Zines/phrack/40/14.txt

                                ==Phrack Inc.==

                    Volume Four, Issue Forty, File 14 of 14

              PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
              PWN                                             PWN
              PWN              Phrack World News              PWN
              PWN                                             PWN
              PWN           Issue 40 / Part 3 of 3            PWN
              PWN                                             PWN
              PWN        Compiled by Datastream Cowboy        PWN
              PWN                                             PWN
              PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN


 Bellcore Threatens 2600 Magazine With Legal Action               July 15, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
THE FOLLOWING CERTIFIED LETTER HAS BEEN RECEIVED BY 2600 MAGAZINE.  WE WELCOME
ANY COMMENTS AND/OR INTERPRETATIONS.

Leonard Charles Suchyta
General Attorney
Intellectual Property Matters

Emanuel [sic] Golstein [sic], Editor
2600 Magazine
P.O. Box 752
Middle Island, New York 11953-0752

Dear Mr. Golstein:

It has come to our attention that you have somehow obtained and published in
the 1991-1992 Winter edition of 2600 Magazine portions of certain Bellcore
proprietary internal documents.

This letter is to formally advise you that, if at any time in the future you
(or your magazine) come into possession of, publish, or otherwise disclose any
Bellcore information or documentation which either (i) you have any reason to
believe is proprietary to Bellcore or has not been made publicly available by
Bellcore or (ii) is marked "proprietary," "confidential," "restricted," or with
any other legend denoting Bellcore's proprietary interest therein, Bellcore
will vigorously pursue all legal remedies available to it including, but not
limited to, injunctive relief and monetary damages, against you, your magazine,
and its sources.

We trust that you fully understand Bellcore's position on this matter.

Sincerely,


LCS/sms


LCS/CORR/JUN92/golstein.619

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Emmanuel Goldstein Responds
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
The following reply has been sent to Bellcore.  Since we believe they have
received it by now, we are making it public.

Emmanuel Goldstein
Editor, 2600 Magazine
PO Box 752
Middle Island, NY 11953

July 20, 1992

Leonard Charles Suchyta
LCC 2E-311
290 W. Mt. Pleasant Avenue
Livingston, NJ 07039

Dear Mr. Suchyta:

We are sorry that the information published in the Winter 1991-92 issue of 2600
disturbs you.  Since you do not specify which article you take exception to, we
must assume that you're referring to our revelation of built-in privacy holes
in the telephone infrastructure which appeared on Page 42.  In that piece, we
quoted from an internal Bellcore memo as well as Bell Operating Company
documents. This is not the first time we have done this.  It will not be the
last.

We recognize that it must be troubling to you when a journal like ours
publishes potentially embarrassing information of the sort described above.
But as journalists, we have a certain obligation that cannot be cast aside
every time a large and powerful entity gets annoyed.  That obligation compels
us to report the facts as we know them to our readers, who have a keen interest
in this subject matter.  If, as is often the case, documents, memoranda, and/or
bits of information in other forms are leaked to us, we have every right to
report on the contents therein.  If you find fault with this logic, your
argument lies not with us, but with the general concept of a free press.

And, as a lawyer specializing in intellectual property law, you know that you
cannot in good faith claim that merely stamping "proprietary" or "secret" on a
document establishes that document as a trade secret or as proprietary
information.  In the absence of a specific explanation to the contrary, we must
assume that information about the publicly supported telephone system and
infrastructure is of public importance, and that Bellcore will have difficulty
establishing in court that any information in our magazine can benefit
Bellcore's competitors, if indeed Bellcore has any competitors.

If in fact you choose to challenge our First Amendment rights to disseminate
important information about the telephone infrastructure, we will be compelled
to respond by seeking all legal remedies against you, which may include
sanctions provided for in Federal and state statutes and rules of civil
procedure.  We will also be compelled to publicize your use of lawsuits and the
threat of legal action to harass and intimidate.

Sincerely,

Emmanuel Goldstein

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Exposed Hole In Telephone Network Draws Ire Of Bellcore          July 24, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Taken from Communications Daily (Page 5)

                         Anyone Can Wiretap Your Phone

Major security hole in telephone network creates "self-serve" monitoring
feature allowing anyone to listen in on any telephone conversation they choose.
Weakness involves feature called Busy Line Verification (BLV), which allows
phone companies to "break into" conversation at any time.  BLV is used most
often by operators entering conversation to inform callers of emergency
message.  But BLV feature can be used by anyone with knowledge of network's
weakness to set up ad hoc 'wiretap' and monitor conversations, said Emmanuel
Goldstein, editor of 2600 Magazine, which published article in its Winter 1991
issue.

2600 Magazine is noted for finding and exposing weaknesses of
telecommunications.  It's named for frequency of whistle, at one time given
away with Cap'n Crunch cereal, which one notorious hacker discovered could,
when blown into telephone receiver, allow access to open 800 line.  Phone
companies have since solved that problem.

