asleep. ....till next year. Quotes from the weekend: A short conversation I had with some newbie kid who wandered into the root party. " So your in l0pht" " oh yeah me and the rest of the east coast people" "really" "My son did his first hack at age 7, I was so proud." Major Malfunction. Who Agent X is a slacker. The views, commentary and ideas expressed in this article are not those of Hacker News Network, it's Editors or the Defcon Organizers. I own my own words. Agent_X@flashmail.com Links referenced in the original HTML version of this article: http://www.defcon.org http://www.cultdeadcow.com/ http://www.dis.org/doc.html http://www.dis.org/warz/beer.html http://www.caezarschallenge.org/ @HWA 05.0 Hacking Faq by ben-z 5/14/99 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ There are a number of "hacking faqs" around the net most of which date back at the very least to 1996 this is one of the few 'new' ones i've come across, so i've decided to share it here for your reading pleasure, its aimed at the 'newbie hacker' and is written by a well known underground denizen, ben-z - Ed Found at http://come.to/sota [**] FAQ: Hacking @ 5/14/99 by ben-z [**] NOTE: if date > */2000, dont bother reading this. http://www.slacknet.org | benz@slacknet.org A. Section [I] -- Beginners (index) 01. How do i tell if a system is running UNIX? 02. How do i determine which flavor of UNIX a system runs? 03. What exactly happens when i "hack" UNIX? 04. Do I need an account on a system to hack it? 05. What is DoS? 06. How do I protect myself from DoS attacks? 07. What is a buffer overflow? 08. What are some good web/ftp sites for UNIX? 09. What is BSD? 10. What is Linux? 11. What does x86 have to do with anything? 12. What else is there besides x86 systems? 13. What are some commonly open services to look for? 14. What is the easiest way to hack a system right now? 15. Can i hack anything from windows? 16. Why is Linux a better OS than windows? 17. What is suid/sgid? 18. Where is the best source of info for newbies? 19. How much trouble can I get in for hacking? 20. What kind of system should I try hacking first? (Q/A) 01. How do i tell if a system is running UNIX? A: There are several ways to determine the operating system of a remote system. The first and foremost way to determine if a system is running UNIX is to both telnet and ftp to it, then check the login message. For telnet, if you get anything like BSD, UNIX, Linux, AIX, IRIX, or HPUX then it is most likely a unix system. However, it is possible to change the message displayed (/etc/issue.net) when a telnetd connection is established, so telnet banner grabbing is not always the most reliable. Via ftp, you can usually make a fairly accurate guess at the OS by looking at the ftpd version. If you see something like wu, ncfptd, or proftpd, then it is a UNIX system. Most large ftp archives run UNIX, but just in case, look for a message containing "Microsoft" or "Serv-U", which do not run on anything but ms windows (bad!). Another more accurate way of determining the OS is to examine the packets via predetermined OS fingerprints. There are several packages out now which do this, the best of them being nmap by fyodor (http://www.insecure.org/nmap), and queso by els apostols. These simply scan the open ports on a system and attempt to find a match for the packet types. Nmap currently includes hundreds of OS fingerprints, and is known for its accuracy and speed. OS fingerprinting is not one-hundred percent accurate either; the details of this are too complex for this paper. Basically, some system administrators change the look of the outgoing packets to fool your scanner into thinking it is something else, or give it no reading whatsoever. the details are available at http://www.geek-girl.com/bugtraq. 02. How do i determine which flavor of UNIX a system runs? A: (see telnet banner grabbing description above) -- telnet banners often reveal which OS and version the system is running. If you have local access to the machine (an account), then you can type uname -a to see some system information. On Linux, you can cd to /proc and cat cpuinfo for other interesting stats. If the system is running RedHat Linux, then a file exists in /etc called redhat-release which contains the release and version of the system. I am also working on a package to determine the distrobution of a system via comparing rpm's to known fingerprints (similar to nmap), thus making it easier to find an exploit which will work on the system. 03. What exactly happens when i "hack" UNIX? A: To know whether or not you have successfully "hacked" a UNIX system, there are a few commands you need to be familiar with: _______________________________________________________________________________ | command | description | |-----------------------------------------------------------------------------| | id | prints your current UID/GID. 0 = root = success! | | whoami | determines which user you are logged in as. | | set | shows a list of some system variables including $USER and $EUID. | ------------------------------------------------------------------------------- If you don't know what root is, then you need to do some background UNIX research before reading this again. Otherwise, here are a few other tricks to see if you are really root. a. bash prompt: When logged in as a normal user, you usually have a prompt similar to bash$. As root, your prompt defaults to bash#. b. system variables: typing echo "$USER / $EUID" *should* effectively tell you which user the system thinks you are. c. file access: As root, you should have access to read/write most files. Try logging in as a normal user and reading /etc/shadow or /etc/passwd. Most systems do not allow normal users to read these files for security reasons however, if you are root, you may read/write them as you wish. 04. Do I need an account on a system to hack it? A: No. Many systems can be compromised remotely via overflows in vulnerable services running. This is the main difference between hacking UNIX and NT: UNIX was designed with remote administration in mind, thus making it easier to manipulate once access is obtained. With NT, no telnet daemon is present, and playing around usually requires your presence at the actual system itself. Of course anyone with 1/2 of a brain can secure their system from remote attacks, so a local account is a definate bonus. 05. What is DoS? A: No kiddies, this isnt C:\DOS. This is Denial of Service, a very deadly (and lame) concept. As there are very few useful purposes for DoS, it is mostly used to show power and skill, even though it requires almost no skill whatsoever. The only useful reason i can think of to DoS a system is for spoofing purposes: when a system is taken off of a LAN, you can change your address to the one you knocked off, and intercept vital information and user passwords. This is explained in detail at http://www.rootshell.com (under documentation) look for whitepapers on tcp hijacking. Ok, back to my explanation of DoS. Denial of Service by definition is simply denying service to any machine on a network, thus causing problems and/or crashing the system. The most popular DoS attacks out right now (to my limited knowledge) are papasmurf, boink/poink, feh, smack, bmb, and synk5. These are commonly used toys on irc, so watch your back. 06. How do I protect myself from DoS attacks? A: There is no one-hundred percent reliable method for stopping DoS attacks. If the attackers bandwidth is much greater than yours, then you lose: end of story. However, if the attacker has equal or lesser resources than you, they are easily filtered out by software such as ipfwadm for linux 2.0.x, ipchains for linux 2.2.x, and conseal pc firewall for windows. Some interesting firewall/filtering scripts can be found at http://www.freshmeat.net and http://www.linuxberg.com. If you like to chat on irc (yay!), then it is wise to use a bnc (bounce) to hide your real address and virtually irc off of a faster connection. bnc source is available for download at ftp.bitchx.org/pub/misc. 07. What is a buffer overflow? A: In short, a buffer overflow