    [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
  ==========================================================================
  =                       <=-[ HWA.hax0r.news ]-=>                         =
  ==========================================================================
    [=HWA'99=]                         Number 31 Volume 1 1999 Aug 29th  99
  ==========================================================================
    [                     61:20:6B:69:64:20:63:6F:75:                    ]
    [               6C:64:20:62:72:65:61:6B:20:74:68:69:73:              ]
    [              20:22:65:6E:63:72:79:70:74:69:6F:6E:22:!              ]        
  ==========================================================================
   
  Well http://welcome.to/HWA.hax0r.news/ is still down and out of reach, I 
  have an email in to the admins of the V3 redirector site to see if I can't
  get access back to my redirector but i'm not hopeful. Meanwhile you can
  get us at www.csoft.net/~hwa 
                       

  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                       
 
 
          This week features an article by Dragos Ruiu entitleed
          "Stealth Coordinated Attack HOWTO" and is a very well
          written piece that sysadmins and hackers alike will find
          very informative, its a must-read (section #42) - Ed                       
          
                       
  
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=                       
                       


     New mirror sites
                
                http://www.attrition.org/hosted/hwa/
                http://www.ducktank.net/hwa/issues.html.
                http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
                http://hwazine.cjb.net/
                http://www.hackunlimited.com/files/secu/papers/hwa/
                http://www.attrition.org/~modify/texts/zines/HWA/
                
              * http://hwa.hax0r.news.8m.com/           
              * http://www.fortunecity.com/skyscraper/feature/103/  
               
              * Crappy free sites but they offer 20M & I need the space...
                        
                        
     
     HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net
     and www.digitalgeeks.com thanks to p0lix for the digitalgeeks bandwidth
     and airportman for the Cubesoft bandwidth. Also shouts out to all our
     mirror sites! tnx guys. 
     
     http://www.csoft.net/~hwa
     http://www.digitalgeeks.com/hwa

     
     HWA.hax0r.news Mirror Sites:
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     http://www.attrition.org/hosted/hwa/
     http://www.attrition.org/~modify/texts/zines/HWA/
     http://www.ducktank.net/hwa/issues.html. ** NEW **
     http://www.alldas.de/hwaidx1.htm ** NEW ** CHECK THIS ONE OUT **
     http://www.csoft.net/~hwa/ 
     http://www.digitalgeeks.com/hwa.
     http://members.tripod.com/~hwa_2k
     http://welcome.to/HWA.hax0r.news/
     http://www.attrition.org/~modify/texts/zines/HWA/
     http://archives.projectgamma.com/zines/hwa/.  
     http://www.403-security.org/Htmls/hwa.hax0r.news.htm

   =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=         
   
   
  
   SYNOPSIS (READ THIS)
   --------------------
   
   The purpose of this newsletter is to 'digest' current events of interest
   that affect the online underground and netizens in general. This includes
   coverage of general security issues, hacks, exploits, underground news
   and anything else I think is worthy of a look see. (remember i'm doing
   this for me, not you, the fact some people happen to get a kick/use
   out of it is of secondary importance).

    This list is NOT meant as a replacement for, nor to compete with, the
   likes of publications such as CuD or PHRACK or with news sites such as
   AntiOnline, the Hacker News Network (HNN) or mailing lists such as
   BUGTRAQ or ISN nor could any other 'digest' of this type do so.

    It *is* intended  however, to  compliment such material and provide a
   reference to those who follow the culture by keeping tabs on as many
   sources as possible and providing links to further info, its a labour
   of love and will be continued for as long as I feel like it, i'm not
   motivated by dollars or the illusion of fame, did you ever notice how
   the most famous/infamous hackers are the ones that get caught? there's
   a lot to be said for remaining just outside the circle... <g>
   
   

   @HWA

   =-----------------------------------------------------------------------=

                     Welcome to HWA.hax0r.news ... #31

   =-----------------------------------------------------------------------=


    
    We could use some more people joining the channel, its usually pretty
    quiet, we don't bite (usually) so if you're hanging out on irc stop
    by and idle a while and say hi...   

    *******************************************************************
    ***      /join #HWA.hax0r.news on EFnet the key is `zwen'       ***
    ***                                                             ***
    *** please join to discuss or impart news on techno/phac scene  ***
    *** stuff or just to hang out ... someone is usually around 24/7***
    ***                                                             ***
    *** Note that the channel isn't there to entertain you its for  ***
    *** you to talk to us and impart news, if you're looking for fun***
    *** then do NOT join our channel try #weirdwigs or something... ***
    *** we're not #chatzone or #hack                                ***
    ***                                                             ***
    *******************************************************************


  =-------------------------------------------------------------------------=
  
  Issue #31

  =--------------------------------------------------------------------------=
  [ INDEX ]
  =--------------------------------------------------------------------------=
    Key     Intros                                                         
  =--------------------------------------------------------------------------=
 
    00.0  .. COPYRIGHTS ......................................................
    00.1  .. CONTACT INFORMATION & SNAIL MAIL DROP ETC .......................
    00.2  .. SOURCES .........................................................
    00.3  .. THIS IS WHO WE ARE ..............................................
    00.4  .. WHAT'S IN A NAME? why `HWA.hax0r.news'?..........................
    00.5  .. THE HWA_FAQ V1.0 ................................................

  =--------------------------------------------------------------------------=
    Key     Content 
  =--------------------------------------------------------------------------=

    01.0  .. GREETS ..........................................................
     01.1 .. Last minute stuff, rumours, newsbytes ...........................
     01.2 .. Mailbag .........................................................
    02.0  .. From the Editor.................................................. 
    03.0  .. DOJ contemplates secret searches.................................
    04.0  .. First net convict will do no time................................
    05.0  .. NORTON ANTIVIRUS 2000 IS OUT.....................................
    06.0  .. SSL CPU CONSUMPTION CAUSES CONCERNS..............................
    07.0  .. Bug in Bill Gate's Anus?.........................................
    08.0  .. CESA Causing Outrage In Libertarians ............................
    09.0  .. ReDaTtAcK Arrested, Questioned, Charged, Released................
    10.0  .. Some GPS Systems Fail With Date Rollover ........................
    11.0  .. Security Search Engine MindSec Goes Online ......................
    12.0  .. CIA Ex-Director Security Clearance Revoked ......................
    13.0  .. GAO Releases Report on Risk Assement ............................
    14.0  .. CESA Drives People to Freedom ...................................
    15.0  .. Who's doing the Scanning? .......................................
    16.0  .. Japanese police go after copyright infringers....................
    17.0  .. Anti-Gay Web domain Returned to Original Owner ..................
    18.0  .. EXPLOIT-DEV Mailing List Started ................................
    19.0  .. NetBus - Product Under Siege ....................................
    20.0  .. Worst Security Hole Ever? .......................................
    21.0  .. IRC Banned in Malaysia ..........................................
    22.0  .. I want my, I want my, I want my HNN - more goodies from HNN......
    23.0  .. Melissa Creator Admits Guilt ....................................
    24.0  .. cDc Responds to Allegations About HKBs ..........................
    25.0  .. $50G Offered in 'Hacker Challenge' Publicity Stunt ..............
    26.0  .. NSA Recruiting In the Underground ...............................     
    27.0  .. Distributed.net Fingers Thief ...................................
    28.0  .. Hacktivism Email List ...........................................
    29.0  .. Mitnick in Car Accident .........................................
    30.0  .. Hong Kong Police Create Computer Crime Squad ....................
    31.0  .. Outlook Holes Demonstrated at USENIX ............................
    32.0  .. Feds Overflowing with Siezed Equipment ..........................
    33.0  .. Computer Hacker’s Sentence Spotlights High-Tech Crime Prosecutions
    34.0  .. Triads Linked to Info Vandalism - Alleged CoverUp by RCMP .......
    35.0  .. DoD Preps to Fight InfoCriminals Both Foreign and Domestic ......
    36.0  .. Another Big Hole Found in NT ....................................
    37.0  .. Korea to Block All Porn .........................................
    38.0  .. Grammatically Challenged InfoCriminal Defaces Site ..............
    39.0  .. Bank Emails Virus to Investors ..................................
    40.0  .. IS YAHOO SPAM OR ANTI-SPAM ORIENTED?.............................
    41.0  .. "NINES PROBLEM"..................................................
    42.0  .. Stealth Coordinated Attack HOWTO by Dragos Ruiu..................
    43.0  .. TAIWAN CIRCLES WAGONS IN CYBER-WARFARE...........................
    44.0  .. UK WEBHOSTING COMPANY HIT BY VIRUS...............................
    45.0  .. NETSCAPE ISSUES WEB-SERVER FIX...................................
    46.0  .. CWI CRACKS 512 BIT KEY...........................................
    47.0  .. MOUNTING AN ANTI-VIRUS DEFENSE...................................
    48.0  .. RETROSPECTIVE ON CRACKING CONTESTS...............................
    49.0  .. SHOUTCAST COMPROMISED............................................
    50.0  .. AUDIT OFFICE BLASTS AGENCIES' SERIOUS SECURITY FLAWS.............
    51.0  .. ISS X-FORCE ADVISORY ON LOTUS NOTES DOMINO SERVER 4.6............
    52.0  .. TECHNOLOGY KEY TO TRACKING DOWN INTERNET CRIME...................
    53.0  .. GOVT HOME-INVASION BILL DRIVES US PC USERS TO CANADA.............
    54.0  .. HACKERS SCANNING FOR TROUBLE.....................................
    55.0  .. Canada Net they've built a super fast network, but what to do with it?
    56.0  .. Security focus BUGTRAQ summary...................................
    57.0  .. A typical script kiddie attack scenerio against HTTP server......
    58.0  .. NMAP - Scan Analysis (v2)........................................
    59.0  .. Security Focus: Incidents Summary................................
    60.0  .. Security Focus: Jobs.............................................
    =--------------------------------------------------------------------------=   
    
    AD.S  .. Post your site ads or etc here, if you can offer something in return
             thats tres cool, if not we'll consider ur ad anyways so send it in.
             ads for other zines are ok too btw just mention us in yours, please
             remember to include links and an email contact. Corporate ads will
             be considered also and if your company wishes to donate to or 
             participate in the upcoming Canc0n99 event send in your suggestions
             and ads now...n.b date and time may be pushed back join mailing list
             for up to date information.......................................
             Current dates: POSTPONED til further notice, place: TBA..    .................
    Ha.Ha .. Humour and puzzles  ............................................
              
              Hey You!........................................................
              =------=........................................................
              
              Send in humour for this section! I need a laugh and its hard to
              find good stuff... ;)...........................................

    SITE.1 .. Featured site, .................................................
     H.W   .. Hacked Websites  ...............................................
     A.0   .. APPENDICES......................................................
     A.1   .. PHACVW linx and references......................................
 
  =--------------------------------------------------------------------------=
     
     @HWA'99

     
 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

          THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE
          OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO
          WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT
          (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST
          READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ).
     
          Important semi-legalese and license to redistribute:
     
          YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF
          AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE
          ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED
          IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE
          APPRECIATED the current link is http://welcome.to/HWA.hax0r.news
          IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK
          ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL
          ME PRIVATELY current email cruciphux@dok.org
     
          THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL
          WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL
          THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS:
     
          I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE
          AND REDISTRIBUTE/MIRROR. - EoD
     
     
          Although this file and all future issues are now copyright, some of
         the content holds its  own copyright and these are printed and
         respected. News is news so i'll print any and all news but will quote
         sources when the source is known, if its good enough for CNN its good
         enough for me. And i'm doing it for free on my own time so pfffft. :)
     
         No monies are made or sought through the distribution of this material.
         If you have a problem or concern email me and we'll discuss it.
     
         cruciphux@dok.org
     
         Cruciphux [C*:.]



 00.1 CONTACT INFORMATION AND MAIL DROP
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


     Wahoo, we now have a mail-drop, if you are outside of the U.S.A or
    Canada / North America (hell even if you are inside ..) and wish to
    send printed matter like newspaper clippings a subscription to your
    cool foreign hacking zine or photos, small non-explosive packages
    or sensitive information etc etc well, now you can. (w00t) please
    no more inflatable sheep or plastic dog droppings, or fake vomit
    thanks.

    Send all goodies to:

	    HWA NEWS
	    P.O BOX 44118
	    370 MAIN ST. NORTH
	    BRAMPTON, ONTARIO
	    CANADA
	    L6V 4H5

    WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are
    ~~~~~~~  reading this from some interesting places, make my day and get a
             mention in the zine, send in a postcard, I realize that some places
             it is cost prohibitive but if you have the time and money be a cool
             dude / gal and send a poor guy a postcard preferably one that has some
             scenery from your place of residence for my collection, I collect stamps
             too so you kill two birds with one stone by being cool and mailing in a
             postcard, return address not necessary, just a  "hey guys being cool in
             Bahrain, take it easy" will do ... ;-) thanx.



    Ideas for interesting 'stuff' to send in apart from news:

    - Photo copies of old system manual front pages (optionally signed by you) ;-)
    - Photos of yourself, your mom, sister, dog and or cat in a NON
      compromising position plz I don't want pr0n. <g>
    - Picture postcards
    - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250
      tapes with hack/security related archives, logs, irc logs etc on em.
    - audio or video cassettes of yourself/others etc of interesting phone
      fun or social engineering examples or transcripts thereof.
    
    
    Stuff you can email:
    
    - Prank phone calls in .ram or .mp* format
    - Fone tones and security announcements from PBX's etc
    - fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities)
    - reserved for one smiley face ->        :-)            <-
    - PHACV lists of files that you have or phac cd's you own (we have a burner, *g*)
    - burns of phac cds (email first to make sure we don't already have em)
    - Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp*
    

    If you still can't think of anything you're probably not that interesting
    a person after all so don't worry about it <BeG>

    Our current email:

    Submissions/zine gossip.....: hwa@press.usmc.net
    Private email to editor.....: cruciphux@dok.org
    Distribution/Website........: sas72@usa.net

    @HWA



 00.2 Sources ***
      ~~~~~~~~~~~

     Sources can be some, all, or none of the following (by no means complete
    nor listed in any degree of importance) Unless otherwise noted, like msgs
    from lists or news from other sites, articles and information is compiled
    and or sourced by Cruciphux no copyright claimed.

    News & I/O zine ................. http://www.antionline.com/
    Back Orifice/cDc..................http://www.cultdeadcow.com/
    News site (HNN) .....,............http://www.hackernews.com/
    Help Net Security.................http://net-security.org/
    News,Advisories,++ .(lophtcrack)..http://www.l0pht.com/
    NewsTrolls .(daily news ).........http://www.newstrolls.com/
    News + Exploit archive ...........http://www.rootshell.com/beta/news.html
    CuD Computer Underground Digest...http://www.soci.niu.edu/~cudigest
    News site+........................http://www.zdnet.com/
    News site+Security................http://www.gammaforce.org/
    News site+Security................http://www.projectgamma.com/
    News site+Security................http://securityhole.8m.com/
    News site+Security related site...http://www.403-security.org/  *DOWN*
    News/Humour site+ ................http://www.innerpulse.com
    News/Techie news site.............http://www.slashdot.org
    
    

    +Various mailing lists and some newsgroups, such as ...
    +other sites available on the HNN affiliates page, please see
     http://www.hackernews.com/affiliates.html as they seem to be popping up
     rather frequently ...

    
    http://www.the-project.org/ .. IRC list/admin archives
    http://www.anchordesk.com/  .. Jesse Berst's AnchorDesk

    alt.hackers.malicious
    alt.hackers
    alt.2600
    BUGTRAQ
    ISN security mailing list
    ntbugtraq
    <+others>

    NEWS Agencies, News search engines etc:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    http://www.cnn.com/SEARCH/
       
    http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0
        
    http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack
        
    http://www.ottawacitizen.com/business/
        
    http://search.yahoo.com.sg/search/news_sg?p=hack
        
    http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack
        
    http://www.zdnet.com/zdtv/cybercrime/
        
    http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column)
        
    NOTE: See appendices for details on other links.
    


    http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm
        
    http://freespeech.org/eua/ Electronic Underground Affiliation
        
    http://ech0.cjb.net ech0 Security
    
    http://axon.jccc.net/hir/ Hackers Information Report
        
    http://net-security.org Net Security
        
    http://www.403-security.org Daily news and security related site
        

    Submissions/Hints/Tips/Etc
    ~~~~~~~~~~~~~~~~~~~~~~~~~~

    All submissions that are `published' are printed with the credits
    you provide, if no response is received by a week or two it is assumed
    that you don't care wether the article/email is to be used in an issue
    or not and may be used at my discretion.

    Looking for:

    Good news sites that are not already listed here OR on the HNN affiliates
    page at http://www.hackernews.com/affiliates.html

    Magazines (complete or just the articles) of breaking sekurity or hacker
    activity in your region, this includes telephone phraud and any other
    technological use, abuse hole or cool thingy. ;-) cut em out and send it
    to the drop box.


    - Ed

    Mailing List Subscription Info   (Far from complete)         Feb 1999
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   ~~~~~~~~~~~~~~~~~~~         ~~~~~~~~

    ISS Security mailing list faq : http://www.iss.net/iss/maillist.html


    THE MOST READ:

    BUGTRAQ - Subscription info
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~

    What is Bugtraq?

    Bugtraq is a full-disclosure UNIX security mailing list, (see the info
    file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to
    bugtraq, send mail to listserv@netspace.org containing the message body
    subscribe bugtraq. I've been archiving this list on the web since late
    1993. It is searchable with glimpse and archived on-the-fly with hypermail.

    Searchable Hypermail Index;

          http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html

          <a href="http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html">Link</a>

    About the Bugtraq mailing list
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    The following comes from Bugtraq's info file:

    This list is for *detailed* discussion of UNIX security holes: what they are,
    how to exploit, and what to do to fix them.

    This list is not intended to be about cracking systems or exploiting their
    vulnerabilities. It is about defining, recognizing, and preventing use of
    security holes and risks.

    Please refrain from posting one-line messages or messages that do not contain
    any substance that can relate to this list`s charter.

    I will allow certain informational posts regarding updates to security tools,
    documents, etc. But I will not tolerate any unnecessary or nonessential "noise"
    on this list.

    Please follow the below guidelines on what kind of information should be posted
    to the Bugtraq list:

    + Information on Unix related security holes/backdoors (past and present)
    + Exploit programs, scripts or detailed processes about the above
    + Patches, workarounds, fixes
    + Announcements, advisories or warnings
    + Ideas, future plans or current works dealing with Unix security
    + Information material regarding vendor contacts and procedures
    + Individual experiences in dealing with above vendors or security organizations
    + Incident advisories or informational reporting

    Any non-essential replies should not be directed to the list but to the originator of the message. Please do not
    "CC" the bugtraq reflector address if the response does not meet the above criteria.

    Remember: YOYOW.

    You own your own words. This means that you are responsible for the words that you post on this list and that
    reproduction of those words without your permission in any medium outside the distribution of this list may be
     challenged by you, the author.

    For questions or comments, please mail me:
    chasin@crimelab.com (Scott Chasin)


    
    Crypto-Gram
    ~~~~~~~~~~~

       CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
      insights, and commentaries on cryptography and computer security.

      To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
      blank message to crypto-gram-subscribe@chaparraltree.com.  To unsubscribe,
      visit http://www.counterpane.com/unsubform.html.  Back issues are available
      on http://www.counterpane.com.

       CRYPTO-GRAM is written by Bruce Schneier.  Schneier is president of
      Counterpane Systems, the author of "Applied Cryptography," and an inventor
      of the Blowfish, Twofish, and Yarrow algorithms.  He served on the board of
      the International Association for Cryptologic Research, EPIC, and VTW.  He
      is a frequent writer and lecturer on cryptography.


    CUD Computer Underground Digest
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    This info directly from their latest ish:

    Computer underground Digest    Sun  14 Feb, 1999   Volume 11 : Issue 09
     
                      ISSN  1004-042X

       Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
       News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
       Archivist: Brendan Kehoe
       Poof Reader:   Etaion Shrdlu, Jr.
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Cu Digest Homepage: http://www.soci.niu.edu/~cudigest



    [ISN] Security list
    ~~~~~~~~~~~~~~~~~~~
    This is a low volume list with lots of informative articles, if I had my
    way i'd reproduce them ALL here, well almost all .... ;-) - Ed


    Subscribe: mail majordomo@repsec.com with "subscribe isn".



    @HWA


 00.3 THIS IS WHO WE ARE
      ~~~~~~~~~~~~~~~~~~
 
      Some HWA members and Legacy staff
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      cruciphux@dok.org.........: currently active/editorial
      darkshadez@ThePentagon.com: currently active/man in black
      fprophet@dok.org..........: currently active/IRC+ man in black
      sas72@usa.net ............. currently active/IRC+ distribution
      vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black
      dicentra...(email withheld): IRC+ grrl in black
      eentity ...( ''      ''   ): Currently active/IRC+ man in black


      Foreign Correspondants/affiliate members
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
       Qubik ............................: United Kingdom 
       D----Y ...........................: USA/world media
       HWA members ......................: World Media
       
      
      
      Past Foreign Correspondants (currently inactive or presumed dead) 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
       N0Portz ..........................: Australia           
       system error .....................: Indonesia           
       Wile (wile coyote) ...............: Japan/the East      
       Ruffneck  ........................: Netherlands/Holland 

       
       Please send in your sites for inclusion here if you haven't already
       also if you want your emails listed send me a note ... - Ed

      Spikeman's site is down as of this writing, if it comes back online it will be
      posted here.
      http://www.hackerlink.or.id/  ............ System Error's site (in Indonesian) 
       

       *******************************************************************
       ***      /join #HWA.hax0r.news on EFnet the key is `zwen'       ***
       *******************************************************************

    :-p


    1. We do NOT work for the government in any shape or form.Unless you count paying
       taxes ... in which case we work for the gov't in a BIG WAY. :-/

    2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news
       events its a good idea to check out issue #1 at least and possibly also the
       Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ...


    @HWA



 00.4 Whats in a name? why HWA.hax0r.news??
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                             
      
      Well what does HWA stand for? never mind if you ever find out I may
     have to get those hax0rs from 'Hackers' or the Pretorians after you.

     In case you couldn't figure it out hax0r is "new skewl" and although
     it is laughed at, shunned, or even pidgeon holed with those 'dumb
     leet (l33t?) dewds' <see article in issue #4> this is the state
     of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you
     up  and comers, i'd highly recommend you get that book. Its almost
     like  buying a clue. Anyway..on with the show .. - Editorial staff


     @HWA

00.5  HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again)
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Also released in issue #3. (revised) check that issue for the faq
    it won't be reprinted unless changed in a big way with the exception
    of the following excerpt from the FAQ, included to assist first time
    readers:

    Some of the stuff related to personal useage and use in this zine are
    listed below: Some are very useful, others attempt to deny the any possible
    attempts at eschewing obfuscation by obsucuring their actual definitions.

    @HWA   - see EoA  ;-)

    !=     - Mathematical notation "is not equal to" or "does not equal"
             ASC(247)  "wavey equals" sign means "almost equal" to. If written
             an =/= (equals sign with a slash thru it) also means !=, =< is Equal
             to or less than and =>  is equal to or greater than (etc, this aint
             fucking grade school, cripes, don't believe I just typed all that..)

    AAM    - Ask a minor (someone under age of adulthood, usually <16, <18 or <21)

    AOL    - A great deal of people that got ripped off for net access by a huge
             clueless isp with sekurity that you can drive buses through, we're
             not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the
             least they could try leasing one??

   *CC     - 1 - Credit Card (as in phraud)
             2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's

    CCC    - Chaos Computer Club (Germany)

   *CON    - Conference, a place hackers crackers and hax0rs among others go to swap
             ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk
             watch videos and seminars, get drunk, listen to speakers, and last but
             not least, get drunk.
   *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker
                 speak he's the guy that breaks into systems and is often (but by no
                 means always) a "script kiddie" see pheer
              2 . An edible biscuit usually crappy tasting without a nice dip, I like
                  jalapeno pepper dip or chives sour cream and onion, yum - Ed

    Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger
              Vanilla Ice is a wigger, The Beastie Boys and rappers speak using
              ebonics, speaking in a dark tongue ... being ereet, see pheer

    EoC    - End of Commentary

    EoA    - End of Article or more commonly @HWA

    EoF    - End of file

    EoD    - End of diatribe (AOL'ers: look it up)

    FUD    - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt",
            usually in general media articles not high brow articles such as ours or other
            HNN affiliates ;)

    du0d   - a small furry animal that scurries over keyboards causing people to type
             weird crap on irc, hence when someone says something stupid or off topic
             'du0d wtf are you talkin about' may be used.

   *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R

   *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to
            define, I think it is best defined as pop culture's view on The Hacker ala
            movies such as well erhm "Hackers" and The Net etc... usually used by "real"
            hackers or crackers in a derogatory or slang humorous way, like 'hax0r me
            some coffee?' or can you hax0r some bread on the way to the table please?'

            2 - A tool for cutting sheet metal.

    HHN    - Maybe a bit confusing with HNN but we did spring to life around the same
             time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper
             noun means the hackernews site proper. k? k. ;&

    HNN    - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html

    J00    - "you"(as in j00 are OWN3D du0d) - see 0wn3d

    MFI/MOI- Missing on/from IRC

    NFC   - Depends on context: No Further Comment or No Fucking Comment

    NFR   - Network Flight Recorder (Do a websearch) see 0wn3d

    NFW   - No fuckin'way

   *0WN3D - You are cracked and owned by an elite entity see pheer
   *OFCS  - Oh for christ's sakes

    PHACV - And variations of same <coff>
            Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare

          Alternates: H - hacking, hacktivist
                      C - Cracking <software>
                      C - Cracking <systems hacking>
                      V - Virus
                      W - Warfare <cyberwarfare usually as in Jihad>
                      A - Anarchy (explosives etc, Jolly Roger's Cookbook etc)
                      P - Phreaking, "telephone hacking" PHone fREAKs ...
                     CT - Cyber Terrorism

   *PHEER -  This is what you do when an ereet or elite person is in your presence
            see 0wn3d

   *RTFM  - Read the fucking manual - not always applicable since some manuals are
            pure shit but if the answer you seek is indeed in the manual then you
            should have RTFM you dumb ass.

    TBC   - To Be Continued also 2bc (usually followed by ellipses...) :^0

    TBA   - To Be Arranged/To Be Announced also 2ba

    TFS   - Tough fucking shit.

   *w00t  - 1 - Reserved for the uber ereet, noone can say this without severe repercussions
            from the underground masses. also "w00ten" <sic>

            2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers)

    *wtf  - what the fuck, where the fuck, when the fuck etc ..

    *ZEN  - The state you reach when you *think* you know everything (but really don't)
            usually shortly after reaching the ZEN like state something will break that
            you just 'fixed' or tweaked.
            
     @HWA            
     
     
                            -=-    :.    .:        -=-
                            
                            
                            

 01.0 Greets!?!?! yeah greets! w0w huh. - Ed
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Thanks to all in the community for their support and interest but i'd
     like to see more reader input, help me out here, whats good, what sucks
     etc, not that I guarantee i'll take any notice mind you, but send in
     your thoughts anyway.


       * all the people who sent in cool emails and support
       
     FProphet       Pyra                TwstdPair      _NeM_
     D----Y         Dicentra            vexxation      sAs72
     Spikeman       p0lix           
     
          
     Ken Williams/tattooman of PacketStorm, hang in there Ken...:(
          
     & Kevin Mitnick (Happy Birthday)                              
     
     kewl sites:

     + http://www.securityportal.com/ NEW
     + http://www.securityfocus.com/ NEW
     + http://www.hackcanada.com/
     + http://www.l0pht.com/
     + http://www.2600.com/
     + http://www.freekevin.com/
     + http://www.genocide2600.com/
     + http://www.packetstorm.harvard.edu/    ******* DOWN (THANKS JP) ******
     + http://www.hackernews.com/ (Went online same time we started issue 1!)
     + http://www.net-security.org/
     + http://www.slashdot.org/
     + http://www.freshmeat.net/
     + http://www.403-security.org/
     + http://ech0.cjb.net/

     @HWA


 01.1 Last minute stuff, rumours and newsbytes
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       "What is popular isn't always right, and what is right isn't
         always popular..."
                           - FProphet '99
                           
       

    +++ When was the last time you backed up your important data?
     
     ++ DEFAULT #3 RELEASED
     
        The cool DEFAULT newsletter by Help net-security.org is up to issue#3 check it out
                
        by BHZ, Friday 27th August 1999 on 3:01 pm CET
        Third issue of our newsletter is out. You can read abot following topics: Y2K week in
        review + Outlook Express Year 2000 Update, Look into basic cryptography, Freedom
        Network, IP Masquerading, Macintosh security, Trojan forensics, Scams - Getting
        something by all means, Freedom of the speech review and part two of excellent
        Intrusion and detection article. Download > default3.txt or default3.zip. 
        
        http://default.net-security.org/dl/default3.txt
        http://default.net-security.org/dl/default3.zip
        
        
     
     
      Thanks to myself for providing the info from my wired news feed and others from whatever
      sources, also to Spikeman for sending in past entries.... - Ed
      
     @HWA

 01.2 MAILBAG - email and posts from the message board worthy of a read
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      (No mail worthy of posting here this issue,)
      
      Yeah we have a message board, feel free to use it, remember there are no stupid questions...
      well there are but if you ask something really dumb we'll just laugh at ya, lets give the
      message board a bit more use eh? i'll be using a real message board when the hwa-iwa.org
      domain comes back online (soon) meanwhile the beseen board is still up...
      
      Since theres nothing to print here, here's the Mentor's last words direct from Phrack7
      file 003 complete and unabridged... send in your mail/questions etc! - Ed
      
                                     ==Phrack Inc.==

                    Volume One, Issue 7, Phile #3 of 10
      
              The following was written shortly after my arrest.  I am currently
      groupless, having resigned from the Racketeers, so ignore the signoff...
      
      The Conscience of a Hacker... by The Mentor... 1/8/86
              Another one got caught today, it's all over the papers.  "Teenager
      Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
              Damn kids.  They're all alike.
              But did you, in your three-piece psychology and 1950's technobrain,
      ever take a look behind the eyes of the hacker?  Did you ever wonder what
      made him tick, what forces shaped him, what may have molded him?
              I am a hacker, enter my world...
              Mine is a world that begins with school... I'm smarter than most of
      the other kids, this crap they teach us bores me...
              Damn underachiever.  They're all alike.
              I'm in junior high or high school.  I've listened to teachers explain
      for the fifteenth time how to reduce a fraction.  I understand it.  "No, Ms.
      Smith, I didn't show my work.  I did it in my head..."
              Damn kid.  Probably copied it.  They're all alike.
              I made a discovery today.  I found a computer.  Wait a second, this is
      cool.  It does what I want it to.  If it makes a mistake, it's because I
      screwed it up.  Not because it doesn't like me...
                      Or feels threatened by me...
                      Or thinks I'm a smart ass...
                      Or doesn't like teaching and shouldn't be here...
              Damn kid.  All he does is play games.  They're all alike.
              And then it happened... a door opened to a world... rushing through
      the phone line like heroin through an addict's veins, an electronic pulse is
      sent out, a refuge from the day-to-day incompetencies is sought... a board is
      found.
              "This is it... this is where I belong..."
              I know everyone here... even if I've never met them, never talked to
      them, may never hear from them again... I know you all...
              Damn kid.  Tying up the phone line again.  They're all alike...
              You bet your ass we're all alike... we've been spoon-fed baby food at
      school when we hungered for steak... the bits of meat that you did let slip
      through were pre-chewed and tasteless.  We've been dominated by sadists, or
      ignored by the apathetic.  The few that had something to teach found us will-
      ing pupils, but those few are like drops of water in the desert.
              This is our world now... the world of the electron and the switch, the
      beauty of the baud.  We make use of a service already existing without paying
      for what could be dirt-cheap if it wasn't run by profiteering gluttons, and
      you call us criminals.  We explore... and you call us criminals.  We seek
      after knowledge... and you call us criminals.  We exist without skin color,
      without nationality, without religious bias... and you call us criminals.
      You build atomic bombs, you wage wars, you murder, cheat, and lie to us
      and try to make us believe it's for our own good, yet we're the criminals.
              Yes, I am a criminal.  My crime is that of curiosity.  My crime is
      that of judging people by what they say and think, not what they look like.
      My crime is that of outsmarting you, something that you will never forgive me
      for.
              I am a hacker, and this is my manifesto.  You may stop this indiv-
      idual, but you can't stop us all... after all, we're all alike.
      +++The Mentor+++
         Racketeers
      
      ==============================================================================
      

      

 02.0 From the editor.
      ~~~~~~~~~~~~~~~~

     #include <stdio.h>
     #include <thoughts.h>
     #include <backup.h>

     main()
     {
      printf ("Read commented source!\n\n");

     /* This issue includes an article by Dragos Ruiu that is well worth the read
      * it is entitled "Stealth Coordinated Attack HOWTO" as mentioned in the header
      * and outlines various attack methods employed by todays hacker used to scope
      * out and penetrate your systems. The article can be found in section 42.0
      *
      * As always we welcome your stories, articles and poetry, please send them with any
      * information about yourself you see fit or would like included to the address below...
      *
      * Please, send your submissions to: hwa@press.usmc.net thank you.
      *
      * Cruciphux
      */
      printf ("EoF.\n");
      }

      

      Congrats, thanks, articles, news submissions and kudos to us at the
     main address: hwa@press.usmc.net complaints and all nastygrams and
     mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to
     127.0.0.1, private mail to cruciphux@dok.org

     danke.

     C*:.
     
03.0 DOJ contemplates secret searches
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     From http://www.net-security.org/ 
     
     SECRET SEARCHES FROM DOJ
     by BHZ, Tuesday 24th August 1999 on 2:34 pm CET
     InfoWar published a briefing on public policy issues written by Center for Democracy
     and Technology (www.cdt.org). "The Justice Department is planning to ask Congress
     for new authority allowing federal agents armed with search warrants to secretly break
     into homes and offices to obtain decryption keys or passwords or to implant 'recovery
     devices' or otherwise modify computers to ensure that any encrypted messages or
     files can be read by the government". Read the briefing here. 
 
      
     8/23/99 

     DOJ Proposes Secret Searches


     C D T  P O L I C Y  P O S T 

     A BRIEFING ON PUBLIC POLICY ISSUES
     AFFECTING CIVIL LIBERTIES ONLINE
     from
     THE CENTER FOR DEMOCRACY AND TECHNOLOGY 

     Volume 5, Number 19 August 20, 1999 


     CONTENTS:
     (1) Justice Department Proposes Secret Searches of Homes, Offices
     (2) If the Government Wants Your Data, It Should Come to You For It
     (3) Proposal Also Sets Standards for Access to Escrowed Keys
     (4) Subscription Information
     (5) About the Center for Democracy and Technology

     ** This document may be redistributed freely with this banner intact **
     Excerpts may be re-posted with permission of ari@cdt.org This document is also available at: 
     http://www.cdt.org/publications/pp_5.19.html 



     (1) JUSTICE DEPARTMENT PROPOSES SECRET SEARCHES OF HOMES, OFFICES 

     The Justice Department is planning to ask Congress for new authority allowing federal agents armed with search warrants to secretly break into homes
     and offices to obtain decryption keys or passwords or to implant "recovery devices" or otherwise modify computers to ensure that any encrypted messages
     or files can be read by the government. 

     With this dramatic proposal, the Clinton Administration is basically saying: "If you don't give your key in advance to a third party, we will secretly enter
     your house to take it if we suspect criminal conduct." 

     The full text of the Justice Department proposal, a section-by-section analysis prepared by DOJ lawyers, and related materials are available at:
     http://www.cdt.org/crypto/CESA. 

     The proposal has been circulating within the Clinton Administration since late June. On August 5, the Office of Management and Budget circulated it for
     final interagency review. In the normal course, after all potentially interested agencies have been consulted, the proposal would be transmitted to Capitol
     Hill, where it could be introduced by any Member, or offered as an amendment to pending legislation. 



     (2) IF THE GOVERNMENT WANTS YOUR DATA, IT SHOULD COME TO YOU FOR IT 

     The proposal is intended to eliminate a core element of our civil liberties. Normally, under the Fourth Amendment in the Bill of Rights, when the
     government wants to search your home or office, the government must obtain a court order issued by a judge based on a finding of probable cause to
     believe that a crime is being committed AND the government must provide you with contemporaneous notice of the search -- show you the warrant and
     leave an inventory of the items seized. 

     This notice requirement has ancient roots. It is based on the notion that the judicial warrant (issued on the basis of the government agent's untested
     assertions presented to a judge in private) does not provide adequate protection against abuse. Notice is important because it gives you the opportunity to
     observe the conduct of the government agents and protect your rights. If the agents are exceeding the scope of the warrant, for example, you can even
     rush down to the courthouse and ask a judge to stop the search. And after the search, you can exercise your rights for return of your property and
     otherwise defend yourself. 