Security risks are outlined in article titled "U.S. Phone Companies Face Built-
In Privacy Hole" that quotes from internal Bellcore memo and Bell Operating Co.
documents: "'A significant and sophisticated vulnerability' exists that could
affect the security and privacy of BLV." Article details how, after following 4
steps, any line is susceptible to secret monitoring.  One document obtained by
2600 said: "There is no proof the hacker community knows about the
vulnerability."

When Bellcore learned of article, it sent magazine harsh letter threatening
legal action.  Letter said that if at any time in future magazine "comes into
possession of, publishes, or otherwise discloses any Bellcore information"
organization will "vigorously pursue all legal remedies available to it
including, but not limited to, injunctive and monetary damages."  Leonard
Suchyta, Bellcore General Attorney for Intellectual Property Matters, said
documents in magazine's possession "are proprietary" and constitute "a trade
secret" belonging to Bellcore and its members -- RBOCs.  He said documents are
"marked with 'Proprietary' legend" and "the law says you can't ignore this
legend, its [Bellcore's] property."  Suchyta said Bellcore waited so long to
respond to publication because "I think the article, as we are not subscribers,
was brought to our attention by a 3rd party."  He said this is first time he
was aware that magazine had published such Bellcore information.

But Goldstein said in reply letter to Bellcore: "This is not the first time we
have done this.  It will not be the last."  He said he thinks Bellcore is
trying to intimidate him, "but they've come up against the wrong publication
this time."  Goldstein insisted that documents were leaked to his magazine:
"While we don't spread the documents around, we will report on what's contained
within."  Suchyta said magazine is obligated to abide by legend stamped on
documents.  He said case law shows that the right to publish information hinges
on whether it "has been lawfully acquired.  If it has a legend on it, it's sort
of hard to say it's lawfully acquired."

Goldstein said he was just making public what already was known: There's known
privacy risk because of BLV weakness: "If we find something out, our first
instinct is to tell people about it.  We don't keep things secret."  He said
information about security weaknesses in phone network "concerns everybody."
Just because Bellcore doesn't want everyone to know about its shortcomings and
those of telephone network is hardly reason to stifle that information,
Goldstein said.  "Everybody should know if their phone calls can be listened in
on."

Suchyta said that to be considered "valuable," information "need not be of
super, super value," like proprietary software program "where you spent
millions of dollars" to develop it.  He said information "could well be your
own information that would give somebody an advantage or give them some added
value they wouldn't otherwise have had if they had not taken it from you."
Goldstein said he was "sympathetic" to Bellcore's concerns but "fact is, even
when such weaknesses are exposed, [phone companies] don't do anything about
them."  He cited recent indictments in New York where computer hackers were
manipulating telephone, exploiting weaknesses his magazine had profiled long
ago.  "Is there any security at all [on the network]?" he said.  "That's the
question we have to ask ourselves."

Letter from Bellcore drew burst of responses from computer community when
Goldstein posted it to electronic computer conference.  Lawyers specializing in
computer law responded, weighing in on side of magazine.  Attorney Lance Rose
said: "There is no free-floating 'secrecy' right . . . Even if a document says
'confidential' that does not mean it was disclosed to you with an understanding
of confidentiality -- which is the all-important question."  Michael Godwin,
general counsel for Electronic Frontier Foundation, advocacy group for the
computer community, said: "Trade secrets can qualify as property, but only if
they're truly trade secrets.  Proprietary information can (sort of) qualify as
property if there's a breach of a fiduciary duty."  Both lawyers agreed that
magazine was well within its rights in publishing information.  "If Emmanuel
did not participate in any way in encouraging or aiding in the removal of the
document from Bellcore . . . that suggests he wouldn't be liable," Godwin said.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Bellcore And 2600 Dispute Publishing Of Article                  July 27, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Barbara E. McMullen & John F. McMullen (Newsbytes)

MIDDLE ISLAND, NY -- Eric Corley a/k/a "Emmanuel Goldstein", editor and
publisher of 2600 Magazine: The Hacker Quarterly, has told Newsbytes that he
will not be deterred by threats from Bellcore from publishing material which he
considers important for his readership.

Earlier this month, Corley received a letter (addressed to "Emanuel Golstein")
from Leonard Charles Suchyta, General Attorney, Intellectual Property Matters
at Bellcore taking issue with the publication by 2600 of material that Suchyta
referred to as "portions of certain Bellcore proprietary internal documents."

The letter continued "This letter is to formally advise you that, if at any
time in the future you (or your magazine) come into possession of, publish, or
otherwise disclose any Bellcore information or documentation which either (i)
you have any reason to believe is proprietary to Bellcore or has not been made
publicly available by Bellcore or (ii) is marked "proprietary," "confidential,"
"restricted," or with any other legend denoting Bellcore's proprietary interest
therein, Bellcore will vigorously pursue all legal remedies available to it
including, but not limited to, injunctive relief and monetary damages, against
you, your magazine, and its sources."