is the pushing of data onto a stack, thus executing carefully constructed code as the user the program is running as. Example: [benz@oldbox]$ whoami benz [benz@oldbox]$ /usr/bin/sperl4.036 AAAAAA(etc..) [garbage]/bin/sh Segmentation Fault [root@oldbox]# whoami root The above log is an example of the classic sperl overflow which drops root access. To make sure the program you are trying to overflow will give you root, you need to type ls -al file and look for "s" in the permissions somewhere, and that it is owned by root. This indicates that the program is suid/root and when run will actually switch to user root and execute. This explanation is a very short and simple version of a complex topic, which can be studied in more detail at http://www.phrack.com - issue 49-14: "Smashing the Stack for Fun and Profit" by Aleph One. 08. What are some good web/ftp sites for UNIX? A: Bugtraq security mailing list: http://www.geek-girl.com/bugtraq rootshell archives (out of date): http://www.rootshell.com technotronic archives: ftp://ftp.technotronic.com SlackNet: http://www.slacknet.org Linux.org: http://www.linux.org FreeBSD.org: http://www.freebsd.org Packetstorm: http://packetstorm.genocide2600.com 2600 magazine: http://www.2600.com Phrack magazine: http://www.phrack.com 09. What is BSD? A: BSD, short for Berkeley Systems Distrobution, is a UNIX flavor known for its stability and ease of use. More information can be found at http://www.freebsd.org, http://www.openbsd.org, www.bsdi.org, etc. 10. What is Linux? A: Linux, originally developed my Linus Torvalds, is a POSIX based OS commonly used by everyone from hackers to goat feeders. more information can be found at http://www.linux.org. 11. What does x86 have to do with anything? A: x86 is the standard abbreviation for an intel processor based system. the x has nothing to do with the processor, it is simply a wildcard definition for all *86 systems. Example: i386, 586 (pentium). 12. What else is there besides x86 systems? A: Besides Intel based systems, their are many other architectures used with UNIX. Probably the most common non-x86 architecture is a sparc. Although capable of handling almost anything, these typically run either SunOS or Solaris. 13. What are some commonly open services to look for? A: The services i generally look for the most are very dependant on what OS the target is running. For example, if the target system is Linux 2.0.3x, I typically scan for rpcbind/portmap on tcp/111 because of the well known mountd overflow. Below is a brief list of what I check for specifically on several operating systems. Redhat 4.2: tcp/143 (imap), etc.. RedHat 5.0: tcp/25 (sendmail), tcp/143 (imap), tcp/25 (qpop), tcp/53 (bind) RedHat 5.1: tcp/111 (rpcinfo -p ), tcp/110 (qpop), tcp/53 (bind) RedHat 5.2: tcp/21 (wu-2.4.2-academ[BETA-18](1)) Slackware: tcp/111 (rpc), tcp/110 (qpop), tcp/21 (wu-ftpd), tcp/53 (bind) FreeBSD: tcp/110 (qpop), tcp/143 (imap), tcp/53 (bind) Solaris: tcp/110 (rpc), tcp/53 (bind) 14. What is the easiest way to hack a system right now? A: 15. Can i hack anything from windows? A: Suprisingly, yes. There are about 50 different ways you can hack with just a web browser. These are known as cgi exploits; below is a list of several which i typically check for: /cgi-bin/phf /cgi-bin/php.cgi /cgi-bin/Count.cgi /cgi-bin/info2www /_vti_pvt/service.pwd /cgi-bin/test-cgi /cfdocs/expeval/openfile.cfm /cgi-dos/args.bat /cgi-win/uploader.exe 16. Why is Linux a better OS than windows? A: There are hundreds of reasons why Linux owns windows, but instead of explaining all of them, I'll just give you some advice: take my word for it. If you happen to be one of those people that needs facts to survive, check out http://www.darkelf.net/metachart. 17. What is suid/sgid? A: 18. Where is the best source of info for newbies? A: My best reccomendation would definatly have to be irc. Since most hackers tend to learn things on their own, hacking resources are not as plentiful as they probably should be, but there are still excellent sources available. See the URL section above for more information. 19. How much trouble can I get in for hacking? A: The typical student hacker (such as me) is still under the age of 18, rendering him a minor. If adult charges cannot be filed, then don't worry about much other than a harsh bitching and possibly a small fine. For those of you that no longer have the age advantage, I reccomend consulting a lawyer before getting seriously into hacking. This may sound a bit extreme, but anyone who gets good enough to be noticed needs a lawyer eventually anyway. For some information on what can happen as an adult, just take a look at http://www.kevinmitnick.com. 20. What kind of system should I try hacking first? A: For beginners, the first computer I reccomend trying to root is your own. Their is no better way of security and learning than a local machine that you actually own and operate. Try experimenting with several UNIX flavors such as Linux and BSD, then it's up to you from there. [**] dont worry.. part [II] Intermediate instruction is coming! [**] @HWA 06.0 Group approves controversial software law ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by D----Y http://www.infoworld.com/cgi-bin/displayStory.pl?990729.ecucita.htm Group approves controversial software law By Jack McCarthy, Nancy Weil, and Jessica Davis InfoWorld Electric Posted at 5:00 PM PT, Jul 30, 1999 In a blow to both big corporate software consumers and those who buy their software in retail stores, a group that works to unify state laws this week passed the Uniform Computer Information Transactions Act (UCITA) legislation, which is widely opposed by software consumer advocates, software developers, and IT organizations. The legislation will theoretically allow software vendors to repossess software by disabling it remotely, and to disclaim warranties. It will also prevent the transfer of software licenses from one party to another without vendor permission, and will outlaw reverse engineering. UCITA's opponents said that its development was heavily influenced by software manufacturers, and that it favors them in software contracts and disputes concerning software licensing. "What purpose is it going to serve other than litigation and additional cost to users?" said Michael Scott, a senior engineer at the California Department of Transportation, in Sacramento, Calif. "It sounds like a great coup for the software industry, but doesn't sound very advantageous for users." Members of the National Conference of Commissioners on Uniform State Laws (NCCUSL) voted on UCITA and several other revisions to the commercial code at their annual meeting in Denver. In a state-by-state vote, 43 states approved UCITA, six opposed it, two abstained, and two were not present at the voting. The proposal now goes to various state legislatures for approval. Most or all states typically approve the laws recommended by the NCCUSL. IT opposition to the legislation, including a letter-writing campaign to members of the NCCUSL, failed to sway the commissioners. The dry, complex language of the 123-page legislation may also have contributed to a lack of understanding on the part of many software users. Proponents of the legislation have said that UCITA is a necessary step in defining the law regarding software and computer information sales, which were not contemplated when the Uniform Commercial Code (UCC) for the sale of goods was written. The act means both vendors and users will be able to count on a uniform law, instead of relying on differing laws on a state-by-state basis, according to Ray Nimmer, a law professor at the University of Houston Law Center and the law's primary author. "We think that this will extend the rights of end-users," Nimmer said. Nimmer said that the opposition to the law during the last year and a half has been punctuated by hyperbole, and now it is critical that the debate shift over to reality. Opponents to the legislation include technology consumer groups, various trade associations, and some law professors, who contend that UCITA will result in increased costs for companies, while giving software vendors undue power. "This law is going to be bad for the industry and for the country," said Cem Kaner, a software developer, attorney, and author who has taken a lead in fighting the proposal. "It redefines intellectual property law in a way that transfers huge amounts of power from the public, including universities, libraries, and [software] customers, to software publishers." In the days before the final UCITA vote, several state attorneys wrote letters to the president of NCCUSL, urging the group to reject the law. An estimated 25 to 28 attorney generals have gone on the record in opposition, including those from Connecticut, Idaho, Indiana, Iowa, Kansas, Oklahoma, Pennsylvania, and Washington state. The National Conference of Commissioners on Uniform State Laws, in Chicago, is at www.nccusl.org. Jack McCarthyis a San Francisco correspondent for the IDG News Service, an InfoWorld affiliate. Nancy Weil is a Boston correspondent for the IDG News Service, an InfoWorld affiliate. Jessica Davis is an InfoWorld associate news editor. @HWA 07.0 Falun Gong Web Sites Attacked by China? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by tacscan Web sites of the group Falun Gong a meditation group is claiming that the web sites of its supporters are being target and attacked by China. Initial evidence seems to point to the Public Security Ministry's Internet Monitoring Bureau as the agnecy responsible for various attacks. Falun Gong, outlawed in China, is a group that draws on martial arts, Buddhism and Taoism and is devoted to physical and mental fitness, high moral standards, and denies that it is either a religion or a political movement. Boston Globe http://www.boston.com/dailynews/211/nation/Chinese_officials_try_to_hack_:.shtml Chinese officials try to hack U.S. Web sites, meditation group members say By Peter Svensson, Associated Press, 07/30/99 16:17 NEW YORK (AP) Web sites in the United States and elsewhere devoted to the Falun Gong meditation group are coming under heavy electronic attack, managers of the sites said Friday, and at least one ''hacking'' attempt appears to trace back to a Chinese national police bureau in Beijing. Falun Gong has been banned in China, where communist authorities are engaged in an escalating crackdown, arresting adherents and confiscating publications and videos. Bob McWee, of Middletown, Md., a Falun Gong practitioner, said a site he maintains to promote the group, www.falunusa.net, has been under persistent electronic assault. In a telephone interview, McWee said his Web server was undergoing a continuous ''denial-of-service'' attack, a common Internet tactic used to overwhelm a computer with repeated electronic requests like a telephone ringing nonstop to block other callers. In addition, someone tried to gain access to the server, pretending to be a legitimate webmaster, and in the process left an Internet address, he said. ''They tried to hack my machine from theirs. And they can't do that without revealing their'' Internet address, he said. The address McWee said was left behind is registered with the Asia Pacific Network Information Centre, a public registry service for Internet addressees. According to the service, there are two phone numbers in Beijing listed with that address. When The Associated Press called the numbers, a person who answered the phone identified them as belonging to the Public Security Ministry. A telephone operator at the ministry said they belonged to its Internet Monitoring Bureau. Ministry officials and spokesmen refused to comment Friday. McWee registered a complaint about the hacking attempt with the Maryland state police's computer crimes division. Police spokesman Pete Piringer said that because the attack did not succeed in getting access to McWee's server, there did not seem to be a crime committed. A U.S. government agency saw an indirect sign of the attacks. A network engineer at the U.S. Department of Transportation contacted McWee when they noticed his server was contacting one of their computers unasked, according to Everett Dowd, deputy director of telecommunications of the Information Technology Operation at the department. McWee said this was because the denial-of-service attack sent requests to his server with forged return addresses, one of which happened to be the department's server. Administrators of other Web sites devoted to the movement also said they had been attacked. Li Shao, in Nottingham, Britain, said the site he maintains was hacked into Monday. What he called Chinese ''government propaganda'' was placed on some pages, while others were deleted. Jillian Ye, of Toronto, Canada, who maintains two sites, said that beginning one or two months ago, her server began going down almost every day. The problems got progressively worse, until she recognized the symptoms of an attack and moved the sites to a more secure server. In their barrage of criticism of Falun Gong, Chinese state media have cited the group's Internet presence as proof that it was well-organized and not just harmless meditation buffs. A government ban on Falun Gong publications passed after the group was outlawed includes electronic publications. Nearly all of Falun Gong Web sites in China have been shut down since the ban was announced. China's communist leaders banned the Falun Gong movement last week, accusing it of trying to develop political power. Falun Gong leaders have denied any political ambitions and denied they organized protests that erupted two weeks ago after authorities reportedly arrested leading members of the group. Falun Gong, founded by Li Hongzhi, who now lives in the United States, draws on martial arts, Buddhism and Taoism. The group says its goals are physical and mental fitness and high moral standards, and denies that it is either a religion or a political movement. Associated Press Writer John Leicester in Beijing contributed to this report. @HWA 08.0 Super Computer Almost Gets Away ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Mudge Sandia National Laboratories sold a surplus nuclear weapons research computer, an old Intel Paragon XPS, as "spare parts", without the OS to a Chinese national in California for $30,000 last October. Quing-Chang Jiang, a citizen of the Peoples Republic of China, then tried to buy the parts from Intel needed to make it run again. After conferring with the DOE, Sandia then paid $88,000 two weeks ago to get it back because of security worries about the deal. The computer, the fastest in the world in 1993, while now obsolete by U.S. standards, could have aided a foreign government in duplicating the advanced work done by US nuclear weapons labs. (Super Computers just aren't that hard to get a hold of these days, even fully functional ones.) San Jose Mercury News - second story http://www7.mercurycenter.com/premium/nation/docs/natwashdig24.htm < link broken/Story missing - Ed > Posted at 8:57 p.m. PDT Friday, July 23, 1999 U.S. buys back computer sold to Chinese citizen Associated Press WASHINGTON -- The Energy Department's Sandia National Laboratory last week bought back a supercomputer it had sold as surplus to Korber Jiang, a Chinese citizen who is the principle of EHI Group USA and exports American goods to his home country. Rep. Curt Weldon, R-Pa., called Friday for Energy Secretary Bill Richardson's resignation, saying that the computer could have been used ``to design nuclear weapons.'' ``He's going around the country saying there are no problems in the Department of Energy, that everything is under control,'' Weldon said in a telephone interview. ``If there are no problems, then how can this happen?'' Neal Singer, a spokesman for Sandia National Laboratories, said that the New Mexico facility sold the Intel Paragon XPS to Korber's one-man company for $30,000 in October. After discovering Korber's nationality, Singer said, the department bought back the computer for $88,000 last week and stored it under guard at Sandia. The spokesman said the difference in cost may have been due to shipping costs incurred by Korber. ``Secretary Richardson has instituted