     Over time, our society has tolerated exceptions to this rule. For example, the government can enter secretly to plant bugs to pick up oral communications or
     to bug your phone, but that is quite rare. Most wiretaps do not involve entry into the home. A few courts in a few cases have allowed so-called "sneak and
     peek" searches, in which government agents can enter surreptitiously, provided they don't take anything. And in the name of foreign counterintelligence, the
     government has long conducted "black bag jobs," such as the one in which they searched the home and computer of CIA employee Aldrich Ames. 

     The new DOJ proposal is a huge expansion of these previously narrowly defined exceptions. The proposal takes extraordinary cases at the fringes of the
     law and makes them routine, given the increasingly ubiquitous nature of computers. 

     Thus, the encryption debate, which up until now has been about privacy and security in cyberspace, is becoming a struggle over the sanctity of the home. 



     (3) PROPOSAL ALSO SETS STANDARDS FOR ACCESS TO ESCROWED KEYS 

     The proposal also includes detailed procedures for government access to keys and other forms of decryption assistance stored with third parties. Again, the
     essence of the DOJ proposal is government access to keys without the knowledge or cooperation of the crypto user. 

     The DOJ claims that these key recovery provisions provide greater protection for lawful users of encryption, by making it clear that a third party holding a
     decryption key or other recovery information cannot disclose it or use it except in accordance with the procedures set forth in the Act. The DOJ-drafted
     procedures are complicated and unique, turning on unanswered questions of what is "generally applicable law" and what is a "constitutionally protected
     expectation of privacy." They fall far short of protections proposed by Sen. Patrick J. Leahy (D-VT) in the Electronic Rights for the Twenty-First Century
     (E-RIGHTS) bill, S. 854, described at http://www.cdt.org/crypto/legis_106/ERIGHTS/ 

     In any case, few individuals use third party key recovery, and there seems to be little individual or corporate interest in key recovery for communications,
     so even the strictest procedures for access to escrowed keys would be vastly outweighed by the proposed secret searches of homes and offices. 

     In the small comfort department, the DOJ proposal makes it clear that key escrow or third party key recovery would not be mandatory. 



     (4) SUBSCRIPTION INFORMATION 

     Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post
     news distribution list. CDT Policy Posts, the regular news publication of the Center for Democracy and Technology, are received by Internet users,
     industry leaders, policymakers, the news media and activists, and have become the leading source for information about critical free speech and privacy
     issues affecting the Internet and other interactive communications media. 

     To subscribe to CDT's Policy Post list, send mail to 

     majordomo@cdt.org 

     In the BODY of the message (leave the SUBJECT LINE BLANK), type 

     subscribe policy-posts 

     If you ever wish to remove yourself from the list, send mail to the above address with NOTHING IN THE SUBJECT LINE and a BODY TEXT of: 

     unsubscribe policy-posts 



     (5) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US 

     The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and
     advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. 

     Contacting us: 

     General information: info@cdt.org
     World Wide Web: http://www.cdt.org/ 

     Snail Mail: The Center for Democracy and Technology
     1634 Eye Street NW * Suite 1100 * Washington, DC 20006
     (v) +1.202.637.9800 * (f) +1.202.637.0968


     End Policy Post 5.19 

     Aleksandr Gembinski
     Webmaster etc.
     Center for Democracy and Technology
     1634 Eye Street, NW
     11th Floor
     Washington, DC 20006
     (v) +1.202.637.9800
     (f) +1.202.637.0968
     http://www.cdt.org/  
     
     
     @HWA     
     
04.0  FIRST NET CONVICT WILL DO NO TIME
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      From http://www.net-security.org/
     
     
      by Thejian, Monday 23rd August 1999 on 9:30 pm CET
      The University of Oregon student who last Friday pled guilty to felony cyber-crime
      charges and in so doing became the first-ever person convicted under the No
      Electronic Theft (NET) Act, will not do any jail time. The student will be sentenced
      Nov. 2 - and although he faces a maximum of three years in jail for his conviction on
      one count of "criminal infringement or reproduction" of commercial software - his plea
      arrangement assures that he will not see the inside of a jail cell, altough he still is
      saddled with a felony conviction according to the deputy chief of DOJ's computer
      crime division. Story on Newsbytes      
      
      First NET Convict Will Do No Time - Update 



                  
      By David McGuire, Newsbytes
      WASHINGTON, DC, U.S.A., 
      23 Aug 1999, 12:31 PM CST

      A University of Oregon student convicted of distributing pirated software over the Internet will not spend any
      time in jail under a plea agreement with Department of Justice attorneys. 

      The student last Friday pled guilty to felony cyber-crime charges and in so doing became the first-ever person convicted
      under the decade-old the No Electronic Theft (NET) Act, Newsbytes reported last week. 

      The student was accused of pilfering thousands of business and entertainment programs and posting them, free-of-charge,
      on his Website, said David Greene, deputy chief of Justice's computer crime division. 

      Before the NET Act was passed, prosecutors had to prove that cyber- thieves received "commercial benefits" from their
      thefts in order to win convictions. But the NET Act closed that loophole. 

      The student will be sentenced Nov. 2 - and although he faces a maximum of three years in jail for his conviction on one
      count of "criminal infringement or reproduction" of commercial software - his plea arrangement assures that he will not see
      the inside of a jail cell, Greene said. 

      Still, he is saddled with a felony conviction, and Greene hopes coverage of the case will deter other software pirates, he
      said. 

      Earlier this year, some congressional Republicans questioned why there had been no Department of Justice prosecutions
      under the NET Act. DoJ called yesterday's conviction a clear message that Justice is enforcing the law. 

      "We are not going to bring hundreds of these cases," Greene said. But DoJ is "trying to discourage (computer piracy) as a
      hobby." 

      While such thefts may seem comparatively innocuous, they have "done some real damage to software companies," Greene
      said. 

      Reported by Newsbytes.com, http://www.newsbytes.com . 

      12:31 CST
      Reposted 12:31 CST 
      
            
      ZD Net    
      http://www.zdnet.com/zdnn/stories/news/0,4586,2318386,00.html?chkpt=hpqs014
      
      --------------------------------------------------------------
      This story was printed from ZDNN,
      located at http://www.zdnet.com/zdnn.
      --------------------------------------------------------------
      
      Feds convict first Internet pirate
      By Reuters 
      August 20, 1999 5:22 PM PT
      URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2318386,00.html?chkpt=hpqs014
      
      WASHINGTON -- An Oregon college student who gave away music, movies and software on
      the Web has become the first person convicted of a felony under a law punishing Internet
      copyright piracy, the government said Friday. 
      
      Jeffrey Gerard Levy, 22, a senior at the University of Oregon in Eugene, pleaded guilty
      to violating the No Electronic Theft Act of 1997, the U.S. Justice Department announced. 
      
      The Justice Department said Levy admitted that in January of this year he "illegally posted
      computer software programs, musical recordings, entertainment software programs and digitally
      recorded movies on his Internet Web site, allowing the general public to download and copy 
      these copyrighted products." 
      
      A Justice Department official said there was no evidence that Levy had made any profit from
      the freely available works. 
      
        Anybody who distributes 10 or more copyrighted works with a value of more than $2,500 can
      face up to three years in prison and a fine of up to $250,000. 
      
      Levy faces sentencing Nov. 2. 
      
      @HWA
      
      
05.0  NORTON ANTIVIRUS 2000 IS OUT
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      From http://www.net-security.org/
     
     
      by BHZ, Tuesday 24th August 1999 on 3:17 pm CET
      Symantec (www.symantec.com) published Norton Utilities 2000, Norton AntiVirus
      2000, and Norton CleanSweep 2000. Norton AntiVirus 2000 has two new features -
      support for automatic scanning of incoming e-mail attachments from POP-based
      applications such and it can automatically eliminate viruses in multiple compressed
      file levels, such as a Zip file inside another Zip file.       
      
      @HWA
     
06.0  SSL CPU CONSUMPTION CAUSES CONCERNS
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      From http://www.net-security.org/
      
      
      by Thejian, Tuesday 24th August 1999 on 11:50 am CET
      A recently released study by research and consulting firm Networkshop, found that
      various combinations of servers, processors, operating systems and online content
      used in conjunction with Secure Sockets Layer (SSL) can hamper the performance of
      Web servers. SSL helps secure e-commerce transactions, but these new findings
      suggest that its CPU consumption may end up impeding those same transactions.
      Full story 
      
 
      SSL's CPU appetite causes concern
      Amy Rogers
 
      Washington, D.C. - Secure Sockets Layer (SSL) technology helps secure
      E-business transactions, but its voracious consumption of CPU space may end
      up impeding those same transactions.
 
      In a study released this summer, research and consulting firm Networkshop,
      Ottawa, found that various combinations of servers, processors, operating
      systems and online content used in conjunction with SSL can hamper the
      performance of Web servers.
 
      Networkshop paired Linux, Windows NT and Sun Microsystems Inc. Solaris
      with Web servers including Apache, Stronghold and Microsoft Corp.'s Internet
      Information Server.
 
      Windows NT plus Intel Corp. processors tended to better handle the task of
      processing SSL's complex algorithms, he said.
 
      Slow performance could lead to frustrated or lost customers, so VARs
      implementing E-business solutions might want to examine several types of
      products that offload encryption processing from the server itself to another
      device.
 
      These products include PC cards or server cards, such as Rainbow
      Technologies Inc.'s CryptoSwift; encryption-offloading units that sit on the
      network, such as those from nCipher Corp.; and so-called Internet Commerce
      Appliances, such as IPivot Inc.'s Commerce Director 8000. Such devices,
      including IPivot's Commerce Accelerator 1000, an entry-level version of
      Commerce Director, free up Web servers to perform tasks other than crunching
      numbers.
 
      CryptoSwift offloads 200 SSL transactions per second, said Bob Bova, director
      of business development at Rainbow Technologies, Irvine, Calif. Rainbow is
      seeking resellers that add "significant value to security technology" to add to its
      stable of partners. Already 15 VARs and integrators are on board, he said.

      Copyright ® 1999 CMP Media Inc.

    
07.0  Bug in Bill Gate's Anus?
      ~~~~~~~~~~~~~~~~~~~~~~~~
     
      Aug 27th
     
      SmoG sent this in...
     
      http://support.microsoft.com/isapi/support/pass.idc?Product=Bill%20Gates%20Anus
     
      In case it has been replaced by the time you read this the following headlined
      a bug report form on Microsoft's tech support page
     
      "Do you think you've found a bug in Microsoft Bill Gates Anus?"
     
      With the submission form following the header...
     
     
      @HWA     
      
     
08.0  CESA Causing Outrage In Libertarians 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/
 
      contributed by AlienPlague 
      The 'Cyberspace Electronic Security Act', which HNN
      has previously reported on, is drawing much criticism
      and causing outrage amongst civil libertarians and
      high-tech industry trade groups. They say that the act
      not only violates Civil Rights, but "would make police
      break-ins far more common than they are now." While
      law enforcement agencies claim that encryption is
      detrimental to their job of tracking criminals and crime,
      most seem to feel that it is just another way the
      current administration will attempt to impose 'big
      brother' monitoring powers over American citizens. 

      MSNBC      
      http://www.msnbc.com/news/302945.asp
      
      Furor rising over PC wiretap plan
      Civil libertarians, trade groups outraged by DOJ proposal that
      would ‘booby-trap’ PCs. But will Congress go ‘ballistic’?
                                                  By Maria Seminerio
                                                                ZDNN

      Aug. 20 — A U.S. Department of Justice proposal
      to make it easier for police to break into homes
      and access computers is drawing a furious
      reaction from civil libertarians and high-tech
      industry trade groups.
      
      

             THE DRAFT LEGISLATION, for which the DOJ
      hopes to find a sponsor in Congress, is dubbed the
      Cyberspace Electronic Security Act. The law would make it
      easier for law enforcement officials to obtain from judges a
      now-rarely-used authorization to break into a suspect’s
      home and plant a hidden listening device. 
             But in this case, the computer equivalent of the
      “listening device” is the authorization for investigators to
      disable data-scrambling encryption programs on PCs. (In
      order to actually copy data from the computer, police
      would still need a separate warrant from a judge.) 
             
 
            DOJ wants clearance to bug PCs 
 
             ”(The proposal) strikes at the heart of the Bill of
      Rights,” said David Sobel, general counsel for the Electronic
      Privacy Information Center.
             Noting that judges in all federal and state courts
      combined only issued 50 warrants for so-called
      “surreptitious physical entries” last year, Sobel said
      extending such authorization to cases involving computer
      files “would make police break-ins far more common than
      they are now.”
             
      ‘BOOBY-TRAP YOUR COMPUTER’
             The proposal would “basically allow investigators to
      booby-trap your computer ahead of time” by disabling
      encryption, he said.
             The proposal was most likely spurred by the frustration
      investigators have experienced when finding encrypted data
      on computers used by suspected drug dealers and other
      criminals, he added. 
             DOJ officials did not respond to requests for interviews
      Friday. But in a letter to House Speaker Dennis Hastert,
      Acting Assistant Attorney General Jon Jennings said the
      new law would aid investigators when information needs to
      be deciphered “in a timely manner.”
             “While under existing law, law enforcement is provided
      with different means to collect evidence of illegal activity,
      these means are rendered wholly insufficient when
      encryption is used,” wrote Jennings in the letter.
             “In the context of law enforcement operations, stopping
      a terrorist attack or seeking to recover a kidnapped child,
      time is of the essence and may mean the difference between
      success and catastrophic failure.
             “While existing means of obtaining evidence would
      remain applicable in a fully-encrypted world, the failure to
      provide law enforcement with the necessary ability to obtain
      the plain-text version of the evidence makes existing
      authorities useless,” he wrote.
             
      EPIC: CONGRESS WILL GO ‘BALLISTIC’
             Noting that the proposal would need to find a sponsor
      in Congress and then be passed into law before it could
      take effect, EPIC’s Sobel said it could encounter resistance
      by lawmakers.
             “I think people in Congress are going to go ballistic
      over this, particularly since it’s coming right on the heels of
      the FIDNET” controversy, he said. FIDNET — the
      controversial proposal to monitor government and some
      private networks for hacking activity — came to light earlier
      this summer and remains in limbo. 
 
 
             Barry Steinhardt, president of the American Civil
      Liberties Union, said that the Federal Bureau of
      Investigation has often misused its powers in the past, and
      could do so again under the DOJ proposal. 
             “There’s every reason to believe they’re not just going
      to look at the Mob using the powers sought under the
      proposal,” Steinhardt said. “They’ll use this power to
      interfere with protected speech.” 
             Also condemning the plan were the Computer and
      Communications Industry Association, the Center for
      Democracy and Technology, and Americans for Computer
      Privacy. 
             
      CLINTON ADMIN: BIG BROTHER?
             The plan is “an unprecedented attempt by the Clinton
      administration to impose ‘big brother’ monitoring powers
      over American citizens,” ACP officials said in a statement.
      “The fact is that current laws provide law enforcement
      broad powers to obtain information.”
             “This is another attempt by law enforcement to do an
      end-run (around encryption),” said Ed Black, president of
      the CCIA. “It offers a real temptation for investigators to
      overreach and overextend” the current limits on searches
      and seizures, he said.
             “Anybody’s vulnerable,” Black added. ”(This)
      resembles something the KGB would propose.”
                                 
       
      @HWA
      
09.0  ReDaTtAcK Arrested, Questioned, Charged, Released
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
      
      From HNN http://www.hackernews.com/

      contributed by Wizzy24 
      After electronically breaking into the General Bank of
      Belgium, ReDaTtAcK has been apprehended. He was
      traced via his cell phone and then arrested and later
      released. He has not been charged with computer
      intrusion as Belgium has no such law. Instead he will be
      charged with electronic eavesdropping charges after
      breaking into SkyNet a Belgian ISP run by the state
      owned telephone company Belgacom. ReDaTtAcK has
      stated that he will continue to do what he does. 

      The Standard - Dutch      
      http://www.standaard.be
      
      @HWA
      
10.0  Some GPS Systems Fail With Date Rollover 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
      
      From HNN http://www.hackernews.com/
      
      contributed by Code Kid 
      While the GPS satellites themselves and most GPS
      receivers continued to function normally some units
      failed when the GPS date rolled over this past weekend.
      Many Japanese users of in car navigation systems
      experienced complete systems failure when the date
      rolled over. Four Japanese manufacturers of GPS
      systems have completed updating a little over half of
      the GPS systems sold in the country since 1996. 

      Yahoo News      
      http://dailynews.yahoo.com/h/nm/19990822/tc/gps_japan_1.html
      
      Sunday August 22 1:10 AM ET 
      
      Irate Japanese Car Drivers Hit By GPS Bug
      
                           TOKYO (Reuters) - A steady stream of irate customers called Japanese car navigation makers Sunday after their
                           automotive directional devices failed due to a computer flaw.
      
      The screens on some car navigation systems went blank while others froze up as a computer bug struck Global Positioning System (GPS)
      devices, electronics company Pioneer Electronic Corp said. Pioneer, one of several car navigation system makers battling the bug, had
      received several hundred phone calls since the problem started at 9 a.m., a spokeswoman said.
      
      About 450 Pioneer workers manned telephone lines and staffed service centers over the weekend to help customers with the GPS problem, she said.
      
      Some 95,000 car navigation units sold in Japan may be unable to cope with an internal date change in the system, the Ministry of International Trade and Industry
      said.
      
      Four Japanese manufacturers of GPS systems have completed updating only about 170,000 of the estimated 260,000 units sold in Japan since 1996 and believed to
      be still in operation.
      
      Japanese drivers are heavily reliant on the navigational devices because most streets in urban centers such as Tokyo are unnamed and follow curving paths laid out
      among a tangle of property lines.
      
      Japan's Maritime Safety Agency has received reports that ships with older GPS systems are in or near territorial waters but has not received any distress calls as of
      Sunday noon, a spokesman said.
      
      At midnight GMT, the 24 satellites of the Global Positioning System, which provide navigational data from 17,700 kilometers (11,000 miles) out in space, switched
      their timing system back to zero.
      
      The rollover is because the system, which uses radio signals from satellites to provide navigation data, was designed to ignore calendar dates but keep precise time
      measured in seconds and weeks.
      
      Only 1,024 weeks were allotted from January 6, 1980, before the system is reset to zero. 
      
      @HWA
      
11.0  Security Search Engine MindSec Goes Online 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Erik 
      www.mindsec.com goes live today, providing a search
      engine to search 90 different sites that are security and
      administration related. MindSec will also have product
      reviews on admin and security applications and
      hardware. 

      MindSec     
      http://www.mindsec.com
             
      @HWA
      
12.0  CIA Ex-Director Security Clearance Revoked 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/
      
      contributed by Erik 
      John Deutch, former director of the CIA, has had his
      security clearance revoked after it was found that he
      kept classified material on his home PC. 

      Yahoo News      
      http://dailynews.yahoo.com/h/nm/19990822/tc/cia_3.html
      
      Sunday August 22 12:02 AM ET 
      
      CIA Suspends Ex-Director Deutch Security Clearance
      
      WASHINGTON (Reuters) - The CIA has suspended security clearance for its former director, John Deutch, who was found to have kept
      classified material on a computer at his home.
      
      A CIA statement Friday said clearance for Deutch, the Central Intelligence Agency director for 20 months up to December 1996, had been
      suspended ``for an indefinite period of time.''
      
      The decision followed a review of the case by the current director, George Tenet, and a decision by the Justice Department in April not to prosecute Deutch.
      
      The statement said that although a report by the CIA's Inspector General ``found no evidence that national security information was lost, the potential for damage to
      U.S. security existed.''
      
      Newsweek reported in April that 31 classified documents were discovered on a computer at his home in a routine check after Deutch, a pillar of the Washington
      establishment for decades, left the agency.
      
      Deutch issued a statement through the CIA Friday saying: ''...I erred in using CIA-issued computers that were not configured for classified work to compose
      classified documents and memoranda.''
      
      He said: ``Although I accept responsibility for my mistake, I want to make clear that I never considered the information to be at risk or intended to violate security
      precautions. But good intentions simply are not enough. Strict compliance is the standard.''
      
      Earlier this year Deutch was appointed to head a commission reviewing security at science laboratories after reports of Chinese spying at nuclear facilities but he
      withdrew as reports of his own misuse of classified materials emerged. 
      
      @HWA
      
13.0  GAO Releases Report on Risk Assement 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Evil Wench 
      In an attempt to give federal agencies some sort of
      guideline on how to secure their systems the
      Government Accounting Office has released the
      Information Security Risk Assessment: Practices of
      Leading Organizations report. The report details security
      programs used by four unnamed organizations, which
      included oil, financial and computer companies and one
      federal regulatory agency. The report goes on to
      identify seven critical factors of a successful ongoing
      security risk-assessment program. 

      Federal Computer Week
      http://www.fcw.com:80/pubs/fcw/1999/0823/fcw-newsgao-08-23-99.html
      
      General Accounting Office           
      http://www.gao.gov
      
      FCW;
      

      AUGUST 23, 1999 


      GAO report tries to sort out risk-assessment
      confusion

      BY DIANE FRANK (diane_frank@fcw.com)

      Facing growing security threats to increasingly complex government
      computer systems, the General Accounting Office last week released a report
      to help federal agencies determine how vulnerable their systems are and how
      to make them more secure.

      Although GAO's report, "Information Security Risk Assessment: Practices of
      Leading Organizations," does not present specific suggestions for agencies to
      determine how to secure systems from cyberattacks, it identifies seven critical
      factors of a successful ongoing security risk-assessment program, including
      defining and documenting procedures and results.

      The report details programs put in place by four unnamed organizations, which
      included oil, financial and computer companies and one federal regulatory
      agency. GAO did not name the organizations because it feared that hackers
      might target them. The report also includes diagrams detailing the
      risk-assessment process for each organization and a description of how they
      made their decisions.

      For example, the regulatory agency conducts risk assessments "to determine
      the applicable security controls," the GAO reported. "This is done by
      determining which of a pre-defined set of controls is appropriate for individual
      business operations and comparing what is appropriate to controls already in
      place to identify and address gaps."

      The best practices outlined in the report will be helpful, especially at smaller
      civilian agencies that do not have the resources that department-level agencies
      have, said John Gilligan, chief information officer at the Energy Department
      and co-chairman of security on the CIO Council's Critical Infrastructure,
      Privacy and Security Committee.

      "I think it will be useful for people who are charged with risk management to
      have examples of what others are doing," he said.

      This is especially true because security and risk assessment are not
      one-size-fits-all concepts, said Mike Lortz, vulnerability assessment product
      manager at Internet Security Systems Inc. "The process needs to be different
      from agency to agency...but the agencies need to be able to use something as
      a guideline," he said.

      GAO intends the report to be a supplement to last year's executive guide on
      information security management. Risk assessment is only one of the five areas
      outlined in last year's guide, but GAO decided to focus its latest guide on that
      area because it is what most people in government seem to be worried about,
      GAO said.

      "When we did the original guide, during the exposure draft period we got
      some comments that [said] we should dig deeper into some of these areas,
      and more comments mentioned risk assessment than any others," said Jean
      Boltz, assistant director of governmentwide and defense information systems
      within GAO's Accounting and Information Management Division.

      Agencies have been confused about how to conduct risk assessment and
      apply that to the security needs they have, Boltz said, especially after the
      Office of Management and Budget revised its computer security regulations in
      1996 and eliminated the requirement to perform risk assessments. Agencies
      have been confused about what to do because, although OMB no longer
      requires risk assessments, it still requires agencies to measure their systems'
      vulnerability to cyberattacks and unauthorized access and then base their
      security architecture on that knowledge, Boltz said.

      Agencies' confusion about risk assessment has heightened because of the
      increasing use of the Internet and because computer systems are becoming
      more interdependent, Gilligan said. "Risk assessment is a big deal because it
      has not been institutionalized," Gilligan said. "In the past, there had been great
      emphasis on doing risk assessment, but [it] tended over time to not be used or
      not be done well." 
       
      @HWA
      
14.0  CESA Drives People to Freedom 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Jordan 
      The Cyberspace Electronic Security Act, a recent
      proposal, which if it became law, would allow law
      enforcement agents to break into your personal PC, is
      forcing people to seek out ways to protect themselves.
      One of the methods people have been looking at is
      Freedom from Zero Knowledge Systems. While the
      software is still in Beta it promises complete anonymity
      on the internet. Freedom Beta 3 is nearing completion
      and is slated for release during the first week in
      September. The new beta will have increased
      functionality, stability and ease of use. 

      Freedom
      http://www.zks.net/clickthrough/click.asp?partner_id=542
      Zero Knowledge CESA Info Page
      http://www.zeroknowledge.com/cesa/

      CNN       
      http://www.cnn.com/TECH/computing/9908/18/freedom/
      
      Total digital privacy may be
      on the horizon 

      August 18, 1999
      Web posted at: 5:32 p.m. EDT (2132 GMT)


      In this story:

      How it works

      Freedom gets high marks

      U.S. encryption policy has its pros and
      cons

      RELATED STORIES, SITES  




      By Robin Lloyd
      CNN Interactive Senior Writer 

      (CNN) -- If American software
      developers were to touch any of the
      code in the 10,000 released beta
      versions of an Internet privacy
      solution that is getting good
      preliminary marks, they would be
      subject to prosecution. 

      In fact, if Zero-Knowledge Systems
      were based in the United States, it
      would be illegal for the company to
      export its Internet privacy software,
      dubbed 'Freedom.' 

      Instead, the Montreal-based start-up,
      headed up by 26-year-old Austin Hill, is set to release the first product of its
      kind -- a comprehensive Internet privacy package that offers multiple online
      pseudonyms and Byzantine encrypted rerouting that even Zero-Knowledge
      couldn't crack if it wanted to. 

      No more cookies, e-mail trails and digital identity stealing. At least, that's the
      idea. More than a dozen "cookie killers" already exist, along with several
      e-mail and browser anonymity services such as anonymizer.com. 

      Those all rely on what Hill calls a "trust-me" mechanism. A third party server
      holds users' identity and data. Freedom makes it so the end-user has sole
      possession of that data. 

      "If there was a gun to my head, I still could not reveal or break the privacy
      of my users," Hill says. 

      The user has the only "key" to their pseudonyms, which can be linked to
      independent e-mail addresses, geographic locations and encryption keys. 

      Freedom is designed to protect the e-mail, chats, browsing and newsgroup
      searches of anyone from a Chinese dissident posting pro-democracy
      messages to an employee checking out listings for Alcoholics Anonymous. 

      The software can encrypt private chats and newsgroup discussions, ensures
      anonymous Web browsing and can even block spam, Hill says. Each digital
      identity relies on full strength encryption that ranges from 128 to 4,096 bits. 

      Freedom 1.0, which works only on Windows platforms, is set for release in
      late October or early November. It will be downloadable for $49.95.
      Macintosh and Linux versions are due out next year. Freedom doesn't work
      with America Online, however, since AOL is an online service separate from
      the Internet. 

      Zero-Knowledge released 1,000 beta copies of Freedom at the DefCon 7
      convention in Las Vegas last month. Since then, it has released thousands
      more via its Web site. A total of 50,000 people have requested copies since
      then. 

      How it works

      Web users leave traces of their identity behind every time they visit a Web
      site or send e-mail. To get a sense of the process, visit the Center for
      Democracy and Technology's site and use its demo. 

      Freedom allows users to set up separate pseudonyms for different aspects
      of their lives -- an identity for an online chat about health care, another for
      interactions with friends and family, others for Internet browsing and finally a
      'true' identity for e-commerce. 

      Zero-Knowledge is working on an e-commerce identity protection solution
      for future versions. 

      Freedom scrambles data coming from a user's PC and hides the source and
      destination of Internet traffic routed through the service. 

      The message or data packet is first sent to Zero-Knowledge's servers where
      it is wrapped in a layer of encryption. 

      That initiates a delivery process where the data bounces from one
      independently owned relay station to the next and can only be opened by
      one specific user who then forwards it to another specific user, with that
      process repeating several times. 

      Eventually a data packet goes to its intended target but neither snoopers, nor
      the final recipient, have any way of tracing its origins. 

      Third-party protections, the approach relied upon by Freedom's
      predecessors, can be hacked or bought away when the company makes a
      new acquisition, as was the case when Double Click acquired Abacus, Hill
      said. Or, civil lawsuits can force ISPs to turn over their records. 

      Freedom gets high marks

      David Sobel, general counsel for the Electronic Privacy Information Center,
      and Ari Schwartz, a policy analyst with the Center for Democracy and
      Technology, agree that Freedom is a good solution. 

      "I suspect that it is one of the best solutions that we've seen," Sobel said.
      Freedom's strength comes from Hill's philosophical commitment to
      preserving privacy and anonymity on the Internet, Sobel said. 

      Schwartz underlined the Center's stance on Internet privacy -- software
      solutions combined with self-regulation among service providers and
      legislation will be needed to protect privacy online. 

      The U.S. Congress has introduced several bills this session relating to online
      privacy but advocates say they may not go far enough. 

      A CDT report concludes that online privacy is the exception, not the rule, in
      the private sector. 

      U.S. encryption policy has its pros and cons

      The U.S. policy that prohibits encryption exports and labor is based on
      protecting security codes produced and cracked by the FBI and other
      national security agencies. 

      The downside is that we may lose out on what has turned into a $1.5 billion
      cryptography business for Canada, where limits are less strict, Hill says. 

      The U.S. approach could backfire and result in a brain drain of encryption
      experts, EPIC's Sobel said. 

      "The end result will be that American companies will lose leadership in this
      field," he said, "and it is not going to result in encryption being out of the
      hands of anyone our government might be concerned about." 

      @HWA
      

15.0  Who's doing the Scanning? 
      ~~~~~~~~~~~~~~~~~~~~~~~~~ 
      
      From HNN http://www.hackernews.com/

      contributed by Code Kid 
      Netsentry.net and all IPs in the 38.x.x.x range appear to
      be systematically scanned. Owners of machines in that
      range, which is controlled by PSINet want action to be
      taken, but what action? So far scanning is not illegal, so
      what can be done? And who is doing the scans and
      why? 

      MSNBC 
      http://www.msnbc.com/news/302835.asp
      
      Scanning for trouble
      Relentless computer ‘probes’ cause concern, but no damage
      yet
                                                By Bob Sullivan
                                                          MSNBC



  
               
      Aug. 23 —  Dragos Ruiu was just minding his own
      business, a Vancouver software start-up, when it
      started. Day after day, relentlessly, someone or
      some group out there on the Internet is banging
      away at his servers, sneaking in and gaining full
      access. A security expert, he knows what’s
      happening: He’s being probed. Is this mere sport,
      or a “casing,” like a bank robber who visits the
      bank several times to study its security systems
      before the heist?
      
          EVERY DAY they come, they lurk — then they leave
      without doing damage. And Ruiu is powerless to stop it. Every
      method he has tried, they have trumped. They’re toying with
      him. “They must feel like gods,” he says. 
             They come at him through clients’ computers, through
      Canadian ISPs, once even through one of the largest Canadian
      banks. They hack into Linux boxes, NT boxes, Unix boxes.
      Hack by day or night. No matter. 
             And all for no apparent reason. They look, but don’t
      touch.
             Ah, the life of a network administrator these days. There
      are thousands of ways to break into a computer, and there are
      now several downloadable software packages designed to
      scan the Internet for Web sites and servers that have just one
      flaw. 
 
 
 
             According to Peter Tippett at computer security research
      firm ICSA, a new box connected to the Net will almost
      certainly be “scanned” before one week goes by. And the
      amount of scanning activity has doubled in the past six months.
             That’s about when the scanning started for Brandon
      Pepelea, a former employee at PSINet who says his collection
      of Web sites has been scanned systematically several times a
      week since January. In another example of a victimless probe,
      Pepelea thinks someone or something has been banging
      through all the Internet addresses between 38.240.x.x and
      38.200.x.x, a so-called Class-B range of addresses that
      constitute about 16,000 possible computers. 
             In his case, the scans were unsuccessful. Whoever or
      whatever it is, they haven’t been able to break into Pepelea’s
      computers. Still, the relentless, systematic nature of the probe
      has him spooked. He’s been demanding that PSINet, which
      owns all the addresses in the 38.x.x.x range, chase down the
      scanner and prosecute. 
             “I don’t think they understand how serious it is,” Pepelea
      said. “The threat not so much being the nature of the scan but
      the scope of the scan… If you’re between 38.240 and 38.200
      you’ve had the scans. They’ve walked through and gotten to
      you.” 
             
      NOSE FOR TROUBLE
             The attack itself involves use of the Simple Network
      Management Protocol, frequently used on network routers.
      Pepelea owns machines between the 38.240 and 38.200
      address range, and concluded scans spanned that range by
      studying patterns of hits to his own and his client’s machines. 
      
      
      Dancing
      tantalizingly over
      the edge of the
      law, they show an
      ability to do far
      more damage. 
      
 
             This is not the first time Pepelea, now CEO of a small
      security company he calls “Designer’s Dream,” has done a
      hefty amount of personal cybersleuthing. Last December, he
      compiled information on a virus writer named VicodinES, and
      shared it with the FBI, the CIA and other law enforcement
      agencies. His tips fell on deaf ears, and VicodinES, who the
      world now knows as Dave Smith, went on to release the
      Melissa virus. Pepelea’s hell bent on being heard this time
      around. “Once again, nobody cares,” he laments.
             PSINet said early last week the scans were being
      generated by an account serviced by the company, and that it
      had dealt with the matter by canceling the account. But by
      Friday, the company had canceled three more accounts in an
      effort to stop the probes. While officials there say they take the
      matter seriously, they are not convinced it’s an organized
      hacker attack. 
 
 
             “It’s not possible to characterize whether this is a mistake,
      a malicious event, was planned, or it just happened,” said Cole
      Libby, Director of Network Engineering. For example, it could
      a wrongly configured piece of hardware searching a section of
      the Internet for a new printer. “There are lots of examples of
      technology out of control in the world.”
             
      NO HARM, NO FOUL?
             Scanning, the cyberspace equivalent of walking down
      Main Street and jiggling handles to see who leaves the front
      door unlocked, brings up murky legal issues. Entering
      someone else’s computer is illegal, but scanning, which
      amounts to asking a computer how it’s been set up, probably
      isn’t. Pepelea says PSINet told him to pursue legal action
      against his cyberpest — but for what? Meanwhile, Pepelea
      thinks PSINet should be liable if any real trouble ever comes
      from his suspected hacker, particularly since the Net provider
      was warned.
             That’s not likely, says Internet law expert Dorsey
      Morrow. PSINet would almost certainly face no criminal
      liability for the actions of a hacker on their network, and
      wouldn’t likely face civil liability either.
             “As long as they can show ‘We were doing everything we
      can. We’ve got security policies in place. We’re using the
      latest software.’ That mounts up to a pretty good defense,”
      Morrow said.
             So there’s no consequences for scanning, either to the
      hacker or the company that provides the means. But what of
      Ruiu’s hackers, who go just one step further than Pepelea’s
      scanners? They scan, then enter, lurk around, and leave.
      Dancing tantalizingly over the edge of the law, they show an
      ability to do far more damage.
             Their methods are painstakingly deliberate, designed to
      avoid detection. They launch attacks from multiple sites,
      sometimes sending no more than a packet per day from any
      site, in order to hide the kind of suspicious activity protective
      “sniffer” programs look for. 
             “We saw one new machine coming at us every five
      minutes,” Ruiu said. “They must have felt like gods because
      they could break into any machine they wanted.”
             That includes a collection of Canadian ISPs, and even one
      major Canadian bank, the hackers broke into. When he
      called, Ruiu often had a tough time convincing victimized ISP
      administrators they’d been hacked. 
             “The reaction of ISPs was disbelief,” he said. “One didn’t
      believe us until a marketing guy had his laptop taken out and it
      started sending weird packets.”
             Ruiu is convinced the hacks are coming from a
      coordinated team, because of their speed and variety. But
      while the cat-and-mouse game continues, he can only
      speculate on motive. His company, a 15-person startup called
      Netsentry.net, is hardly a big target. So Ruiu thinks his outside
      efforts in the security community are likely to blame. He
      recently worked on project called “Trinux,” which aimed to
      create a security-enhanced version of Linux that fits on one
      floppy disk. Among his partners was Ken Williams, who until
      recently ran Packet Storm Security, perhaps the most popular
      reference site in the hacker community.
             “I suspect these guys are targeting security software,” he
      said, but added they have not revealed their intentions. “This is
      really bugging me. The lack of a motive really disturbs me…it
      gave me the creeps.” 
             The attacks have also been humbling for Ruiu, who has
      spent a lot of time chasing the hackers when he could be
      working to get his business off the ground.
             “There are a lot of assumptions we’re all making about
      Internet security that we shouldn’t,” he said. ”“There’s a lot of
      things we don’t know.” 
             For example, these hackers made a habit of hijacking
      machines Ruiu’s computers normally talked to, then initiated
      attacks from these supposedly “friendly” computers. That
      made them almost impossible to detect. 
             “If they get a machine that’s close to your machine, that’s
      almost as bad as taking over your Web server. It’s a great
      place to launch an attack on your firewall,” he said. 
             Nothing about Ruiu or Pepelea’s stories surprised
      ICSA’s Tippett, who expects security problems to get worse
      before they get better.
             “It’s the wild, wild West out there,” he said. “The tools
      are pervasive and so common. The chance of getting caught is
      pretty slim… Our neighbors are now very close and enough of
      them don’t have a great social conscience.”
             A more extensive report on the one of these attacks,
      written by Ruiu, can be found at www.securityfocus.com.
             If you have more information about this story, e-mail
      tipoff@msnbc.com.
             