While the letter did not mention any specific material published by 2600,
Corley told Newsbytes that he believes that Suchyta's letter refers to an
article entitled "U.S. Phone Companies Face Built-In Privacy Hole".that appears
on page 42 of the Winter 1991 issue.  Corley said "What we published was
derived from a 1991 internal Bellcore memo as well as Bell Operating Company
documents that were leaked to us.  We did not publish the documents.  However,
we did read what was sent to us and wrote an article based upon that.  The
story focuses on how the phone companies are in an uproar over a 'significant
and sophisticated vulnerability' that could result in BLV (busy line
verification) being used to listen in on phone calls."

The 650-word article said, in part, "By exploiting a weakness, it's possible
to remotely listen in on phone conversations at a selected telephone number.
While the phone  companies can do this any time they want, this recently
discovered self-serve monitoring feature has created a telco crisis of sorts."

The article further explained how people might exploit the security hole,
saying "The intruder can listen in on phone calls by following these four
steps:

"1. Query the switch to determine the Routing Class Code assigned to the BLV
    trunk group.
"2. Find a vacant telephone number served by that switch.
"3. Via recent change, assign the Routing Class Code of the BLV trunks to the
    Chart Column value of the DN (directory number) of the vacant telephone
    number.
"4. Add call forwarding to the vacant telephone number (Remote Call Forwarding
    would allow remote definition of the target telephone number while Call
    Forwarding Fixed would only allow the specification of one target per
    recent change message or vacant line)."

"By calling the vacant phone number, the intruder would get routed to the BLV
trunk group and would then be connected on a "no-test vertical" to the target
phone line in a bridged connection."

The article added "According to one of the documents, there is no proof that
the hacker community knows about the vulnerability.  The authors did express
great concern over the publication of an article entitled 'Central Office
Operations - The End Office Environment' which appeared in the electronic
newsletter Legion of Doom/Hackers Technical Journal.  In this article,
reference is made to the 'No Test Trunk'."

The article concludes "even if hackers are denied access to this "feature",
BLV networks will still have the capability of being used to monitor phone
lines.  Who will be monitored and who will be listening are two forever
unanswered questions."

Corley responded to to Suchyta's letter on July 20th, saying "I assume that
you're referring to our revelation of built-in privacy holes in the telephone
infrastructure which appeared on Page 42.  In that piece, we quoted from an
internal Bellcore memo as well as Bell Operating Company documents.  This is
not the first time we have done this.  It will not be the last.

"We recognize that it must be troubling to you when a journal like ours
publishes potentially embarrassing information of the sort described above.
But as journalists, we have a certain obligation that cannot be cast aside
every time a large and powerful entity gets annoyed.  That obligation compels
us to report the facts as we know them to our readers, who have a keen interest
in this subject matter.  If, as is often the case, documents, memoranda, and/or
bits of information in other forms are leaked to us, we have every right to
report on the contents therein.  If you find fault with this logic, your
argument lies not with us, but with the general concept of a free press.

"And, as a lawyer specializing in intellectual property law, you know that
you cannot in good faith claim that merely stamping "proprietary" or "secret"
on a document establishes that document as a trade secret or as proprietary
information.  In the absence of a specific explanation to the contrary, we must
assume that information about the publicly supported telephone system and
infrastructure is of public importance, and that Bellcore will have difficulty
establishing in court that any information in our magazine can benefit
Bellcore's competitors, if indeed Bellcore has any competitors.

"If in fact you choose to challenge our First Amendment rights to disseminate
important information about the telephone infrastructure, we will be compelled
to respond by seeking all legal remedies against you, which may include
sanctions provided for in Federal and state statutes and rules of civil
procedure.  We will also be compelled to publicize your use of lawsuits and the
threat of legal action to harass and intimidate.

  Sincerely,
  Emmanuel Goldstein"

Corley told Newsbytes "Bellcore would never have attempted this with the New
York Times.  They think that it would, however, be easy to shut us up by simple
threats because of our size.  They are wrong.  We are responsible journalists;
we know the rules and we abide by them.  I will, by the way, send copies of the
article in question to anyone who request it.  Readers may then judge for
themselves whether any boundaries have been crossed."

Corley, who hosts the weekly "Off the Hook" show on New York City's WBAI radio
station, said that he had discussed the issue on the air and had received
universal support from his callers.  Corley also told Newsbytes, that, although
he prefers to be known by his nomme de plume (taken from  George Orwell's
1984), he understands that the press fells bound to use his actual name.  He
said that, in the near future, he will "end the confusion by having my name
legally changed."

Bellcore personnel were unavailable for comment on any possible response to
Corley's letter.
_______________________________________________________________________________

 Interview With Ice Man And Maniac                                July 22, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Joshua Quittner (New York Newsday)(Page 83)

Ice Man and Maniac are two underground hackers in the New England area that
belong to a group known as Micro Pirates, Incorporated.  They agreed to be
interviewed if their actual identities were not revealed.

[Editor's Note:  They are fools for doing this, especially in light of how
                 Phiber Optik's public media statements and remarks will
                 ultimately be used against him.]

Q: How do you define computer hacking?

Maniac:  Hacking is not exploration of computer systems.  It's more of an
         undermining of security.  That's how I see it.