a moratorium on any sales of surplus material that incorporates export control technology until there has been a thorough review of what happened,'' said Energy Department spokeswoman Brooke Anderson. The transaction was first reported by Insight Magazine. @HWA 09.0 Symantec's website hacked ~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by D----Y It was rumoured that the site was not only hacked but also infected with virii, this article tries to clear up the story, ZDNET - ed http://www.zdnet.com/filters/printerfriendly/0,6061,2307804-2,00.html -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Symantec: Vandals didn't infect us By Robert Lemos, ZDNN August 2, 1999 2:02 PM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2307804,00.html Internet vandals broke into the servers of network security and utilities firm Symantec Corp. Monday morning, defacing the company's Web site. While the vandals claimed to have infected Symantec's network two months ago with a worm, quaintly dubbed Bloworm, the company denied Monday that any worm existed on its systems. "There is no virus infection, no worm infection, and no danger to customers," said Richard Saunders, a spokesman for the Cupertino, Calif., company. "They didn't get in beyond posting a mildly offensive, but otherwise impotent, message on our home page." The five cyber vandals, who identified themselves only by their handles, claimed otherwise. "0ur w0rm iz spreading around (Symantec's) netw0rk and infecting (it's) f1lez, since about 2 months ago. phear," stated the group in a document of typically spelling-impaired hacker-speak. The document was left behind by the group after it broke into the servers of Symantec at about 5 a.m. PT Monday. Worms are virus-like programs that infect systems through networks automatically and without the need for an unknowing user to open a file or run an application. Symantec (Nasdaq:SYMC) has always been a popular target for Internet vandals looking for a hard nut to crack. The only difference: This time someone actually got in. "What this incident does show is that you cannot be complacent towards this kind of threat," said Saunders. The Symantec spokesman could not detail how the cyber vandals entered the company's network. Symantec engineers took down the page within an hour of its posting, but not before the media in Europe got wind of the defacement. The BBC posted a story early Monday morning. -=- BBC; Anti-virus company hacked A leading provider of net security and anti-virus software, Symantec, has had its website hacked for about 12 hours, ending around 1300 BST. The FBI has been informed and is already beginning an investigation. Visitors to www.symantec.com early on Monday found a page claiming that a group of five crackers had infiltrated Symantec's servers with a virus called bloworm. The crackers said that their virus, a worm, has been spreading around Symantec's network, infecting files for two months. However, Aled Miles, Symantec's Regional Director for UK and Ireland, told BBC News Online: "I can categorically state that there is no effect on our servers internally - that is a hoax which adds to the publicity wagon." He added that: "We have established that there was no risk [of infection] to anyone visiting our website during that time." Symantec are the makers of Norton Anti-virus software and their UK website says: "Symantec is a leader in Internet and content security." The hacking of their website will be seen as embarrassing but Mr Miles said that any organisation, even the CIA itself, could fall prey to malicious attacks like these. He said: "The sad reality is that whilst the Internet is a tremendous new technological force, it comes with its down side. What matters is how quickly we as a company react to this type of incident. "What I am not embarassed about is the speed and agility we have shown in sorting this out. I don't think it damages our reputation in the slightest." Symantec has become a higher profile target in recent months due to its work in combatting viruses such as Melissa, explore.zip and the program Back Orifice. @HWA 10.0 New virus due to hit town "New virus spills your beans " - BBC ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by D----Y BBC http://news.bbc.co.uk/low/english/sci/tech/newsid_381000/381054.stm Tuesday, August 3, 1999 Published at 15:11 GMT 16:11 UK New virus spills your beans A new strain of computer virus could distribute your highly confidential documents all over the Internet. Anti-virus developers are warning that they cannot develop an antidote until the virus appears. Far from destroying vital files, the virus will make sure everyone can see them. The new virus is expected to be a variant of either Melissa or the Explore.Zip worm, both of which have cost businesses millions in recent weeks. Both Melissa and the Explore.Zip worm rely on people opening email attachments. Once into the computer the virus sends a message to everyone in the victim's in-box and then destroys every file written in Microsoft Word, Excel or Powerpoint, among others. New virus on the block One variant has already appeared. PrettyPark replicates itself by sending copies to everyone in the victim's address book. It waits silently until the victim is on the Internet, then sends lists of the victim's user names, password files and address lists to Internet Relay Chat channels. Anti-virus developers are expecting the next step to be a virus which roots around in your files and then posts your documents across the Internet. "The virus wouldn't be able to tell which of your documents are secret. It might just post your shopping list, or it could be a highly sensitive company document. "What's more, it would appear as if you sent it," says Graham Cluley of Sophos Anti-Virus. Several anti-virus makers already have an answer to PrettyPark. But they cannot build a defence against future variants until they encounter them. Java and ActiveX - next infection target It is predicted that the next generation of viral infections will hit small Webpage programmes called applets, written in Java and particularly ActiveX. A recent survey revealed that more than half of medium-sized organisations using an intranet had no security policy in place to respond to the threat of attacks on Java applets. Recent estimates indicate that Melissa, Explore.Zip and other malicious attacks have cost US business $7.6bn this year alone. @HWA 11.0 New York Times Debunked - FIDNet Moves Ahead as Planned ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Ted The Register has taken the time to actually read the draft proposal reported on last week by John Markoff of the New York Times. The draft proposal, now seven weeks old, calls for the creation of the Federal Intrusion Detection Network, or FIDNET. When the NYT reported on this story last week privacy advocates cried foul claiming that such a network would intrude on personal freedoms. Obviously a closer look at the document is warranted. The Register http://www.theregister.co.uk/990730-000022.html Officials from the CIAO and NIPC and other groups have said that the recent media attention and public outcry over the proposed FIDNet will not prevent the plan from going forward. Federal Computer Week http://www.fcw.com:80/pubs/fcw/1999/0802/fcw-newssecurityside-08-02-99.html The Register; Posted 30/07/99 7:31pm by Thomas Greene in Washington US net snooping plans debunked Terror spread across the Net on Thursday when New York Times correspondent John Markoff broke the Big Story: a National Security Council draft proposal will put the FBI in control of "a sophisticated software system to monitor activities on non-military Government networks, and a separate system to track networks used in crucial industries." Ghastly. The body to be created will be called the Federal Intrusion Detection Network, or FIDNET. Big Brother by another name, no doubt. Libertarian alarmists and conspiracy paranoiacs dropped their daily meds and rose angrily, if unsteadily, to arms. "The plan... specifies that the data [FIDNET] collects will be gathered at the National Infrastructure