      
      @HWA                                                                        
      
16.0  Japanese Police Go After Copyright Infringers 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/
      

      contributed by Hosimi 
      The Akita Prefectural Police are investigating the
      activities of a civil servant who allegedly posted
      accounting software and MP3s to the internet in
      violation of copyright law. The suspect had all of his
      computer equipment confiscated last month. 

      Asia Biz Tech      
      http://www.nikkeibp.asiabiztech.com/wcs/leaf?CID=onair/asabt/moren/79863
      
      
      Akita Prefecture Police Pursue Internet Crime
      August 24, 1999 (TOKYO) -- The Akita Prefectural Police on Aug. 19 sent papers alleging unauthorized
      Internet program delivery to the Akita District Prosecutor's Office, for prosecution.
      
      The case is being pursued by the Kisakata Police Station.
      In the case, a male civil servant residing in Akita Prefecture is believed to have been engaged in 
      unauthorized free delivery of personal computer programs and digital music data over the Internet. 
      The man is suspected of infringing on the right of public transmission under the Copyright Law.
      According to the prefectural police, the man had registered accounting software of Obic Business 
      Consultants Ltd. and MP3-based musical data on his home PC. He is suspected of having posted these
      programs on the Internet so that PC users can download them free of charge.<BR><BR>In June, the 
      Kisakata Police Station investigated the man's house and confiscated his PCs and peripheral equipment.
      The police decided to send papers pertaining to the case to the district public prosecutor's office 
      because the free delivery of PC software was deemed to be illegal, it said.  
      
      The Japan Society of Rights of Authors and Composers has already accused the man of unauthorized delivery 
      of musical data.
      
      The Akita Prefectural Police's task force specializing in high-tech crimes played a significant role in 
      this investigation.  To combat the increasing number of high-tech crimes, the National Police Agency is
      calling on prefectural police stations to organize task forces specializing in high-tech crimes, starting
      in the current fiscal year.  The task force set up by the Akita police has reportedly contributed 
      substantially to analysis of communications records and other matters related to the case.
      (BizTech News Dept.)

      @HWA 
               
      
17.0  Anti-Gay Web domain Returned to Original Owner 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      contributed by Code Kid 
      Last week the web domain registration of
      www.godhatesfags.com was altered to point to the
      same people who own the www.godlovesfags.com. The
      change was accomplished by someone using an
      anonymous remailer with the internic registration
      database. The admins of www.godlovesfags.com has
      returned the domain to the original owner. 

      CNN      
      http://cnn.com/TECH/computing/9908/23/hack.folo/index.html
      
      Anti-gay site goes back to
      rightful owners

      August 23, 1999 
      Web posted at: 4:52 PM EDT (2052 GMT) 

      By D. Ian Hopper
      CNN Interactive Technology Editor

      As slowly as it came, the road to love
      veered back to hate on an anti-gay
      Web site run by Pastor Fred Phelps
      of the Westboro Baptist Church in
      Topeka, Kansas.

      Last Wednesday, domain name
      registrar Network Solutions’ Internic
      directory was fooled to associate the
      godhatesfags.com domain name with
      the server containing
      godlovesfags.com, a pro-gay site.

      Kris Haight, a systems administrator
      at Sugar-River.Net, a New Hampshire Internet service provider, still
      maintains that he did not make the change himself, and was the beneficiary of
      a still-anonymous hacker. His site received about 70,000 page views after
      the switch, which had only received a total of 7,500 page views prior to
      Wednesday.

      Haight finally relinquished the name on Friday, after pressure from his
      employer and his employer’s service provider, a larger Internet provider
      which sells connectivity to the smaller ISP. According to Haight, a lawyer
      from the Phelps organization contacted the larger provider, Destek
      Networking Group of Nashua, New Hampshire, and threatened action.
      Destek then contacted Haight.

      Haight then attempted to contact Phelps, leaving a message telling Phelps to
      check his e-mail for a notice from Internic that the domain name was pointed
      back to the original host server.

      Phelps' organization refused to confirm the call to Destek, and continued to
      downplay the incident. “It hasn’t hurt us one iota,” said Shirley
      Phelps-Roper, Fred Phelps’ daughter and a lawyer for the organization. “It
      demonstrated to the world that fags are what we said they are. These
      experiences confirm what the scripture says about them. They are lawless;
      nothing is sacred with them.”

      T. Parsinnen, owner of Sugar-River.Net and Haight’s employer, said he
      knew nothing of the change until after it happened. “We received an e-mail
      giving a server change to godhatesfags, “ Parsinnen explained, “But I didn’t
      notice anything in particular. I thought, ‘Oh, that’s Kris’s domain, I don’t
      have to do anything about it.’ It was so close that it didn’t register to me
      what it actually was.”

      The next day, Kris told him what he did. “I said, ‘You’re going to have to
      give that back,’ and he said he would.”

      Parssinen said he doesn’t anticipate any legal action and will continue to host
      the godlovesfags Web site. Haight is leaving the company for another job
      opportunity. According to Parssinen, it’s just in time. “To demonstrate to
      everybody that we had nothing to do with what took place, we would have
      been forced to terminate his employment.”

      A mystery remains, though. Who made the switch?

      Parssinen said he doesn’t think Haight knew how to do it himself, and Haight
      refuses to give any more information about the e-mail that told him to watch
      for the switch, other than it was from an anonymous remailer. There’s plenty
      of speculation, however, ranging from a Phelps ploy to sabotage himself in
      order to get more media attention, to a result of the recent Chaos
      Communication Camp in Germany, to a challenge made to hackers to
      reassign a set of domain names.

      Nevertheless, Network Solutions spokesperson Nancy Huddleston said that
      there are three levels of domain name security, and relatively few choose the
      highest level, password encryption. With that level, this sort of domain
      redirection wouldn’t have been nearly as easy to do. “We just sent another
      alert to our users telling them about the three levels of security,” Huddleston
      said.

      Even with more security, it seems almost inevitable that high-profile and
      controversial sites will continue to be a prime target for attention-hungry
      hackers. Phelps-Roper has resigned herself to that fact, reporting that the
      godhatesfags site has been a target many times before, usually with
      denial-of-service attacks.

      You know there’s 365 days in a year, Phelps-Roper said, If we’re down
      3, we’re still up the rest. We don’t really care.
      
      (Gotta love their attitude, this kills me... bahahaha - Ed)

      @HWA
      
18.0  EXPLOIT-DEV Mailing List Started 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/
      
      contributed by Ryan 
      In an effort to promote discussion on potential or
      undeveloped holes a new mailing list has been created
      by the folks at Security Focus. The list will be dedicated
      to interactively developing exploits. 

      Security Focus      
      http://www.securityfocus.com/forums/exploit-dev/faq.html
      
      
      
      We are pleased to host a new security mailing list that may be of
      interest BUGTRAQ subscribers.
      
      
      What is EXPLOIT-DEV?
      
      
        There are many forums for reporting security bugs and distributing exploit
      code or examples.  A prime example of such a forum is the BUGTRAQ
      mailing-list.  However, nearly all of these forums exist mostly for the
      dissemination of fully-researched reports, and they leave little room
      for discussion.  In addition, many bugs are spotted not written-up,
      due to lack of interest, time, or expertise.
      
      
        The EXPLOIT-DEV list exists to allow people to report potential or
      undeveloped holes.  The idea is to help people who lack expertise, time,
      or information about how to exploit a hole do so.
      
      
        The EXPLOIT-DEV list is dedicated to the concept of full disclosure.  We
      believe that release of exploit code serves the security community overall.
      Since the list is dedicated to interactively developing exploits, there will
      there will generally NOT be an opportunity to warn software vendors or
      authors. In many cases it will not be clear that there is a problem until
      the exploit or description is finalized, at which point all list subscribers
      will know.  It is very appropriate to notify vendors or authors as soon as
      it is clear there is a problem.
      
      
      For more information read http://www.securityfocus.com/forums/exploit-dev/faq.html
      
      
      To subscribe email LISTSERV@SECURITYFOCUS.COM with a message body of:
      
      
        SUBS EXPLOIT-DEV Firstname Lastname
      
      
      --
      Elias Levy
      Security Focus
      http://www.securityfocus.com/
      
      @HWA
      
      
      
19.0  NetBus - Product Under Siege 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/
      
      contributed by Judd 
      UltraAccess.net, the company that makes NetBus Pro, is
      lashing out against Anti-Virus vendors for restricting
      sales of its product by labeling the software as a virus.
      Net Bus Pro 2.1 is a remote administration tool similar to
      Back Orifice that allows an administrator to control a
      remote system. UltraAccess.net is claiming that AV
      vendors like Symantec think that NetBus is competition
      for their remote administration software and that is why
      it is being flagged by the AV software. UltraAccess says
      that unless some sort of agreement can be reached
      they may purse legal action against AV companies for
      defamation and restraint of trade. 

      UltraAccess.net
      http://www.ultraaccess.net
      
      @HWA
      
20.0  Worst Security Hole Ever? 
      ~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      This new hole in Internet Explorer 5 allows an
      infocriminal to place a program on a victim's hard disk
      that will be executed at the next reboot. The bug can
      be exploited from a user opening a web page or reading
      an email. The problem is located with an Active X
      control called "Object for constructing type libraries for
      scriptlets". Microsoft is working on a fix, in the meantime
      users are urged to turn off Active X within their
      browsers. (Sure glad I use Netscape.) 

      George Guninski's Home Page - Demo and Source Code Available
      http://www.nat.bg/~joro/
      Internet News  
      http://www.internetnews.com/prod-news/print/0,1089,9_188461,00.html
      
      
      New IE5 Security Bug the Worst Ever? 
                                                         August 24, 1999
      Brian McWilliams, InternetNews.com Correspondent 
                                                    Product News Archives 
      
      
      Bulgarian browser bugmeister Georgi Guninski is at it again. The 27-year-old
      independent computer consultant has discovered a new security flaw affecting
      Internet Explorer 5, which enables a malicious hacker to place a program on the
      victim's hard disk, to be executed at the next reboot. 
      
      Guninski is credited by Microsoft with discovering and publicizing a number of
      significant security flaws in its Internet Explorer browser in the past year. While he's
      also spotted several security bugs in Netscape's Navigator, Guninski is especially
      fond of poking holes in Active X, the scripting technology used in IE. 
      
      "I think this is the most significant of my discoveries and the most dangerous also,"
      Guninski told InternetNews Radio. "It allows a Web page or e-mail message to
      take control of the computer and do anything." 
      
      According to Guninski, the attack can be launched by causing IE5 users to click on
      a hyperlink on a web page, but it also can be transmitted by e-mail to users of
      Microsoft's Outlook 98. The exploit places an executable program in an HTML
      Application file in a Window 95 or 98 computer's start-up folder. When the victim
      reboots his or her computer, the program will execute. 
      
      Guninski said the problem lies in an Active X control called "Object for
      constructing type libraries for scriptlets". He has posted a demo and source code of
      the exploit at his Web site. 
      
      Microsoft officials were not immediately available for comment. Guninski asserts
      that the company has reproduced the bug and plans to issue a patch. In the
      meantime, concerned IE5 users can protect themselves by going into security tab of
      the browser's Internet Options menu, and disabling ActiveX controls or plug-ins.
      
      
      @HWA
                             
21.0  IRC Banned in Malaysia 
      ~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by AlienPlague 
      Undernet, EFnet and DALNet, Internet Relay Chat
      Networks, had banned users from Malaysia for seven
      days last week. Both of Malaysia's Internet service
      providers Jaring and TMNet ISPs had been banned from
      using the networks effectively cutting off the entire
      country. The ban was due to users in the country
      abusing the networks services. After discussions with
      both ISPs the ban was lifted last Friday. 

      South China Morning Post
      http://www.technologypost.com/internet/Daily/19990824110643506.asp?Section=Mai
      
      INTERNET 

          Malaysians banned
             from global IRC
                   network 

      NEWSBYTES 

      Undernet, a worldwide Internet Relay Chat (IRC)
      network that allows people to connect to its
      privately-run computer servers free of charge to
      communicate in real time over the Internet, has banned
      Internet users from both of Malaysia's only two Internet
      service providers (ISPs) for abusing its services.

      Although Undernet is one of many IRC networks, it is
      one of the largest and joins two of the other largest -
      DALNet and EFnet - in instituting temporary or
      permanent bans on Internet users logging on from the
      Jaring or TMNet ISPs in Malaysia.

      Bans typically run for several hours to days or weeks
      depending on the network and the level of abuse and
      the response of ISPs to complaints from IRC network
      administrators.

      Within the IRC community, abusive behaviour ranges
      from repeated offensive behaviour toward other users,
      automatically flooding chat rooms with multiple
      messages, running robot programs and launching denial
      of service attacks against other users or the servers
      themselves (basically, trying to hack the system and
      bring it down).

      Because Internet users often connect from dial-up
      connections it is impossible for IRC networks to identify
      and ban an individual user as they can just log out and
      return with a different IP address.

      This is where IRC administrators ask ISPs for
      assistance with serious offenders who do not respond to
      IRC operators requests to cease online.

      Since the ISP can connect an IP address at any point in
      time to a particular user, they are in a position to pass
      on a warning or even account termination if hacking is
      against the ISP's terms of service, which is the case for
      most ISPs worldwide.

      IRC networks do not usually take the next step and ban
      a whole ISP's domain, and so all of its users guilty and
      innocent, unless the ISP is unresponsive to abuse
      reports.

      Undernet found that Jaring and TMNet administrators
      ignored abuse reports and so they were forced to ban
      all users from both services for seven days last week.

      "In the last few months alone, over 182,300 global bans
      have been set against various address's in the *@*.my
      domain," read an Undernet.org e-mail sent to Jaring and
      TMNet.

      "We simply cannot afford to absorb the costs of these
      attacks any longer. 

      "We must either reach some form of working,
      responsible relationship with the administrators of the
      various *.my providers, or these bans will become
      permanent. 

      "Basically, we are only asking that they support and
      enforce their own policies they have in place already."

      Undernet lowered the bans against Jaring on Friday
      after some discussion between the two organisations.

      The network presented the ISP with a list of requests
      and suggestions for abuse management. TMNet, the
      ISP arm of national telco Telekom Malaysia, had not
      contacted Undernet on Friday and on Sunday a
      permanent ban was placed on the TM.net.my IP space.

      Undernet officials said that the bans were not about
      Malaysian Internet users being particularly worse
      behaved than any other country's. They said it was
      about "irresponsible and unresponsive administration of
      the Malaysian ISPs".

      "We are not singling out Malaysia, but it is in general is
      the most abusive domain currently accessing the
      Undernet," said Undernet.

      "Malaysian IP space and resources are being used to
      launch denial of service attacks and the last attack
      against one of our routing servers was the straw that
      broke the camel's back."

      Undernet estimated it costs its hosts US$2.2 million in
      bandwidth alone to run the Undernet network each
      year. At times more than 30,000 users are connected
      simultaneously from all around the world. 
      
      @HWA
      
      
22.0  I want my, I want my, I want my HNN - more goodies from HNN
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
      From HNN http://www.hackernews.com/
      
      contributed by Space Rogue 
      Monday HNN announced that the new Java HNN News
      Ticker is available on the Affiliate Resources page.
      Today we are happy to announce several new ways
      which you can receive your HNN. With our new XML
      backend we now have channels on My Netscape and My
      Userland. This is in addition to our box on Slashdot and
      our previously announced PQA for the Wireless Palm
      Pilot. We've got even more features in the works so
      keep your eyes open. 

      I want my HNN
      http://www.hackernews.com/misc/myhnn.html
      
      @HWA

23.0  Melissa Creator Admits Guilt 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by Code Kid 
      David L. Smith, the man who has been charged with
      creating and disseminating the Melissa virus, admitted
      to investigators that he did it, according to court
      papers. Lawyers for the defense dispute that an
      admission of guilt was made. Smith has pleaded not
      guilty to charges of interrupting public communication,
      conspiracy, theft of computer service, and wrongful
      access to computer systems. David Smith remains free
      on $100,000 bail. 

      C|Net
      http://www.news.com/News/Item/0,4,40912,00.html?st.ne.fd.mdh.ni
            
      Nando Times
      http://www.nandotimes.com/technology/story/body/0,1634,85786-135501-944958-0,00.html
     
      CNN 
      http://www.cnn.com/US/9908/25/melissa.virus.ap/index.html
      
      
      
      C|Net;
      
      Court papers: Smith admits to creating Melissa virus 
      
      By Erich Luening
      Staff Writer, CNET News.com
      August 25, 1999, 8:25 a.m. PT 
 
      update The New Jersey man charged with creating the Melissa virus, which disrupted
      computers around the world, admitted to investigators that he did it, according to court papers.
 
      On April 1, David L. Smith was arrested by federal and state officials and charged with creating and
      disseminating the Melissa virus that began spreading across the Internet March 26. 
 
      Smith, 30, a resident of Aberdeen Township, New Jersey, was arrested at the home of his brother in
      Eatontown, New Jersey. Smith was tracked down with the help of America Online and by traced phone calls. 
 
      A spokesman for the New Jersey Attorney General's office told CNET's News.com that the prosecution "expects to see some
      kind of resolution by September." He would not elaborate further. 
 
      A brief filed in state superior court by supervising deputy attorney general Christopher G. Bubb said Smith waived his Miranda
      rights and spoke to investigators when police arrived at his apartment, according to a courthouse spokesperson. 
 
      Smith admitted to writing the "Melissa" macro virus, illegally accessing America Online for the purpose of posting the virus onto
      the Internet, and destroying the personal computer he used to post the virus, Bubb stated. 
 
      The state attorney filed his brief in response to a motion made by Smith’s attorney Edward F. Borden Jr. seeking certain
      prosecution documents. 
 
      The FBI continues to provide assistance to New Jersey prosocuters in the case. Federal charges have not been levied against
      Smith. "The decision to bring federal charges against Smith is at the descretion of the U.S. Attorney," said FBI spokesperson
      Debbie Weierman. 
 
      In April, Smith pleaded not guilty to charges of interrupting public communication, conspiracy to commit the offense, and the
      attempt to commit the offense. He also pleaded not guilty to charges of two lesser offenses: theft of computer service and
      wrongful access to computer systems. 
 
      If convicted on the state charges, Smith faces a maximum of 40 years in prison and fines of $480,000. 
 
      AOL tipped the New Jersey attorney general's office to the virus's originator. AOL said it had tracked the source through a
      listserver to Monmouth County, New Jersey. 
 
      Since his arrest, Smith has changed attorneys. 
 
      The Melissa virus was first introduced on an "alt.sex" newsgroup using the AOL account of Scott Steinmetz, whose username
      was "skyroket." Steinmetz, a civil engineer in Lynnwood, Washington, told CNET News.com that he had nothing to do with writing
      or introducing the virus. 
 
      The virus used a combination of Microsoft's Outlook and Word programs to spread, taking advantage of users' email address book
      entries to gain the appearance of coming from a known person. 
 
      Smith remains free on $100,000 bail. 
      
      Nando Times;
      
      Accused admitted creating 'Melissa' virus, prosecutor says 

      Copyright © 1999 Nando Media
      Copyright © 1999 Associated Press
      
      From Time to Time: Nando's in-depth look at the 20th century. 
      
      FREEHOLD, N.J. (August 25, 1999 10:57 a.m. EDT http://www.nandotimes.com) - The man charged with creating the Melissa computer virus that
      clogged e-mail systems around the world last spring admitted he created the bug, a prosecutor alleges in court papers. 
      
      David L. Smith, a former computer programmer, was arrested in April. 
      
      A brief filed in state Superior Court by Supervising Deputy Attorney General Christopher G. Bubb says Smith waived his Miranda rights and spoke to
      investigators when police arrived at his apartment. 
      
      "Smith admitted, among other things, to writing the 'Melissa' macro virus, illegally accessing America Online for the purpose of posting the virus onto
      cyberspace, and destroying the personal computers he used to post 'Melissa,'" Bubb wrote. 
      
      Defense lawyer Edward P. Borden Jr. told the Asbury Park Press of Neptune that he disputes Bubb's assertions. He refused to comment further, the
      newspaper reported Wednesday. 
      
      The Melissa virus was disguised as an e-mail marked "important message" from a friend or colleague of each recipient. It caused affected computers
      to create and send 50 additional infected messages. The volume of messages generated slowed some systems to a crawl. 
      
      Authorities say the virus was named after a topless dancer in Florida. 
      
      Bubb's brief was filed in response to a defense motion seeking additional prosecution documents. 
      
      Borden says he needs the prosecution documents to file a motion to suppress evidence seized during the search of Smith's apartment. A hearing on
      his motion was to be held Wednesday afternoon. 
      
      Smith is charged with interruption of public communications, conspiracy and theft of computer service. The maximum penalty for the offense is 40
      years in prison. 
      
      He remains free on $100,000 bail. 
      
      CNN;
      
      Prosecutor says man
      admitted creating 'Melissa'
      computer virus

      August 25, 1999 
      Web posted at: 10:49 AM EDT (1449 GMT)

      FREEHOLD, New Jersey (AP) --
      The man charged with creating the
      Melissa computer virus that clogged
      e-mail systems around the world
      admitted he created the bug, a
      prosecutor alleges in court papers. 

      David L. Smith, a former computer
      programmer, was arrested in April. 

      A brief filed in state Superior Court by Supervising Deputy Attorney General
      Christopher G. Bubb says Smith waived his Miranda rights and spoke to
      investigators when police arrived at his apartment. 

      "Smith admitted, among other things, to writing the 'Melissa' macro virus,
      illegally accessing America Online for the purpose of posting the virus onto
      cyberspace, and destroying the personal computers he used to post
      'Melissa,' " Bubb wrote. 

      Defense lawyer Edward P. Borden Jr. told the Asbury Park Press of
      Neptune that he disputes Bubb's assertions. He refused to comment further,
      the newspaper reported today. 

      The Melissa virus was disguised as an e-mail marked "important message"
      from a friend or colleague of each recipient. It caused affected computers to
      create and send 50 additional infected messages. The volume of messages
      generated slowed some systems to a crawl. 

      Authorities say the virus was named after a topless dancer in Florida. 

      Bubb's brief was filed in response to a defense motion seeking additional
      prosecution documents. 

      Borden says he needs the prosecution documents to file a motion to
      suppress evidence seized during the search of Smith's apartment. A hearing
      on his motion was to be held Wednesday afternoon. 

      Smith is charged with interruption of public communications, conspiracy and
      theft of computer service. The maximum penalty for the offense is 40 years
      in prison. 

      He remains free on $100,000 bail. 
       
      @HWA
    
24.0  cDc Responds to Allegations About HKBs 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/
       
      contributed by Evil Wench 
      Oxblood Ruffin, from the Cult of the Dead Cow, gives an
      interview about the existence of the Hong Kong
      Blondes. The HKBs are a group of Chinese dissidents
      who are trying to destabilize the Chinese Government
      through the Internet. Last week a report was issued
      that there was no evidence to support their existence
      and concluded that therefore they must not exist. 

      IT Daily      
      http://www.itdaily.com/daily.lasso?-database=dailybasepublic&-layout=today&-response=itdailyfree.htm&-recid=39830&-search
      
      
      
      Thursday, August 25, 1999
      Cult claims Hong Kong hackers are real
      threat



      US hackers respond to itdaily.com story

      By Neil Taylor

      Leading US hacker group the Cult of the Dead Cow has told itdaily.com that elusive Chinese hackers
      the Hong Kong Blondes are operating in Asia.
          According to the CDC, the Blondes are a group of Chinese dissidents who aim to destabilise the
      Chinese Government through the Internet. Along with an offshoot named the Yellow Pages, the
      group threatened to use information warfare to attack China's information infrastructure. The group
      threatened to attack both Chinese state-owned organisations and Western companies investing in the
      country.
          When the group was first reported, the CDC claimed to be training the Blondes in encryption and
      intrusion techniques. 
          A recent investigation by itdaily.com found no evidence of the group's existence. Despite
      approaching the Hong Kong ISP Association, the Hong Kong Government, Police, universities,
      security experts and hackers alike, nobody contacted by itdaily.com knew anything about the group. 
          However, CDC foreign minister OXblood Ruffin told itdaily.com that the Hong Kong Blondes are
      for real, and that they are operating in Asia. The chief organisers, nicknamed Blondie Wong and
      Lemon Li, were last reported to be based in India.
          "The Blondes do exist, although the CDC has truncated our official relationship with them," said
      Ruffin. "The Yellow Pages on the other hand briefly existed but were shut down by me."
          Ruffin said that the reason the group has been so low-key is that they operate secretly to avoid
      compromising members in China "They're hyper secure. They're organised in cells of three members
      with no one but Blondie and Lemon knowing the entire membership."
          The CDC has portrayed the Hong Kong Blondes as "hacktivists"; meaning they break into
      computer networks for political ends. "The Yellow Pages got together and they were gonna do
      support work to draw attention to social justice issues in China linked to current trading practices on
      the Western side..."
          Ruffin said that he later learned that the group planned to shut down the networks of a number of
      large US corporations, at which point he decided to disband the group and disassociate himself with
      the Hong Kong Blondes. 
          "The American public would not have supported any such adventure and it would have worked
      seriously against the cause," he said.
          He added that the CDC no longer maintains any relationship with the group. 
          As previously reported in itdaily.com, the first and only Hong Kong Blondes interview was leaked
      to the press by the CDC just one month before the group released its well-known remote
      administration tool Back Orifice. BO can be installed on a Windows PC without the user's knowledge,
      giving full control over the machine to unauthorised third parties.
          Since then, Back Orifice has become widespread internationally, particularly in China. 
          There is still no evidence beyond the word of OXblood Ruffin that the Hong Kong Blondes do, in
      fact, exist, but as Ruffin's e-mail signature notes: "First we take the networks, then we take Peking." 
      
      @HWA


25.0  $50G Offered in 'Hacker Challenge' Publicity Stunt 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by Yazmon 
      Global Markets Research (GMR), a UK company, has
      offered $50,000(US) to anyone who can break their
      proprietary email system within three months. The
      company designed 1on1 e-mail "to guarantee complete
      confidentiality", the program uses 2048 bit encryption
      while email is in transit and can autodelete email after it
      has been read. 

      BBC
      http://news.bbc.co.uk/hi/english/sci/tech/newsid_430000/430084.stm
      
      1 on 1 Mail 
      http://1on1mail.com
      

      HNN has stated its feelings about these 'Hacker
      Challenges' before. These should not be considered
      adequate testing methods. Reasons, 1) Most people
      with the knowledge to break systems like this are busy
      making bigger money elsewhere, 2) The real bad guys
      don't want to give away their secrets, 3) this is not a
      controlled environment conducive to good research. 

      If companies want publicity and a good test of their
      security then they should hire someone like NMRC, Phar
      Lap, L0pht, eEye, or any other independent third party
      security experts to review their software.
      
      NMRC.....: http://www.nmrc.org
      Phar Lap.: http://www.pharlap.com/
      L0pht....: http://www.l0pht.com
      eEye.....: http://www.eeye.com/
      
      BBC:
      
      Thursday, August 26, 1999 Published at 08:15 GMT 09:15 UK 


      Sci/Tech

      The self-destructing e-mail 

      Providing secure e-mail is a growing business 

      A new program can send e-mail messages which
      self-destruct after a set time. 

      Its developers claim this will protect senders from having
      ill-judged electronic words used against them later. 

      The most high-profile instance came last year when
      Microsoft's Bill Gates had to defend himself against his
      own e-mails in a US antitrust case. 

      Hack it if you can

      UK company Global Markets Research (GMR) designed
      1on1 e-mail "to guarantee complete confidentiality". 

      It uses 2,048-bit public key encryption to secure the
      message in transit and GMR have such confidence in it
      that they are offering $50,000 to anyone who can hack
      into a message within three months. 

      The self-destruct feature is called autoshredder and the
      package also prevents recipients from just cutting and
      pasting out of it. "That would be pointless," GMR's
      technical director, Steven James told New Scientist
      magazine. 

      1on1mail also ensures that the e-mail is not stored
      anywhere on the recipient's computer. Finally, when the
      message self-destructs, it is overwritten on the disk, so
      it cannot be undeleted later. 

      Gimmick jibe

      However, critics have been quick to give their views.
      "2,048-bit encryption is ridiculous," cryptographer Bruce
      Schneier told technical news Website ZDNN. "It is
      irrelevant. The security is determined by the password
      anyway. If the user picks a bad one, the security is
      bad." 

      Hushmail, a rival encrypted e-mail service, dismissed the
      self-destruct feature as a gimmick. 

      Another fear is that e-mails used to send viruses or
      trojans could destroy themselves along with any
      evidence. 

           
      @HWA
      
       
26.0  NSA Recruiting In the Underground     
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by Ender 
      The National Security Agency has been actively
      recruiting at least one member of the underground
      community. Ender Wiggin, editor of OSAll web site has
      received offers for free tuition to a four year college,
      salary, and room and board, in exchange for working for
      the NSA for five years after graduation. After noticing
      the NSA was visiting his web site he sent an inquiring
      email and then received the offer to join this program. 

      OSALL - NSA and Kids
      http://www.aviary-mag.com/News/NSA_and_Kids/nsa_and_kids.html
      
      OSALL - Ender and CNN       
      http://www.aviary-mag.com/News/CNN/cnn.html
      


      The NSA is actively recruiting high school kids, offering to
              pay for college -- and a salary to boot.


      The NSA and Kids

                                                  Mike Hudack
                                                 Editor-in-Chief

      They were visiting the Web site daily.  Every day they downloaded all
      the new files and left.  Who were they?  The National Security Agency. 
      The NSA was created in the fifties with a mandate to read other nations´
      mail and keep our mail from being read.  Since then they´ve moved into
      computer security in addition to their original cryptology.

      Curious, I sent an e-mail to the registered custodian of the address
      visiting the site.  It must have been referred around the mulberry bush
      because someone else answered.  "Do you know about our college
      programs?" this new person asked...  I didn´t.

      Apparently the NSA actively recruits students in high school (only local
      to Fort Meade) and college.  The NSA employee asked for my address
      and received it.

      About two weeks later I received a hand-addressed manila envelope
      (which has been broadcast on CNN) containing a series of glossy
      recruitment brochures touting an "opportunity the brightest students
      cannot afford to miss."

      They had no idea about my academic qualifications when they told me
      about the program -- or at least I didn´t tell them.  My academic
      credentials are, however, quite good with the exception of attendance.

      About a week after I received the brochures I received another e-mail
      from this NSA employee who I was now recognizing as a recruiting
      officer.  He told me that I could "definately get into the program," and
      that I would be able to go to "any college [I] want," suggesting they
      could get me into the colleges.

      Since then he´s e-mailed me almost weekly asking if I´ve applied.  

      This happened to me almost half a year ago now, and I´ve since spoken
      to others who have been the subject of recruiting efforts.  One teenager
      told me "they were very enthusiastic.  Kept telling me how I could get
      paid for going to college... They sounded like the Army."  And well they
      should -- they are part of the Department of Defense.

      The offer is pretty simple, and anyone can apply.  If you plan to study
      computer science, electrical or computer engineering, mathematics or
      language in college, the NSA will allow you to apply.  You must have at
      least a 1200 on your SATs and a 3.0 GPA.  In return for four years of
      college, a salary, room and board, you must work for NSA for five
      years post-graduation.

      Most of the people the NSA is targetting in this recruiting program seem
      to have problems with the idea.  Most, including me, disagree with the
      NSA´s cryptology policies (read: key escrow and export limitations). 
      Likewise, however, the opportunity is certainly an amazing one.

      Related Links: 

                National Security Agency 
                http://www.nsa.gov
                NSA Names Schools 
                http://www.aviary-mag.com/News/Old_News/NSA_Colleges/nsa_colleges.html
                
 
 
      Ender & CNN

                                                  Mike Hudack
                                                Editor-in-Chief

      Mike Hudack, aka Ender Wiggin, editor of OSAll, was profiled on the
      Cable News Network beginning on Monday.  The entire profile will run
      on Saturday on CNN at 1:30pm eastern time.  

      The story focuses on the fact that I´ve been actively recruited by the
      National Security Agency.  To find out more about it you´ll have to
      watch :-)

      A segment of the story originally ran on CNN Headline News on
      Monday, repeating every half hour.  Subsequently it ran on CNN
      World Today at 10pm eastern.  It ran again on CNN´s morning show
      on Tuesday morning.

      The idea behind the story is to make a positive impact on the media and
      public´s understanding of hackers.  It is meant to "break the hacker
      stereotype."  As a CNN anchor said, you "may remember the movie
      War Games.  Now the government is remaking the image of hackers."

      I will be interviewed by FOX News on Wednsday night to air on Labor
      Day Weekend.  The focus of the FOX story will be similiar -- with a
      focus on breaking the hacker stereotype and emphasizing the positive
      side of hackers.  Likewise, I have been in discussions with an NBC
      channel for a similiar story.

      I´ve previously been quoted or pictured in magazines such as US News
      & World Report and PC World on security subjects.  The US News
      article was likewise focused on changing the attitude about hackers.

      Since the CNN story started running I´ve been swamped by hundreds
      of e-mails from everyone from venture capitalists to former NSA
      employees.  All have been very supportive, and I thank them very
      much.

      Related Links: 

           OSAll BBSystem 
           http://www.aviary-mag.com/bbsystem
           
           National Security Agency 
           http://www.nsa.gov
           
           Cable News Network 
           http://www.cnn.com
           
           CNN Transcript of Partial Segment 
           http://cnn.com/TRANSCRIPTS/9908/23/wt.06.html
           
           FOX News Network 
           http://www.foxnews.com
           
           NBC 
           http://www.nbc.com
           
           US News & World Report 
           http://www.usnews.com
           
           PC World Magazine
           http://www.pcworld.com

       Transcript:
       
       World Today

       Teenage Hacker Gets Attention of NSA

       Aired August 23, 1999 - 10:51 p.m. ET 

       THIS IS A RUSH TRANSCRIPT. THIS COPY MAY NOT BE IN ITS
       FINAL FORM AND MAY BE UPDATED. 

       JOIE CHEN, CNN ANCHOR: Perhaps you'll remember the movie "War
       Games," which told the story of a cyberwhiz who was pursued by the
       Pentagon and CIA because of his hacking activities. Now some parallels in
       the life of a real-life teen now being targeted by a key security agency. 

       The details from CNN's Ann Kellan. 

       (BEGIN VIDEOTAPE) 

       ANN KELLAN, CNN CORRESPONDENT (voice-over): He's your
       typical teenager -- hangs out with friends, loves pizza, argues with his
       parents that he really is old enough to drive. So why would the government's
       top-secret national security agency, the NSA, be interested in Mike Hudak?
       This 16-year-old is a computer whiz kid, a hacker. 

       MIKE HUDAK III, COMPUTER HACKER: Most hackers are not
       malicious. They're good people. 

       KELLAN: Mike was 12 when he bought his first computer and immediately,
       and legally, hacked it. 

       HUDAK: One of the first things I did with it is I took it apart and then put it
       back together. And I was praying, you know, and it worked. 

       KELLAN: He even set up his own hacker news Web site. The NSA
       noticed it. 

       HUDAK: They visited my site every day, and I can tell from site logs. So I
       e-mailed them, and they e-mailed me back, telling me about their recruitment
       program. 

       KELLAN: The NSA wouldn't comment on camera, but off-camera says it
       recruits students like Mike and will pay four years college tuition, room and
       board, even pay a salary. In exchange, students work summers and at least
       five years after college for the NSA. 

       HUDAK: Don't use all caps. Turn off caps lock. 

       KELLAN: It's tempting for someone like Mike, who babysits everyday after
       school and during the summer to make a buck. But then he wonders if he
       can work for the NSA when he disagrees with some its policies. 

       HUDAK: I would have to think long and hard before I did it. 

       KELLAN: Not your typical computer hacker stereotype. 

       HUDAK: This made it into the dictionary this year. 

       KELLAN: Mike's parents are proud of his accomplishments, but dad wants
       mike to be a doctor. 

       MIKE HUDAK II, MIKE'S FATHER: I love what he's doing now, but I
       think with his ability he could be a hell of a surgeon. 

       HUDAK: No, I've always -- the sight of blood has always made me weak
       in the knees. 

       KELLAN: Mike, at 16, wants a career where fun and money go hand in
       hand. 

       Ann Kellan, CNN, Fairfield, Connecticut. 