Q: How many people are in your group, Micro Pirates Incorporated?

Ice Man: Fifteen or 14.

Maniac:  We stand for similar interests.  It's an escape, you know.  If I'm not
         doing well in school, I sit down on the board and talk to some guy in
         West Germany, trade new codes of their latest conquest.  Escape.
         Forget about the real world.

Ice Man. It's more of a hobby.  Why do it?  You can't exactly stop.  I came
         about a year-and-a-half ago, and I guess you could say I'm one of the
         ones on a lower rung, like in knowledge.  I do all the -- you wouldn't
         call it dirty work -- phone calls.  I called you -- that kind of
         thing.

Q: You're a "social engineer"?

Ice Man: Social engineering -- I don't know who coined the term.  It's using
         conversation to exchange information under false pretenses.  For
         example, posing as a telecommunications employee to gain more
         knowledge and insight into the different [phone network] systems.

Q: What social engineering have you done?

Maniac:  We hacked into the system that keeps all the grades for the public
         school system.  It's the educational mainframe at Kingsborough
         Community College.  But we didn't change anything.

Ice Man: They have the mainframe that stores all the schedules, Regents scores,
         ID numbers of all the students in the New York high school area.  You
         have to log in as a school, and the password changes every week.

Q: How did you get the password?

Ice Man: Brute force and social engineering.  I was doing some social
         engineering in school.  I was playing the naive person with an
         administrator, asking all these questions toward what is it, where is
         it and how do you get in.
 
Q: I bet you looked at your grades.  How did you do?

Ice Man: High 80s.

Q. And you could have changed Regents scores?

Ice Man: I probably wouldn't have gotten away with it, and I wouldn't say I
         chose not to on a moral basis.  I'd rather say on a security basis.

Q: What is another kind of social engineering?

Maniac:  There's credit-card fraud and calling-card fraud.  You call up and
         say, "I'm from the AT&T Corporation.  We're having trouble with your
         calling-card account.  Could you please reiterate to us your four-
         digit PIN number?"  People, being kind of God-fearing -- as AT&T is
         somewhat a God -- will say, "Here's my four-digit PIN number."

Q:  Hackers from another group, MOD, were arrested recently and charged with,
    among other things, selling inside information about how to penetrate
    credit bureaus.  Have you cleaned up your act?

Maniac:  We understand the dangers of it now.  We're not as into it.  We
         understand what people go through when they find out a few thousand
         dollars have been charged to their credit-card account.

Q: Have you hacked into credit bureaus?

Ice Man: We were going to look up your name.

Maniac:  CBI [Credit Bureau International, owned by Equifax, one of the largest
         national credit bureaus], is pretty insecure, to tell you the truth.

Q: Are you software pirates, too?

Maniac: Originally.  Way back when.

Ice Man: And then we branched out and into the hacking area.  Software piracy
         is, in the computer underground, the biggest thing.  There are groups
         like THG and INC, which are international.  THG is The Humble Guys.
         INC is International Network of Crackers, and I've recently found out
         that it's run by 14 and 15-year-olds.  They have people who work in
         companies, and they'll take the software and they'll crack it -- the
         software protection -- and then distribute it.

Q: Are there many hacking groups in New York?

Maniac:  Three or four.  LOD [the Legion of Doom, named by hacker Lex Luthor],
         MOD, MPI and MOB [Men of Business].

Q: How do your members communicate?

Ice Man: The communication of choice is definitely the modem [to access
         underground electronic bulletin boards where members leave messages
         for each other or "chat" in real time].  After that is the voice mail
         box [VMB].  VMBs are for communications between groups.

         A company, usually the same company that has beepers and pagers and
         answering services, has a voice-mail-box service.  You call up [after
         hacking out an access code that gives the user the ability to create
         new voice mail boxes on a system] and can enter in a VMB number.
         Occasionally they have outdial capabilities that allow you to call
         anywhere in the world.  I call about five every day.  It's not really
         my thing.

Q: Is your group racially integrated?

Ice Man: Half of them are Asian.  Also we have, I think, one Hispanic.  I never
         met him.  Race, religion -- nobody cares.  The only thing that would
         alienate you in any way would be if you were known as a lamer.  If you
         just took, took, took and didn't contribute to the underground.  It's
         how good you are, how you're respected.

Maniac:  We don't work on a racial basis or an ethnic basis.  We work on a
         business basis.  This is an organized hobby.  You do these things for
         us and you get a little recognition for it.

Ice Man: Yeah.  If you're a member of our group and you need a high-speed
         modem, we'll give you one, on a loan basis.

Q: How does somebody join MPI?

Maniac:  They have to contact either of us on the boards.

Ice Man: And I'll go through the whole thing [with them], validating them,
         checking their references, asking them questions, so we know what
         they're talking about.  And if it's okay, then we let them in.  We
         have members in 516, 718, 212, 201, 408, and 908.  We're talking to
         someone in Florida, but he's not a member yet.

Q: Are any MPI members in other hacking groups?