Protection Center (NIPC), an interagency task force housed at the Federal Bureau of Investigation," the Times went on, adding that "the plan strikes at the heart of a growing controversy over how to protect the nation's computer systems while also protecting civil liberties -- particularly since it would put a new and powerful tool into the hands of the FBI." But it so happens that The Register has its own copy of the draftt proposal, and unlike the New York Times, we've actually read ours. Let's just have a peek at the text. The first observation we make is that the text states plainly, "the GSA (General Services Administration) is responsible for establishing the FIDNET Program Office: this includes creating an interagency management team from the defence, intelligence, technical, legal, and law-enforcement communities." According to our reading, FBI's NIPC team will come in later, when FIDNET data gathered by the GSA suggest criminal activity. Again we take the unconventional approach of consulting the text: "FIDNET will provide raw/filtered data from network sensors and the Federal Computer Incident Response Capability. NIPC will continue to be responsible for further data processing." We remain at a loss to explain why the NYT reported that FIDNET would "put a new and powerful tool into the hands of the FBI." On the contrary, it appears that the Bureau's NIPC will be a tool of the GSA, if and when it decides the government has been cracked. Michael Vadis, FBI's Director of NIPC, made it clear during testimony to the Senate Y2K Committee yesterday that the FBI will respond only where there is evidence of a federal crime. The only language we found in any way alarming was, "FIDNET will interface with the currently planned intrusion detection systems being developed for DOD (Department of Defence) and national security agencies." We didn't quite know what the pseudo-verb "interface" was intended to mean, but we know that American law enforcement and the military are forbidden to do a great deal in the way of "interfacing". As the very existence of America's Act of Posse Comitatus indicates a history of some difficulty in distinguishing between civil and military purviews, this little snippet naturally raised our eyebrows. On this matter the Department of Justice computer crimes division declined to be helpful. The level of interdependence between military and non-military bodies being contemplated is indeed a controversial issue, but it seems unlikely that the final product will initiate military involvement in civilian affairs enough to invite a popular backlash. Elections are coming up, after all; and the FIDNET system will present itself as a tempting target for cyberterrorists if its management becomes odious, thereby having the ironic effect of decreasing security for government systems. Assuming that the language of the proposal does get tidied up a bit, we can expect a much softer line in reference to DOD's role in FIDNET. This still leaves the matter of DOD participation in case of an emergency. The president is permitted by law to suspend the Act of Posse Comitatus in difficult circumstances, such as insurrection, mayhem in the streets, foreign invasion, or those the Y2K rollover might possibly present. A further bit of constitutional intrigue will undoubtedly emerge if a foreign military organization should attack a US civilian network related to banking, energy, transportation or some other essential service. It does not necessarily follow that the DOD would need access to civilian networks in order to reply on behalf of the USA. Vadis for one thinks an organised attack is inevitable. He declined to go into specifics, but left us with the strong impression that hostile military bodies overseas are developing the means to disable military, government and civilian networks remotely via an internet-based attack. Clinton's National Security Advisor, Sandy Berger, said on Thursday that there exist "governments that we know are developing systems to get access to our computer systems." Not an especially comforting thought. "We know that, in fact... there have been intrusions into sensitive systems," Berger added. Whether or not such an attack is being planned, it is certain that the US government expects one. We wonder if the increased level of connection among government systems needed for FIDNET to monitor them effectively might not lead to increased vulnerability. Whether it happens, or when it happens, it is sure to be a jurisdictional nightmare; and the FIDNET proposal does foreshadow that confusion with its own vague language. A crucial point here is that the proposal leaked to us is in draft form and now seven weeks old. The Register's contact on the White House National Security Council, who goes by the name of "an administration official," made it clear that the final draft will not be ready for submission to the President until September at the earliest. The FIDNET document is at present quite fluid, and on its way past numerous reviewers including the Department of Justice computer crimes division, the General Services Administration, the Department of Defence, the National Security Council and the FBI. Furthermore, our source at NSC tells us, the proposal currently being circulated does address and tighten up the unfortunately vague "interface" language. The level of involvement between DOD and non-military government agencies is intended to be little more than an advisory relationship and a sharing of new quirks, bugs and attack techniques much as "one police department might share tips with another in a different jurisdiction." The language which led to an assumption by many that FIDNET might one day monitor private-sector networks is also being clarified. NSC says that there will not be even an opt-in programme for private users to voluntarily choose such monitoring. FIDNET will, however, share its tricks with private enterprise, and leave it to them to implement what it chooses, on its own nickel. The Register will report fully and eagerly on the specific changes to the FIDNET proposal as soon as the latest version is leaked. It might actually make sense to withhold judgment on the piece until after it's been reviewed and polished. Just a thought. ® -=- Federal Computer Week; AUGUST 2, 1999 Officials: Security plan on track In the face of privacy concerns, schedule remains unchanged BY DIANE FRANK (diane_frank@fcw.com) Despite public outcry and congressional interest, federal officials are sticking to their schedule for developing and releasing a plan to protect the federal information infrastructure from cyberattacks. Several stories in the media last week inaccurately reported that the draft of the National Plan for Information Systems Protection would put the FBI in charge of monitoring private-sector and government networks for cyberattacks through the Federal Intrusion Detection Network (Fidnet). This touched off protests from public-interest groups about citizens' privacy, and several members of Congress asked for a complete copy of the draft and a briefing in the next few weeks. Officials from the Critical Infrastructure Assurance Office (CIAO), the National Infrastructure Protection Center and other high-level federal groups involved in creating the plan said the attention to what is still an internal document under development will not change anything. "This will have no effect on the process," one senior National Security Council official said. "It is just now completing the second round of comments from the agencies and industry...and will be brought to the president in October." Others stressed that the plan deals only with federal networks and that the privacy and civil rights of Americans are being taken into account at every step. "An important element of the Fidnet program is a legal review by the Justice Department," said John Tritak, director of the CIAO. The plan also is being reviewed by the chief counselor for privacy at the Office of Management and Budget's Office of Information and Regulatory Affairs, and those reviews may change the current version of the plan, he