       (END VIDEOTAPE) 

       TO ORDER A VIDEO OF THIS TRANSCRIPT, PLEASE CALL
       800-CNN-NEWS OR USE OUR SECURE ONLINE ORDER FORM
       LOCATED AT www.fdch.com 
       
       -=-
       
       http://cnn.com/TECH/computing/9908/26/t_t/teen.hacker/index.html
       
       Federal agency recruits hacker
       teens

       August 26, 1999
       Web posted at: 11:21 a.m. EDT (1521 GMT)

       FAIRFIELD, Connecticut (CNN) --   What image comes to mind when you
       hear the word hacker?  

       If it's someone evil or malicious,  somebody breaking into computers
       illegally, you're only partly right. 

       For instance, Mike Hudack is your typical teenager. He hangs out with
       friends, loves pizza and argues with his parents that he really is old enough to
       drive. 

       So why would the National Security Agency be interested in him? Because
       this 16-year-old is a computer whiz, a hacker. 

       "Not every hacker, not everyone who calls themselves a hacker, is a bad
       person," Mike says. "Most hackers are not malicious. They are good people." 

       Mike was 12 years old when he bought his first computer. 

       "And I took it home, and I loved it so much," Mike says. "One of the first
       things I did with it is I took it apart and then put it back together." 

       He even set up his own hacker news Web site, offering security advice to
       government agencies. That is how he got the NSA's attention. 

       "They visited my site every day and I e-mailed them, they e-mailed me back,
       telling me about their recruitment program," Mike says. 

       The NSA says it recruits students like Mike and will pay four years of college
       tuition, room and board and even a salary. 

       In exchange, students work summers and at least five years after college for
       the NSA. 

       It's tempting for someone like Mike who baby-sits every day after school and
       during the summer to make a buck. 

       But he wonders if he can work for the NSA, given that he disagrees with
       some its policies. 

       "I would have to think long and hard before I did it," Mike says. 


       @HWA
          
27.0  Distributed.net Fingers Thief 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by Evil Wench 
      On two separate occasions stolen laptops where
      recovered with the help of the distributed.net RC5
      client. The idiotic thieves did not reformat the hard
      drives of the stolen systems like they should have and
      instead started using them on the internet with the
      original software installed. Distributed.net was then able
      to match the original email address from the clients with
      the machines new IP numbers to trace the thieves. 

      Wired 
      http://www.wired.com/news/news/technology/story/21431.html

      Not everyone thinks this is a good thing. Some feel that
      Distributed.net erred by giving out its web logs without
      a warrant. 

      MindSec  
      http://www.mindsec.com/misc/distnet.html
      
      Wired;
      
      Net Address Helps Finger Felons
      by Andy Patrizio 
      
      2:00 p.m.  25.Aug.99.PDT
      Running the RC5 client on your computer is not only a nifty way to win a few thousand dollars, 
      it could also help find your PC if it is stolen. 
      
      The RC5 client is used in a contest where people put their PCs to work in an attempt to break 
      RSA Data Securities' 64-bit encryption. 
      
      
      On two occasions, computers running the RC5 client were stolen, but the crooks were caught because
      they didn't realize that the computers could be traced. 
      
      RSA, a leading developer of data encryption, issued a US$10,000 challenge two years ago to break 
      its 64-bit encryption security. 
      
      There are 18 quintillion key possibilities with 64-bit encryption, and after two years and 197,000
      participants, only 11.8 percent of the keys have been tested. 
      
      RC5 runs during idle CPU cycles. It periodically connects to Distributed.net servers to return
      processed encryption keys and to retrieve new ones.  
      
      When the thieves started to use the computers, RC5 continued to process keys and connect to 
      Distributed.net servers, sending in completed work and fetching new keys. And when the stolen 
      computer communicated with the server, it logged in using the thief's IP address. 
      
      The Distributed.net administrators tracked down the IP address back to the thieves' ISPs, and in turn
      were able to determine who was using that IP address when the keys were sent. 
      
      In separate incidents, in May 1998 in Sweden, and this year at Oregon State University in Corvallis,
      Oregon, police were able to recover the computers, said David McNett, a programmer who runs Distributed.net. 
      
      "We have a joke in the admin channel that Distributed.net is like LoJack for your computer." LoJack is a 
      device placed in cars that allows police to determine their location if the vehicles are stolen. 
      
      "It's certainly an unanticipated side effect of running the client, but a good one." 
      
      
      The other side of the coin
      Mindsec;
      
      Wired News Article http://www.wired.com/news/news/technology/story/21431.html 
      
      Mindsec.com has noted that services like distributed.net, and Seti@home, that let you have a background 
      client running, which will periodically send in your finished blocks, or some data that they are processing,
      as well as the IP you came from, and your email address. It sends the email address you provide to it for 
      statistics and tracking purposes. When that is done, binded to your IP address, it effectively lets them see
      where you are coming from.
      
      Well that is not a problem, that is fine. Except when two things happen, the first would be when 
      distributed.net, without being served a warrant, just gives logs to a regular person, who wants them. It is
      great that the person got their stolen computer back, and the person who stole it was arrested, however it 
      should have gone through legal channels, and they should have been served a warrant. The second, what if they 
      are served a warrant to track someone? Well, there is nothing you can do about that, except to use a fake email
      address, or an account that you never access from anywhere else, and use a proxy server to connect to them. If
      you just use a fake email account, and use it ONLY with distributed.net, you would be OK, since there is no 
      way someone would know what that account is. However if someone found it, poof, you have been tracked.
            
      These are things you should keep in mind, they are important and serious. They are a big part in computer 
      privacy, and Mindsec.com fully support Computer Privacy, and Privacy in general.
      
      When we spoke to the administrative contact at distributed.net, he said that they gave out the logs just to 
      help them out. he also stated "The logs are no different than any web server that logs your IP". I corrected
      him in the fact that web servers do not cross reference to a database of email addresses. I am sure they meant
      no harm, and I hope they will realize that this is bad and never do it again. They were contacted by the people
      who had their computers stolen, and they did the research for them. It is unclear if it was distributed.net who
      spoke to the ISP of the thief, or if it was turned over the the police first. 
      
      Late Addition: Just to clarify to the people who are mailing and saying that they don't see the problem. Go 
      sign up to be on distributed.net. What authentication does it do to find out who you are? None, so how can 
      someone go after the fact and try to say "Well that is me". I am sure I could say "I am Joe Johnson, my laptop
      got stolen, this is my email address, could you give me the logs?". If distributed.net even asked for any kind of
      verification of who they were, besides their email address, and sending email to the same account that the rc5 
      client was using, how is that secure verification? If "Hacker X" wanted to track down "Hacker B", they hack that
      persons account, and if that was already enough to track them, they could find them in almost real time, to their
      IP address, thanks to distributed.net. I like the idea behind distributed computing, most people like the idea. 
      But the way it logs and such are serious, it either needs real verification, via pgp of some sort.. I would say
      they need to just not give out their logs without a warrant, but nobody can trust them after this. 
      

      
      @HWA
      
28.0  Hacktivism Email List 
      ~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by grugnog 
      An email list to discuss news about recent hactivists
      events and analysis about hacktivism and for discussion
      possibly leading to a better understanding of what
      'hacktivism' means (as a word and in a tactical, ethical
      and practical sense). 

      Hacktivism list
      http://www.tao.ca/~grugnog/hacktivism/
                
      @HWA
      
29.0  Mitnick in Car Accident 
      ~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/ 


      contributed by maverick212 
      While being transported from the San Bernardino Jail to
      the Los Angeles Metropolitan Detention Center the
      vehicle Kevin Mitnick was riding in was involved in a
      multi car pile up. The accident occurred on Highway 60
      between 8:30 and 9 a.m.. Kevin was thrown against a
      metal divider within the vehicle and suffered minor head
      and neck injuries. Although Kevin and the other
      prisoners were shackled in chains no seat bealts were
      used. After the accident Kevin was transported back to
      the San Bernardino Jail. 

      FREE KEVIN
      http://www.freekevin.com/
      
      Wired                  
      http://www.wired.com/news/news/politics/story/21455.html
      
      Mitnick Hurt in Car Crash
      by Douglas Thomas 
      
      4:30 p.m.  26.Aug.99.PDT
      LOS ANGELES -- Convicted hacker Kevin Mitnick sustained minor head and neck injuries Wednesday morning in a multi-car accident while he was
      being transferred to a facility that satisfied his dietary requirements. 
      
      Mitnick, being transferred in anticipation of a court ruling which would order Mitnick moved to a facility that served kosher meals, was thrown
      against a metal divider. 
      
      
                                                     See also: Life Not Kosher for Mitnick 
      
      
      Mitnick and an unknown number of other inmates -- shackled in chains but with no safety restraining devices -- were being transported from the
      San Bernardino Jail to the Los Angeles Metropolitan Detention Center. The crash occurred on Highway 60 between 8:30 and 9 a.m. 
      
      "I really slammed my head when I hit the metal divider," Mitnick said in a telephone interview on Thursday. 
      
      X-rays proved negative, although Mitnick continues to complain of headaches, nausea, and shoulder and neck pain. 
      
      Insult soon added to his injuries: After spending several hours waiting to be admitted to the MDC, Mitnick was transferred back to the San
      Bernardino facility, which does not serve kosher food. 
      
      Mitnick wound up spending most of Wednesday night waiting on the floor of a holding cell to be readmitted. He was finally booked into the facility
      at 3:30 a.m. Thursday. 
      
      Mitnick said he has yet to be seen by a San Bernardino facility nurse, and has had no access to any painkiller, including Tylenol. "I don't think they
      have any idea what happened," Mitnick said, referring to the lack of medical attention. 
      
      Although unwilling to comment on legal action regarding the accident, Mitnick's attorneys did say that they immediately sent a letter to the U.S.
      Marshals Service requesting that Mitnick be moved to a federal facility. They say a federal facility could provide him access to kosher food and to
      medical treatments in keeping with federal guidelines. 
      
      U.S. Marshals were unavailable for comment. 
      
      "This has definitely been one of the worst days in custody," Mitnick said. 
      
      (If that was his worst day he's been doing alright, noone has made him their girlfriend yet ... - Ed)
      
      @HWA
                
                
30.0  Hong Kong Police Create Computer Crime Squad 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by Code Kid 
      The Hong Police have announced plans to form the
      Computer Crime Investigation Cadre to help tackle
      computer crime at district levels. Members of the squad
      will be selected from officer training course being run by
      the Commercial Crime Bureau. 

      South China Morning Post            
      http://www.technologypost.com/enterprise/Daily/19990826112510135.asp?Section=Main
      
      Published on Thursday, August 26, 1999

      ENTERPRISE 

        HK police to establish
        computer crime team 

      NEWSBYTES 

      The Hong Kong police yesterday announced plans to
      form a special team of officers with expert knowledge in
      the area of computer crime to help battle criminals that
      are increasingly turning to electronic means to commit
      crimes. 

      The new squad will consist of an unspecified number of
      officers who will be called in to help colleagues when
      criminals employ sophisticated computer techniques in
      committing their crimes.

      "The surge in computer use, the increase of related
      criminal cases and other emerging issues in various
      regions over the past year have resulted in a challenge
      which the 17 members of the section now find it difficult
      to cope with, without resorting to help from their Force
      colleagues," explained Commercial Crime Bureau Chief
      Superintendent, Victor Lo Yik-kee.

      "That is what Cadre members will be for," added Mr
      Lo. "Once qualified and recognised, they can help
      provide support services to their own formations in
      handling cases of computer-related crimes while officers
      of the Section can continue to play the role of a
      co-ordinator and provide assistance when needed."

      The first members of the squad are expected to be
      recruited by September. The Commercial Crime Bureau
      is already running a training course for officers from
      across the course, said the force, and this course is
      being used to select members of the new Computer
      Crime Investigation Cadre which will help tackle
      computer crime at District levels.

      The training course follows a similar two day meeting at
      the Police Training School in July when over 180
      officers of different ranks and members of the
      Immigration Department and the Customs and Excise
      Department attended seminars on computer crime and
      undertook a written test to judge their knowledge of the
      subject. 

      Copyright (c) Post-Newsweek Business Information, Inc.
      All rights reserved.    
      
      @HWA

                
31.0  Outlook Holes Demonstrated at USENIX 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by Weld Pond 
      Richard Smith, president of Phar Lap Software, recently
      gave a presentation at the 8th Usenix Security
      Symposium detailing over a dozen major holes in
      Windows Outlook. Some holes would give infocriminals
      complete access to your desktop computer. 

      Wired
      http://www.wired.com/news/print_version/business/story/21442.html?wnpg=all
      
      Locking Windows' Backdoors
      by Declan McCullagh 
      
      3:00 a.m.  26.Aug.99.PDT
      WASHINGTON, DC -- If you use Microsoft Outlook, be warned. Over a dozen bugs in Windows 98 let malicious virus writers and meddlesome peeping
      Toms view or erase any file on your hard drive. 
      
      At a computer security conference Wednesday afternoon, an expert demonstrated how malcontents can send apparently innocuous email with
      hidden commands that -- if opened using certain email programs -- will give an intruder complete access to a Windows computer. 
      
      
                                                    See also: Same Hole, Different Exploit 
      
      
      "We've got some serious problems here, folks. We've got some really bad backdoors on the computers we have on our desktops," said Richard
      Smith, president of Cambridge, Massachusetts-based Phar Lap Software, who identified the person accused of writing the Melissa virus. 
      
      During his presentation at the 8th Usenix Security Symposium, Smith demonstrated some new security flaws he and his collaborators have identified
      in their spare time. One recently unearthed and not-yet-fixed Win98 glitch lets an email opened in Outlook execute any DOS command -- including
      reformatting your hard drive or uploading its contents to a remote Web site. 
      
      The solution? Consumers could switch to a non-Microsoft operating system. Another option, Smith suggested, is for customers to begin asking
      computer companies to turn off features that let email messages execute other programs. 
      
      "It's prudent to avoid systems in which we can have executable content," said Peter Neumann, the conference's keynote speaker and a researcher
      at SRI International. "There is no way you can have any assurance whatsoever that it will work." 
      
      Many of the problems security experts have identified stem from the design choices Microsoft made when developing Windows 95 and 98, which are
      much more vulnerable to intrusions than Linux, Unix, or even Macintosh systems. 
      
      One gaping security hole is Microsoft's complicated ActiveX technology, which lets remote Web pages or email messages execute programs that
      manufacturers claim are trustworthy. But sometimes they're not. With a little programming, a nefarious person can send email or create a Web page
      that activates Active X functions that delete files, modify them, or even send their contents to any address on the Internet. 
      
      As security experts have identified these flaws, Microsoft has tried to fix them, and Smith said some have been eliminated from early versions of
      Windows 2000. But the millions of people using current versions of Windows 98 and Outlook are still at risk, he said, unless they switch off ActiveX. 
      
      Not only Microsoft is to blame. Netscape has acknowledged security glitches in its browser. Unrepaired versions of Qualcomm's Eudora 4 let
      executable programs masquerade as links. 
      
      Computer makers, too, have been shipping buggy software. Hewlett Packard has included two ActiveX controls on about 5 million Pavilion
      computers, Smith said, that let HTML email messages opened in Outlook or Eudora take control of the computer. An intruder can silently insert a
      virus, disable security features, view documents, or crash the system. 
      
      Some Compaq Presario computers suffer from a similar security risk. As configured from the factory, the computers trust all applications provided by
      Compaq -- one of which can execute whatever program an email message orders it to run. 
      
      "Compaq gave every hacker in the world a way to run programs," Smith said. 
      
      To improve the security of Outlook, go to the Security tab in the program's Options dialog box and select "restricted sites zone." Then, in the
      Internet Options Windows control panel, go to "Restricted sites/Custom level" and scroll down and disable "Active Scripting." 
      
      @HWA
      
32.0  Feds Overflowing with Siezed Equipment 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 
      
      contributed by netmask 
      Hundreds of computer systems are piling up and cases
      are going untried because the FBI lacks the resources
      to examine confiscated equipment. Under federal law
      investigators may keep property seized as possible
      evidence until the statute of limitation for the given
      crime expires, generally five years for computer crime
      cases. 

      New York Times- Registration Required      
      http://www.nytimes.com/library/tech/99/08/cyber/cyberlaw/27law.html
      
      Investigators Face a Glut of Confiscated
      Computers 

      By MATT RICHTEL 

             hen the FBI raided the family home of Paul Maidman, 18, in late
             May, they seized his computer as possible evidence of online
      criminal activity and took it to a high-tech forensics lab in Dallas. The
      Waldwick, N.J., teenager, who has yet to be arrested or charged with a
      crime, is concerned that it could take a long time to learn his fate -- and
      that of his computer. 

                                 The FBI and prosecutors on cases
                                 like Maidman's say he could be
                                 waiting a while. Maidman is one of
                                 hundreds of people whose computers
                                 are in federal and state custody. Law
                                 enforcement officials say they lack the
                                 time, resources and sometimes
                                 expertise to examine all of the PCs
                                 that are piling up. 

      For example, at the headquarters of a federal cybercrime task force in
      Dallas, more than 100 hard drives await examination, but only three
      forensics experts are available to look at them, said Paul E. Coggins, the
      United States Attorney in Dallas. The computers were seized in cases
      involving a range of alleged crimes, including fraud, embezzlement, child
      pornography and computer break-ins. 

      "We've had hackers who are ready to plead guilty, but we're slowed
      down because we lack the resources" to scour through the evidence,
      Coggins said, adding that few forensics agents have been trained to find
      and understand incriminating data on hard drives. "It's hard to find people
      to begin with who not only have the interest but the competence," he
      said. 

      It is unclear how widespread this problem is among state and federal
      agencies. But Coggins said that numerous agencies, both state and
      federal, seek the advice and assistance of the three forensics investigators
      in Dallas, suggesting there is insufficient expertise in many jurisdictions. 

      "We are desperate for resources to process these cases," said Matthew
      E. Yarbrough, an assistant United States Attorney based in Dallas who is
      one of 25 federal prosecutors assigned by Congress to pursue
      cybercrime cases full-time. 

      Supporters of hackers and the hacker ethos, which champions
      non-malicious computer tinkering, say the situation is worrisome. They
      fear that computer users who are innocent, or who may never be charged
      with a crime, may be deprived of thousands of dollars worth of
      equipment far longer than necessary. 

      As evidence, they point to a recent study by a
      senior fellow at the Electronic Privacy
      Information Center which found the prosecution
      rate for computer crime to be lower than that
      for other types of crime. That suggests to critics
      that investigators are unfairly targeting innocent
      people. Federal law enforcement officials counter that, in part because of
      the complexity of evidence gathering, the computer crimes are
      complicated to prosecute. 

      When it comes to holding confiscated property, the investigators have the
      law on their side. Under federal law, they may keep property seized as
      possible evidence until the statute of limitation for the given crime expires
      -- with non-capital offenses, generally five years after the crime is
      committed. Defense lawyers concede it is not unusual for law
      enforcement to keep property as possible evidence in an ongoing
      investigation for several years. 

      "It's not abnormal, but it is a big deal for the innocent person whose
      expensive equipment is taken from them," said Jennifer S. Granick, a San
      Francisco lawyer who represents hackers. 

      "Whether the seizure of the property is justified, we can't know now," she
      said. "But in time, when the affidavits are unsealed, then we'll know
      whether there was good cause or sound reason to deprive these people,
      or whether the seizures are part of anti-hacker hysteria." 

      The issue dates back to a debate in 1990 over a government
      investigation called "Operation Sun Devil," targeting members of the
      Legion of Doom, a hacker group. As part of the investigation, agents
      confiscated computers at Steve Jackson Games, a small company in
      Austin, Tex., in search of a rule book for a game. Investigators thought
      the book might be a how-to guide for computer criminals. 

      Without his computers, Jackson was nearly forced out of business. He
      took the Secret Service to court and won on two of three counts, forcing
      the Secret Service to pay more than $300,000 in damages and legal fees.

      Today, federal investigators say they make an effort to return computers
      to a business whose equipment may have been used by an employee
      without its knowledge, or machines that are needed to keep a legitimate
      business in operation. One way investigators accomplish this is by taking
      a snapshot of the hard drive, copying all of the data and then returning the
      original to its owner. 

      But Yarbrough, the assistant United States Attorney, said returning
      personal computers to people suspected of wrongdoing is another
      matter. He said their computers may be instruments used in a crime, and
      would not be returned any more than a gun would in a similar situation. 

      Yarbrough said that it is not a valid use of limited government resources
      to spend time copying the hard drives of a suspect's computer just to be
      able to return it to them. "We don't give the gun back to a bad guy, and
      we don't give the computer back to a bad guy," he said. 

      But Ms. Granick disagreed, arguing that while it is necessary to hold a
      gun as evidence, hard drives are different. "You can't copy the gun and
      have it be good evidence in court. You need to have the actual gun," she
      said. 

      Hackers and others are allowed under federal law to
      petition the government to return their property. But
      some say they worry that if they do so, they risk
      irritating investigators and making things harder on
      themselves. "I don't want to make any problems," said
      Maidman, the 18-year-old from New Jersey. "I'd
      really like my stuff back, but I don't want to upset
      them." 

      Maidman's home was raided in June during a broad sweep by federal
      agents against computer criminals and phone "phreakers" -- people who
      hijack time and resources from phone companies. At the time, Coggins's
      office issued 16 warrants in 12 jurisdictions; the FBI said at the time that
      the investigation targeted the theft of passwords and credit cards, among
      other possible charges. 

      Coggins said the investigation is ongoing. But he said the government also
      has to set priorities, and that with limited resources, the hacking cases
      sometimes take a back seat to economic espionage or other major
      crimes that require high-tech forensics research. 

      The federal government is not alone in its frustration. State governments
      say they too are toiling under limited resources and expertise in dealing
      with computer-based evidence. Kevin Higgins, chief Deputy Attorney
      General for the state of Nevada, said that the spread of computers
      among more ordinary criminals is making matters worse; even
      methamphetamine dealers carry electronic organizers with the names of
      their associates, he said. 

      "These days there's a debate over whether even to seize computers," he
      said. "You've pretty much got to have a room just to store them in." 

      Carl S. Kaplan is on vacation. 

      @HWA

          
33.0  Computer Hacker’s Sentence Spotlights High-Tech Crime Prosecutions
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      http://www.epic.org/staff/banisar/hacker.html

      Computer Hacker’s Sentence Spotlights High-Tech Crime Prosecutions
      
      By David Banisar, Contributing Editor
      Criminal Justice Weekly,
      
      Notorious computer hacker Kevin Mitnick, once described as "Cyberspace’s Most Wanted," is scheduled to be sentenced this month in U.S. District Court (C.D.
      Cal) to 46 months in prison after pleading guilty to computer fraud and abuse in April 1999 for breaking into dozens of computers around the United States. The
      sentencing will end a five-year, highly publicized chase and prosecution of the best-known hacker in the country. It raises many questions about the ability of law
      enforcement to handle cases involving new technologies and the prosecutions of those accused of computer crimes.
      
      Cyberspace’s Most Wanted?
      
      The case has been the subject of worldwide media attention, which Mitnick’s supporters say has blown his exploits out of proportion. The New York Times led the
      coverage, describing him in a 1994 front-page story as "Cyberspace’s Most Wanted." The Times stories increased interest in the case, and Mitnick was tracked
      down and arrested in North Carolina in 1995. He was charged with 25 counts of computer fraud, wire fraud, and wiretapping, but none of these alleged crimes
      were mentioned in the Times series. In previous prosecutions, Mitnick’s relationship with computers has been described by mental health experts as "obsessive." In
      the current federal prosecution and a pending state case in California, he has not been accused of using computers for personal gain.
      
      Prosecutors apparently decided to use his case as a warning to others. Since his arrest, he has been held without bail and repeated requests for a bail reduction
      hearing have been denied. Prosecutors refused to give him access to a computer with the eight gigabytes of evidence they planned to use against him, claiming that he
      could use it to break into more systems, even without a phone line and modem. He was once put into solitary confinement when prosecutors claimed that he was
      converting an AM/FM radio into a transmitter.
      
      Mitnick pleaded guilty to five felony charges following over four years of pretrial detention. He is now eligible for release to a halfway house, having already served
      most of his time. The probation office has recommended that unsupervised use of computers, modems, or cellular phones be prohibited as a condition of supervised
      release.
      
      Mitnick still faces a California state charge of computer fraud for telephoning the California DMV in 1992 to persuade an employee there to fax him the driver’s
      license information of a suspected informant. According to Carolyn Hagin, an attorney at the law offices of famed hippie lawyer Tony Serra, the attorney who is
      representing Mitnick in state court, an attempt to lower bail from $1 million was denied by a Los Angeles Superior Court judge on July 9, who admitted that media
      portrayals of Mitnick convinced him to deny bail. Meanwhile, John Markoff, the New York Times reporter whose gripping front-page stories made Mitnick a
      celebrity, landed a book contract one week after Mitnick’s capture worth a reported $750,000. Takedown, a movie starring Tom Berringer, is scheduled to be
      released later this year.
      
      The Long Arm of the Law
      
      The primary federal statute regarding computer crime is the Computer Fraud and Abuse Act (18 USC § 1030). The Act, originally adopted in 1984 and
      substantially amended in 1986 and 1990, prohibits the unauthorized access or exceeding of the user’s permitted access to computers run by government agencies,
      financial institutions, or computers used in interstate or foreign commerce, such as those connected to the Internet. It also prohibits releasing viruses or other
      programs that can secretly access computers and cause damage.
      
      The penalties for a first offense range from one year for accessing computers without intending to cause damage and without financial gain, to five years for
      intentionally damaging computers or stealing information for material gain. A maximum of ten years can be imposed for using the access to obtain information
      protected "for reasons of national defense or foreign relations."
      
      There are several other statutes included in the U.S. Department of Justice Computer Crime Program category: those involving trafficking in access devices such as
      passwords, cell phone cloning devices, or credit card numbers (18 U.S.C. § 1029), and mail and wire fraud (18 U.S.C. § 1343). Every state also has its own
      computer statute.
      
      Referrals Increasing, Most Cases Rejected
      
      Federal agency referrals for prosecution of computer crimes have increased substantially over the past several years, but actual prosecutions are fairly rare.
      According to U.S. Justice Department data obtained under the Freedom of Information Act by the Transactional Records Access Clearinghouse (TRAC) of
      Syracuse University, the DOJ prosecuted 83 cases out of 417 referred in 1998 under the Computer Fraud program category.
      
      Referrals have more than tripled since 1992 and 1993. Each year between 1992 and 1998, the DOJ has declined to prosecute between 64 and 78 percent of these
      cases. Forty percent of the cases were declined because of lack of evidence of criminal intent, weak or insufficient admissible evidence, or no apparent violation of
      federal law.
      
      In 1998, 47 persons were convicted of computer crimes and 10 were found not guilty. Twenty were sentenced to prison. That year, the average sentence for those
      convicted was five months, and over half received no jail time. Since 1992, 196 persons have been convicted and 84 persons have been sentenced to prison for
      computer crimes.
      
      Average sentences imposed for federal computer fraud and abuse violations have ranged from four to 18 months. In most years, over half of those convicted served
      actual time behind bars. The longest sentence was against profit-oriented hacker Kevin Poulsen, who was sentenced in 1995 to 71 months for manipulating the
      phone system to win radio contests. Like Mitnick, he was held without bail for five years. In his case, the prosecution initially charged him with obtaining classified
      information as a justification for denying bail and then dropped the charge before trial.
      
      Currently, there is no federal sentencing guideline specifically applicable to the Computer Fraud and Abuse Act (18 U.S.C. §§ 1029-1030). In 1993, the U.S.
      Sentencing Commission’s Computer Fraud Working Group examined the application of existing federal sentencing guidelines as applied to the statute. The working
      group found that for most cases, the fraud guideline, Section 2F1.1, adequately addressed most offenses. It recommended against creating a new guideline for
      computer fraud because of the difficulty in measuring harm, the possibility of charging decisions that could lead to the same actions being prosecuted differently, and
      the lack of empirical support (case law) for creating a separate guideline. The working group is presently drafting guidelines on losses for software piracy as required
      by Congress under the No Electronic Theft (NET) Act (PL 105-147, 1997).
      
      The FBI claims that there were nearly $400 million in losses between 1996 and 1998 due to computer fraud, but these numbers are difficult to verify. Mark Rasch, a
      former federal prosecutor and now senior vice-president of Global Integrity Corp., a Virginia computer security consulting firm, notes that the issue of damages in
      these types of cases "drives the sentencing guidelines" and are "tremendously fact specific."
      
      In many cases, the numbers appear to be grossly inflated. In 1990, the federal government brought a case against Craig Neidorf, the publisher of Phrack magazine,
      an underground online newsletter, for publishing the "source code" to BellSouth’s emergency 911 system. Prosecutors claimed that with the code, which they valued
      at $57,000, hackers could shutdown the 911 system in the United States. Three days into the trial, Neidorf’s attorneys showed that the document was actually a
      memo on procedures available for sale from BellSouth’s own catalog for $13, and the case was dropped. BellSouth had included in its figures the cost of the
      workstation used to write the memo and the salary of the author.
      
      In Mitnick’s case, the companies whose computers he broke into, including Sun Microsystems and Nokia, claim that he caused nearly $300 million in damages by
      accessing their systems and stealing software. Several of the companies listed the entire cost for developing the software, rather than actual losses. Recently, Sun
      Microsystems, which claimed Mitnick stole source code worth $80 million, recently began selling the same code to students and software developers for $100. Phil
      Karn, a senior engineer at Qualcomm Inc., a San Diego-based cellular phone manufacturer, whose offices were broken into by Mitnick, told the Los Angeles Times
      that "the real damage was loss of productivity and hassles . . . I don’t want to condone what Mitnick did, but he’s really not public enemy No. 1." Assistant U.S.
      Attorney David Schindler is demanding Mitnick pay $1.5 million in restitution. His sentencing hearing has been put off several times while this issue is being
      negotiated, but supporters say that without access to computers, Mitnick is unlikely to ever be able to earn enough money to pay restitution, no matter what the
      amount.
      
      A Cyberspace War or a New Red Scare?
      
      While Mitnick cooled his heels awaiting trial, a new public fear of computers, and the potential impact of computer hackers on individual lives and national security
      has emerged. In 1998, President Clinton signed Executive Order PDD 63, Critical Infrastructure Protection. Following the Executive Order, a number of
      government agencies including the FBI, DOJ, and the National Security Agency (NSA), pressed for limits on security programs that include encryption, which can
      protect communications from interception, and new powers to access telecommunications providers, such as telephone companies to protect them from
      cyberattacks.
      
      The New York Times reported on July 28 that the National Security Council has proposed a Federal Intrusion Detection Network (Fidnet) that would monitor
      traffic on the Internet to look for patterns of computer intrusions. Data on the traffic would be stored at the National Infrastructure Protection Center, an interagency
      task force run by the FBI.
      
      Thomas Guidoboni of Michaels, Wishmer and Bonner, Washington, D.C., who has represented several persons accused of computer crimes, says there is a
      paranoia about hackers. "Everyone is frightened of what they can do. . . . It scares people to think their computers can be broken into."
      
      The NSC proposal, which could have profound privacy and civil liberties implications, has been criticized both inside and outside the government and is unlikely to
      be adopted. But the combination of the growth of the Internet, fear, and bureaucratic demands for more power to protect systems ensure that there will be more
      prosecutions in the coming years.
      
      David Banisar is a Washington, DC, area attorney specializing in computer and communications law. He is the co-author of The Electronic Privacy
      Papers (John Wiley and Sons, 1997) and a Senior Fellow at the Electronic Privacy Information Center. He is a contributing editor to Criminal Justice
      Weekly.
      
       
      
      Editor’s note:
      
      Since the publication of this article, Mitnick was sentenced to 46 months in jail and ordered to pay $4,100 in restitution. The pending case against him in the state of
      California was also dropped.

      @HWA
      
34.0  Triads Linked to Info Vandalism - Alleged CoverUp by RCMP 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/ 

      contributed by Hex_Edit 
      Classified documents from the Royal Canadian Mounted
      Police allege that Chinese nationals with links the Triads,
      (Chinese Mafia) have broken into the computer system
      at Canadian High Commission in Hong Kong. The
      Computer Assisted Immigration Processing System is
      supposed to have had over 788 files deleted. The
      intrusions may have taken place as long as seven years
      ago. It is believed that the RCMP is covering up the
      events. 

      National Post
      http://www.nationalpost.com/home.asp?f=990826/63514
      
      Vancouver Province      
      http://www.vancouverprovince.com/newsite/news/990826/2775271.html
      
      National Post;
      
      Triads linked to hacking at
      Canadian mission
      Files deleted, blank visa forms missing in
      Hong Kong

      Fabian Dawson
      The Province 

      VANCOUVER - Chinese nationals linked to organized crime
      have broken into the immigration computer at the Canadian High
      Commission in Hong Kong, classified documents allege. 

      At least 788 files from the Computer Assisted Immigration
      Processing System (CAIPS) were deleted, and up to 2,000 blank
      visa forms have disappeared, according to the documents. 

      The core allegation is that certain people paid locally engaged high
      commission staff to delete their backgrounds in the computer
      system to hide their links with Triads -- the Chinese Mafia. 

      A related concern is that the stolen visa forms have been used by
      possibly hundreds of people, including criminals, to enter Canada
      illegally. 

      For seven years, the RCMP, Immigration Canada and the
      Department of External Affairs are alleged to have kept a lid on
      the case, which several sources call a ''breach of national
      security.'' 

      Two key figures in the investigation suspect the RCMP is covering
      up criminal acts and negligence at Canada's immigration office in
      Hong Kong. 

      Details of the case are contained in reports filed by Robert Read,
      an RCMP corporal in Ottawa, and Brian McAdam, a former
      immigration control officer at the high commission in Hong Kong. 

      ''I believe there has been a massive conspiracy to cover up the
      whole issue,'' Cpl. Read said. In a report marked ''Top Secret,''
      he wrote: ''The loss of control of CAIPS ... loss of control over
      immigration from Hong Kong ... from 1986 to 1992 is a most
      serious breach of national security." 

      Cpl. Read, who has written orders from his boss, Inspector Jean
      Dube, not to talk to the media, said: ''I am going public because
      there needs to be a public inquiry into this whole thing.'' 

      Officials would not confirm or deny the existence of an
      investigation. 

      In fact, the investigation began in 1992, when the Department of
      External Affairs sent to Hong Kong an electronic data processing
      officer, David Balser, and RCMP Sergeant John Conohan. 

      According to Cpl. Read and Mr. McAdam, the two carried out a
      cursory investigation. Neither Mr. Balser nor Mr. Conohan
      recommended further investigations or criminal charges, despite
      Mr. McAdam's reports, which indicated security breaches by
      locally employed staff and the discovery of fake Canada
      Immigration stamps in one of their desks. 

      Mr. Conohan was also told about local staff who had given
      themselves unauthorized, top-level security clearance to access
      the computer, according to one of Cpl. Read's reports. 

      Mr. Conohan reported that the suspect in whose desk the fake
      stamps were found had fled to Taiwan, despite being given
      information that she was living in B.C., some of the reports allege. 

      Documents also show that a second suspect, who operated the
      CAIPS computer, fled her job in September, 1993, because of
      gambling debts owed to Triads. 

      Mr. Balser's report is described by investigators familiar with the
      allegations as ''unintelligible bureaucratese.'' 

      He makes no express mention of the deleted files, fake stamps or
      missing blank visas, which were included in Mr. McAdam's
      reports. 

      Mr. Balser does talk about the potential for security breaches and
      recommends that locally engaged staff not be given high security
      clearance. He hints that someone could misuse blank visas, which
      were left lying in open cardboard boxes, but does not report
      allegations that at least 2,000 blank immigrant visas were found to
      be missing. 

      Mr. Read alleges that Mr. Balser has told him on the record that
      he was ordered to ''obfuscate'' his report. Mr. Balser is now
      retired and could not be reached for comment. 

      Unable to get any answers to his concerns, Mr. McAdam
      continued with his complaints and a series of RCMP investigators
      were given the case and then abruptly transferred. 

      The Canadian Security Intelligence Service, was also brought in to
      investigate Chinese espionage and together with the RCMP
      launched Operation Sidewinder in 1995. 

      That operation, which was to look at the influence of Chinese
      officials and tycoons at the Hong Kong mission, was also halted. 

      The investigation into the penetration of CAIPS is now being
      conducted by Sergeant Sergio Pasin of the immigration and
      passport section of the RCMP. 

      ''If the RCMP does not tell the government that a disaster has
      occurred, the government cannot decide how to react to it, cannot
      decide when to tell the people of Canada what has occurred,''
      said Cpl.
      
      -=-
      
      Vancouver Province;
      
      'A breach of national
      security'
      Files at Canada's diplomatic mission in Hong Kong were
      infiltrated Fabian Dawson, Staff Reporter The Province 
      Chinese nationals linked to organized crime have broken into the
      immigration computer at Canada's diplomatic mission in Hong Kong,
      classified documents obtained by The Province allege. 