Ice Man: I know of no member of MPI that is in any other group.  I wouldn't
         call it betrayal, but it's like being in two secret clubs at one time.
         I would want them faithful to my group, not any other group.  There is
         something called merging, a combination of both groups that made them
         bigger and better.  A lot of piracy groups did that.

Q: Aren't you concerned about breaking the law?

Maniac:  Breaking the law?  I haven't gotten caught.  If I do get caught, I
         won't be stupid and say I was exploring -- I'm not exploring.  I'm
         visiting, basically.  If you get caught, you got to serve your time.
         I'm not going to fight it.
_______________________________________________________________________________

 FBI Unit Helps Take A Byte Out Of Crime                          July 15, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Bill Gertz (The Washington Times)(Page A4)

FBI crime busters are targeting elusive computer criminals who travel the world
by keyboard, telephone and  computer  screen and use such code names as "Phiber
Optik," "Masters of Disaster," "Acid Phreak" and "Scorpion."

"Law enforcement across the board recognizes that this is a serious emerging
crime problem, and it's only going to continue to grow in the future," said
Charles L. Owens, chief of the FBI's economic crimes unit.

Last week in New York, federal authorities unsealed an indictment against five
computer hackers, ages 18 to 22, who were charged with stealing long-distance
phone service and credit bureau information and who penetrated a wide variety
of computer networks.

The FBI is focusing its investigations on major intrusions into banking and
government computers and when the objective is stealing money, Mr. Owens said
in an interview.

FBI investigations of computer crimes have doubled in the past year, he said,
adding that only about 11 percent to 15 percent of computer crimes are reported
to law enforcement agencies.  Because of business or personal reasons, victims
often are reluctant to come forward, he said.

Currently, FBI agents are working on more than 120 cases, including at least
one involving a foreign intelligence agency.  Mr. Owens said half of the active
cases involve hackers operating overseas, but he declined to elaborate.

The FBI has set up an eight-member unit in its Washington field office devoted
exclusively to solving computer crimes.

The special team, which includes computer scientists, electrical engineers and
experienced computer system operators, first handled the tip that led to the
indictment of the five hackers in New York, according to agent James C. Settle,
who directs the unit.

Computer criminals, often equipped with relatively unsophisticated Commodore 64
or Apple II computers, first crack into international telephone switching
networks to make free telephone calls anywhere in the world, Mr. Settle said.

Hackers then can spend up to 16 hours a day, seven days a week, breaking into
national and international computer networks such as the academic-oriented
Internet, the National Aeronautics and Space Administration's Span-Net and the
Pentagon's Milnet.

To prevent being detected, unauthorized computer users "loop and weave" through 
computer networks at various locations in the process of getting information.

"A lot of it is clearly for curiosity, the challenge of breaking into systems,"
Mr. Settle said.  "The problem is that they can take control of the system."

Also, said Mr. Owens, computer hackers who steal such information from
commercial data banks may turn to extortion as a way to make money.

Mr. Settle said there are also "indications" that computer criminals are
getting involved in industrial espionage.

The five hackers indicted in New York on conspiracy, computer-fraud, computer
tampering, and wire-fraud charges called themselves "MOD," for Masters of
Deception or Masters of Disaster.

The hackers were identified in court papers as Julio Fernandez, 18, John Lee,
21, Mark Abene, 20, Elias Ladopoulos, 22, and Paul Stira, 22.  All live in the
New York City area.

Mr. Fernandez and Mr. Lee intercepted data communications from a computer
network operated by the Bank of America, court papers said.

They also penetrated a computer network of the Martin Marietta Electronics
Information and Missile Group, according to the court documents.

The hackers obtained personal information stored in credit bureau computers,
with the intention of altering it "to destroy people's lives or make them look
like saints," the indictment stated.
_______________________________________________________________________________

 And Today's Password Is...                                        May 26, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Robert Matthews (The Daily Telegraph)(page 26)

                  "Ways Of Keeping Out The Determined Hacker"

One of the late Nobel Prize-winning physicist Richard Feynman's favorite
stories was how he broke into top-secret atomic bomb files at Los Alamos by
guessing that the lock combination was 271828, the first six digits of the
mathematical constant "e".  Apart from being amusing, Feynman's anecdote stands
as a warning to anyone who uses dates, names or common words for their computer
password.

As Professor Peter Denning, of George Mason University, Virginia, points out in
American Scientist, for all but the most trivial secrets, such passwords simply
aren't good enough.  Passwords date back to 1960, and the advent of time-
sharing systems that allowed lots of users access to files stored on a central
computer.  It was not long before the standard tricks for illicitly obtaining
passwords emerged:  Using Feynman-style educated guessing, standing behind
computer users while they typed in their password or trying common system
passwords like "guest" or "root".  The biggest security nightmare is, however,
the theft of the user-password file, which is used by the central computer to
check any password typed in.