said. In fact, the first version of the plan has already been reviewed by the Office of the Assistant Attorney General, which determined it was completely legal, according to a senior DOJ official. The plan is based on the critical infrastructure protection plans from agencies and industry required by Presidential Decision Directive 63 and originally was scheduled to be sent to Congress and the president this fall, Tritak said. It also includes programs for education and training of information security professionals, research and development of computer security profits, and the basis for revisions of current laws to "promote greater information sharing, enhance systems security, and strengthen protections for civil liberties and privacy." Although members of Congress has known about the plan for some time, most did not realize its extent, and that is partly what touched off a request from Sen. Bob Bennett (R-Utah) to receive a copy of the plan, said a spokesman for the senator. @HWA 12.0 Computer `crackers' set sights on .gov for chaos ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Contributed by D----Y http://www.businesstoday.com/techpages/hack08011999.htm Computer `crackers' set sights on .gov for chaos by Mark Mueller Sunday, August 1, 1999 It was the kind of threat for which computer hackers are famous, a declaration of war dripping with the risk-free bravado so common on the anonymous Internet. The warning, which appeared on a hacked Web page of the U.S. Interior Department in late May, promised unrelenting attacks against government computers to avenge an FBI roundup of hackers associated with the group Global Hell. Just weeks earlier, Global Hell had claimed responsibility for an attack on the White House's main Web page. ``Now, it's our turn to hit them where it hurts by going after every computer on the Net with a .gov,'' the message read. ``We'll keep hitting them until they get down on their knees and beg.'' That the threat was made - risking the pique of the FBI - isn't as surprising as the follow-through. In recent months, hackers, or crackers, as bad-guy hackers are known, have indeed blazed through a wide swath of government and university computers, defacing some Web sites and shutting down others. Among the high-profile targets: the U.S. Senate (twice), the Army, the Navy and the Departments of Agriculture, Labor and the Interior. Computer systems also were hit at Georgetown University, the University of Colorado, the University of Michigan and Harvard University. The most brazen of the attacks targeted the lion's den itself: the FBI Web page, which was out of service for nearly a week as programmers beefed up security on the site. Jim Settle, former chief of the FBI's computer crimes squad and now an Internet security consultant, calls the FBI strike ``an out-and-out declaration of electronic warfare.'' For some, it's a war that can't afford to be lost. The feeble network that once was the domain of a few scientists is now a robust and far-reaching behemoth that caters to hundreds of millions of people, some of whom pay their taxes, buy goods and send intensely personal information through their computers. In the wrong hands, such information could prove embarrassing or costly. Seen in its most sinister light, computer intrusion is a threat to national security. But the self-proclaimed ``warriors'' who carried out the recent attacks against government Web sites hardly sound like cyberspace shock troops. Their loose-knit groups bear names like the ``Keebler Elves,'' the ``Masters of Downloading'' and ``Hacking for Girlies.'' When they hack sites, they traditionally leave behind inane scrawlings - ``Boo! Did we scare you?'' - and ``shout-outs'' to their friends. Those familiar with the hacking subculture say such groups are generally composed of teens - and occasionally people in their early 20s - with a lot of computer equipment and too much time on their hands. ``These are just immature kids doing this from their home computers,'' said John Vranesevich, founder of Anti-Online, a group that tracks hacker activity and that has compiled dossiers on 6,000 hackers. ``It's a game to them. They make a move, and they can't contemplate how it affects people in the real world. It's not reality until the FBI bangs on their door.'' Vranesevich called the recent wave of attacks a ``temper tantrum'' over the May FBI raids, in which agents confiscated computer equipment and questioned teens in 11 cities, including Houston, Seattle and San Diego. A spokeswoman for the FBI in Boston said the New England office was not involved in the operation. Those who deface Web sites - about 1,300 sites have been defaced so far this year, according to the most reliable statistics - justify their actions by arguing they're actually doing companies and organizations a service by pointing out security deficiencies. But law enforcement authorities and others who deal with hackers dismiss the argument. ``I don't buy it,'' said Drew Williams, the founder of an AXENT Technologies' SWAT team to deal with hacker attacks. ``Any hacker group that has not been invited to test security is committing a crime.'' That assessment is shared by David Green, deputy chief of the computer crimes and intellectual property section at the Justice Department. ``This is not just electronic graffiti,'' Green said. ``They're shutting down access to Web sites, sometimes for hours, sometimes for days, and it makes it impossible for people who want access to that Web source to get it.'' Moreover, there's far more at risk than down time for Web servers, contends Peter Mell, who conducts hacker research for the National Institute of Standards and Technology, a division of the U.S. Commerce Department. ``Real harm can be done,'' Mell said. ``A lot of people download their tax forms from the IRS today. What if someone broke into the IRS Web server and changed just a single number? It would cause supreme chaos.'' Mell also pointed to electronic banking and stock trading, saying Web servers today handle increasing amounts of sensitive information. ``This isn't child's play anymore,'' he said. ``I pay my bills online. I trade stocks online. In that kind of environment, I can't afford people breaking into computers.'' The FBI heartily agrees, though it has not characterized its crackdown on hackers in quite the grandiose terms that hackers do. ``We don't have a war against hackers. We're following our mandate, which is to investigate violations of federal law,'' said Bill Carter, a spokesman for the FBI's headquarters in Washington. ``The fact that these hackers or hacker groups have their noses out of joint over this, we can't help that.'' Most hackers are not caught, but the recent raids suggest the FBI is starting to get better at tracking them. The agency has about 500 open computer crimes cases at any given time. But the federal agents' methods - charging in with warrants and bulletproof vests - worries some in the hacking community. ``For those of us in the scene for a number of years, it's starting to get scary only because we worry it's going to turn into a witch hunt,'' said Space Rogue, a member of the Boston-area group L0pht Heavy Industries, a former hacker clan that now bills itself as an electronic think tank. ``While defacements will probably continue no matter what law enforcement officials do, it would be very easy for the government to just start executing search warrants left and right, seizing computers and scaring people half to death.'' Internet watchdogs - and some hackers themselves - say that while the crackdown should continue, the real issue is computer security. Space Rogue argues that nearly all Web page defacements are carried out with known security flaws in software. As an example, he said, his group e-mailed the Army's webmaster about a flaw in its ColdFusion server software a month before someone used the hole to hack into the Army's Web site. ``It comes down to the person in charge of the machine and whether they're taking their security seriously,'' Space Rogue said. ``This sort of thing never should have happened