      At least 788 files from the Computer-Assisted Immigration Processing
      System (CAIPS) were deleted, and up to 2,000 blank visa forms have
      disappeared, according to the documents. 

      The core allegations are: 

      - That certain people paid locally engaged staff of the Canadian
      commission (now the consulate-general) to delete their backgrounds in the
      computer system to hide their links with triads -- the Chinese Mafia. 

      - That the visa forms have been used by possibly hundreds of people,
      including criminals, to enter Canada illegally. 

      For seven years, the RCMP, Immigration Canada and the department of
      external affairs are alleged to have kept a lid on the case, unwilling to
      reveal the extent of what several sources call a "breach of national
      security." 

      Two key figures in the investigation suspect the RCMP is covering up
      criminal acts and negligence at Canada's immigration office in Hong Kong. 

      Details of the case are contained in reports filed by Robert Read, an
      RCMP corporal in Ottawa, and Brian McAdam, a former immigration
      control officer at the Canadian commission in Hong Kong. 

      "I believe there has been a massive conspiracy to cover up the whole
      issue," Read said. 

      In a report marked Top Secret, he wrote: "The loss of control of CAIPS .
      . . loss of control over immigration from Hong Kong . . . from 1986 to
      1992 is a most serious breach of national security." 

      Read, who has written orders from his boss, Insp. Jean Dube, not to talk
      to the media, told The Province: "I am going public because there needs to
      be a public inquiry into this whole thing." 

      Official spokesmen would not confirm or deny the existence of an
      investigation. 

      In fact, the investigation began in 1992, when the department of external
      affairs sent to Hong Kong an electronic data processing officer, David
      Balser, and RCMP Sgt. John Conohan. 

      Read and McAdam say the two men carried out a cursory investigation.
      Despite evidence indicating security breaches by locally employed staff and
      the discovery of fake Immigration Canada stamps in one of their desks,
      neither recommended further investigations. 

      Conohan was also told about local staff who had given themselves
      unauthorized, top-level security clearance to access the computer,
      according to one of Read's reports. 

      The sergeant reported that the suspect in whose desk the fake stamps
      were found had fled to Taiwan, despite having been given information that
      she was living in B.C., some of the reports allege. 

      Documents also show that a second suspect, a woman who operated the
      CAIPS computer, fled her job in September 1993 because of gambling
      debts owed to triads. 

      Balser's report, a copy of which The Province has obtained, is described
      by sources familiar with the allegations as "unintelligible bureaucratese." 

      He makes no express mention of the deleted files, fake stamps, missing
      blank visas or the disappearing local staff. 

      Balser does talk about the potential for security breaches and recommends
      that locally engaged staff not be given high security clearance. 

      And he hints that someone could misuse blank visas, which were left lying
      in open cardboard boxes, but does not report allegations that at least
      2,000 blank immigrant visas were found to be missing. 

      Read, a Mountie for 24 years, alleged that Balser has told him on the
      record that he (Balser) was ordered to "obfuscate" his report. Balser is
      now retired. 

      Unable to get any answers to his concerns, McAdam continued with his
      complaints. A series of RCMP investigators were given the case and then
      abruptly transferred. 

      The Canadian Security and Intelligence Service, Canada's spy agency, was
      brought in to investigate Chinese espionage. Together with the RCMP,
      CSIS launched Operation Sidewinder in 1995. That operation, which was
      to look at the influence of Chinese officials and tycoons at the Hong Kong
      mission, was also abruptly halted. 

      The investigation into the penetration of CAIPS is now being conducted by
      Sgt. Sergio Pasin of the immigration and passport section of the RCMP in
      Ottawa. 

      "There is enough evidence in this case and in my other reports to initiate a
      public inquiry . . . but for some reason nobody wants to do anything," said
      McAdam. 

      "If the RCMP does not tell the government that a disaster has occurred,"
      said Read, "the government cannot decide how to react to it, cannot
      decide when to tell the people of Canada what has occurred. 

      "They have Balser's report, McAdam's testimony, the missing files in Hong
      Kong . . . and my report. 

      "Why won't they do anything?"


      
      
      @HWA
      
      
35.0  DoD Preps to Fight InfoCriminals Both Foreign and Domestic 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/ 
      
      contributed by mmuliin3 
      The Joint Task Force on Computer Network Defense
      came to full strength in June and is in now ready
      monitor the nations defense networks for cyber attack
      regardless of where that attack may originate from. The
      JTF-CND works out of Global Network Operations and
      Security Center at Defense Information Systems Agency
      headquarters in Arlington, Va. and is under the control
      of Space Command. (Interesting quote in this article
      "We don't get real worried about Web page hacks," said
      Army Col. Larry Frank, chief of operations. "That's an
      appearance issue." - Somehow I don't think he gets it. 

      Government Computer News      
      http://www.gcn.com/vol18_no27/news/440-1.html

                                         August 23, 1999

                   DOD set to fight hackers both foreign and domestic

      Task force monitors network to give department another layer of protection against cyberterrorism

      By William Jackson
      GCN Staff

      When the Defense Department’s Joint Task Force on Computer Network Defense opened for business last
      December, it found plenty to do.

      “We have been at cyberwar for the last half-year,’’ deputy Defense secretary John Hamre said. “At least we had
      a place to work on it.’’

      Hamre spoke at ceremonies this month to mark the task force’s coming to full strength in June. Since then, an
      interservice staff—supported by the DOD Computer Emergency Response Team, an intelligence cell and law
      enforcement liaisons—has been monitoring the Defense Information Infrastructure around the clock. The task
      force works out of the Global Network Operations and Security Center at Defense Information Systems Agency
      headquarters in Arlington, Va.

      So far, none of the cyberthreats has proved serious. But Hamre said DOD’s primary mission is to prepare for the
      next battle, “buying the infrastructure in advance that we know we are going to need at some time.’’

      Hamre has testified to Congress about the threat of what he called an electronic Pearl Harbor—an attack on the
      nation’s information infrastructure. He said he was referring not to a devastating surprise attack but rather to
      military preparedness.

      “It wasn’t that we got hit, but that we were ready to respond,’’ Hamre said.

                                 Warning signs

                                 Until recently, DOD has not been ready to respond to a full-scale electronic
                                 attack. Air Force Maj. Gen. John Campbell, DISA vice director and task
                                 force commander, said the network defense unit grew out of the Eligible
                                 Receiver 97 exercise in 1997, in which National Security Agency teams
                                 waltzed into DOD systems using off-the-Internet hacking tools.

                                 No one was then in charge of defending DOD networks, and it showed,
                                 Campbell said. Awareness was reinforced by the monthlong Solar Sunrise
                                 assault on DOD systems by a pair of teen-agers last year.

                                 Today, “we are really serious about protecting our networks and our
      systems,’’ Campbell said.

      Although the task force is physically at DISA headquarters, organizationally it is part of the Space Command,
      reporting to the commander-in-chief at Peterson Air Force Base, Colo. The task force uses DISA’s global
      network management capability to monitor and analyze problems on DOD systems and coordinate responses.

      “We don’t fix the computers; we look at the operational side,’’ said Army Col. Larry Frank, chief of operations.
      “The other thing we bring to the table is command authority.’’ DISA has no authority over any of the services.

      The task force this spring encountered the Melissa computer virus, which spread rapidly by e-mail and
      threatened to swamp some DOD systems. The virus struck on a Friday, giving a two-day weekend buffer. The
      Defense CERT responded with a patch to block the virus within 12 hours.

      “We were lucky it wasn’t very damaging,’’ Frank said.

      The task force was aware of hacks against DOD Web sites during the air
      war in Kosovo, but they were not operationally significant, Frank said,
      because DOD does not rely on the Web to carry out its missions.

      “We don’t get real worried about Web page hacks,’’ he said. “That’s an
      appearance issue.’’

      The task force has a judge advocate on staff liaison officers from DOD
      criminal investigative agencies. 

      It also maintains a working relationship with the FBI and other law
      enforcement agencies. Most attacks come from the outside, Frank said,
      and dealing with them is a law enforcement issue. 

      An attack from beyond U.S. borders might become an intelligence issue.

      National jurisdictions are blurred in cyberspace, Frank said. 

      @HWA 
      
36.0  Another Big Hole Found in NT 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/       


      contributed by newbie 
      NTA Monitor Ltd has discovered that Windows NT with
      SP4 is vulnerable to Predictable IP Sequence Numbering,
      also known as IP Spoofing. IP Spoofing is a technique
      used to to make it appear that a user has a different IP
      address than he is supposed to have. 

      NTA Monitor
      http://www.nta-monitor.com/news/NT4-SP4.htm
      
      Microsoft      
      http://support.microsoft.com/support/kb/articles/Q192/2/92.ASP
      
      NTA Monitor
      
      Leading Security testers ’NTA Monitor’ Discover Security Flaw in Microsoft NT4 SP4

      25 August 1999 
      
      NTA Monitor Ltd have discovered a flaw (known as ‘Predictable TCP Sequence Numbering’) in Microsoft NT 4 when used with Service Pack 4 (SP4), which
      means that it is vulnerable to a range of attacks known as ‘IP spoofing’. Microsoft‘s web site has referred to SP4 correcting a similar problem with NT4 SP3, but it
      is now apparent that although there has indeed been a change to the sequence numbering method used, the new method is no more secure than SP3. 
      
      NTA Monitor Ltd came across the issue in the course of an external test (also known as a Penetration Test) of the security of an Internet gateway for one of it’s
      over 100 corporate customers, performing the Regular Monitor test service. NTA Monitor reported to the customer the fact that one of their public servers
      appeared from other tests to be NT based, but had a different predictable IP sequence problem. Following confirmation from the customer that NT4 SP4 was in
      use, NTA then performed bench testing to confirm that the problem is generic to the product. 
      
      Further discussions with Microsoft took place over several weeks, and Microsoft have now confirmed NTA Monitor’s findings. 
      
      Microsoft will be addressing this issue and making it public so that systems administrators with NT4 SP4 in use can review what action they should take in light of
      this new risk. 
      
      Each user needs to weigh up the risks from this flaw in their own particular network environment, and the impact from a potential security breach. Individual
      decisions will need to be made as to whether to temporarily disable NT4 SP4 servers from Internet usage, or move to alternative non-NT platforms, or to continue
      as is, with heightened observation of the servers. 
      
      NT4 is widely used on the Internet by organisations for public-facing servers such as Email hosts (using for example Microsoft Exchange) or Web servers (
      Microsoft’s Internet information Server (IIS) has large number of users). 
      
      This flaw allows an attacker to communicate with the victim device whilst appearing to be another system, such as a trusted host or another system inside the
      organisation’s network, and thus to circumvent the device’s protections against external Internet systems. 
      
      The simplest exploit possible would be sending ‘perfectly untraceable’ fake email - which will be received by staff at the victim site and be indistinguishable from a
      genuine email from the faked email ‘From:’ address. 
      
      More serious exploits would include obtaining a remote log-in to systems as if from the organisation’s inside networks, and once achieved with further scope to
      attempt to take full control of the victim system. 
      
      NTA Monitor will be posting news of this problem on a number of the Internet security mail lists and newsgroups. 
      
      Says NTA Monitor’s Testing Development Director Roy Hills: 

     "Although here at NTA Monitor we do a huge amount of security testing of corporate Internet security, we are not a security research company - and
     so we were initially surprised to find such a flaw. It appears that no one else has spotted this before, and begs the question as to whether Microsoft
     themselves did any testing after releasing SP4 for NT4... 

     "However, it simply highlights a message that we make every day - that active security testing is the only way to find out whether an organisation’ s
     Internet perimeter is really providing the intended security - and this testing should be regular - monthly or quarterly. 

     "Every VP or Director of IT should ask to see their organisation's last Internet security test report. 

     "In fact many organisations have never had their security tested, and those that have tend to rely on an annual test - which is quite ineffective when you
     consider the fact that there are typically 5 or 6 significant new Internet security risks every month, providing remote exploitation attacks on widely used
     Internet software products." 

      @HWA
      
37.0  Korea to Block All Porn 
      ~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/       

      contributed by Lamer 
      The Commission on Youth Protection in South Korea
      yesterday said it will ask to have the 26 local Internet
      service providers (ISPs) to ban access to all
      pornography. ISPs defying the government ban will be
      punished with up to two years in prison or 20 million won
      in fines, plus the cancellation of their business licenses. 

      The Korea Herald      
      http://www.koreaherald.co.kr/news/1999/08/__02/19990826_0211.htm
      
      Gov't to block online porn from abroad 

           The government has decided to ban pornographic material from being provided
      by foreign servers over the Internet.

           The Commission on Youth Protection, which folds under the Prime Minister's
      Office, said yesterday it will seek to have about 26 local Internet service providers
      (ISPs), such as KORNET, BORANet and NETSGO, block pornographic sites
      provided through foreign servers. 

           Existing laws ban pornographic material by domestic servers. But between 50
      and 100 sites carried by foreign servers have been virtually unrestrained, and
      officials noted that domestic pornographic program providers have used the foreign
      servers, exploiting the loophole that limit domestic laws from being able to govern
      foreign-based servers.

           The special measure involves two steps that aim to make lewd material
      inaccessible to all Internet users in Korea. 

           "The idea is to make hard-core, violent and perverted pornography illegal for all
      users, just as we do with printed material," Nam Hyung-ki, a commission member,
      said.

           To that end, the commission said that it will first ask the minister of information
      and communications to decree an administrative order to the nation's ISPs to block
      foreign pornographic sites early next year. 

           At the same time, the commission will require ISPs to develop technical devices
      and measures, such as real-name user-ID systems, to sort out the minors among its
      users. Both commission officials and industry insiders said that such a measure will
      take some time to take root, suggesting that an all-out ban on Internet pornography
      is a more likely scenario in the near future.

           ISPs defying the government ban will be punished with up to two years in prison
      or 20 million won in fines, plus the cancellation of their business licenses.

           Meanwhile, industry insiders welcomed the announcement, but doubted that the
      measures would be effective.

           "It is technically possible, I guess, to block pornographic sites to minors. But
      there will always be some loophole, some minor who will use his or her parents'
      name to click on," an employee at one of the nation's 20 ISPs said.

           

      Updated: 08/26/1999
      by Kim Ji-soo Staff reporter 
      
      @HWA
      
38.0  Grammatically Challenged InfoCriminal Defaces Site 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/       


      contributed by Weld Pond 
      The Tucson Unified School District's web site was
      defaced by what reporters have called a 'grammatically
      challenged' individual. The defacement left obscenities,
      misspellings, and grammar errors throughout the page.
      Local officials are investigating. 

      Arizona Daily Star
      http://www.azstarnet.com/public/dnews/121-8392.html
      <this link is dead - Ed>      
      
39.0  Bank Emails Virus to Investors 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/       

      contributed by Yazmon 
      Last Friday Fuji Bank Ltd in Japan accidently emailed a
      computer virus to a few global investors. A
      spokesperson for Fugi said that the email came from a
      machine that is not normally used and therefore was
      outside what they normally monitor. The virus, on the
      14th day of each month would display the message "big
      stupid jerk". 
     
      Financial Times     
      http://www.ft.com/hippocampus/q14554e.htm
      
      Fuji Bank bugs investors with rude e-mail 
                  By Gillian Tett and Alexandra Nusbaum in Tokyo

                       One of Japan's biggest banks
                       has embarrassed itself - and
                       risked insulting some of its key
                       investors - by e-mailing a
                       computer virus to dozens of fund
                       managers worldwide.

                       The e-mailed memo was part of a
                       public relations offensive by Fuji
      Bank, which last week announced plans for a merger
      with Industrial Bank of Japan and Dai-Ichi Kangyo Bank
      to create the world's largest banking group.

      The bug will make recipients' computers display a
      message from Fuji Bank on the 14th day of each month
      telling the viewer in English that he or she is "a big
      stupid jerk!". It also changes some of the names in the
      e-mail to "Dr Mountain Dew".

      Fuji yesterday admitted it had inadvertently sent out a
      virus to dozens of global investors in a memo describing
      the three-way alliance. When it discovered what had
      happened, it sent a second e-mail warning recipients
      about the bug and the insulting message.

      "I have never received anything like this from a Japanese
      bank before," said Brian Waterhouse, analyst at HSBC
      Securities.

      "I have also never heard of a case of a Japanese bank
      having a computer bug problem before. But I suppose
      that's a sign of technological change, and them catching
      up with the rest of the banking world."

      A Fuji official said yesterday: "This computer bug is
      absolutely no joke . . . we have never seen anything like
      this before. We are determined that this will never
      happen again."

      The bank said it had eliminated the virus from its own
      software. It denied suggestions that the bug might have
      been the work of employees opposed to restructuring,
      saying it had come from "outside sources".

      Fuji had produced the merger announcement in such a
      hurry that it had taken the unusual step of outsourcing
      some of its information technology procedures rather
      than relying on its own staff.
      
      @HWA
      
40.0  IS YAHOO SPAM OR ANTI-SPAM ORIENTED?
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
     
      From http://www.net-security.org/
     
      by BHZ, Friday 27th August 1999 on 10:12 pm CET
      Is Yahoo for spam or against it? According to Wired reporter Chris Oakes , they play
      on the both sides of the coin. "Yahoo distributes the advice to users of its Yahoo
      Store electronic storefront hosting service. The Web site instructs users on how to
      send out unsolicited email to target promotional partners for their Yahoo-hosted
      storefronts." Read very interesting article on it below
     
      http://www.wired.com/news/news/technology/story/21461.html
     
      Yahoo Two-Faced on Spam
      by Chris Oakes 
      
      3:00 a.m.  27.Aug.99.PDT
      Can the Web's most popular site be anti-spam and pro-spam all at the same time? 
      
      Anti-spammers say the contradiction is alive and well at Yahoo. 
      
      
                                                   See also: Yahoo: Keep Your Homestead 
      
      
      "Anytime you're saying 'look for a list of people and send them an unsolicited message,' that's spam," said Peter Seebach, president, of tiny ISP
      Plethora.net in St. Paul Minnesota. 
      
      Yahoo distributes the advice to users of its Yahoo Store electronic storefront hosting service. The Web site instructs users on how to send out
      unsolicited email to target promotional partners for their Yahoo-hosted storefronts. 
      
      Seebach said he encountered the advisory pages on Yahoo after being led to the Yahoo pages by way of an anti-spam mailing list. 
      
      "Step one is to build a list of sites that you want to get links from," reads the page, which is entitled "Build Traffic with Incentives." It reads: 
      
           ...For example, if you are selling products related to show dogs, search for show dog in all the search engines. Add those sites to your
           list, then follow the links to find others. 
      
      The instructions then recommend emailing the webmasters to try to get them to link. 
      
      But using Yahoo's email service to spam these folks is a no-no, the instructions warn: 
      
           "Note: Don't use your Yahoo! Mail account to do this, because all unsolicited commercial email is forbidden by the Yahoo! Mail terms of
           service." 
      
           "Although this type of mail isn't really spam in the usual sense of the word, it is unsolicited, and your account could be canceled for it if
           someone complains." 
      
      Is there a contradiction here? 
      
      "We're not advocating a form message or mass distribution," said Tim Brady, executive producer of Yahoo. "What we're advocating is to use search
      engines to find related sites, write those sites down, and contact them. Probably somewhere in there, there's a judgment call." 
      
      Seebach said these stances are all the more alarming because they contradict the company's overall opposition to spam. 
      
      "In a lot other contexts, Yahoo has been fairly solidly anti-spam. So it's sort of surprising." 
      
      But Brady said there is no disparity in its policies. "Yahoo Store's terms of service forbid spam, and we have shut down sites for spam. There have
      only been a couple of cases." 
      
      "I think our policies are consistent." 
      
      But to Seebach, there is no question about the nature of Yahoo's advice. "They didn't say 'find one person.' They said 'find people' -- plural -- and
      they acknowledge that they'd [the Yahoo Mail service] kick people off for it. The community standard is that that's considered spam." 
      
      Elsewhere in the customer advice, Yahoo Store also instructs users on how to get search engines to display a Yahoo Store site address higher in
      the list of search results. This activity, widely considered to be corrupting search results, is similarly disdained by the Net community. 
      
      Nick Nicholas, executive director of the Mail Abuse Prevention System noted that Yahoo's recommendations on search results are once again
      contradictory. 
      
      "It's particular surprising to have that come from Yahoo. Because people are trying this all the time with sites like Yahoo." 
      
      But Brady said the search advice is sound and not seeking to trick search engines. 
      
      "We're clearly not advocating putting any irrelevant words in there. It's more of an education about how search engines work. If you have your
      front page and it's all graphics and your competitor's is all text -- and your trying to understand why your competitors come up first in a search
      engine -- this is a great education. It's design guidelines." 
      
      He did acknowledge that the company may need to adjust the language of the instructions. 
      
      "We remain strongly anti-spam and nothing we suggest or promote is in any way spam like we believe.... But I can see where potentially there's a
      bit of a gray area here." 
      
      A gray area is problematic when it comes to stemming the growth of the Net's huge spam problem, said J.D. Falk, board member of the Coalition
      Against Unsolicited Commercial Email. 
      
      "The problem with a gray area is that there's so many spammers out there that anybody in the gray area -- some people are going to consider it
      spam. My advice is to stay completely out of gray area until the complete mass of spam dies down." 
      
      Editors note: By late Thursday, after this story was written, the page described above was changed. Yahoo removed the paragraph encouraging
      mass email and the note warning users not to use Yahoo for such mailings. Because the article was accurate when written, Wired News stands by
      the story. 
      
      @HWA

41.0  "NINES PROBLEM"
      ~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/
      
      by BHZ, Friday 27th August 1999 on 9:51 pm CET
      Everybody is panicking over Y2K bug who will hit us in 4 months. But did you hear for
      nines problem? At issue is the impact of an old programming convention that used
      four nines in a row -- 9999 -- to tell computers to stop processing data or to perform a
      special task. Read about it on Wired. 
      
      http://www.zdnet.com/zdnn/stories/news/0,4586,2322320,00.html
     
     
      --------------------------------------------------------------
      This story was printed from ZDNN,
      located at http://www.zdnet.com/zdnn.
      --------------------------------------------------------------
      
      Will 9/9/99 create Y2K-like havoc?
      By Jim Wolf, Reuters 
      August 27, 1999 7:16 AM PT
      URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2322320,00.html
      
      WASHINGTON -- A computer glitch that could cause system failures on Sept. 9 -- 9/9/99 -- is
      about to get a lot of attention. 
      
      In a kind of dry run for the Year 2000 glitch, authorities and computer scientists worldwide will be
      scrutinizing networks on that Thursday for any fallout from the so-called "Nines Problem." 
      
      At issue is the impact of an old programming convention that used four nines in a row -- 9999 --
      to tell computers to stop processing data or to perform a special task. 
      
      End of file
      In the relatively unlikely case that systems misread Sept. 9 as 9999 -- without zeros as in 09/09 --
      they might confuse the nines with what programmers call an "end of file" marker. 
      
      Four nines in the date field could also trigger a grand total or a sorting operation, said Jim Kelton,
      president of Software Unlimited, an Irvine, California, software consulting firm specialized in
      networks and Y2K. 
      
      "All nines could be interpreted as almost anything," he said. For instance, the nines might cause
      computers to disregard data received after Sept. 9, causing a cutoff in the updating of bank
      records. 
      
      The glitch, which the financial industry has been fixing as part of its $9 billion Y2K preparations,
      could figure in customized applications written in decades-old computer languages such as
      FORTRAN, COBOL and RPG, experts say. 
      
      Robert Banghart, director of development at Unisolve, a Costa Mesa, California, software firm
      working on the Y2K glitch, said a string of nines long had been used to tell computers to ''end a
      routine,'' or no longer execute certain instructions. 
      
      Rehearsal for preparedness
      In a worst-case scenario, four nines in a date field could spark problems not unlike Y2K, a coding
      glitch that threatens to keep ill-prepared computers from distinguishing the year 2000 from the
      year 1900. 
      
      The U.N.-backed International Y2K Cooperation Center, a global clearing house for millennium
      bug data, is using Sept. 9 to rehearse a plan aimed at keeping up-to-the-minute tabs on how the
      world is faring as it enters 2000. 
      
      "It's a dry run for the rollover date," said Lisa Pelegrin, spokeswoman for the Washington-based,
      World Bank-funded center. "We will be testing our reporting system." 
      
      That reporting system, to be updated in real time on the center's Web site, www.iy2kcc.org,
      ultimately will reflect the input of 170 or more national Y2K coordinators. 
      
      On the center's Sept. 9 shakeout run, about 15 countries are expected to take part. For the most
      part, they are members of its steering committee -- Britain, Bulgaria, Chile, Gambia, Iceland,
      Japan, Mexico, Morocco, Netherlands, Philippines, South Korea and the United States. 
      
      New Zealand and Australia, also active backers, are due to report in. Graeme Inchley, Australia's
      Y2K coordinator, told Reuters that he was ``absolutely convinced'' Sept. 9 would go by without a
      hitch. 
      
      First test for Y2K center
      Sept. 9 also will mark the first test of a $40 million-dollar U.S. inter-agency Y2K center meant to
      give U.S. decision makers a round-the-clock view of Y2K problems in their areas of
      responsibility. 
      
      Likewise, on Sept. 8 and 9, the North American Electric Reliability Council, an industry group,
      will rehearse an emergency scenario to test operating, communications and contingency responses
      for the Y2K transition. 
      
      "If all goes well in this drill, the electric utilities can pat themselves on the back; if not, they may be
      tempted to blame the 'nines','' said Janis Gogan, an information technology expert at Bentley
      College in Waltham, Mass. 
      
      Mitch Ratcliffe, editorial director of publisher Ziff Davis's Y2K Web site, rated Sept. 9's chance
      of triggering problems as extremely low because the date would have to be misrepresented --
      without zeros as in 09/09 -- "in a way that defies logic." 
      
      "The Nines Problem is almost totally a myth," he said. 
      
      @HWA

    
42.0 Stealth Coordinated Attack HOWTO
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     This was emailed to us by the author and is a very well written piece full of important information for
     the sysadmin and hacker alike, definately a must-read by all. - Ed
     
     
     Contributed by Dragos Ruiu

     note: this was written before the l0pht antisniff annoucement was made so that's why the future tense.  
           And I'm not talking about route table hijacking as the DHCP vulnerability :-)....      cheers, --dr)
 
      Cautionary Tales: Stealth Coordinated Attack HOWTO
      By Dragos Ruiu
      
      A lot has been written in the popular media about the effects of hostile coordinated traffic attacks 
      (hacking), and, as a sysadmin, I find my systems increasingly under attack by hostile sources. Two years
      ago, we got mapped and port-scanned for vulnerabilities once a month. One year ago the scan frequency was
      up to once a week, and these days we get scanned several times a day with real attack attempts at least 
      once a week. The Internet is becoming an increasingly hostile place and the traditional defenses and 
      documentation of attack systems seems woefully inadequate. With this article, I hope to remedy some of the
      false misconceptions of security that some admins have. Yes, I hope that descriptions of these attack 
      techniques scare you into beefing up security on your home PC, at your office, everywhere. Over the last 
      fifteen or so years, as a sysadmin of network connected systems, I have seen the knowledge of computer 
      technologies propagate across the spectrum of human population, bringing with it the traditional demographic
      including the stupid people, the malicious people as well as the helpful and the apathetic people. 
      
      With the burst of Internet technology over the last few years there has also been a burst of new computer
      adoption, increasing pervasiveness of computing and networks and increasing occurrences and danger/damage
      caused by hostile computer use. While I don't believe for a second the over-inflated, hyped-up estimates of
      the cost of these hacker intrusions bandied in the media, I can vouch that the problem is real. As the chief
      technical weenie of our company, NetSentry Technology, I've been manning the front line defenses of our company
      net equipment. I've also been documenting the increasingly hostile nature of attacks on our network and would 
      like to share some of my experiences in this area. The technical level of the attacks is increasing at an 
      alarming pace, and I haven't seen any documentation of these new attack techniques yet, so here are some 
      cautionary tales culled from our real-life experiences. My hope is that after reading this you will re-examine
      your own network security. Most organizations are woefully under-protected. 
      
      The ISPs are having increasing difficulties in responding to customer requests for assistance in intrusion cases
      and the police are even further under-staffed and out-gunned technologically. So increasingly, it leaves companies
      to fend for themselves to secure their systems. Here is what you have to worry about. 
      
      I wish I could take credit for all the techniques described here, but a majority of them were derived from 
      analysis of traffic used for hostile attacks on us. Credit belongs to the anonymous hackers that have taken a run
      at our defenses. I write the following from the point of view of the attacker to emphasize the point that security
      is vastly neglected at most sites and because I want to ask, what will you do when faced with these attacks? And 
      what can you do with your current defensive equipment? Not much, I wager. 
      
      The phases of a successful attack are A) Reconnaissance, B) Vulnerability identification, C) Penetration, 
      D) Control, E) Embedding, F) Data extraction/modification, and G) Attack relay. 
      
      A) Reconnaissance 
      
      The first part of a successful attack is to get to know the network topology in the region surrounding your 
      target and the parties it communicates to. This is also an important part of the penetration of each successive
      layer of your target's networks. Currently, the best publicly available tool for net topology identification is
      Fyodor's excellent "nmap" program and derivatives. The objective of the reconnaissance is to understand as much
      about the target and to identify attack destinations defenses and potential attack relay bases. 
      
      In private circulation, the following tools exist or will soon exist: 
      
      Attack Tool: Coordinated multi-site scanners. Mapping software that distributes the mapping "probe" packets to be
      sent to the destination addresses and nearby sites over a number of geographically dispersed attack sites, and 
      trickles them out at low rates to avoid detection so that there never is a lot of traffic at any one time or from
      any particular site (see stealth section). The results of the pokes and probes at the target that these systems 
      send is summed and collated to build a picture of what equipment the target has installed. There was a lot of 
      noise in the press earlier this year as some of the crude versions of these coordinated scan tools were aimed at
      US military sites, but either the operators of these tools have improved them to the point where the relatively 
      immature military defense systems no longer identify these scans, or the military has found some other threat to
      highlight in the press and use to get funding. 
      
      Attack Tool: Sniffer Detectors. Sniffers produce unique traffic patterns that may be detected. They also provide
      some interesting penetration vulnerabilities, as their network interfaces are placed in promiscuous mode, allowing
      all packets past the address filters to be processed by network stacks and applications. Some attack methods 
      directly target security systems, which, ironically enough, are often notoriously insecure themselves. Once the
      security system is penetrated, all kinds of nice information like traffic patterns and passwords may be gleaned,
      and evidence of your attacks can be conveniently removed. And because of promiscuous listening in the sniffer you
      can even take it out with traffic destined for a different system. 
      
      Attack Tool: DNS Zone transfer. A DNS zone lists the externally accessible points a company maintains. A nice map
      of the externally visible systems that your target has put on the Internet and a great attack point list. Not many
      sysadmins go over the name server records closely enough to detect this, however the more advanced intrusion 
      detection systems are getting better at identifying these kinds of transfers as pre-cursors to an attack. 
      
      The important information to gather is the DNS names and addresses of the target's hosts and neighbors. Then you 
      must further identify the OS and open port configuration of each of your target's systems. The latter is determined
      using site scanners and analyzing the responses that a site delivers. Current tools such as "nmap" and "queso" are 
      getting very good at determining device, OS version and some network application configuration information from 
      careful analysis of the timing and contents of responses to probing or mapping traffic. The OS and port 
      configuration are used to identify systems that could have software packages with vulnerabilities and bugs open 
      for exploits. 
      
      Knowing who your target's ISPs are by analysis of address use can provide useful attack bases for your onslaught
      Getting into their ISP's equipment and servers first could enable you to get important information about them and
      if you can subvert equipment installed on the same network links as your target can let you glean important 
      information such as traffic patterns of your target. All without your target even suspecting. It may also be
      easier to penetrate the ISP than a secure target. Some ISPs such as @Home even keep extensive (but often out of
      date) databases listing customer's hardware and software configurations as well as other info, which if accessed
      can mitigate some of the dangers of triggering intrusion detection systems with your site scanning traffic. 
      
      Once the traffic patterns of the target's external traffic are known, a basic technique to take out a secure target
      is to first take over a less secure target that your main target talks to, and then come in to your main target 
      under the cover of that site's usual traffic. Any site your target talks to periodically, including popular web 
      sites, employee's dial-up accounts, and system traffic, such as network time protocol (NTP) clocks, are all 
      candidates for attack relays. Sprinkling in your attack traffic with large web downloads and ftp transfers will 
      make it more difficult for security personnel to use sniffing and detection tools to identify your attack, as 
      scrolling through reams of logs and captured data can often be more time consuming than possible with most network
      staffing levels. Taking out and controlling your target's conversation peers can provide you with useful channels 
      through your target's defensive firewalls and detection systems. Your traffic will look on all the scanners like 
      that web-site the Joe in IT is surfing to, but will provide you with a nice channel right past all the firewalls to
      a machine inside the core of your target's net. 
      
      One useful target is the DNS caches and servers that your target uses at your ISP. Accessing the DNS logs can give
      you the addresses of all the sites that your target talks to, and furthermore, careful analysis can even give 
      indication of when the activity happened, or is happening, offering excellent potential for cover. 
      
      As we'll talk about later, owning the DNS server can have many benefits. In general the DNS servers are ripe with
      hacking opportunities. 
      
      Another useful target is the ISP DHCP server, which is used to dynamically assign IP addresses to clients on
      connection, as it can be used to identify periods of system activity from the logs, and also periodically 
      establishes connections to the client systems as the address leases expire. A common DHCP vulnerability also
      allows client system takeover from this ISP host. DHCP address lease expiry also provides a nice way to signal
      embedded attack software at pre-determined times to do things like wake up in the middle of the night and send
      data when no-one is looking. 
      
      An often available source of useful relay bases for attacks is other systems in the same ISP client pool (on the
      same modem bank, other ADSL users on the same DSLAM, or cablemodem users on the same segment), which are in many
      cases default configuration, open like Swiss cheese, Windows systems - typically with file-sharing turned on and
      personal web services enabled, a combination that sports a plethora of available vulnerabilities to exploit. After
      taking out the easy "marshmallow" soft client PC, the adjacent main target can then be attacked using local subnet
      attacks, offering again some potentially powerful techniques for hiding from and exploiting your target's security
      systems. In easy cases, the equipment rack will bridge broadcast traffic between the "marshmallow" and the target,
      allowing use of address resolution traffic such as ARP and DHCP to be used for system attacks and control. For 
      stealth, these kinds of attack bases are excellent too, because the broadcast traffic is largely repetitive, very
      voluminous, and mostly uninteresting, which, combined with a great immaturity among the security tools for this 
      kind of traffic, make it a ripe vulnerability area. Local area broadcasts can also be used as another "mapping" 
      system too, even in passive listening to traffic at the nearby "marshmallow". By recording the address lookup 
      broadcasts from your target, you can build up that traffic pattern information so that you can sneak into the site
      undetected. 
      
      Another often overlooked source of mapping and reconnaissance information (and break-ins) is the management systems
      the ISP may be maintaining. The Simple Network Management Protocol (SNMP) that most of these systems use is a bit 
      too simple and is ripe with vulnerabilities, rich with information (including complete remote sniffers useable to 
      pick up passwords in some RMON MIB equipment) and lame about security. 
      
      The most powerful relay base for attacks is the ISP's router system. Once you control the paths of your target's
      packets, you really have them at your mercy, as you can silently redirect any of their traffic to your attack 
      relay bases without them knowing, and other fun tricks. However, most ISPs guard their Ciscos and other routers
      as the most valuable resource with the most defenses, so this is really a target for the most daring and brilliant
      attacks. 
      
      B) Vulnerability Identification 
      
      The objective of the mapping phase is to find externally accessible traffic paths into your target's net systems.
      Over the last year it has been easy to see what are the most popular scriptware for the so called script-kiddies:
      the low-tech, mostly teen, hackers who just download pre-compiled exploits and run it blindly against targets. 
      The standard script-kiddy technique is to set up a broad address sweep broadcast of probe traffic, to the whole
      section of the Internet that seeks some sort of response from the target, that would indicate that software is 
      installed with the vulnerability the exploit is using. 
      
      The classic vulnerabilities that we frequently see sweeps for are: 
      
          o FTP Server Exploits. Especially vulnerable are servers with anonymous write access. 
          o NFS and SMB share vulnerabilities. 
          o Holes in POP and IMAP mail delivery servers. 
          o Vulnerabilities in the "bind" name daemon software. 
          o Web server CGI exploits (Apache, MS IIS). 
          o Installed control daemons such as BackOrifice. 
      