By the mid-1970s, ways of tackling this had been developed.  Using so-called
"one-way functions", each password was encrypted in a way that cannot be
unscrambled.  The password file then contains only apparently meaningless
symbols, of no obvious use to the would-be hacker.  But, as Denning warns, even
this can be beaten if passwords are chosen sloppily.  Instead of trying to
unscramble the file, hackers can simply feed common names and dates -- or even
the entire English dictionary -- through the one-way function to see if the end
result matches anything on the scrambled password file.  Far from being a
theoretical risk, this technique was used during the notorious Project
Equalizer case in 1987, when KGB-backed hackers in Hanover broke the passwords
of Unix-based computers in America.

Ultimately, the only way to solve the password problem is to free people of
their fear of forgetting more complex ones.  The long-term solution, says
Denning, probably lies with the use of smart-card technology.  One option is a
card which generates different passwords once a minute, using a formula based
on the time given by an internal clock.  The user then logs on using this
password.  Only if the computer confirms that the password corresponds to the
log-on time is the user allowed to continue.  Another smart-card technique is
the "challenge-response" protocol.  Users first log on to their computer under
their name, and are then "challenged" by a number appearing on the screen.
Keying this into their smart card, a "response number" is generated by a
formula unique to each smart card.  If this number corresponds to the response
expected from a particular user's smart card, the computer allows access.  A
number of companies are already marketing smart-card systems, although the
technology has yet to become popular.

In the meantime, Denning says that avoiding passwords based on English words
would boost security.  He highlights one simple technique for producing non-
standard words that are nonetheless easy to remember: "Pass-phrases".  For
this, one merely invents a nonsensical phrase like "Martin says Unix gives gold
forever", and uses the first letter of each word to generate the password:
MSUGGF.  Such a password will defeat hackers, even if the password file is
stolen, as it does not appear in any dictionary.  However, Denning is wary of
giving any guarantees.  One day, he cautions, someone may draw up a
computerized dictionary of common phrases.  "The method will probably be good
for a year or two, until someone who likes to compile these dictionaries starts
to attack it."
_______________________________________________________________________________

 Outgunned "Computer Cops" Track High-Tech Criminals               June 8, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Tony Rogers (Associated Press)

BOSTON -- The scam was simple.  When a company ordered an airline ticket on its
credit card, a travel agent entered the card number into his computer and
ordered a few extra tickets.

The extra tickets added up and the unscrupulous agent sold them for thousands
of dollars.

But the thief eventually attracted attention and authorities called in Robert
McKenna, a prosecutor in the Suffolk County district attorney's office.  He is
one of a growing, but still outgunned posse of investigators who track high-
tech villains.

After the thief put a ticket to Japan on a local plumbing company's account, he
was arrested by police McKenna had posing as temporary office workers.  He was
convicted and sentenced to a year in prison.

But the sleuths who track high-tech lawbreakers say too many crimes can be
committed with a computer or a telephone, and too few detectives are trained to
stop them.

"What we've got is a nuclear explosion and we're running like hell to escape
the blast.  But it's going to hit us," said Chuck Jones, who oversees high-tech
crime investigations at the California Department of Justice.

The problem is, investigators say, computers have made it easier to commit
crimes like bank fraud.  Money transfers that once required signatures and
paperwork are now done by pressing a button.

But it takes time to train a high-tech enforcer.

"Few officers are adept in investigating this, and few prosecutors are adept
in prosecuting it," Jones said.

"You either have to take a cop and make him a computer expert, or take a
computer expert and make him a cop.  I'm not sure what the right approach is."

In recent high-tech crimes:

- Volkswagen lost almost $260 million because of an insider computer scam
  involving phony currency exchange transactions.

- A former insurance firm employee in Fort Worth, Texas, deleted more than
  160,000 records from the company's computer. 

- A bank employee sneaked in a computer order to Brinks to deliver 44
  kilograms of gold to a remote site, collected it, then disappeared.

Still, computer cops have their successes.

The Secret Service broke up a scheme to make counterfeit automatic teller
machine cards that could have netted millions.

And Don Delaney, a computer detective for the New York State Police, nabbed
Jaime Liriano, who cracked a company's long-distance phone system.

Many company phone systems allow employes to call an 800 number, punch in a
personal identification number and then make long-distance calls at company
expense.

Some computer hackers use automatic speed dialers -- known as "demon dialers"
-- to dial 800 numbers repeatedly and try different four-digit numbers until
they crack the ID codes.  Hackers using this method stole $12 million in phone
service from NASA.

Liriano did it manually, calling the 800 number of Data Products in
Wallingford, Connecticut, from his New York City apartment.  He cracked the
company's code in two weeks.

Liriano started selling the long distance service -- $10 for a 20-minute call
anywhere -- and customers lined up inside his apartment.

But Delaney traced the calls and on March 10, he and his troopers waited
outside Liriano's apartment.  On a signal from New York Telephone, which was
monitoring Liriano's line, the troopers busted in and caught him in the act.

Liriano pleaded guilty to a misdemeanor of theft of services, and was
sentenced to three years' probation and community service.