in the first place.'' Settle, the former FBI computer crimes chief, says the danger will be far greater when those doing the hacking aren't teens out for kicks but terrorists intent on electronic warfare. ``Our computer systems today are like cars operating without safety equipment: no headlights, no bumpers, no airbags, no roofs,'' he said. ``Heck, if teenagers can do this, what can sophisticated intelligence operatives do? This is just a taste of things to come.'' The government acknowledges as much. In testimony before a congressional panel, government security experts said government computers are easy marks because employees lack training, because well-trained staff flee for the bigger paycheck of the private sector and because internal security procedures often aren't followed. ``Most federal agencies continue to lack the ability to detect against and recover from cyber attacks,'' U.S. Rep. Connie Morella (R-Md.), chair of the House Science Subcommittee on Technology, said at the June 23 hearing. To combat the deficiency, the Clinton administration last week proposed spending $1.5 billion in the next fiscal year on a sophisticated intruder warning system that would be installed on military, government and private-sector computer networks by 2003. Operating something like a burglar alarm, the system would detect break-ins, funneling that information to a central location. ``A concerted attack on the computers of any one of our key economic sectors or governmental agencies could have catastrophic effects,'' Clinton wrote in a draft cover letter accompanying the proposal. Civil libertarians and Internet privacy watchdogs already have protested the plan, saying it will give the government unprecedented surveillance powers, equipping authorities with the tools to peruse the private dispatches of the masses. House Majority Leader Dick Armey (R-Texas) joined in the criticism, deriding the plan as an opportunity for ``government peeping toms.'' No matter the government response, hackers will, no doubt, continue mounting challenges, probing for deficiencies in networks and deriding those who chase them. ``You can stop one, but you can not stop all,'' hackers wrote when they defaced the U.S. Senate Web page for the second time in late June. A more recent defacement of an obscure Venezuelan Web page repeated the theme, carrying a ``call to arms'' imploring competing hacker groups to unite to ``win this war.'' ``Remember, this is our world, not the government's,'' the page read. Time will tell. Prosecuted `cracker' a martyr to techies In hacker circles, he is a modern-day martyr, a technological tinkerer whose attacks on other people's computers amounted to harmless exploration before the FBI swooped down on him, dubbing him Online Enemy No. 1. To prosecutors and to judges, he is a dangerous miscreant whose ability to crack computer systems and whose propensity for running from the law required that he be held without bail. Kevin Mitnick, for four years the cause celebre of the Internet's dark side, could soon be going free. Mitnick, 35, who pleaded guilty in March to multiple counts of computer and wire fraud for breaking into systems and stealing software from such companies as Sun Microsystems, Novell, Motorola and Nokia, will be sentenced Aug. 9 under a plea agreement that could, with good behavior credits, allow him to leave federal prison within weeks. ``Kevin is optimistic that this case will be over and that he can get on with his life,'' said Mitnick's lawyer, Donald C. Randolph of Santa Monica, Calif. But even if Mitnick himself fades into obscurity, his cause is unlikely to follow. In the hacking community, Mitnick long ago became a symbol of what hackers term gross government over-reaction, a theme repeatedly hammered home by Randolph. ``The government prosecution of Mr. Mitnick was to carry out an agenda launched by them in the 1990s,'' Randolph said. ``The government wanted to demonstrate they were going to be tough on computer terrorism. Unfortunately, the government did not have a bonafide computer terrorist to prosecute, so they went after Mr. Mitnick, a recreational hacker who was arrested with a big splash and who became a convenient target.'' Randolph's comments could be dismissed as the arguments of a defense lawyer looking to gain sympathy for his client, but he's not the only one making them. Drew Williams, who founded Axent Technologies' SWAT team to respond to hacking incidents for clients, said the government miscalculated with Mitnick. ``I am not a Mitnick supporter at all. However, I think the government did in fact set out to make an example and instead made a martyr,'' Williams said. ``An individual's rights to due process probably got a little trampled.'' Denied bail on charges that could have initially landed him in jail for a century, Mitnick appealed all the way to the U.S. Supreme Court, where the justices declined to hear his lawyer's argument that bail should be set. Hackers have seized on the bail issue, leaving ``Free Kevin'' messages on the Web sites they hack. Recent examples include the home pages of the U.S. Senate and Greenpeace, where hackers left the tongue-in-cheek message ``Free Mitnick or we will club 600 baby seals.'' There is also a ``Free Kevin'' Web site (www.freekevin.com) that gives Mitnick updates and carries a confinement clock showing - to the second - how long Mitnick has been jailed. Randolph argues that while people should be prosecuted for breaking into systems, the law needs to be refined to distinguish between recreational hackers and information terrorists. ``I do not quarrel at all with the government's right to prosecute computer fraud and to go after computer terrorists, but it's high time they distinguish between high crimes and misdemeanors so they're not trumpeting the arrest of the century when the suspect is a kid on a laptop,'' Randolph said. Mitnick's prosecutors insist they have not overreached, that Mitnick caused millions in damage by stealing and changing information in computer systems. ``This is someone whose conduct over a 2-year period was very broad and very serious,'' Assistant U.S. Attorney Christopher Painter said. ``He hit a huge number of companies with a lot of damage. He is not the victim.'' If Mitnick does win his freedom soon, it could be short-lived. The Los Angeles County District Attorney's Office is preparing its own case against him on charges similar to the federal claim. Randolph said he's confident Mitnick, in the end, will prevail. ``In 1995, the press and the public were fooled into thinking Kevin Mitnick was this cyber bogeyman,'' he said. ``That type of argument doesn't fly in 1999. People know better.'' Sites that have been targeted Here's a partial list of Web sites that have been attacked in recent months. In most cases, the sites were defaced. In others, a flood of requests for service overwhelmed Web servers, rendering them unusable. In several of the attacks, the intruders called the acts revenge for FBI ``harassment'' of hackers. Bell South eBay (on-line auctioneer) FBI Fort Monmouth (N.J.) U.S. Army Garrison Georgetown University Harvard University Idaho National Engineering and Environmental Laboratory (conducts research for the U.S. Department of Energy) Illinois Comptroller's Office NASA Goddard Space Flight Center National Oceanic and Atmospheric Administration Storm Prediction Center State of Virginia home page University of California-Davis University of Colorado University of Michigan University of Wisconsin U.S. Army main Web site U.S. Coast Guard U.S. Department of Agriculture U.S. Department of Education U.S. Department of the Interior U.S. Department of Labor U.S. Information Agency U.S. Navy U.S. Senate (twice) The White House @HWA 13.0 IIS Server 'hackproof'? ~~~~~~~~~~~~~~~~~~~~~~~ contributed by Code Kid A small company in Sydney Australia, called Creative Digital Technology, has claimed to have created software that will make web pages on IIS Servers 'hack proof'. The software, known as SecurePage digitally signs all pages and then compares those signatures against encrypted master copies. If