      The scans for these holes are so common these days that it is difficult for most sites to even catalog origins of
      such scans. These kinds of scans are so commonplace that, as long as traffic volume and frequency is controlled, it
      is possible to conduct them with relative impunity. But the attacker has to be prepared for the case of zealous 
      sysadmins who contact ISPs and complain about port-scans. Never port-scan from a node you are not prepared to have
      disconnected, seized or otherwise lost. Here, the best policy is to use the least useful and network connected 
      systems in your attack fleet of controlled systems as they may be lost or jammed and blocked by firewall software
      when the hostile mapping probe traffic is detected. Mapping traffic stands out like a sore thumb when pointed at 
      systems not running the vulnerable software - if the target has the tools to analyze this kind of attack (i.e. 
      Abacus Sentry). If attacking a net-savvy sysadmin, he will be able to detect things like IMAP probes against 
      servers not running mail software. However, even these days, targets with effective intrusion detection systems
      are few and far between. And sysadmins with enough time to examine, properly and frequently, all their logging 
      systems are even fewer. 
      
      At the sites that have management and security systems, these are ripe targets too. Penetrating the security system
      has the best advantage of rendering the target effectively blind. I have seen experienced sysadmins dismiss 
      unquestionable, hard evidence of tampering because their beloved and trusted, but thoroughly compromised, security
      sniffer shows them that there is nothing to worry about - or doesn't even show that kind of data at all. The other
      factors in the attacker's favor are the egos of the network designer and IT group. Every sysadmin thinks their 
      defensive plan is carefully thought out and "their" system couldn't possibly be penetrated. Here at NetSentry we
      used to contact operators of systems that had been compromised and were now being used for attacks against us. But
      after many hours of fruitless attempts to convince maintenance personnel, who, if you did reach them, often didn't
       even understand the attack traffic their own site was launching, insisted that it "couldn't possibly be our system,
       it must be your equipment or monitors that are wrong." 
      
      I remember very vividly one ISP we contacted: when we were watching, in pretty much real time, as the attackers were
      compromising system by system at their site and using each as a base for attacks against us, how their support person
      and security specialist looked at some local system when we called and decided that we couldn't possibly be correct.
      An hour later, as the ISP's systems being used as attack relays switched from probing to all out denial of service 
      flooding and attacks, we called back and everyone had happily gone home for the night there. We never did bother to 
      call them again and as far as we know the attacker still owns all their systems. The only guys who really took one of
      our attempts at warnings seriously was the security department at a regional bank, who came in on a Saturday to put 
      sniffers on the line - but they were a notable exception. 
      
      The best targets are those that are the most widely known, used, and difficult to take off-line or re-locate. Mail,
      DNS, Web and FTP servers all fall into this category. With these servers, sites that notice suspicious traffic will
      often not off-line them because they are critical to network operations. And even if they take them off line and 
      restore them from backup, or otherwise keep you out, they are often forced to bring the servers back with the same
      vulnerability as was available for initial entry because user complaints about the unavailability of network 
      resources override the attempts to identify and close the hole. 
      
      Like penetrating the sniffer and management systems, the mail servers also provide excellent opportunities at 
      invisibility, by letting you monitor internal conversations, what aspects of the intrusion have been detected and
      what countermeasures are being mandated. 
      
      C) Penetration 
      
      The most successful hack is the one where the target doesn't even know it has been penetrated. The next best thing
      is that when the intrusion is detected, they won't know where it's coming from. Since the source may be detected, 
      it's better to use attack relays so the attacker's anonymity can be maintained. The general technique is to quickly
      find some clueless newbie who has put his home system or office server on the net with major vulnerabilities, and 
      use that as a relay. Never use a system with your name or organization attached to it to attack. 
      
      Use several levels of indirection and make sure you cross several geographical and political boundaries to hide your
      trail. ISPs in the same country often will not share log information and this gets even more difficult across borders.
      I listened with sympathy when I heard a poor overworked security colleague who works for the Canadian RCMP describe 
      the nine month process (!) for the paperwork to request log files from U.S. ISPs. The police and ISP security 
      departments often have their hands tied by procedure and policy and general understaffing. The more organizational and
      geographic boundaries that your attack redirection trail can cross, the more safe and anonymous you will be. 
      
      People complain about the lack of anonymity on the net, but for those that cross that line into unauthorized systems
      use, there is altogether too much anonymity. It's often almost impossible to follow a chain of connections through 
      multiple ISPs and countries. The hidden are truly anonymous on the net. Sysadmins should give up now on the romantic
      idea that you will be able to track down who is attacking you - it's just another bunch of random numeric addresses,
      and even if you trace it down to an ISP, their logs will only point to another ISP and so on. 
      
      If the attacker can knock out the target's intrusion and sniffing facilities then you can proceed the rampage though
      their network with relative impunity, but even if you don't have the technology to compromise such systems, there are
      a number of techniques you can use to make your attack more stealthy. 
      
      Attack Tools: Firewall tunnels. There are a wide variety of virtual private network and proxy programs, which you can
      use to relay your traffic to inside a protected network and not make the traffic appear on an intrusion detection 
      system. Literally dozens of such firewall "borers", such as HTTPtunnel, are available now in source and binary form.
      These tunnel programs relay your traffic through the firewall and IDS systems by making it look like innocuous 
      transfers to and from your "mole" system to common web-sites and other forms of traffic "chameleoning" to make it
      look unexceptional. These tunnels embed your attack and control traffic inside this relatively innocent looking 
      traffic to seem like HTTP or partial TCP fragments. These tunnels can also encrypt your traffic, making it more 
      difficult for your target to identify the penetration methods. 
      
      Most sites employ hard-shell, layered network security. That is to say the links external to the organization have 
      firewalls and net proxies to restrict access to the inside network. The standard technique is to have a hardened 
      Demilitarized Zone (DMZ) made up of firewalls and security IDS systems. The most secure sites will have multiple 
      servers and systems dedicated to these roles, but the majority of installations often rely on one inadequate server
      for this gatekeeper function. And once you are through this shell, which is checked most often by maintenance 
      personnel, you are usually into the internal network that has almost no security. Another often overlooked security
      breach is to use floppy based Linux distributions such as the Trinux project, or client software for common Windows
      and NT systems, to carry in such a tunnel program physically into the organization where it can be surreptitiously 
      installed on a system inside the "hard" shell. This "mole" or tunnel can then penetrate the security from the inside
      where vulnerabilities are seldom checked. >From this attack relay base, you can proceed to scan the internal systems
      and take over other servers, further embedding your control of their infrastructure. 
      
      Firewalls are hardened quite well these days. But even so, some firewall operations can be predicted and broken, in
      areas like the port number sequences of outbound connections. With predictable sequence number connections, firewall
      connections can be hijacked and attack sequences passed through the defenses. And while firewalls are often tough, 
      many sysadmins make mistakes and leave vulnerabilities open on the host the firewall runs on (like running Microsoft
      IIS on the firewall), allowing penetration and access to both the internal and external Ethernet interfaces on the 
      box for malicious software to bridge packets between the two. Once the host with network interfaces on both segments
      is penetrated, packet hijack software can grab the packet and relay it to the other interface before the firewall 
      software even sees it, essentially providing you with an invisible back-door into the target. 
      
      Some forms of firewall penetration do not even involve bypassing the firewall. One interesting attack technique it 
      to identify frequently visited sites by the target, taint the DNS database with a forged update to their DNS server 
      or cache so that the next time the target client contacts the frequently visited site, the traffic is pointed to one
      of your attack systems instead. This attack relay system can conveniently embed your attack exploit in relayed copies
      of the original web site. With modern Java enabled browsers, the client naively executes any code the supposedly well
      known site, which is in reality your attack relay, sends. The data is sent in response to a client's request through
       the firewall and walks right past the intrusion detectors, virtually indistinguishable from ordinary data. This 
       attack mode is also available by taking over the target ISP's router or DNS server. 
      
      Other forms of stealth involve penetrating SNMP traffic statistics or nearby systems at their ISP or other peer 
      clients to identify traffic activity. The design flaw of the Internet that makes identifying forged source addresses
      a difficult problem can also let you hide the origin of the attacks (so called "spoofing"). If attack traffic is sent
      from (or spoofed to look like) a source that is currently sending a lot of data to the target, it makes it that much
      more difficult to spot the attacks. This buries the attack packet amongst reams of other voluminous data. It quickly
      scrolls the attack packets off the screen of sniffers and makes network security staff at the other end go through 
      the tedious "find the needle in the haystack" procedure of sorting and filtering megabytes and megabytes of capture
      data if they suspect the attack. Most of the time they will not have the patience to exhaustively search for attacks
      by scrolling though the captures and logs, again rendering you invisible. 
      
      After penetration, further attack software can be embedded in ordinary traffic to transfer it into the target's 
      systems. Patience is the key here. The lower the data rate that can be used to get the information in and out, the
      lower your chances of being detected are. Spreading out your packets, so only a few per hour are transmitted, makes
      your hack very difficult to detect with today's tools. (However, we have developed some special tools to counter 
      this kind of attack.) 
      
      One of the more devious penetration methods we observed was a system that trickled data in and out in the normally
      unused padding at the end of user data packets. On normal sniffers and detectors, the packets looked completely 
      innocent, as even those tools did not display the padding "garbage" used for the hack. This padding was used to 
      install malicious software by trickling the attack executable into the target a little bit at a time, a few bytes
      with every packet. 
      
       Another interesting stealthy attack system that will negate most firewalls is to embed your hacking control channel
      for your attack bot software and results and information back from the bot in addressing translation requests, that 
      by definition need to be passed on by firewalls. One such clever system we experienced was an attacker who penetrated
      another nearby client node on an ADSL system. They then penetrated one of our systems (a sniffer of all things) and 
      installed a key-stroke logger that encoded the keystrokes typed at the console into the address field of Address 
      Resolution Protocol (ARP) lookup messages, which were happily passed through the firewall and relayed to the attacker
      at the nearby system outside the firewall on the same subnet that received the ARP encoded keystrokes. This key logger
      even delayed, encrypted and grouped keystroke transmissions to make detection more difficult. We have also seen 
      keyboard loggers that were clever enough to store your keystrokes on disk, in case the system was disconnected from
      the network (like a laptop) for a while and then trickled them out later when the net connection was re-established.
      Key loggers provide easy access to most authentication tokens, scrambling keys and passwords. 
      
      The basic form of penetration is to use stack smashes which take advantage of basic low level coding bugs in a piece
      of applications software or an operating system component. The form of a stack smash exploit is to utilize a data 
      coding that allows variable length data that you send to be erroneously copied into fixed length buffers or variables,
      and writing into data past the end of the buffer. Since this data can overrun the stack, you can overwrite a return 
      address for the currently executing function and make the processors CPU jump to and execute arbitrary code of your 
      choosing. If the bug exists in a privileged piece of software, these instructions that you jump to are virtually 
      unlimited, allowing you to do literally anything with the penetrated computer. 
      
      The problem with this form of attack is that it often requires detailed knowledge of the operating system and memory
      map of the target. Often this form of attack will have to be coded in multiple ways to account even for the version 
      of OS and software package being penetrated. The drawback for the attacker and the advantage for the defender is that
      usually stack smashes involves "groping" around blindly, sending multiple variants with different offsets and values 
      until the appropriate magic version number that works correctly and responds back is found. In some cases an incorrect
      variant can crash software and systems, necessitating lots of patience and long time delays between variants tried. 
      
      
      A common target for stack smashes are recent and older variants of the "bind" name daemon that is in almost universal
      use to translate from symbolic DNS names and URLs into numeric IP addresses. The code and traffic structure of this 
      program is very complicated, difficult to debug and ripe with vulnerabilities and bugs. One 17 year-old hacker managed
      to take over more than 12,000 systems over two years - before he was caught with an automated "bind" takeover worm. 
      
      Another common form of attack is to exploit the increasingly complex and powerful native data types of applications 
      software (especially Microsoft products that often contain several complete programming languages in things like word
      processors and mail readers). Web server script exploits also fall into this category. The basic technique here is to
      either hijack an existing connection and inject malicious data or to send unsolicited attack traffic that will take 
      over the application and eventually the system. 
      
      D) Control 
      
      Once you are into the system and have compromised a piece of software, the next bit of work is to get control of the
      host. This is usually a bootstrap process, where a piece of small code, "the exploit", is first gotten into the target
      and the vulnerability is used to execute the code. This code needs to contact one of your attack relay systems and 
      download further code and instructions. The simplest form of bootstrap is to allow remote access to a command shell 
      that can execute arbitrary operating system commands. 
      
      There are many forms of bootstraps, as they are often linked to the exploit itself, and some, like BackOrifice, 
      include a whole command interpreter. But those more advanced download a minimum of code and use existing portions of
      the operating system code to build a remote control system attack bot. These advanced exploits can, in object oriented
      fashion, build whole parallel network stacks and control systems that run invisibly in the background on the machines 
      using software already installed on the machine. 
      
      A portion of the bootstrap process during attack is to restart or patch the application that was crashed so that the 
      intrusion is not noticeable. Other important parts of this process include cleaning up the log files to remove 
      intrusion messages and hiding the attack bot so that it isn't listed in the task viewer or process list. "Scrubbing"
      the log files can be easily accomplished by recording the file pointers to important log files at exploit time, 
      installing and bootstrapping your attack bot and then "rewinding" the log files to their pre-attack positions to
      erase any evidence of the installation by overwriting the operating system file pointers in memory with your 
      pre-attack copies. Subsequent log entries will overwrite the evidence of the attack. Log files to be cleaned up 
      include sniffer capture files, system event logs, DNS and other daemon diagnostic files, IDS systems files and file
      integrity checkers like Tripwire. The good attack bots make log-files almost useless for intrusion detection. 
      
      Your attack bot can control the machine up to the privilege level of the software that has been penetrated. It can
      access any resource that the original software could. In many cases, this will not include super-user "root" or 
      "administrator" privileges and you will need to use another local exploit to break in further. One alternative 
      approach is to download a password cracker and dictionary to be stored in invisible files or unused portions of the
      disk and let this cracker run in the background on the machine (invisibly off any task list of course), using a brute
      force search for the password on the same machine. This generates little traffic, and is very difficult to detect by
      the target, as the machine will work silently to crack the password for you when idle. One such attack system that 
      was used against us used a remarkably compact word-list and a very patient brute force cracker - to good success. 
      
      Super-user privileges are not needed all the time. Even in cases where the cracked software has been limited to 
      accessing only a few resources, it is often enough to use the system as an attack relay base. One of our attackers
      used a "bind" exploit once on a firewall system where we had purposefully confined the non-privileged version of 
      "bind" program to a "chroot" jail that limited filesystem access to a very small subset of files. This didn't stop 
      the sophisticated attacker much, as even the ordinary user privilege "bind" already had permission to access both 
      internal and external Ethernet interfaces and bridge packets between the two to bypass the firewall software. 
      
      With careful design, your attack bot can allow you to encrypt, hide, download, remotely install and run arbitrary
      software packages, and send traffic so that even sniffers installed on the target do not see the packets. It is 
      relatively straightforward to insert and remove packets from the network card, transmit and receive queues, so that
      normal OS security and logging measures on the penetrated host never even detect the traffic (including bypassing 
      low-level transmit and receive counters). Similarly, it isn't a major technical feat to hide the bot tasks so that
      they don't show up on system diagnostics. You can completely remotely control a machine and run programs on it, 
      upload and download data, without any indication to the user other than occasional sporadic slowness - which on 
      Windows is almost indistinguishable from normal performance, and Linux and NT aren't much better. 
      
      E) Embedding 
      
      After you have gotten in and have control of the target, the next step is ensuring that you can retain control even
      if your actions are discovered. You need to quickly map the local net and penetrate any other system suspected of 
      being a sniffer or key communications links, such as mail servers, to observe any suspicion of intrusion on the part
      of the target's IT staff. 
      
      The next portion of clean up is to trickle in any additional attack code into the target and whatever is needed to
      make your controlling attack bot install and hide itself on disk. The point here is to allow your bot to survive a
      system re-boot and retain control so that you do not have to go through the dangerous - and detectable - attack and 
      clean-up sequence again. Several techniques have been observed for doing this. One is to overwrite existing and 
      little used OS files that exist in nice, known predictable places/paths, but are seldom used (the more marginal 
      games that come with OS distributions, and terminal definitions for obscure terminals quickly come to mind for this
      purpose). A sophisticated variation on this is to encrypt and spread your binary over many files (sometimes called 
      steganography). Another alternative that requires more low level programming is to use unused, empty portions of 
      local disks. The system then has to be modified to re-enable your bot after rebooting. 
      
      A variation on this hidden attack bot is to install a back-door that will lie dormant on the disk and install a small,
      difficult to detect bot that waits until receipt of a special traffic trigger which will then set off re-assembly from
      code pieces spread out on disk files and activation of the more powerful attack relay bot. This kind of traffic 
      trigger system could also be used to render the traffic invisible. One attack system installed itself across multiple
      systems and suspended normal OS operations and triggered execution of the loaded command in the attack bot upon 
      receipt of a multicast trigger. The OS remained suspended until a time out or reset trigger was received, allowing 
      the exploit to run without any normal security and logging active. By using a multicast trigger, multiple systems can
      be triggered and momentarily suspended simultaneously, and if the control bot is installed on any sniffer systems, 
      data recording was suspended while the attack bots execute their commands in this suspended state and send their 
      traffic, again rendering the whole attack invisible. Multicast traffic also has the added advantage of being not 
      reported in the default configuration of most sniffers, so unless the IT staff explicitly enables reporting, they 
      will not usually be aware of it. This kind of attack is very difficult to detect unless an operator is paying very
      close attention to traffic LEDs. 
      
      One condition for the attacker to plan for is what happens to your bot if it is discovered. One attacker once used 
      a system that erased itself if it lost contact with the attack relay base for more than a certain period of time, or
      if the system was re-booted (as would happen when a system gets off-lined because breaches are suspected). In this 
      way any evidence was erased whenever a penetration was suspected. 
      
      The Perl language, if installed on the target, provides a nice compact way to download very powerful programs with a
      minimum of data transferred, and the standard Perl kit includes routines for embedding (hiding) your Perl script into
      other binaries. 
      
      Another clever exploit is to store a piece of your attack bot bootstrap sequence on the network card itself. Most
      modern network cards have 64 bytes (or more) of EEPROM that are used to store the 6 byte hardware MAC address, 
      leaving the majority of the space unused. More sophisticated server network cards even have more space for 
      downloadable firmware. The mostly unused network card EEPROM is typically loaded by OS drivers in its entirety - 
      usually to a fixed address static buffer. A small segment of code could be programmed into the card and executed 
      from this buffer by an exploit. The advantages to storing a portion of the attack code in the NIC is that it makes
      tracing the activity of the exploit difficult for someone trying to reverse engineer the code, and more importantly,
      a short program installed here will survive a disk formatting and OS re-install. This kind of exploit will lead to 
      a lot of head scratching and questions about "How the hell do they keep getting back in after a disk wipe?" at the 
      target. 
      
      F) Data extraction/modification 
      
      After you have established control, then you can get on with your nefarious purposes. Typically this will be data 
      extraction and modification on the target system. On Microsoft systems, the registry and Microsoft's own system 
      information utility, enable rapid gathering and dense transmission of key system configuration back to your attack
      relay. Under Linux, the /proc filesystem provides the most rapid clues as to system configuration, allowing your 
      attack bot to build a summary of what it found on the newly penetrated server and transmit it to the relay. 
      
      Important attributes of data extraction and control of modifications for attack bots are to hide and encrypt this
      data stream. It will be beneficial to spread these transmissions out over several relay destinations and have them
      happen at low rates. One of the safer, stealthier data extraction systems is to embed the data in HTTP web transfers
      that make up a large percentage of most site traffic these days. Putting your encrypted data deep into packets and 
      disguising it as JPEG or GIF binary data will help hide it. Most traffic loggers and sniffers usually capture only
      the beginning of most packets, so embedding your data deep into the packet will make it all that much more difficult
      to see, depending on what security tools your target is equipped with. 
      
      As was mentioned above ARP and DNS also provide methods of hiding your data transmissions. A key piece of information
      on the path to hiding your attack bot data traffic amongst the target's traffic is understanding your target's traffic
      patterns. You need to know when, how (what protocol) and who the target is talking to. Both Linux/Unix and Windows 
      come with some pre-made system tools that you can use to record these traffic patterns, without downloading much 
      additional software. The more sophisticated network cards under Windows come with RMON and other MIBs that can be 
      used to gather traffic pattern information, so that your traffic can be spoofed and modified to look like client 
      traffic requested by users at the target site. RedHat Linux contains many pre-installed mapping tools including 
      arpwatch and SNMP that can be used to monitor local traffic to see what kinds of traffic will likely escape detection
      Penetrations of the target's ISP to get traffic stats can be a boon here too. 
      
      Another important kind of data hiding is to send your data in little bursts, and follow that data with a burst of
      legitimate addressing or ARP traffic to scroll your attack data off the display screen of any sniffers in case you 
      encounter a fairly quiet traffic level at the target's system. Doing this kind of data transmission in the wee hours
      of the morning will also lower the chances that there are any humans looking at status screens at the network control
      center and noticing anomalies. 
      
      G) Attack Relay 
      
      The final step in attacking is to successfully use your new system as a relay base for other attacks. Building up a 
      large "fleet" of attack bases is its own reward - with more systems to attack from your subsequent conquests will be
      more stealthy and difficult to track. But now your target relay site will likely notice if you start port-scanning 
      "trantor.army.mil" or other such contentious targets, so be careful (this is another real-life example scenario used
      on us here). Most sysadmins will not take kindly to the possibility of getting phone calls from the U.S. military 
      asking why their servers are attacking them. But then again, most won't notice. 
      
      Attack-Tool: One clever exploit a hacker used on one of the "honey-pot" decoy systems we use as hacker-bait for 
      analysis was an SNMP triggered attack reflector. This system used two SNMP triggers to effectively hide the out-bound
      attacks. The first trigger put the system into listen mode. After sending the trigger, the attacker quickly sends a 
      spoofed attack packet containing the attack to the relay system. The spoofed attack packet is coded to look like a 
      packet from the attack destination to the relay. Upon receipt of the second SNMP trigger and after a delay, the 
      recorded attack packet is sent back to the actual attack target with the original source and destination reversed. 
      In this way the sequence of the attack is seemingly reversed, with the local relay system responding with a single 
      packet after receipt of the single packet from the target. Unless you look carefully on most sniffers and IDS 
      systems, it looks like the target is attacking the relay system instead of the other way around. 
      
      A good ploy to avoid detection is to use many different attack relay or mapping systems and to avoid using the same
      attack relay system twice in the same day or week with a particular target. An isolated packet here and there destined
      for a strange system will not arouse many suspicions, but repeated transmissions to the same target could possibly 
      trigger off alarms at the relay or target - however unlikely that may be with most sysadmins asleep at the security 
      wheel. 
      
      Conclusion 
      
      I hope the above attack techniques scare any sysadmins reading this. As they should. Too many people these days feel
      that security is keeping out the script-kiddies or installing a firewall. There are a lot of nastier things out there
      on the net than the mindless script-hordes, so beware. I hope you can use this article to justify better security 
      measures to your boss. This stuff is out there - it's been used on us. Odds are these kinds of exploits have been 
      used on you and you have no knowledge of it. There are malicious minds developing new attack bots, and communities 
      of people dedicated to the breaching of security measures. I would even surmise that there are now organized and 
      funded efforts on the part of military and intelligence agencies to further develop such offensive software. One of
      these days, organized crime may even wake up to this. As we are discovering, it's the law of the jungle out there on
      the Net, and there are few places to turn to for assistance in case you get some malicious bozo attacking you. Often
      you are left to your own devices, and with little support from your own organization, that may be technically 
      illiterate when it comes to network security. The only defense seems to be to stay technologically ahead of the 
      attackers - a constant and resource intensive process. The good news is that it's easier to play defense than 
      offence. Good luck.  
      
      P.S. You do have good backups, don't you? 


      @HWA
      
43.0  TAIWAN CIRCLES WAGONS IN CYBER-WARFARE
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/
      
      by Thejian, Thursday 26th August 1999 on 11:40 pm CET
      A senior Ministry of National Defense official wednesday said that Taiwan is capable
      of defending itself from an information technology attack by China, but will not itself
      provoke a cyber war. The ministry has also set up a special task force to oversee the
      island's information warfare strategy, said the director of the ministry's Electronic
      Communications and Information Bureau. "China has put a lot of effort into building up
      its information capabilities in the past decade," Lin said. He added that Beijing has
      conducted a few military exercises to test its information warfare development. "But
      Taiwan is also working on it. We are not as fragile as many people think," he said.
      Read more below
      
      
      From Infowar.com
      
      http://www.infowar.com/mil_c4i/99/mil_c4i_082599c_j.shtml
     
      China: Taiwan Circles Wagons In Cyber-warfare.
 
      A senior Ministry of National Defense official said yesterday that Taiwan is capable of defending itself from an information technology attack by China,
      but will not itself provoke a cyber war. 
 
      The ministry has also set up a special task force to oversee the island's information warfare strategy, said Lin Ching-ching, the director of the ministry's
      Electronic Communications and Information Bureau. "China has put a lot of effort into building up its information capabilities in the past decade," Lin
      said. He added that Beijing has conducted a few military exercises to test its information warfare development. "But Taiwan is also working on it. We
      are not as fragile as many people think," he said. 
 
      A power outage that plunged four-fifths of the island into darkness on July 29 intensified Taiwanese people's fear of a Chinese military attack. But while
      those fears have gone unrealized, cross-strait tensions continued to rise in early August as hackers from both sides of the strait broke into each other's
      government websites to post provocative slogans and national flags. 
 
      The Internet battle also raised public questions as to whether Taiwan has the capability to handle what will be a future trend - information warfare which
      is widely viewed as a major challenge to the island's information technology. 
 
      Lin allayed such concerns, saying that Taiwan has the ability to counter China's information attack and has set up a military information warfare strategic
      policy committee as the highest decision-making body on the issue. 
 
      Lin said that none of the island's computer systems broke down during the blackout. Generally, man-made mistakes cause 70 percent of computer
      breakdowns on the island, he said. 
 
      "We have realized that killing viruses is not our top priority and a crisis-solving center should be established," he said. But because Taiwan has a limited
      national defense budget, everything must be cost-effective, said Lin. 
 
      According to Webster Chiang, the vice chairman of the Cabinet's Research, Development and Evaluation Commission, the maintenance and
      development of information protection systems accounts for only one percent of the national budget. 
 
      Chang Kwang-yuan, director of the information division at the National Security Bureau, said the bureau had tracked down 165 websites as the
      sources of hacking by mainland Chinese on August 7. He said the some of the websites were found to be government-operated but declined to identify
      whether the intrusions were orchestrated by the Chinese government or individual hackers. 
 
      Tang Yao-chung, an information science professor at National Taiwan University, suggested that the government devote more effort to the
      development of Taiwan's offensive computer warfare capabilities. "Developing coding abilities is a profitable business and should be done by private
      companies," said Tang. "But decoding and building offensive strategies are the government's responsibilities." 
 
      Lin said he does not encourage provoking China by Internet hacking, but said Taiwan is capable of standing firmly. 
 
      "On a legal basis, we don't encourage taking the offensive, although we do have the ability to handle any offensive aggression by China," said Lin. The
      cross-strait cyber war is likely to continue as more websites from both sides are hacked. While Taiwan is focusing on more military purchases, the
      incident provided a chance for Taiwan to re-examine its information security. 
 
      ASIA INTELLIGENCE WIRE 
      CHINA NEWS 17/08/1999 
 
       
      @HWA
      
44.0  UK WEBHOSTING COMPANY HIT BY VIRUS
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
     
      From http://www.net-security.org/
      
      by Thejian, Thursday 26th August 1999 on 11:15 pm CET
      UK-based Web hosting and development company Fortune Cookie Digital Media was
      subject to an attack by the Backdoor-G trojan yesterday, affecting approximately 10
      percent of the sites hosted according to the company. Full story      
      
      http://www.idg.net/idgns/1999/08/26/UKWebHostingCompanyHitBy.shtml
      
      U.K. Web hosting
      company hit by virus 
      by Douglas F. Gray, IDG News Service\London Bureau 
      August 26, 1999 

      U.K.-based Web hosting and development
      company Fortune Cookie Digital Media was
      subject to an attack by a "Trojan horse"
      virus yesterday, affecting a number of Web
      sites hosted by the company.

      Approximately 10 percent of the sites
      hosted by the company were infected with
      the virus, according to Justin Cooke, founder
      and managing director of Fortune Cookie.
      Earlier media reports quoted Cooke as
      stating the number as 30 percent, a figure
      which he now states was "probably an
      overestimation because [the situation] was
      still going on."

      The Trojan horse virus, called BackDoor-G,
      provided access to passwords that uploaded
      a second virus to the Web server, which
      then infected certain default documents,
      including default.htm and index.html,
      according to a press release issued by the
      U.K. company.

      Cooke admitted that some of the Web sites
      affected by the virus belonged to
      "small-to-medium companies," but he
      refused to name them.

      The company release claimed that "all
      affected Web sites were returned to normal
      operation" within 20 minutes.

      Fortune Cookie, in London, can be reached
      at http://www.fortune-cookie.com/.
      
      @HWA
      
45.0  NETSCAPE ISSUES WEB-SERVER FIX
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/
      
      
      by Thejian, Thursday 26th August 1999 on 10:50 pm CET
      Netscape and ISS X-Force have issued a patch for the buffer overflow problem in the
      Netscape Enterprise and FastTrack servers. ".. an attacker can exploit the
      vulnerability and remotely upload and execute arbitrary assembly language. An
      attacker can write an exploit to get the computer to do what ever they want.."
      according to X-Force director Chris Rouland. Infoworld has a story, Iplanet has a
      patch.       
      http://www.iplanet.com/downloads/patches/detail_12_86.html
      
      @HWA
      
46.0 CWI CRACKS 512 BIT KEY
     ~~~~~~~~~~~~~~~~~~~~~~ 
     
     From http://www.net-security.org/


     by Thejian, Thursday 26th August 1999 on 10:20 pm CET
     Researchers of the CWI in Amsterdam, Holland, today announced that they have
     been able to crack a 512 bit code. This ones more proves that this standard, which is
     still used on the Internet for e-commerce transactions a lot, just doesn't cut it. The
     technology they used (besides 300 workstations and Pentium II's :) will enable them
     to crack any 512 bit code in the future according to CWI.  
     
     @HWA
    
47.0 MOUNTING AN ANTI-VIRUS DEFENSE
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From http://www.net-security.org/ 
     
     
     by Thejian, Thursday 26th August 1999 on 10:00 pm CET
     With computer viruses on the rise, and in the wake of the 'Melissa' incident, anti-virus
     software becomes a part of the security arsenal. What's needed to keep the viruses
     out? Some firms present their ideas and solutions in this article. 
     
     Mounting an anti-virus defense

     With computer viruses on the rise, and in the wake of the
     'Melissa' incident, anti-virus software becomes a part of the
     security arsenal

     By Heather Harreld 

     Anti-virus software, which often was viewed as the
     security stepchild to sibling powerhouse technologies
     such as intrusion detection and firewalls, has been
     elevated to a new market status following the
     "Melissa" virus, which in March infected machines
     worldwide via e-mail. 

     Once sold mainly as a single desktop solution -
     which users often labored to disable or bypass -
     anti-virus software is being bundled with other
     security solutions designed to secure entire
     enterprises from security threats. Anti-virus software
     has emerged as an integral component of agency
     security efforts because viruses are more easily
     transmitted in today's networked world, and the viral
     breeding ground of the Internet has spurred
     phenomenal virus growth. 

     Although the majority of viruses in 1997 were
     transmitted by floppy disks, the major source of virus
     infections today are from e-mail attachments, which
     can be used to spread a virus at alarming speed. The
     Melissa virus affected more than 100,000 machines
     worldwide in just days by seizing users' computers
     and e-mailing copies of itself to the first 50 names in
     the e-mail address book. 

     In 1986, there was one known computer virus; in
     1990 that number had jumped to 80. From
     December 1998 to January 1999, the total virus
     count jumped from 20,500 to 36,500. Today, there
     are about 45,000 computer viruses in existence, with
     new ones appearing every day.

     "A lot of the virus attacks...are starting to blur the lines between [a virus or a
     vulnerability?]" said Sal Viveros, group product manager for Network
     Associates Inc.'s Total Virus Defense Division. 

     "It is much easier for a hacker to send an e-mail attachment than it is to
     penetrate a firewall. We're seeing more destructive viruses that are hitting
     more people." 

     Network Associates offers an anti-virus package that provides virus
     protection spanning the desktop, groupware and gateways, and it also has a
     security suite offering anti-virus software coupled with firewalls, intrusion
     detection and encryption. 

     Viveros said the common alerting and reporting mechanisms from the security
     suite enable a network administrator to react more quickly to problems. For
     example, if a hacker finds an open port and uses it to insert a virus,
     intrusion-detection and anti-virus software can work in tandem to provide an
     accurate picture of what is happening on a network. 

     "You're starting to have rules-based reactions," Viveros said. "You're taking
     away the need for the network administrator to be sitting there monitoring
     those different things when they happen. By setting rules, the different
     components are talking to each other." 

     Symantec Corp. in May announced its Digital Immune System, a strategy to
     capitalize on its anti-virus technology, while coupling it with intelligent tools
     designed to keep systems running at peak performance. With its anti-virus
     software, the company will offer tools for server management, desktop
     configuration, remote system operation and disaster recovery - all from a
     single console. 

     Chris Mills, Symantec's product manager for Digital Immune System, noted
     that the strategy will include advanced anti-virus management tools that enable
     a network administrator to lock down policy requirements on the desktop and
     configure virus responses that automatically go into effect upon detection. In
     addition, the company plans to add security mechanisms such as e-mail
     scanning, Uniform Resource Locator filtering and protection from malicious
     Java applets, he added. 

     "What [customers are] worried about are threats to their enterprise," Mills
     said. "It's not strictly an anti-virus concept. We're talking about protecting
     your enterprise from unknown threats that will negatively affect your
     credibility, your cost and your uptime." 

     Worldtalk Corp. has bundled multiple security mechanisms into its secure
     server product, which is being used by the Energy Department and the Food
     and Drug Administration. In addition to a server-based virus detection
     solution, the company also offers access control,which regulates who a user
     can send e-mail to and receive e-mail from, and encryption controls. 

     DOE's headquarters used Worldtalk's secure server to begin containing the
     potentially devastating Melissa virus before a fix was even discovered for it,
     said Charlie Smith, information management consultant at DOE. 

     Smith said that although many other anti-virus products provide the ability to
     disinfect incoming viruses before they are passed on to users, Worldtalk's
     server enabled him to program a policy that would target and quarantine any
     incoming e-mail with a specific message in its header. 

     "The quarantine allowed us to really track Melissa," Smith said. "It gave us a
     history to trace back to the originator." 

     Bill Mann, director of product management at Worldtalk, noted that the ability
     to program policies into the server also could be used to fend off potentially
     damaging mobile code, such as hostile Java applets, that users unknowingly
     can download from World Wide Web sites. 

     "Literally anything that can be done by a program can be done by mobile
     code," Mann said. "It can open database connections. It can install viruses on
     your PC. Mobile code gives the hackers so much more flexibility than virus
     writing." 

     It is not only traditional anti-virus and computer security companies that are
     homing in on technology to combat viruses. Companies targeting the
     electronic-commerce market are bundling anti-virus software with other
     computer security solutions. In July, Computer Associates International Inc.
     introduced its eTrust security solution, which bundles anti-virus technology
     with public-key infrastructure technology, encryption controls,
     intrusion-detection scanners, firewall components, network surveillance and
     authentication tools. 

     Kurt Ziegler, senior vice president for CA's security business, said the eTrust
     network surveillance component is crucial to containing viruses because users
     have not always updated their software to detect the latest viruses. Because
     these identification delays can de devastating, a containment strategy is crucial,
     he said. 

     "We include some technology that lets you identify movement, to get a
     pattern," Ziegler said. "It scans the network on the inside...so you can see a
     neighbor sending it to a neighbor inadvertently. Should you get an
     identification...you can quickly go back over the that traffic and say who's
     carrying what where." 

     Judith Spencer, director of the Center for Governmentwide Security at the
     General Services Administration, said the Melissa virus - combined with other
     incidents, such as a hacker group threat to target the federal government - has
     helped increase government security awareness. She noted that though
     anti-virus software is "indispensable" on systems today, it should be viewed as
     only part of an agency's security arsenal. 

     "Integrated security solutions are a good idea," Spencer said. "[But] the way
     that you implement security solutions as opposed to whether or not the
     product comes bundled is more important." 

     Bundling anti-virus software with security mechanisms located at the perimeter
     of a network is advantageous because everything coming in to the environment
     is checked, and network administrators do not have to worry if end users
     have updated their software, said Lance Travis, service director at
     Boston-based AMR Research Inc. However, that method also has its
     drawbacks, he noted. 

     "You're now scanning every e-mail message [and] every Web page that
     comes through your firewall," Travis said. "There's a huge performance
     penalty you could potentially pay." 

     Trend Micro Inc. is an anti-virus firm that has chosen not to bundle its
     anti-virus software with other security products. Instead, the company is
     designing its products so that they will interoperate with other key products
     needed for security, said Dan Schrader, Trend Micro's vice president of new
     technology. 