Data Products lost at least $35,000.  "And we don't know what he made,"
Delaney said of Liriano.
_______________________________________________________________________________

 Who Pays For Calls By Hackers?                                   June 12, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Kent Gibbons (The Washington Times)(Page C1)

ICF International Inc. doesn't want to pay $82,000 for unauthorized calls by
hackers who tapped the company's switchboard.

AT&T says the Fairfax engineering firm owns the phone system and is responsible
for the calls, mostly to Pakistan.

Now their dispute and others like it are in Congress' lap.  A House
subcommittee chairman believes a law is needed to cap the amount a company can
be forced to pay for fraudulent calls, the same way credit card users are
protected.

Edward Markey, the Massachusetts Democrat who held hearings on the subject
said long-distance carriers and local telephone companies should absorb much of
those charges.

Victims who testified said they didn't know about the illegal calls until the
phone companies told them, sometimes weeks after strange calling patterns
began.  But since the calls went through privately owned switchboards before
entering the public telephone network, FCC rules hold the switchboard owners
liable.

"This is one of the ongoing dilemmas caused by the breakup of AT&T," Mr. Markey
said.  Before the 1984 Bell system breakup, every stage of a call passed
through the American Telephone & Telegraph Co. network and AT&T was liable for
fraudulent calls.

Estimates of how much companies lose from this growing form of telephone fraud
range from $300 million to more than $2 billion per year.

The range is so vast because switchboard makers and victims often don't report
losses to avoid embarrassment or further fraud, said James Spurlock of the
Federal Communications Commission.

Long-distance carriers say they have stepped up their monitoring of customer
calls to spot unusual patterns such as repeated calls to other countries in a
short period.  In April, Sprint Corp. added other protective measures,
including, for a $100 installation charge and $100 monthly fee, a fraud
liability cap of $25,000 per incident.

AT&T announced a similar plan last month.

Robert Fox, Sprint assistant vice president of security, said the new plans cut
the average fraud claim from more than $20,000 in the past to about $2,000
during the first five months of this year.

But the Sprint and AT&T plans don't go far enough, Mr. Markey said.

ICF's troubles started in March 1988.  At the time, the portion of ICF that was
hit by the fraud was an independent software firm in Rockville called Chartways
Technologies Inc.  ICF bought Chartways in April 1991.

As with most cases of fraud afflicting companies with private phone systems,
high-tech bandits broke into the Chartways switchboard using a toll-free number
set up for the company's customers.

Probably aided by a computer that randomly dials phone numbers, the hackers
got through security codes to obtain a dial tone to make outside calls.

The hackers used a fairly common feature some companies offer out-of-town
employees to save on long-distance calls.  Ironically, Chartways never used the
feature because it was too complicated, said Walter Messick, ICF's manager of
contract administration.

On March 31, AT&T officials told Chartways that 757 calls were made to Pakistan
recently, costing $42,935.

The phone bill arrived later that day and showed that the Pakistan calls had
begun 11 days before, Mr.Messick said.

Because of the Easter holiday and monitoring of calls by Secret Service agents,
ICF's outside-calling feature was not disconnected until April 4.  By then, ICF
had racked up nearly $82,000 in unauthorized calls.

A year ago, the FCC's Common Carrier Bureau turned down ICF's request to erase
the charges.  The full commission will hear an appeal this fall.
_______________________________________________________________________________

 Dutch Hackers Feel Data Security Law Will Breed Computer Crime    July 7, 1992
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 By Oscar Kneppers (ComputerWorld Netherland)

HAARLEM, the Netherlands -- Dutch hackers will be seriously reprimanded for
breaking and entering computer systems, if a new law on computer crime is
passed in the Netherlands.

Discussed recently in Dutch parliament and under preparation for more than two
years, the proposed law calls hacking "a crime against property."  It is
expected to be made official in next spring at the earliest and will consist of
the following three parts:

-  The maximum penalty for hackers who log on to a secured computer system
   would be six months' imprisonment.

-  If they alter data in the system, they could spend up to four years in
   prison.

- Those who illegally access a computer system that serves a "common use" --
  like that in a hospital or like a municipal population database -- could soon
  risk a prison sentence of six years.

This pending law does not differentiate between computer crimes committed
internally or externally from an office.  For example, cracking the password of
a colleague could lead to prosecution.

Hackers believe this law will only provoke computer crime, because the hackers
themselves will no longer offer "cheap warnings" to a computer system with poor
security.

Rop Gonggrijp, who is sometimes called the King of Hacking Holland, and is
currently editor-in-chief of Dutch computer hacker magazine "Hack-tic" warns
that this law could produce unexpected and unwanted results.

"Students who now just look around in systems not knowing that it [this
activity] is illegal could then suddenly end up in jail," he said.  Gonggrijp
equates hacking to a big party, where you walk in uninvited.

Gonggrijp is concerned about the repercussions the new law may have on existing
hackers.  He said he thinks the current relationship between computer hackers
and systems managers in companies is favorable.  "[Hackers] break into, for
example, an E-mail system to tell the systems manager that he has to do
something about the security.  If this law is introduced, they will be more
careful with that [move].  The cheap warning for failures in the system will,
therefore, no longer take place, and you increase chances for so-called real
criminals with dubious intentions," he added.