the signature changes then the web server will stop serving the page. They have issued a challenge to get people to try and break the system, however, the information on the challenge is difficult to find. The Australian http://technology.news.com.au/techno/4108922.htm Internet News http://www.internetnews.com/intl-news/article/0,1087,6_174011,00.html Creative Digital Technology http://www.creative.com.au/ Developer issues hacker challenge By JENNIFER FORESHEW 3aug99 A SMALL Sydney company that has developed software designed to make Web sites hack-proof, has thrown out a challenge to crack the technology. Creative Digital Technology (CDT) has developed software which, when downloaded, makes a site secure. "We are prepared to stand behind that financially by offering a prize to universities to see if they can do what our developers haven't been able to do," CDT chief operating officer Philip Burton said. CDT, which developed the country's first SET (Secure Electronic Transaction) enabled products, is launching the SecurePage product at Internet World 99 this week. "We can protect any Web site," CDT chief executive Bahram Boutorabi said. "The first version of the product runs on Microsoft's Internet Information Server platform, but we are planning to roll out across all platforms." Mr Boutorabi, who is also technology officer, said many sites could be hacked because they were developed using mostly straight text. "We have developed the technology to put something into Active Server Pages, HTML, Net Commerce Mark-up Language and XML, which represents a signature that someone has made against that page," Mr Boutorabi said. Any attempt to alter a Web site's content would result in action being taken by the system, which is protected by 192-bit, Triple-DES encryption. "If the contents of that page have been altered for any reason it will stop serving that content out and serve it from its own content area, where everything is fully encrypted," Mr Boutorabi said. "SecurePage enables an administrator to put a disc into the system, run the administration and tell it to sign all of the pages with their password. "To alter the code or text, you have to have administrative access to change the content or to stop the system." Mr Burton, who is also a senior partner in CDT, said the company began working on the technology after attacks on high-profile Web sites. "This came about from evidence that significant Web sites were being hacked and destroyed. "We believed we could deliver a protection device in software form that could be downloaded from our Web site by whoever was hosting that particular site. CDT declined to reveal further details of the technology pending approval of a patent on SecurePage. If you decide to take up CDT's challenge to crack its software, Computers & High Technology wants to know. E-mail us at auscomp@ozemail.com.au – but only if you are successful. Internet News http://www.internetnews.com/intl-news/article/0,1087,6_174011,00.html Australian Web Innovations Debut at IW Sydney August 4, 1999 By Gerard Knapp InternetNews.com Australian Correspondent International News Archives [Sydney, AUSTRALIA] Several Australian companies have used the Internet World Australia 99 exhibition to launch new products. Sydney-based startup Pure Commerce has introduced Pure Global Pay, a payment gateway service which can accept 32 different currencies without merchants needing to establish relationships with non-Australian banks. E-commerce developer Creative Digital Technology is debuting two software applications: a wallet which supports the Secure Electronic Transactions (SET) standard for e-commerce transactions called ActiveWallet, and a solution for attempts by hackers to deface corporate Web sites called SecurePage. The ActiveWallet client is an 850KB client-side applet which enables consumers to pay bills and buy products using credit cards in a drag and drop environment. The client is designed to support transactions using the SET-certified merchant server technology of US-based GlobeSet. SecurePage attaches digital signatures to static Web pages and dynamically generated components so that they can be compared against an encrypted master version to check if they have been altered by malicious hackers. Allaire has also used Internet World as its Australian launch for Spectra, its Web content management product. The show has also coincided with the announcement that US-based analyst firm Jupiter Communications had filed preliminary documents for an IPO. Wednesday keynote speaker Gene De Rose, who is CEO and 21.8 per cent stake holder of Jupiter, is poised to become the next Internet multi-millionaire. The Internet World 99 Best of Show product awards, judged by journalists at Internet World Australia magazine, will be announced on Wednesday. 14.0 Latest CWD Pokes at AntiOnline ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Weld Pond The CyberWire Dispatch, a mailing list newsletter, has some very interesting things to say about John Vranesevich and Antionline. CWD writer Lewis Z. Koch makes some powerful observations about his past dealings with and the writings of Mr. Vranesevich. (If you have been following the antics of AntiOnline at all this is a must read piece.) CyberWire Dispatch- republished with permission Note: CyberWire Dispatch is a mailing list only newsletter. It is reprinted here with permision. Subscription information is at the end. CyberWire Dispatch // August 1999 // All Rights Reserved Jacking in from the "Pine-Sol" port: By Lewis Z. Koch CWD Special Correspondent Twenty-year-old John Vranesevich calls his AntiOnline Web site "a valuable tool in the fight against 'CyberCrime'" In a call to arms, this self-anointed, junior G-man wannabe, promises to uncover, reveal and inform on hackers and other miscreants. Out of this misguided cyber-vigilantism, arises the "denunciator" virus, which reaches its full lethality in totalitarian states but also finds a home in democratic societies as well, usually in climates of social resentment, political fanaticism, or, my personal favorite, political self-righteousness. The Denunciator virus, known also as the "Accuser" virus, destroys careers, leaves permanent scars, called "blacklists," gives rise to false alarms, warnings or contrived "cautionary tales" meant to lull or divert citizens. The natural host for this virus is believed to be a species of the rodent called a "snitch," aka squealer, stool pigeon, informer; rat bastard. Every delusional crusader needs a mission statement, Vranesevich is no different. This self-anointed sheriff-of-cyberspace pens this Uber-warning to hackers: "I know that some of you are playing what you feel is a game. A game that you think you are winning. Some of you sit back and laugh at organizations like the FBI. You make sure that you provide enough information to make it obvious who you are, yet are careful not to provide enough information to actually have it proven. I have been watching you these past 5 years. I know how you do the things you do, why you do the things you do, and I know who you are." And if you're keeping score-and you should be-you'll note that Vranesenvich apparently started down this crusader road at the tender age of 15 or just about the time he figured his Johnson could be used for more than simple utilitarian bodily functions. This not-very subtle paean to cyber-vigilantism could easily be dismissed save for the fact that Vranesenvich has earned a demi-celebrity status from journalists working for publications from which we have come to expect more judicious sourcing, including, but not limited to, Matt Richtel of The New York Times, John Schwartz of The Washington Post and even, sadly, CWD's own Brock Meeks while cloaked in his alter-ego as Washington correspondent for MSNBC. And we wonder why fewer and fewer people trust the media. Hung With His Own Rope ===================== In his mission statement Vranesevich unequivocally states, "I've seen myself talking with people who have broken into hundreds of governmental servers, stolen sensitive data from military sites, broken into atomic