     Trend Micro offers an integrated border security approach, scanning for
     viruses at perimeter points such as e-mail servers and Internet gateways. That
     approach was designed to stop viruses and malicious code before they enter
     the network. 

     Trend Micro's anti-virus software is being used by the Department of Housing
     and Urban Development on 75 servers to support about 11,000 users. The
     product was designed to eliminate the expensive and disruptive "pre-

     emptive e-mail shutdown" strategy that many government agencies are forced
     to deploy when threatened with viral infection, Schrader said. 

     "You want to identify where key Internet traffic enters your organization and
     have the code scanner at those entry points," Schrader said. "Anything that
     relies on the end users for best practices is doomed to fail." 

     Many anti-virus vendors are moving to take control of the software away from
     end users, who notoriously try to bypass the software safeguard or forget to
     update it to protect from new viruses. But Roger Thompson, technical director
     of malicious code research at the International Computer Security
     Association, noted that anti-virus software still must be multilayered. 

     "If an infected document is attached to an e-mail, then something at the mail
     server or firewall wouldn't pick it up if the document was encrypted,"
     Thompson said. "You still have to have detection on the desktops." 

     Anti-virus software vendors may see the demand for their products increase
     even more in the future as virus-like threats to networks continue to grow. 

     William Orvis, security specialist at the Computer Incident Advisory
     Capability at Lawrence Livermore National Laboratory, noted that he is
     seeing an increasing incidence of worms - programs that crawl through
     networks, automatically making and distributing copies of themselves while
     installing dangerous back doors in systems as they move. As a result,
     unauthorized users can remotely control a system with a back door installed. 

     Anti-virus software can be designed to watch networks for worms. However,
     Orvis said products of the future will have to "intelligently" detect viruses that
     have never been seen before, instead of relying on tracking viruses by their
     "signatures," which is the most common viral-detection method today.

     "We need a way that we can have smart computer code...and say, 'That is
     probably a virus,' " Orvis said. "We need to learn to teach a machine to
     recognize a virus." 

      Harreld is a free-lance writer based in Cary, N.C.

      @HWA
     
48.0  RETROSPECTIVE ON CRACKING CONTESTS
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/  
       
      by BHZ, Thursday 26th August 1999 on 3:25 am CET
      We covered both Windows2000 and LinuxPPC cracking contests on HNS. Linux
      machine got one-tenth the number of attacks that the Microsoft server has endured.
      Neither of servers was compromised, and the companies said data stored within
      those servers has remained secure. ABC has an article on it. Read it here.     
      
       <insert>                        Microsoft and Linux PPC
                                       Engage in Testing
                                       One-Upsmanship 

                                       Microsoft put a bullseye on its Windows
                                       2000 operating system by inviting hackers
                                       to have a go at it. So far the system has
                                       crashed, but hackers haven't gained
                                       access. (A.Shepherd/ABCNEWS.com)



      By Michael J. Martinez
      ABCNEWS.com
      Aug. 24 — Three weeks ago, Microsoft engineers
      loaded up a server with Windows 2000 beta,
      connected it to the Internet and invited anyone
      who wanted to test its security by trying to
      break into it. 
           The next day two things happened: the Windows 2000
      operating system crashed because of a bug, and Linux
      PPC, a small company in Hales Corners, Wis., put up a
      server running a Linux-based operating system and issued
      the same invitation. 
           Since then, both servers have gone down due to
      various technical problems, though neither has been
      “cracked;” no one has been able to access the information
      stored on those servers. Both Microsoft and Linux PPC
      have claimed the tests demonstrate the security of their
      respective operating systems, though the frequency of
      problems on the Microsoft server has been a source of
      jokes among Linux enthusiasts. 

      Microsoft Puts On a Bullseye
      The new Windows 2000 operating system, due to be
      released in October, will replace Windows NT as
      Microsoft’s workstation and server operating systems for
      businesses. Despite a release schedule marred by
      numerous delays and in spite of the growth of popularity
      of competing systems — particularly those of Linux —
      Microsoft hopes the new operating system will be as
      broadly accepted as its predecessors. 
           So, on Aug. 2, Microsoft loaded a 500 MHz Pentium
      III server with Windows 2000 and the IIS Web server
      program, and linked it to the Internet. The system lacked
      a firewall — impermeable software designed to protect a
      system’s entry points — and was protected only by the
      security inherent to the Windows 2000 operating system. 
           The next day, router failures (not hackers) caused
      intermittent downtimes. The problems continued until Aug.
      14, the first day without downtime on the server. Since
      then, there have been three other disruptions. 
           On the test Web site, Microsoft managers note that no
      data has been taken from the machine — it still remains
      secure. In addition, a number of software bugs in the
      Windows 2000 software have been discovered and fixed.

      Linux Chimes In
      The day Microsoft announced its tests, the engineers at
      Linux PPC began receiving user e-mails wondering if the
      company would respond in kind. Linux PPC is different
      from other Linux distributors; its OS is made for
      Macintoshes instead of the usual IBM clones. 
           “The response from our users was enormous,” says
      Marcia Knapp, business manager for the company. “They
      were confident that our software could withstand much
      more than Microsoft’s, so we decided to put a box up.” 
           The Linux PPC machine is a far cry from the high-end
      server Microsoft is using. The company is using a 132
      MHz Power Macintosh with just 160 MB of RAM, and
      the machine is running an open-source Apache Web
      server. 
           Yet the Linux machine has only gone down twice —
      and one of those times was because someone tripped on
      a cord. The other time was because of a successful denial
      of service attack — the server was crashed not because
      of a security breach, but because someone attempted to
      overload it with meaningless data. 

      Under Attack
      It should be noted that the Linux machine is getting
      one-tenth the number of attacks that the Microsoft server
      has endured — and that the Windows 2000 operating
      system is still in beta, and is due for more debugging once
      it has been released. 
           Still, both sides claim the data stored within those
      servers has remained secure. It may have been just
      another PR stunt. But once again Microsoft comes out
      looking like a giant with egg on his face — egg tossed by
      a tiny rival in Wisconsin.

      @HWA
      
      
49.0  SHOUTCAST COMPROMISED
      ~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/  
      
      by BHZ, Wednesday 25th August 1999 on 10:39 pm CET
      ShoutCAST (yp.shoutcast.com) - online directory of sites that offer you listening MP3
      music on-line, has been compromised earlier today. Attacker just changed info for the
      best ranked sites to: " [skillz] MadCamel 0wns Nullsoft Now Playing: Greetz arr0w
      listeners -31337/31337 Bitrate - 666 and added an additional link to
      www.rootshell.com.      
      
      @HWA
      
50.0  AUDIT OFFICE BLASTS AGENCIES' SERIOUS SECURITY FLAWS
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
      
      From http://www.net-security.org/  
      
      by Thejian, Wednesday 25th August 1999 on 11:05 am CET
      A damning report from the Australian National Audit Office (ANAO), entitled
      "Operation of the Classification System for Protecting Sensitive Information", has
      reveiled serious flaws in the IT security arrangements of six unnamed Australian
      commonwealth government agencies. The audited agencies all had sensitive
      information to protect, with three of the six responsible for protecting national security
      information. Read more.            
      
      http://www2.idg.com.au/CWT1997.nsf/Home+page/4C49A498F5EBCD6F4A2567D70021F2FE?OpenDocument
      
      Audit Office blasts agencies'
      serious IT security flaws 

      By Laura Mason 
      25 August, 1999 

      SYDNEY - A damning report from Australian
      National Audit Office (ANAO) has revealed
      serious flaws in the IT security arrangements of six
      commonwealth government agencies. 
      Entitled 'Operation of The Classification System for
      Protecting Sensitive Information' the report reveals
      that the IT&T environments of the six unnamed
      agencies the ANAO audited have inadequate
      security protection levels.
      The audited agencies all had sensitive information
      to protect, with three of the six respon-sible for
      protecting national security information. "Paper and
      electronic files were often exposed to unauthorised
      access because of various breakdowns in the
      protection of information in use or in transmission,"
      states the report, which was tabled this month.
      Common breakdowns included "sensitive
      information stored on insecure electronic networks,
      and computers left on without the protection of
      screen saver passwords."
      All six of the agencies hold sensitive information in
      both electronic and paper-based form, with two of
      the six agencies operating secure networks, and
      two running mainframes with large databases.
      The audit found that agencies operating
      mainframes, with high-volume transaction
      processing, had better IT security than
      organisations with a LAN based environment,
      however those with mainframes were found to have
      weaknesses in their LAN environment.
      According to the report, "The access management
      controls on local area networks (LANs) were often
      not configured or implemented in accordance with
      ACSI 33 (the Australian Communications
      Electronic Security Instrucions 33 -- a Defence
      Signal Directorate's publication). 
      Areas requiring attention include passwords, the
      number of log-on attempts and inactive user
      accounts. 
      These weaknesses are of concern as all the
      networks carried sensitive information.
      "The audit found that more attention needs to be
      given to establishing effective monitoring and
      review processes, particularly in relation to IT&T
      audit trails to ensure security policies and
      procedures are operating as management
      intended," said the report.
      According to ANAO, all six agencies audited are
      failing to give sensitive information adequate
      protection.
      Dean Kingsley, Partner, Secure e-business at
      Deloitte Touche Tohmatsu, commented that for
      many organisations IT security, outside the context
      of e commmerce, was "way down the priority list"
      since it was viewed as an overhead rather than an
      enabler. 

      @HWA
      
51.0 ISS X-FORCE ADVISORY ON LOTUS NOTES DOMINO SERVER 4.6
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From http://www.net-security.org/  
     
     by Thejian, Tuesday 24th August 1999 on 10:05 pm CET
     ISS X-force reports a denial of service attack against the integrated messaging and
     web application server, because of an overflow problem in the Notes LDAP Service.
     Your are recommended to upgrade to Maintenance release 4.6.6 or 5.0. Here is the
     complete advisory.       
     
     http://xforce.iss.net/alerts/advise34.php3

     ISS Security Advisory
     August 23, 1999

     Denial of Service Attack against Lotus Notes Domino Server 4.6

     Synopsis:

     Lotus Domino Server is an integrated messaging and web application
     server. An attacker can crash the Lotus Notes Domino server and stop
     e-mail and other services that Domino provides for an organization.

     Description:

     There is an overflow problem in the Notes LDAP Service (NLDAP); the
     service that handles the LDAP protocol. This overflow is related to the
     way that NLDAP handles the ldap_search request. By sending a large amount of
     data to the parameter in the ldap_search request, an attacker can cause a
     PANIC in the Domino Server. This will allow an attacker to stop all Domino
     services running on the affected machine.

     Affected Versions: Lotus Notes Domino server 4.6.

     Recommended Action: Upgrade to Maintenance release 4.6.6 or 5.0.

     Additional Information:

     Information in this advisory was obtained by the research of Caleb Sima
     <csima@iss.net> of the ISS X-Force. ISS X-Force would like to thank Lotus
     Development Corporation for their response and handling of this
     vulnerability.

     ________


     About ISS:

     ISS leads the market as the source for e-business risk management
     solutions, serving as a trusted security provider to thousands of
     organizations including 21 of the 25 largest U.S. commercial banks and
     more than 35 government agencies. With its Adaptive Security Management
     approach, ISS empowers organizations to measure and manage enterprise
     security risks within Intranet, extranet and electronic commerce
     environments. Its award-winning SAFEsuite(r) product line of intrusion
     detection, vulnerability management and decision support solutions are
     vital for protection in today's world of global connectivity, enabling
     organizations to proactively monitor, detect and respond to security
     risks. Founded in 1994, ISS is headquartered in Atlanta, GA with
     additional offices throughout the U.S. and international operations in
     Australia/New Zealand, Belgium, France, Germany, Japan, Latin America and
     the UK. For more information, visit the ISS Web site at www.iss.net or
     call 800-776-2362.

     Copyright (c) 1999 by Internet Security Systems, Inc.

     Permission is hereby granted for the redistribution of this Alert
     electronically.  It is not to be edited in any way without express consent
     of the X-Force.  If you wish to reprint the whole or any part of this
     Alert in any other medium excluding electronic medium, please e-mail
     xforce@iss.net for permission.

     Disclaimer

     The information within this paper may change without notice. Use of this
     information constitutes acceptance for use in an AS IS condition. There
     are NO warranties with regard to this information. In no event shall the
     author be liable for any damages whatsoever arising out of or in
     connection with the use or spread of this information. Any use of this
     information is at the user's own risk.

     X-Force PGP Key available at: http://xforce.iss.net/sensitive.php3 as
     well as on MIT's PGP key server and PGP.com's key server.

     Please send suggestions, updates, and comments to: X-Force xforce@iss.net
       of Internet Security Systems, Inc.
      
      
      @HWA
     
52.0  TECHNOLOGY KEY TO TRACKING DOWN INTERNET CRIME
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/  
      
      
      by Thejian, Tuesday 24th August 1999 on 9:45 pm CET
      A recently formed working group focused on rooting out Internet-related crime may
      model technologies that law enforcement agencies use to sift through the Internet to
      keep tabs on online illegal activity. As we reported earlier, US president Clinton this
      month established the working group to examine how law enforcement agencies can
      better investigate and prosecute criminal activities conducted on the Internet. Among
      other things, the group will scrutinize the ways in which the government uses
      technology to crack down on Internet-related crime. The FBI is expected to take the
      lead in developing technology that the federal government will use to comb the
      Internet in search of criminal activity. Full story 
      
      
      AUGUST 23, 1999 


      Technology key to tracking down Internet crime

      BY DOUG BROWN (dbrown@fcw.com)

      A recently formed working group focused on rooting out Internet-related
      crime may model technologies that law enforcement agencies use to sift
      through the Internet to keep tabs on online illegal activity.

      President Clinton this month established the working group, made up of top
      government officials, to examine how law enforcement agencies can better
      investigate and prosecute criminal activities conducted on the Internet, such as
      the online sale of guns and illegal drugs, fraud and the peddling of child
      pornography.

      The Clinton administration decided to form the group because there was
      "recognition within the government that there were some real issues"
      concerning computer crime that needed to be addressed, a White House
      official said. "There was an explosion [of legislation] at both the federal and
      the state level, and there was concern that if we passed a lot of legislation
      without taking a systematic look at this, we would end up with a haphazard
      approach to the problem."

      Among other things, the group will scrutinize the ways in which the
      government uses technology to crack down on Internet-related crime.
      Understanding the technologies agencies use now, the White House official
      said, will help the administration decide how it can improve the investigation
      and prosecution of online criminal activity in the future.

      Some helpful technology applications may come from the FBI, a
      representative from which will serve on the task force. The FBI is expected to
      take the lead in developing technology that the federal government will use to
      comb the Internet in search of criminal activity.

      The FBI's Baltimore field office leads a project called Innocent Images, which
      works to identify and arrest online sexual predators. About 20 agents are
      assigned to the project full time, said Special Agent Barry Maddox, a
      spokesman for the field office. Hundreds of other agents and local law
      enforcement officials in cities nationwide also work with Innocent Images.

      The agents join online chat groups about pedophilia or child pornography and
      also pose as children to try to catch pedophiles who attempt to set up
      face-to-face meetings. The program, which was established in 1995, has led
      to 378 arrests and 322 convictions, Maddox said.

      Advancements developed elsewhere in the FBI also may be considered by
      the administration's working group. Such developments include the
      soon-to-be launched computer crimes squad, which will investigate crimes
      committed by hackers, and the National Infrastructure Protection Center,
      which works to prevent people or groups from hacking into vital government
      systems that operate such things as water supplies and transportation systems.

      The group also may look at increasingly sophisticated and powerful Internet
      search engines as a way to sniff out Internet-related crime, said Rich Kellett,
      director of the General Services Administration's Emerging Information
      Technologies Policies Division.

      With some companies laboring to "store everything that is on the Internet,"
      Kellett said, "you can imagine what kind of base of information you could put
      together" with such databases. Combining powerful search engines with
      enormous databases would provide "interesting cross-sections of what is
      going on in America, including criminal activity."

      Kellett also mentioned the Search for Extraterrestrial Intelligence, a project
      involving more than 800,000 computers networked together that share
      information about radio signals and work together to compute algorithms in
      the hope of pinpointing evidence of life in outer space. A model like this, he
      said, could be used to sift through Internet data in search of criminal activity.

      One problem with such massive undertakings, he said, is that "the use of all of
      that information and sorting through it all has tremendous public policy issues,
      in terms of privacy," Kellett said.

      Daniel Boyle, SAS Institute Inc.'s director of the Defense Department and
      defense intelligence, said the working group likely will consider different ways
      of using data mining to deal with online criminal activity. The SAS Institute,
      Cary, N.C., is a major supplier of custom software to the federal government.

      With a tidal wave of data coursing through the Internet every day, it would be
      impossible to successfully locate criminal activity just through pointing and
      clicking a mouse, Boyle said. What is needed are data-mining software tools
      that sift through data in search of anomalies or patterns - things that "don't
      look quite right," he said. "They've got to find them first, and one of the
      techniques is data mining."

      Of use to government investigators, he said, might be "dump logs," or records
      of people who have visited individual World Wide Web sites. Servers, he
      said, "create volumes of these logs, [which] are tremendous and...exploding
      every day." The logs are used by private companies to see who is visiting their
      sites, but they also could be useful in tracking crime, he said.

      Ari Schwartz, a policy analyst at the Washington, D.C.-based Center for
      Democracy and Technology, cautioned working group members to keep
      privacy concerns in mind when they draft their report, which is due in
      December.

      "This discussion could lead to a whole new set of monitoring tools," he said.
      "We hope this doesn't change the way people surf the Net. We don't want to
      have people think government is monitoring their lives."

      Because it is so open, the Internet already has a vital monitoring system in
      place: the eyes of the millions of people clicking throughout cyberspace. New
      monitoring tools, he said, may be superfluous.

      The government is considering a plan to monitor many non-DOD computers
      for signs of intrusion. In its quest to protect government computers from
      outside attacks, the proposed plan, called the Federal Intrusion Detection
      Network, unnecessarily sacrifices privacy, Schwartz said. 
        
      @HWA
      
    
53.0  GOVT HOME-INVASION BILL DRIVES US PC USERS TO CANADA
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/  
      
      by Thejian, Tuesday 24th August 1999 on 9:20 pm CET
      The recently proposed and already very much discussed US Justice Department bill
      that would allow police to secretly enter homes and disable security features on
      computers has driven tens of thousands of Americans to request privacy protection in
      the form of the Freedom product from Canadian firm Zero-Knowledge Systems, the
      company announced today. Newsbytes     
      
      Govt Home Invasion Bill Drives US PC Users To Canada 


      By Martin Stone, Newsbytes
      MONTREAL, QUEBEC, CANADA, 
      24 Aug 1999, 12:09 PM CST

      A proposed US Justice Department bill that would allow police to secretly enter homes and disable security features on
      computers has driven tens of thousands of Americans to request privacy protection from Canadian firm Zero-Knowledge
      Systems, the company announced today. 

      "This has created a huge wave of concern among computer users in the US," said Zero-Knowledge President Austin Hill, of
      the proposed legislation. 

      Hill told Newsbytes that, when news of the proposed measure broke last Thursday, his office was flooded with calls and
      messages from American Internet users inquiring about the availability of his company's security system, called Freedom,
      which uses a sophisticated network of encoding and remote servers to obscure Internet "trails." 

      "We've received e-mail, telephone messages, and thousands of Freedom beta sign-ups from people looking to secure their
      privacy. It's highly ironic that a Canadian company is being flooded by requests to protect American citizens from their own
      government," Hill said. 

      Zero-Knowledge is presently beta-testing its Freedom technology, which provides total privacy for Web, e-mail, newsgroup,
      and chat-room activities by encrypting data and rerouting it through independently-operated servers scattered worldwide. 

      Hill says an improved beta version will soon enter testing and that, based on the latest flood of interest, his company is
      scaling-up to accommodate, what he says will be, "millions and millions of computer-users all over the world" once the
      product hits the market later this year. 

      The system has been called "the only fully trustworthy privacy solution" by some privacy advocates. 

      According to reports published last week, the Justice Department will seek authorization through the Cyberspace Electronic
      Security Act for FBI and local police to covertly enter private homes and disable computer encryption programs. The
      proposal would dramatically increase police powers by allowing agents to tamper with personal computers to surreptitiously
      monitor personal communications. 

      "It's disappointing that US consumers must look to other countries for protection from a government they feel is overstepping
      its investigative authority," David Sobel, general counsel for the Electronic Privacy Information Center in Washington, told Hill
      following the announcement of the proposed bill. "The United States should be in the forefront of privacy technology, not
      trying to circumvent it." 

      Montreal-based Zero-Knowledge says it benefits from Canada's support for the development of strong privacy solutions, in
      contrast with what it says is the US government's stringent controls on encryption and privacy technologies. 

      Hill says that, because his company's system masks electronic trails, law enforcement agencies would not be able to
      identify computers from which possibly unlawful transmissions were being made, so they would be unable to identify which
      house to enter under the proposed legislation. He says his system would discourage "fishing expeditions" which could result
      from the projected bill. 

      More information on the Zero-Knowledge technology can be found at http://www.zeroknowledge.com 

      Reported by Newsbytes.com, http://www.newsbytes.com 

      12:09 CST
      Reposted 18:09 CST 
       
      @HWA
      
54.0  HACKERS SCANNING FOR TROUBLE
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.net-security.org/  
      
      by Thejian, Tuesday 24th August 1999 on 9:00 pm CET
      Every day they come, they lurk -- then they leave without doing damage. They come
      through clients' computers, through Canadian ISPs, they hack into Linux boxes, NT
      boxes, Unix boxes. Hack by day or night, but they only look and don't touch. These
      kinds of vulnerability scan attacks are causing concern and also bring up some
      murky legal issues. Dragos Ruiu wrote a report for SecurityFocus and ZDNet has a
      story on it.       
      
      --------------------------------------------------------------
      This story was printed from ZDNN,
      located at http://www.zdnet.com/zdnn.
      --------------------------------------------------------------
      
      Hackers scanning for trouble
      By Bob Sullivan, MSNBC
      August 24, 1999 5:38 AM PT
      URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2319298,00.html
      
      Dragos Ruiu was just minding his own business, a Vancouver software startup, when it started.
      Day after day, relentlessly, someone or some group out there on the Internet is banging away at
      his servers, sneaking in and gaining full access. A security expert, he knows what's happening:
      He's being probed. Is this mere sport, or a "casing," like a bank robber who visits the bank several
      times to study its security systems before the heist? 
      
      Every day they come, they lurk -- then they leave without doing damage. And Ruiu is powerless
      to stop it. Every method he has tried, they have trumped. They're toying with him. "They must feel
      like gods," he says. 
      
      They come at him through clients' computers, through Canadian ISPs, once even through one of
      the largest Canadian banks. They hack into Linux boxes, NT boxes, Unix boxes. Hack by day or
      night. No matter. 
      
      And all for no apparent reason. They look, but don't touch. 
      
      Ah, the life of a network administrator these days. There are thousands of ways to break into a
      computer, and there are now several downloadable software packages designed to scan the
      Internet for Web sites and servers that have just one flaw. 
      
      According to Peter Tippett at computer security research firm ICSA, a new box connected to the
      Net will almost certainly be "scanned" before one week goes by. And the amount of scanning
      activity has doubled in the past six months. 
      
      That's about when the scanning started for Brandon Pepelea, a former employee at PSINet who
      says his collection of Web sites has been scanned systematically several times a week since
      January. In another example of a victimless probe, Pepelea thinks someone or something has been
      banging through all the Internet addresses between 38.240.x.x and 38.200.x.x, a so-called
      Class-B range of addresses that constitute about 16,000 possible computers. 
      
                          In his case, the scans were unsuccessful. Whoever or whatever it is, they
                          haven't been able to break into Pepelea's computers. Still, the relentless,
                          systematic nature of the probe has him spooked. He's been demanding
      that PSINet, which owns all the addresses in the 38.x.x.x range, chase down the scanner and
      prosecute. 
      
      "I don't think they understand how serious it is," Pepelea said. "The threat not so much being the
      nature of the scan but the scope of the scan... If you're between 38.240 and 38.200 you've had
      the scans. They've walked through and gotten to you." 
      
      Nose for trouble
      The attack itself involves use of the Simple Network Management Protocol, frequently used on
      network routers. Pepelea owns machines between the 38.240 and 38.200 address range, and
      concluded scans spanned that range by studying patterns of hits to his own and his client's
      machines. 
      
      This is not the first time Pepelea, now CEO of a small security company he calls "Designer's
      Dream," has done a hefty amount of personal cybersleuthing. Last December, he compiled
      information on a virus writer named VicodinES, and shared it with the FBI, the CIA and other law
      enforcement agencies. His tips fell on deaf ears, and VicodinES, who the world now knows as
      Dave Smith, went on to release the Melissa virus. Pepelea's hell bent on being heard this time
      around. "Once again, nobody cares," he laments. 
      
      PSINet said early last week the scans were being generated by an account serviced by the
      company, and that it had dealt with the matter by canceling the account. But by Friday, the
      company had canceled three more accounts in an effort to stop the probes. While officials there
      say they take the matter seriously, they are not convinced it's an organized hacker attack. 
      
      "It's not possible to characterize whether this is a mistake, a malicious event, was planned, or it
      just happened," said Cole Libby, Director of Network Engineering. For example, it could a
      wrongly configured piece of hardware searching a section of the Internet for a new printer. "There
      are lots of examples of technology out of control in the world." 
      
      No harm, no foul?
      Scanning, the cyberspace equivalent of walking down Main Street and jiggling handles to see who
      leaves the front door unlocked, brings up murky legal issues. Entering someone else's computer is
      illegal, but scanning, which amounts to asking a computer how it's been set up, probably isn't.
      Pepelea says PSINet told him to pursue legal action against his cyberpest -- but for what?
      Meanwhile, Pepelea thinks PSINet should be liable if any real trouble ever comes from his
      suspected hacker, particularly since the Net provider was warned. 
      
      That's not likely, says Internet law expert Dorsey Morrow. PSINet would almost certainly face no
      criminal liability for the actions of a hacker on their network, and wouldn't likely face civil liability
      either. 
      
      "As long as they can show 'We were doing everything we can. We've got security policies in
      place. We're using the latest software.' That mounts up to a pretty good defense," Morrow said. 
      
      So there's no consequences for scanning, either to the hacker or the company that provides the
      means. But what of Ruiu's hackers, who go just one step further than Pepelea's scanners? They
      scan, then enter, lurk around, and leave. Dancing tantalizingly over the edge of the law, they show
      an ability to do far more damage. 
      
      Their methods are painstakingly deliberate, designed to avoid detection. They launch attacks from
      multiple sites, sometimes sending no more than a packet per day from any site, in order to hide the
      kind of suspicious activity protective "sniffer" programs look for. 
      
      "We saw one new machine coming at us every five minutes," Ruiu said. "They must have felt like
      gods because they could break into any machine they wanted." 
      
      That includes a collection of Canadian ISPs, and even one major Canadian bank, the hackers
      broke into. When he called, Ruiu often had a tough time convincing victimized ISP administrators
      they'd been hacked. 
      
      "The reaction of ISPs was disbelief," he said. "One didn't believe us until a marketing guy had his
      laptop taken out and it started sending weird packets." 
      
      Ruiu is convinced the hacks are coming from a coordinated team, because of their speed and
      variety. But while the cat-and-mouse game continues, he can only speculate on motive. His
      company, a 15-person startup called Netsentry.net, is hardly a big target. So Ruiu thinks his
      outside efforts in the security community are likely to blame. He recently worked on project called
      "Trinux," which aimed to create a security-enhanced version of Linux that fits on one floppy disk.
      Among his partners was Ken Williams, who until recently ran Packet Storm Security, perhaps the
      most popular reference site in the hacker community. 
      
      "I suspect these guys are targeting security software," he said, but added they have not revealed
      their intentions. "This is really bugging me. The lack of a motive really disturbs me…it gave me the
      creeps." 
      
      The attacks have also been humbling for Ruiu, who has spent a lot of time chasing the hackers
      when he could be working to get his business off the ground. 
      
      "There are a lot of assumptions we're all making about Internet security that we shouldn't," he said.
      "There's a lot of things we don't know." 
      
      For example, these hackers made a habit of hijacking machines Ruiu's computers normally talked
      to, then initiated attacks from these supposedly "friendly" computers. That made them almost
      impossible to detect. 
      
      "If they get a machine that's close to your machine, that's almost as bad as taking over your Web
      server. It's a great place to launch an attack on your firewall," he said. 
      
      Nothing about Ruiu or Pepelea's stories surprised ICSA's Tippett, who expects security problems
      to get worse before they get better. 
      
      "It's the wild, wild West out there," he said. "The tools are pervasive and so common. The chance
      of getting caught is pretty slim… Our neighbors are now very close and enough of them don't have
      a great social conscience." 
      
      A more extensive report on the one of these attacks, written by Ruiu, can be found at
      www.securityfocus.com. 
      
      @HWA
      
55.0  Canada Net they've built a super fast network, but what to do with it?
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      The Great Wired North 


      Canada Builds the World’s
      Fastest Network — And
      Wonders How to Use It 

      Canada’s new CA*Net3 research network
      will link government, business and
      universties across the country with a 100
      percent fiber-optic network 
      and then what? (ABCNEWS.com)



                      By Michael J. Martinez
                      ABCNEWS.com
                      Aug. 27 — What if there were a
                      brand-new, fiber-optic,
                      blazingly fast, nationwide
                      computer network — and no
                      one knew quite what to do
                      with it? 
                           Using a $55 million grant from the
      Canadian government, a consortium of universities and
      businesses has fashioned a next-generation, Internet-style
      network, stretching from Nova Scotia to British Columbia.
      So speedy is CA*Net3, as the network is called, that the
      entire contents of the U.S. Library of Congress could be
      transmitted from one end of Canada to the other in just one
      second. 
           In the United States, the Internet2 project can handle
      that kind of load — but it still takes a full minute for a
      bicoastal download. 
           Canada hopes to use this world’s fastest nationwide
      network to stake its claim to the high-tech future. Unlike
      Internet2, however, CA*Net3 is finding it difficult to attract
      researchers who can use the brand-new network. 
           “Nobody knows what we’re going to use this for,” says
      Alan Greenberg, director of computing at McGill University
      in Montreal. “But that’s the reason you build these things
      — so that people can find new ways to do things.” 

      Pure Optics
      Unlike other research networks, including the ARPANet
      system that formed the basis for today’s Internet, CA*Net3
      is completely optical — no telephone lines are used.
      Instead, the Canadian government stretched fiber-optic
      cable across the country, linking it to 11 “gigapops,”
      network hubs that serve as switching stations for billions of
      bits of data per second. 
           Other networks, including Internet2 and the
      Next-Generation Internet project in the United States, also
      use backup layers, in addition to fiber optics, to ensure that
      data will continue to flow if the fiber-optic cables are cut or
      disrupted. However, CA*Net3 doesn’t have those backups.
      Instead, data are automatically rerouted at the gigapops if a
      disruption is detected. Rerouting uses network rings —
      loops of cable interconnected with the gigapops. 
           “In our network rings, we automatically use both sides
      of the ring in transmitting data,” says Bill St. Arnaud, the
      senior director of network projects for the Canadian
      Network for the Advancement of Research, Industry and
      Education (Canarie), which is running CA*Net3. “Thus, if
      one side of the loop goes down, the other side can pick up
      the slack.” 

      Rainbow of Data
      CA*Net3 also employs new technology that allows
      different wavelengths of light to be transmitted along the
      same fiber-optic cable. By using eight colors of light, the
      amount of data sent through the cable can be increased by
      a factor of eight. 
           That means 80 gigabits of data per second can be
      transmitted through CA*Net3 every second. That’s 1.4
      million times faster than the download speed of a 56K
      modem, and about 60 times faster than America’s Internet2
      project. 
           And it could improve even more, St. Arnaud says.
      Theoretically, an infinite number of wavelengths of light
      could pass through a fiber-optic cable without interfering
      with each other. Right now, researchers are working on
      transmitting data on 2,000 wavelengths — somewhere in
      the neighborhood of 20,000 gigabits or 20 terabits. 

      Filling the Pipe
      Now all that’s needed are applications to make use of such
      huge bandwidth. 
           “Everyone is used to dealing with small bandwidth,”
      Greenberg says. “They’re still trying to figure out how best
      to use this really big pipe they’ve been handed.” 
           A few ideas have been advanced. Canada’s national
      human genome project, an effort to map all the DNA in the
      human body, is using CA*Net3 to link 40 powerful
      computers to perform necessary calculations. 
           The Canadian National Film Board is also using the
      network, to create an on-demand movie jukebox.
      Computers linked to CA*Net3 can request one of 700
      movies currently online. The film board’s server controls a
      robotic arm that can select and play the DVD-ROM of the
      film, sending it over CA*Net3. 
           In the next few years, St. Arnaud hopes to link public
      schools to the new network, using only fiber-optic cables
      and giving schools total access to the immense amount of
      bandwidth available. From there, it’s easy to envision
      connecting every Canadian home to the optical network.
      With an increase in the number of light wavelengths
      available, there will be enough bandwidth for generations. 
           And what they’ll do with it is anyone’s guess. 
           
      @HWA     
      
56.0  Security Focus' BUGTRAQ summary
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Security Focus News, Issue 3, 1999-08-16 to 1999-08-22



      II. BUGTRAQ SUMMARY 1999-08-16 to 1999-08-22
      ----------------------------------------
      
      
      1. SuSE identd Denial of Service Attack
      Bugtraq ID: 587
      Remote: Yes
      Date Published: 1999-08-16
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=587
      Summary:
      In certain distributions of SuSE Linux the in.identd daemon is started
      with an option that causes one identd process waits 120 seconds
      after answering the first request to answer the next request. If a
      malicious remote attacker starts a large number of ident requests in
      a short period of time it will force the target machine to start multiple
      daemons. This can lead the machine to starve itself of memory
      resulting essentially in a machine halt.
      
      
      
      2: Microsoft IIS And PWS 8.3 Directory Name Vulnerability
      Bugtraq ID: 582
      Remote: Yes
      Date Published: 1999-08-16
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=582
      Summary:
      In Microsoft's IIS and PWS, requesting the 8.3 filename version of a
      directory effectively bypasses the security attributes that are
      referenced to the full, long version of the filename, with permissions
      being based instead on those of the parent directory. Successful
      exploitation of this vulnerability could lead not only to unathorized
      directory listings, but also to the remote execution of
      'protected' scripts.
      
      
      
      3: Multiple Vendor 8.3 Directory Name Vulnerability
      Bugtraq ID: 584
      Remote: Yes
      Date Published: 1999-08-16
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=584
      Summary:
      In the Netscape, vqServer and Xitami webservers, restrictions applied to
      directories with long filenames will be ignored if the 8.3
      version of the filename is requested. In Serv-U, the 'cwd' and 'site exec'
      commands are susceptible to a similar vulnerability. Other
      Windows32-based HTTP and FTP servers may have the same or similar
      vulnerabilities.
      
      
      
      4: Microsoft Windows 98 IE5/Telnet Heap Overflow Vulnerability
      Bugtraq ID: 586
      Remote: Yes
      Date Published: 1999-08-16
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=586
      Summary:
      Windows 98 systems running specific versions of IE5 (5.00.2314.1003 and
      5.00.2314.1003IC) are susceptible to a remote vulnerability that
      allows the execution of arbitrary code on a target that views a malicious
      web page. This vulnerability is due to a combination of two different
      weaknesses, one in telnet.exe and one in the latest versions of IE5.
      
      
      
      
      5: Oracle Intelligent Agent Vulnerability
      Bugtraq ID: 585
      Remote: Yes
      Date Published: 1999-08-16
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=585
      Summary:
      Oracle installations with the 'Oracle Intelligent Agent' installed have a
      path related vulnerability. The problem lies in the dbsnmp
      program located in $ORACLE_HOME/bin . This setuid root program calls a tcl
      script ( nmiconf.tcl ) located by default in
      $ORACLE_HOME/network/agent/config. The problem is that the dbsnmp script
      relies on an environment variable (the path to nmiconf.tcl) which can be a
      set by a user. Therefore, intruders can force the script to execute a
      trojaned version of nmiconf.tcl which will run as root.
      