According to a spokesman at the Ministry of Justice in The Hague, the law gives
the Dutch police and justice system a legal hold on hackers that they currently
lack.

"Computer criminals [now] have to be prosecuted via subtle legal tricks and
roundabout routes.  A lot of legal creativity was [previously] needed.  But
when this law is introduced, arresting the hackers will be much easier," he
said.

The Dutch intelligence agency Centrale Recherche Informatiedienst (CRI) in The
Hague agreed with this.  Ernst Moeskes, CRI spokesman, said, "It's good to see
that we can handle computer crime in a directed way now."
_______________________________________________________________________________

 PWN Quicknotes
 ~~~~~~~~~~~~~~
1.  Printer Avoids Jail In Anti-Hacking Trial (By Melvyn Howe, Press
    Association Newsfile, June 9, 1992) -- A printer avoided a jail sentence
    in Britain's first trial under anti-hacking legislation.  Freelance
    typesetter Richard Goulden helped put his employers out of business with a
    pirate computer program -- because he said they owed him L2,275 in back
    pay.  Goulden, 35, of Colham Avenue, Yiewsley, west London, was
    conditionally discharged for two years after changing his plea to guilty on
    the second day of the Southwark Crown Court hearing.  He was ordered to pay
    L1,200 prosecution costs and L1,250 compensation to the company's
    liquidators.  Goulden had originally denied the charge of unauthorized
    modification of computer material under the 1990 Computer Misuse Act.
    After his change of plea Judge John Hunter told him:  "I think it was plain
    at a very early stage of these proceedings that you had no defence to this
    allegation." Mr. Warwick McKinnon, prosecuting, told the jury Goulden added
    a program to a computer belonging to Ampersand Typesetters, of Camden,
    north-west London, in June last year which prevented the retrieval of
    information without a special password.  Three months later the company
    "folded".  Mr Jonathan Seitler, defending, said Goulden had changed his
    plea after realizing he had inadvertently broken the law.
_______________________________________________________________________________

2. ICL & GM Hughes In Joint Venture To Combat Computer Hackers (Extel Examiner,
   June 15, 1992) -- General Motors Corporation unit, Hughes STX, and ICL have
   set up a joint venture operation offering ways of combating computer
   hackers.  Hughes STX is part of GM's GM Hughes Electronics Corporation
   subsidiary.  ICL is 80% owned by Fujitsu.  Industry sources say the venture
   could reach $100 million in annual sales within four years.
_______________________________________________________________________________

3.  Another Cornell Indictment (Ithaca Journal, June 17, 1992) -- Mark Pilgrim,
    David Blumenthal, and Randall Swanson -- all Cornell students -- have each
    been charged with 4 felony counts of first-degree computer tampering, 1
    count of second-degree computer tampering, and 7 counts of second-degree
    attempted computer tampering in connection with the release of the MBDF
    virus to the Internet and to various BBSs.

    David Blumenthal has also been charged with two counts of second-degree
    forgery and two counts of first-degree falsifying business records in
    connection with unauthorized account creation on Cornell's VAX5 system.  He
    was also charged with a further count of second-degree computer tampering
    in connection with an incident that occurred in December of 1991.
_______________________________________________________________________________

4. Computer Watchdogs Lead Troopers To Hacker (PR Newswire, July 17, 1992) --
   Olympia, Washington -- State Patrol detectives served a search warrant at an
   East Olympia residence Thursday evening, July 16, and confiscated a personal
   computer system, programs and records, the Washington State Patrol said.

   The resident, who was not on the premises when the warrant was served, is
   suspected of attempts to break into computer files at the Department of
   Licensing and the State Insurance Commissioner's office.

   The "hacker's" attempts triggered computerized security devices which
   alerted officials someone was attempting to gain access using a telephone
   modem.  Patrol detectives and computer staff monitored the suspect's
   repeated attempts for several weeks prior to service of the warrant.

   Placement of a telephone call by a non-recognized computer was all that was
   required to trigger the security alert.  The internal security system then
   stored all attempted input by the unauthorized user for later retrieval and
   use by law enforcement.  Integrity of the state systems was not breached.

   The investigation is continuing to determine if several acquaintances may be
   linked to the break in.  Charges are expected to be filed as early as next
   week in the case.

   CONTACT: Sgt. Ron Knapp of the Washington State Patrol, (206)459-6413
_______________________________________________________________________________

5. UPI reports that the 313 NPA will split to a new 810 NPA effective
   August 10, 1994.

   Oakland, Macomb, Genesee, Lapeer, St. Clair and Sanilac counties as well as
   small sections of Saginaw, Shiawassee and Livingston counties will go into
   810.  Wayne, Washtenaw, Monroe, and small parts of Jackson and Lenawee
   counties will remain in 313.  The city of Detroit is in Wayne County and
   won't change.
_______________________________________________________________________________