      
      
      6: xmonisdn IFS/PATH Vulnerability
      Bugtraq ID: 583
      Remote: No
      Date Published: 1999-08-16
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=583
      Summary:
      Xmonisdn is an X applet that shows the status of the ISDN links which
      ships with the isndutils package from Debian GNU/Linux 2.1. You can
      configure it to run two scripts when the left or right mouse button are
      clicked on it. Xmonisdn was installed setuid root so that the scripts
      could do things like add and delete the default route. However is that
      while the scripts were checked for owner root and not writeable by group
      or others the scripts are run via the system() library function, which
      spawns a shell to run it. This means that the scripts are open to attack
      via IFS and/or PATH manipulation.
      Debian has made patches available at the following locations:
      http://security.debian.org/dists/stable/updates/binary-alpha/isdnutils_3.0-12slink13_alpha.deb
      http://security.debian.org/dists/stable/updates/binary-i386/isdnutils_3.0-12slink13_i386.deb
      http://security.debian.org/dists/stable/updates/binary-sparc/isdnutils_3.0-12slink13_sparc.deb
      
      
      
      7: Mini SQL w3-msql Vulnerability
      Bugtraq ID: 591
      Remote: Yes
      Date Published: 1999-08-18
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=591
      Summary:
      Under certian versions of Mini SQL, the w3-msql CGI script allows users to
      view directories which are set for private access via .htaccess files.
      Version 2.0.11 of the Mini SQL Server contains a fix for this problem.
      Details available at:
      http://support.Hughes.com.au/cgi-bin/hughes
      
      
      
      8: AIX Source Code Browser Buffer Overflow Vulnerability
      Bugtraq ID: 590
      Remote: Yes
      Date Published: 1999-08-18
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=590
      Summary:
      A buffer overflow vulnerability has been discovered in the Source Code
      Browser's Program Database Name Server Daemon (pdnsd) of versions 2 and 3
      of IBM's C Set ++ for AIX. This vulnerability allows local and remote
      users to gain root access. While IBM no longer supports the affected
      versions, there is a workaround available at the above URL.
      
      
      
      9: BSDI Symmetric Multiprocessing (SMP) Vulnerability
      Bugtraq ID: 589
      Remote: No
      Date Published: 1999-08-18
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=589
      Summary:
      A vulnerability exists in BSDi 4.0.1 Symmetric Multiprocessing (SMP).
      During high CPU usage it is possible to cause BSDi 4.0.1 (possibly others
      but untested) with all current patches to stop responding and 'lock up'
      when a call to fstat is made.
      
      
      
      10: Redhat Linux tgetent() Buffer Overflow
      Bugtraq ID: 588
      Remote: No
      Date Published: 1999-08-18
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=588
      Summary:
      A buffer overflow existed in libtermcap's tgetent() function, which could
      cause the user to execute arbitrary code if they were able to supply their
      own termcap file.
      Red Hat has released a series of rpms to solve this issue. Please see
      'solution' at the above URL for more information.
      
      
      
      11: Linux in.telnetd Denial of Service Vulnerability
      Bugtraq ID: 594
      Remote: Yes
      Date Published: 1999-08-19
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=594
      Summary:
      When a telnet client connects to in.telnetd, the two attempt to negotiate
      a compatible terminal type (via the TERM environment variable). When the
      TERM variable in the client is set before connecting, it's possible that,
      depending on what TERM was set to, a denial of service can be caused.
      Red Hat has released a series of rpms to solve this issue. Please see
      'solution' at the above URL for more information.
      
      
      
      12:QMS 2060 Printer Passwordless Root Vulnerability
      Bugtraq ID: 593
      Remote: Yes
      Date Published: 1999-08-19
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=593
      Summary:
      Access to the QMS 2060 printer is controlled by the passwd.ftp file. This
      file contains simply a list of usernames and passwords. However, even with
      this file in place, root can still logon without a password entered. This
      would allow the attacker to alter the passwd.ftp file, as well as the
      hosts file which lists tha machines authorized to print to the QMS.
      
      
      
      13: Microsoft JET Text I-ISAM Vulnerability
      Bugtraq ID: 595
      Remote: Yes
      Date Published: 08/20/99
      Relevant URL:
      http://www.securityfocus.com/level2/?go=vulnerabilities&id=595
      Summary:
      Microsoft's JET database engine includes a functionality referred to as
      Text I-ISAM. This allows the JET driver to write to a text file, for the
      purpose of another application to read later. This was implemented to
      allow data sharing between JET applications and other applications that
      don't support Dynamic Data Exchange. The vulnerability lies in the fact
      that any text file can be written to, including system files. Because of
      this, a database query could be created that added destructive commands to
      a startup file or script.
      Microsoft has released patces for both JET 3.5x and 4.0:
      3.5x:
      http://www.securityfocus.com/external/http://support.microsoft.com/download/support/mslfiles/Jet35sp3.exe
      4.0:
      http://www.securityfocus.com/external/http://support.microsoft.com/download/support/mslfiles/Jet40sp1.exe
      
      @HWA



57.0  A typical script kiddie attack scenerio against HTTP server
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Picked up from the message board of www.securityfocus.com...
      
            
       To: Incidents
       Subject: kiddie attack via http
       Date: Wed Aug 18 1999 05:13:35
       Author: acpizer
       Message-ID:
                 <Pine.NEB.3.96.990818121207.5340B-100000@mach.unseen.org>
      
      
      Once upon a time, I've setup a small bait, for lusers such as this one,
      and it finally paid off:
      
      Aug 12 09:44:52 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:52 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:52 snork fun-httpd: cmd buff: GET /asakaeval HTTP/1.0^M ^M
      Aug 12 09:44:52 snork fun-httpd: cmd buff: GET /cgi-bin/phf/ HTTP/1.0^M
      Aug 12 09:44:53 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:53 snork fun-httpd: cmd buff: GET /cgi-bin/phf/ HTTP/1.0^M
      Aug 12 09:44:54 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:54 snork fun-httpd: cmd buff: GET /cgi-bin/php.cgi/
      HTTP/1.0^M
      Aug 12 09:44:55 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:55 snork fun-httpd: cmd buff: GET /cgi-bin/campas/ HTTP/1.0^M
      Aug 12 09:44:56 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:56 snork fun-httpd: cmd buff: GET /cgi-bin/htmlscript/
      HTTP/1.0^M
      Aug 12 09:44:57 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:57 snork fun-httpd: cmd buff: GET /cgi-bin/aglimpse/
      HTTP/1.0^M
      Aug 12 09:44:58 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:44:59 snork fun-httpd: cmd buff: GET /cgi-bin/websendmail/
      HTTP/1.0^Aug 12 09:45:00 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:45:00 snork fun-httpd: cmd buff: GET /cgi-bin/websendmail/
      HTTP/1.0^M
      Aug 12 09:45:01 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:45:01 snork fun-httpd: cmd buff: GET /info2www HTTP/1.0^M
      Aug 12 09:45:03 snork fun-httpd: cmd buff: GET /cgi-bin/pfdispaly.cgi/
      HTTP/1.0Aug 12 09:45:04 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:45:04 snork fun-httpd: cmd buff: GET /scripts/convert.bas/
      HTTP/1.0^M
      Aug 12 09:45:19 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:45:19 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:45:19 snork fun-httpd: cmd buff: GET /info2www
      '(../../../../../../../bin/mail  </etc/passwd|)'^M ^M
      Aug 12 09:45:21 snork fun-httpd: cmd buff: GET /asakaeval HTTP/1.0^M ^M
      Aug 12 09:46:07 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:46:08 snork fun-httpd: cmd buff: GET /cgi-bin/webdist.cgi/
      HTTP/1.0^M
      Aug 12 09:46:23 snork fun-httpd: got connection from 204.60.37.97
      Aug 12 09:46:23 snork fun-httpd: cmd buff: GET
      /scripts/convert.bas?../../etc/passwd HTTP/1.0^M ^M
      ARIN shows this on the IP:
      
      Southern New England Telephone (NETBLK-SNET-CIDR001)
         27 Butler St.
         Meriden, CT 06451-4101
         US
      
         Netname: SNET-CIDR001
         Netblock: 204.60.0.0 - 204.60.255.0
      
         Coordinator:
            Devetzis, Taso N  (TND-ARIN)  devetzis@SNET.NET
            +1 203 771 8917 (FAX) +1 203 771 2008
      
      
      
      I don't know some of these vulnerabilities, maybe you guys could enlighten
      me
      on what you recognize.
      
      Cheers.


       To: Incidents
       Subject: Re: kiddie attack via http
       Date: Mon Aug 23 1999 18:39:22
       Author: Fu V0Rt
       Message-ID:<19990824023922.16516.qmail@securityfocus.com>
      
      
      For details on many cgi based vunerabilities, i suggest
      having a look at http://v0rt.dayrom.com.au under the
      advisories section. we list alot of common cgi
      vunerabilities aswell as a tool to scan for most of these
      (http://v0rt.dayrom.com.au/profiler/profiler.c)
      
      As for the /asakaeval attack, i also have not seen any
      information regarding this.
      
      As a final note, also check your access_log for entries sent
      as hex, in some httpd servers they do not correct log
      requests sent as hex, therefor its not obvious asto what
      they are scanning for to the naked eye.
      
      v0rt_
      
      
      -------------------------------------------------------------------------------
      "Probably you've only really grown up, when you can bear not being understood."
      
                                 Marian Gold /Alphaville
                                 
                                 
                                 
      
                                    
      @HWA                              
      
58.0  NMAP - Scan Analysis (v2)
      ~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From http://www.whitehats.com/      
      
      Hello,
      
      This page is for anyone who cares to see the details behind an NMAP scan with the -D decoy option set. Basically I hope to answer two questions:
      
           Does NMAP spoof every aspect of the scan, including ICMP, ACK, and OS Identification? (yes, beautifully if used properly) 
           Can you tell which host in a Decoy Storm is the real host? (no, if used properly) 
      
      When I created a case study of these topics earlier today I used decoy hosts that were not responsive (nonexistent IP addresses). Fyodor quickly pointed
      out that this breaks one of the cardinal rules of decoy scanning. The decoys must be alive. :) 
      
      NMAP appears to correctly spoof identical packets for every operation, sending an identical packet for each source address (your local system, and each
      of the decoys). My initial testing showed that only the local system sends RST's in response to successfully queried ports in a SYN scan. However, this
      behavior is correct. The local system should not send RST's on behalf of the other systems, because that is exactly what they are supposed to do. My
      test decoys (23.23.23.23 and 24.24.24.24) are not active hosts, and so would not generate the expected RST packets. Had I used responsive decoy
      hosts, the local system source address would be indistinguishable from the others.
      
      FIN, NULL, XMAS, and UDP scans appear to work equally well with the -D decoy option.
      
      Hope someone finds this remotely useful or interesting.
      
      -Max Vision
      
       
      
        Decoys, without OS detection
      
      
      
      [audit ~]# nmap -sS -D23.23.23.23,ME,24.24.24.24 -p 80 www.example.com
      
      Starting nmap V. 2.12 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
      
      
      ICMP Probe
      19:44:00.294222 23.23.23.23 > www.example.com: icmp: echo request
      19:44:00.304222 audit.example.com > www.example.com: icmp: echo request
      19:44:00.304222 24.24.24.24 > www.example.com: icmp: echo request
      
      ACK Probe
      19:44:00.314222 23.23.23.23.38159 > www.example.com.http: . ack 0 win 1024
      19:44:00.314222 audit.example.com.38159 > www.example.com.http: . ack 0 win 1024
      19:44:00.314222 24.24.24.24.38159 > www.example.com.http: . ack 0 win 1024
      
      Hey we got a live one here!@#$
      19:44:00.324222 www.example.com.http > audit.example.com.38159: R 0:0(0) win 0 (DF)
      
      SYN scan
      19:44:00.394222 23.23.23.23.38139 > www.example.com.http: S 1559207492:1559207492(0) win 1024
      19:44:00.394222 audit.example.com.38139 > www.example.com.http: S 1559207492:1559207492(0) win 1024
      19:44:00.404222 24.24.24.24.38139 > www.example.com.http: S 1559207492:1559207492(0) win 1024
      
      SYN+ACK response means open port here.  We RST appropriately.
      Note: If you use valid decoys they will RST as well.
      19:44:00.424222 www.example.com.http > audit.example.com.38139: S 3305543706:3305543706(0) ack 1559207493 win 9112  (DF)
      19:44:00.424222 audit.example.com.38139 > www.example.com.http: R 1559207493:1559207493(0) win 0
      
      Interesting ports on www.example.com (1.1.1.1):
      Port    State       Protocol  Service
      80      open        tcp        http            
      
      Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds
      
      
        Decoys, OS detection
      
      
      
      
      [audit ~]# nmap -sS -D23.23.23.23,ME,24.24.24.24 -O -p 80 www.example.com
      
      Starting nmap V. 2.12 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
      
      
      ICMP Probe
      19:29:55.854222 23.23.23.23 > www.example.com: icmp: echo request
      19:29:55.864222 audit.example.com > www.example.com: icmp: echo request
      19:29:55.864222 24.24.24.24 > www.example.com: icmp: echo request
      
      ACK Probe
      19:29:55.864222 23.23.23.23.63836 > www.example.com.http: . ack 0 win 1024
      19:29:55.874222 audit.example.com.63836 > www.example.com.http: . ack 0 win 1024
      19:29:55.874222 24.24.24.24.63836 > www.example.com.http: . ack 0 win 1024
      
      Wooop got your nose!@#$
      19:29:55.884222 www.example.com.http > audit.example.com.63836: R 0:0(0) win 0 (DF)
      
      SYN scan
      19:29:55.954222 23.23.23.23.63816 > www.example.com.http: S 1315816470:1315816470(0) win 1024
      19:29:55.964222 audit.example.com.63816 > www.example.com.http: S 1315816470:1315816470(0) win 1024
      19:29:55.964222 24.24.24.24.63816 > www.example.com.http: S 1315816470:1315816470(0) win 1024
      
      SYN+ACK response means open port here.  We RST appropriately.
      Note: If you use valid decoys they will RST as well.
      19:29:55.974222 www.example.com.http > audit.example.com.63816: S 3191891171:3191891171(0) ack 1315816471 win 9112  (DF)
      19:29:55.974222 audit.example.com.63816 > www.example.com.http: R 1315816471:1315816471(0) win 0
      
      OS Detection (Solaris shown)
      19:29:55.984222 23.23.23.23.63823 > www.example.com.http: S 3812808641:3812808641(0) win 1024 
      19:29:55.984222 audit.example.com.63823 > www.example.com.http: S 3812808641:3812808641(0) win 1024 
      19:29:55.984222 24.24.24.24.63823 > www.example.com.http: S 3812808641:3812808641(0) win 1024 
      
      19:29:55.984222 23.23.23.23.63824 > www.example.com.http: . win 1024 
      19:29:55.984222 audit.example.com.63824 > www.example.com.http: . win 1024 
      19:29:55.984222 24.24.24.24.63824 > www.example.com.http: . win 1024 
      
      19:29:55.994222 23.23.23.23.63825 > www.example.com.http: SFP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:55.994222 audit.example.com.63825 > www.example.com.http: SFP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:55.994222 24.24.24.24.63825 > www.example.com.http: SFP 3812808641:3812808641(0) win 1024 urg 0 
      
      19:29:55.994222 23.23.23.23.63826 > www.example.com.http: . ack 0 win 1024 
      19:29:55.994222 www.example.com.http > audit.example.com.63823: S 3192034216:3192034216(0) ack 3812808642 win 8855  (DF)
      19:29:55.994222 audit.example.com.63823 > www.example.com.http: R 3812808642:3812808642(0) win 0
      19:29:56.004222 audit.example.com.63826 > www.example.com.http: . ack 0 win 1024 
      19:29:56.004222 24.24.24.24.63826 > www.example.com.http: . ack 0 win 1024 
      
      19:29:56.004222 23.23.23.23.63827 > www.example.com.34599: S 3812808641:3812808641(0) win 1024 
      19:29:56.004222 audit.example.com.63827 > www.example.com.34599: S 3812808641:3812808641(0) win 1024 
      19:29:56.004222 24.24.24.24.63827 > www.example.com.34599: S 3812808641:3812808641(0) win 1024 
      
      19:29:56.004222 23.23.23.23.63828 > www.example.com.34599: . ack 0 win 1024 
      19:29:56.014222 audit.example.com.63828 > www.example.com.34599: . ack 0 win 1024 
      19:29:56.014222 24.24.24.24.63828 > www.example.com.34599: . ack 0 win 1024 
      
      19:29:56.014222 23.23.23.23.63829 > www.example.com.34599: FP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:56.014222 audit.example.com.63829 > www.example.com.34599: FP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:56.014222 24.24.24.24.63829 > www.example.com.34599: FP 3812808641:3812808641(0) win 1024 urg 0 
      
      19:29:56.014222 23.23.23.23.63816 > www.example.com.34599: udp 300
      19:29:56.014222 www.example.com.http > audit.example.com.63826: R 0:0(0) win 0 (DF)
      19:29:56.024222 audit.example.com.63816 > www.example.com.34599: udp 300
      19:29:56.024222 24.24.24.24.63816 > www.example.com.34599: udp 300
      
      19:29:56.634222 23.23.23.23.63824 > www.example.com.http: . win 1024 
      19:29:56.644222 audit.example.com.63824 > www.example.com.http: . win 1024 
      19:29:56.644222 24.24.24.24.63824 > www.example.com.http: . win 1024 
      
      19:29:56.644222 23.23.23.23.63825 > www.example.com.http: SFP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:56.644222 audit.example.com.63825 > www.example.com.http: SFP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:56.644222 24.24.24.24.63825 > www.example.com.http: SFP 3812808641:3812808641(0) win 1024 urg 0 
      
      19:29:56.644222 23.23.23.23.63827 > www.example.com.34599: S 3812808641:3812808641(0) win 1024 
      19:29:56.644222 audit.example.com.63827 > www.example.com.34599: S 3812808641:3812808641(0) win 1024 
      19:29:56.654222 24.24.24.24.63827 > www.example.com.34599: S 3812808641:3812808641(0) win 1024 
      
      19:29:56.654222 23.23.23.23.63828 > www.example.com.34599: . ack 1 win 1024 
      19:29:56.654222 audit.example.com.63828 > www.example.com.34599: . ack 1 win 1024 
      19:29:56.654222 24.24.24.24.63828 > www.example.com.34599: . ack 1 win 1024 
      
      19:29:56.654222 23.23.23.23.63829 > www.example.com.34599: FP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:56.654222 audit.example.com.63829 > www.example.com.34599: FP 3812808641:3812808641(0) win 1024 urg 0 
      19:29:56.654222 24.24.24.24.63829 > www.example.com.34599: FP 3812808641:3812808641(0) win 1024 urg 0 
      
      19:29:56.664222 23.23.23.23.63816 > www.example.com.34599: udp 300
      19:29:56.664222 audit.example.com.63816 > www.example.com.34599: udp 300
      19:29:56.664222 24.24.24.24.63816 > www.example.com.34599: udp 300
      
      Sequencing (hey with bsd TTCP and the Linux messup, who needs sequencing? :)
      19:29:57.184222 23.23.23.23.63817 > www.example.com.http: S 3812808642:3812808642(0) win 1024
      19:29:57.204222 audit.example.com.63817 > www.example.com.http: S 3812808642:3812808642(0) win 1024
      19:29:57.214222 www.example.com.http > audit.example.com.63817: S 3192528068:3192528068(0) ack 3812808643 win 9112  (DF)
      19:29:57.214222 audit.example.com.63817 > www.example.com.http: R 3812808643:3812808643(0) win 0
      19:29:57.224222 24.24.24.24.63817 > www.example.com.http: S 3812808642:3812808642(0) win 1024
      
      19:29:57.244222 23.23.23.23.63818 > www.example.com.http: S 3812808643:3812808643(0) win 1024
      19:29:57.264222 audit.example.com.63818 > www.example.com.http: S 3812808643:3812808643(0) win 1024
      19:29:57.274222 www.example.com.http > audit.example.com.63818: S 3192724219:3192724219(0) ack 3812808644 win 9112  (DF)
      19:29:57.274222 audit.example.com.63818 > www.example.com.http: R 3812808644:3812808644(0) win 0
      19:29:57.284222 24.24.24.24.63818 > www.example.com.http: S 3812808643:3812808643(0) win 1024
      
      19:29:57.304222 23.23.23.23.63819 > www.example.com.http: S 3812808644:3812808644(0) win 1024
      19:29:57.324222 audit.example.com.63819 > www.example.com.http: S 3812808644:3812808644(0) win 1024
      19:29:57.334222 www.example.com.http > audit.example.com.63819: S 3192958008:3192958008(0) ack 3812808645 win 9112  (DF)
      19:29:57.334222 audit.example.com.63819 > www.example.com.http: R 3812808645:3812808645(0) win 0
      19:29:57.344222 24.24.24.24.63819 > www.example.com.http: S 3812808644:3812808644(0) win 1024
      
      19:29:57.364222 23.23.23.23.63820 > www.example.com.http: S 3812808645:3812808645(0) win 1024
      19:29:57.384222 audit.example.com.63820 > www.example.com.http: S 3812808645:3812808645(0) win 1024
      19:29:57.394222 www.example.com.http > audit.example.com.63820: S 3193157286:3193157286(0) ack 3812808646 win 9112  (DF)
      19:29:57.394222 audit.example.com.63820 > www.example.com.http: R 3812808646:3812808646(0) win 0
      19:29:57.404222 24.24.24.24.63820 > www.example.com.http: S 3812808645:3812808645(0) win 1024
      
      19:29:57.424222 23.23.23.23.63821 > www.example.com.http: S 3812808646:3812808646(0) win 1024
      19:29:57.444222 audit.example.com.63821 > www.example.com.http: S 3812808646:3812808646(0) win 1024
      19:29:57.454222 www.example.com.http > audit.example.com.63821: S 3193331920:3193331920(0) ack 3812808647 win 9112  (DF)
      19:29:57.454222 audit.example.com.63821 > www.example.com.http: R 3812808647:3812808647(0) win 0
      19:29:57.464222 24.24.24.24.63821 > www.example.com.http: S 3812808646:3812808646(0) win 1024
      
      19:29:57.484222 23.23.23.23.63822 > www.example.com.http: S 3812808647:3812808647(0) win 1024
      19:29:57.504222 audit.example.com.63822 > www.example.com.http: S 3812808647:3812808647(0) win 1024
      19:29:57.514222 www.example.com.http > audit.example.com.63822: S 3193574611:3193574611(0) ack 3812808648 win 9112  (DF)
      19:29:57.514222 audit.example.com.63822 > www.example.com.http: R 3812808648:3812808648(0) win 0
      19:29:57.524222 24.24.24.24.63822 > www.example.com.http: S 3812808647:3812808647(0) win 1024
      
      Interesting ports on www.example.com (1.1.1.1):
      Port    State       Protocol  Service
      80      open        tcp        http            
      
      TCP Sequence Prediction: Class=random positive increments
                               Difficulty=25258 (Worthy challenge)
      Remote operating system guess: Solaris 2.6 - 2.7
      
      Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds
      
      
      Thanks for reading, have fun! 
      
      @HWA       
      
59.0  Security Focus: Incidents Summary
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      IV. INCIDENTS SUMMARY 1999-08-16 to 1999-08-22
      ------------------------------------------
      1. investigating
      Relevant URL:
      http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-08-15&msg=002301bee915$8587b100$2b81fea9@tarleton.edu


      2. kiddie attack via http
      Relevant URL:
      http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-08-15&thread=Pine.NEB.3.96.990819111619.20441B-100000@mach.unseen.org


      3. Asaka (was Re: kiddie attack via http)
      Relevant URL:
      http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-08-15&thread=37BC586C.42EF65E0@globalstar.com


      4. Re: investigating
      Relevant URL:
      http://www.securityfocus.com/templates/archive.pike?list=75&date=1999-08-15&msg=Pine.GSO.4.05.9908211843310.2417-100000@toutatis.comune.modena.it
      

60.0  Security Focus: Jobs
      ~~~~~~~~~~~~~~~~~~~~
    
      V. SECURITY JOBS 1999-08-16 to 1999-08-22
      -------------------------------------
      Seeking Position:
      
      
      1:Contact: jam smith <suidroot@email.com>
      Qualifications:http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&thread=385620377.935021596329.JavaMail.root@web09.mail.com
      Date Posted: 1999-08-18
      
      
      Seeking Staff:
      
      
      2. Position: mid-level Network Security Engineer
      Reply to: Chris Riley <riley@info-tools.com>
      Position Requirements:
      
      
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=37B825AD.8064E6F8@info-tools.com
      Date Posted: 1999-08-16
      
      
      3. Position: senior networking staff
      Reply to: Vince Reed <vreed@mitre.org>
      Position Requirements:
      
      
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=v04210105b3e090fa310b@[128.29.230.9]
      Date Posted: 1999-08-17
      
      
      4. Position: Security Engineer
      Reply to: Hal Lockhart <hal.lockhart@storagenetworks.com>
      Position Requirements:
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=9D8B3C643D2AD311BC8D00508B120BA40F5ACC@mahqexc01.storagenetworks.com
      Date Posted: 1999-08-18
      
      
      5. Position: Security Engineer
      Reply to: Ben Keepper <bkeepper@home.com>
      Position Requirements:
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=000f01bee9f8$1903e740$d9990018@cv1.sdca.home.com
      Date Posted: 1999-08-18
      
      
      6. Position: Security Consultant
      Reply to: Bryan Bushman <bryan.bushman@capitalone.com>
      Position Requirements:
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=0013A20F.4077@capitalone.com
      Date Posted: 1999-08-18
      
      
      7. Position: Network Security Administrator
      Reply to: Wooldridge, Doug <doug.wooldridge@echostar.com>
      Position Requirements:
      
      
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=35AB03C74901D2119DAA00A0C9B6A1FB9576DD@exchange5.echostar.com
      Date Posted: 1999-08-19
      
      
      8.  Position: Project Leader, Team Leader, and Security Engineers
      Reply to: Eric Maiwald <maiwalde@fortrex.com>
      Position Requirements:
      
      
      http://www.securityfocus.com/templates/archive.pike?list=77&date=1999-08-15&msg=Pine.GSO.3.96.990820141043.8181A-100000@ss5.fred.net
      Date Posted: 1999-08-20
      
      
      @HWA
      
             

      -=----------=-         -=----------=-        -=----------=-       -=----------=- 
           
           
           
           
                                             O
                                             0
                                             o
                                           O O O   
                                             0

     -=----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
      
     END of main news articles content... read on for ads, humour, hacked websites etc
              
     -=----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
     
     
     
            
                                HWA.hax0r.news  
     
     
     
     
     
AD.S ADVERTI$ING.           The HWA black market                    ADVERTISEMENT$.
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      
       *****************************************************************************
       *                                                                           *
       *           ATTRITION.ORG     http://www.attrition.org                      *
       *           ATTRITION.ORG     Advisory Archive, Hacked Page Mirror          *
       *           ATTRITION.ORG     DoS Database, Crypto Archive                  *
       *           ATTRITION.ORG     Sarcasm, Rudeness, and More.                  * 
       *                                                                           *
       *****************************************************************************      
              
 
       www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi
       n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co
       m www.2600.com ########################################ww.2600.com www.freeke
       vin.com www.kev#  Support 2600.com and the Free Kevin #.com www.kevinmitnick.
       com www.2600.co#  defense fund site, visit it now! .  # www.2600.com www.free
       kevin.com www.k#             FREE KEVIN!              #in.com www.kevinmitnic
       k.com www.2600.########################################om www.2600.com www.fre
       ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic
       k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre

       <a href="http://www.2600.com/">www.2600.com</a>
       <a href="http://www.kevinmitnick.com></a>
       
       
       +-----------------------------------------------------------------------------+
       | SmoG Alert ..           http://smog.cjb.net/        NEWS on SCIENCE         |
       | ===================     http://smog.cjb.net/        NEWS on SECURITY        |
       | NEWS/NEWS/NEWS/NEWS     http://smog.cjb.net/        NEWS on THE NET         |
       |                         http://smog.cjb.net/        NEWS on TECHNOLOGY      |
       +-----------------------------------------------------------------------------+
       
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net *
       *   www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net     *
    <a href="http://www.csoft.net">One of our sponsers, visit them now</a> www.csoft.net
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       
       

       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV *
       * JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD*
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       
       
       

       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM *
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


         //////////////////////////////////////////////////////////////////////////////
        //  To place an ad in this section simply type it up and email it to        //
       //        hwa@press,usmc.net, put AD! in the subject header please. - Ed    //
      //////////////////////////////////////////////////////////////////////////////


     @HWA
     
       
              
             
HA.HA Humour and puzzles ...etc
      ~~~~~~~~~~~~~~~~~~~~~~~~~
                                                           Don't worry. worry a *lot*
     
      Send in submissions for this section please! ............
      
      
      An oldie but goodie, noone's sending in submissions, 
                                      c'mon you know you wanna...- Ed
            
      
              A Guide to Internet Security: Becoming an Uebercracker
              and Becoming an UeberAdmin to stop Uebercrackers.
      
      
      Author: Christopher Klaus <cklaus@shadow.net>
      Date: December 5th, 1993.
      Version: 1.1
      
        This is a paper will be broken into two parts, one showing 15 easy steps
      to becoming a uebercracker and the next part showing how to become a
      ueberadmin and how to stop a uebercracker.  A uebercracker is a term phrased
      by Dan Farmer to refer to some elite (cr/h)acker that is practically
      impossible to keep out of the networks. 
      
      Here's the steps to becoming a uebercracker.
      
      Step 1. Relax and remain calm. Remember YOU are a Uebercracker. 
      
      Step 2. If you know a little Unix, you are way ahead of the crowd and skip
      past step 3.
      
      Step 3. You may want to buy Unix manual or book to let you know what
      ls,cd,cat does.
      
      Step 4. Read Usenet for the following groups: alt.irc, alt.security, 
      comp.security.unix.  Subscribe to Phrack@well.sf.ca.us to get a background
      in uebercracker culture. 
      
      Step 5. Ask on alt.irc how to get and compile the latest IRC client and
      connect to IRC.
      
      Step 6. Once on IRC, join the #hack channel. (Whew, you are half-way
      there!)
      
      Step 7. Now, sit on #hack and send messages to everyone in the channel
      saying "Hi, Whats up?". Be obnoxious to anyone else that joins and asks 
      questions like "Why cant I join #warez?"
      
      Step 8. (Important Step) Send private messages to everyone asking for new
      bugs or holes. Here's a good pointer, look around your system for binary
      programs suid root (look in Unix manual from step 3 if confused). After
      finding a suid root binary, (ie. su, chfn, syslog), tell people you have a
      new bug in that program and you wrote a script for it.  If they ask how it
      works, tell them they are "layme". Remember, YOU are a UeberCracker. Ask
      them to trade for their get-root scripts.
      
      Step 9. Make them send you some scripts before you send some garbage file
      (ie. a big core file). Tell them it is encrypted or it was messed up and
      you need to upload your script again.
      
      Step 10. Spend a week grabbing all the scripts you can. (Dont forget to be
      obnoxious on #hack otherwise people will look down on you and not give you
      anything.)
      
      Step 11. Hopefully you will now have atleast one or two scripts that get
      you root on most Unixes. Grab root on your local machines, read your
      admin's mail, or even other user's mail, even rm log files and whatever
      temps you. (look in Unix manual from step 3 if confused).
       
      Step 12. A good test for true uebercrackerness is to be able to fake mail.
      Ask other uebercrackers how to fake mail (because they have had to pass the
      same test). Email your admin how "layme" he is and how you got root and how
      you erased his files, and have it appear coming from satan@evil.com. 
      
      Step 13. Now, to pass into supreme eliteness of uebercrackerness, you brag
      about your exploits on #hack to everyone. (Make up stuff, Remember, YOU are
      a uebercracker.) 
      
      Step 14. Wait a few months and have all your notes, etc ready in your room
      for when the FBI, Secret Service, and other law enforcement agencies
      confinscate your equipment. Call eff.org to complain how you were innocent
      and how you accidently gotten someone else's account and only looked
      because you were curious. (Whatever else that may help, throw at them.) 
      
      Step 15. Now for the true final supreme eliteness of all uebercrackers, you
      go back to #hack and brag about how you were busted.  YOU are finally a
      true Uebercracker.
      
      
      Now the next part of the paper is top secret.  Please only pass to trusted
      administrators and friends and even some trusted mailing lists, Usenet
      groups, etc. (Make sure no one who is NOT in the inner circle of security
      gets this.) 
      
      This is broken down on How to Become an UeberAdmin (otherwise know as a
      security expert) and How to stop Uebercrackers.
      
      Step 1. Read Unix manual ( a good idea for admins ).
      
      Step 2. Very Important.  chmod 700 rdist; chmod 644 /etc/utmp. Install 
      sendmail 8.6.4.  You have probably stopped 60 percent of all Uebercrackers
      now.  Rdist scripts is among the favorites for getting root by
      uebercrackers.
      
      Step 3. Okay, maybe you want to actually secure your machine from the 
      elite Uebercrackers who can break into any site on Internet.  
      
      Step 4. Set up your firewall to block rpc/nfs/ip-forwarding/src routing
      packets. (This only applies to advanced admins who have control of the
      router, but this will stop 90% of all uebercrackers from attempting your
      site.)
      
      Step 5. Apply all CERT and vendor patches to all of your machines. You have
      just now killed 95% of all uebercrackers. 
      
      Step 6. Run a good password cracker to find open accounts and close them.
      Run tripwire after making sure your binaries are untouched. Run tcp_wrapper
      to find if a uebercracker is knocking on your machines.  Run ISS to make
      sure that all your machines are reasonably secure as far as remote
      configuration (ie. your NFS exports and anon FTP site.) 
      
      Step 7. If you have done all of the following, you will have stopped 99%
      of all uebercrackers. Congrads! (Remember, You are the admin.)  
      
      Step 8. Now there is one percent of uebercrackers that have gained
      knowledge from reading some security expert's mail (probably gained access
      to his mail via NFS exports or the guest account.  You know how it is, like
      the mechanic that always has a broken car, or the plumber that has the
      broken sink, the security expert usually has an open machine.)  
      
      Step 9. Here is the hard part is to try to convince these security experts
      that they are not so above the average citizen and that by now giving out
      their unknown (except for the uebercrackers) security bugs, it would be a
      service to Internet.  They do not have to post it on Usenet, but share
      among many other trusted people and hopefully fixes will come about and
      new pressure will be applied to vendors to come out with patches. 
      
      Step 10.  If you have gained the confidence of enough security experts,
      you will know be a looked upto as an elite security administrator that is
      able to stop most uebercrackers.  The final true test for being a ueberadmin
      is to compile a IRC client, go onto #hack and log all the bragging and
      help catch the uebercrackers. If a uebercracker does get into your system,
      and he has used a new method you have never seen, you can probably tell
      your other security admins and get half of the replies like - "That bug
      been known for years, there just isn't any patches for it yet. Here's my
      fix." and the other half of the replies will be like - "Wow.  That is very
      impressive. You have just moved up a big notch in my security circle."
      VERY IMPORTANT HERE:  If you see anyone in Usenet's security newsgroups
      mention anything about that security hole, Flame him for discussing it
      since it could bring down Internet and all Uebercrackers will now have it
      and the million other reasons to keep everything secret about security.
      
      
      Well, this paper has shown the finer details of security on Internet. It has
      shown both sides of the coin.  Three points I would like to make that would
      probably clean up most of the security problems on Internet are as the
      following:
      
      1.  Vendors need to make security a little higher than zero in priority. 
      If most vendors shipped their Unixes already secure with most known bugs
      that have been floating around since the Internet Worm (6 years ago) fixed
      and patched, then most uebercrackers would be stuck as new machines get
      added to Internet.  (I believe Uebercracker is german for "lame copy-cat
      that can get root with 3 year old bugs.") An interesting note is that
      if you probably check the mail alias for "security@vendor.com", you will
      find it points to /dev/null.  Maybe with enough mail, it will overfill
      /dev/null.  (Look in manual if confused.)
      
      2.  Security experts giving up the attitude that they are above the normal
      Internet user and try to give out information that could lead to pressure
      by other admins to vendors to come out with fixes and patches.  Most
      security experts probably don't realize how far their information has
      already  spread.
      
      3.  And probably one of the more important points is just following the
      steps I have outlined for Stopping a Uebercracker.
      
      
      Resources for Security:
         Many security advisories are available from anonymous ftp cert.org.
      Ask archie to find tcp_wrapper, security programs.  For more information
      about ISS (Internet Security Scanner), email cklaus@shadow.net.
      
      
      Acknowledgements:  
      
         Thanks to the crew on IRC, Dan Farmer, Wietse Venema, Alec Muffet, Scott
      Miles, Scott Yelich, and Henri De Valois.
      
      
      Copyright:
      
      This paper is Copyright 1993, 1994.  Please distribute to only trusted
      people.  If you modify, alter, disassemble, reassemble, re-engineer or have
      any suggestions or comments, please send them to:
      
      cklaus@shadow.net
      
      

      
     
     
     @HWA
       
       
       
 SITE.1
    
   #1 http://whitehats.com/
   
      This is a newish security site (at least its new to me) that has many IDS signatures
      online for download for use with SNORT (a gnu IDS tool) also a good discussion on the
      NMAP tool's ability to scan undetected by the target host (see #58). - Ed
 
 
  
   #2 http://www.immortalz.com/
 
      New security site reborn with a new layout will be up within a week, check it out ...
      soon to mirror the HWA zine too. ;-) 
        
   
        
       
      @HWA
       
         
         
  H.W Hacked websites 
      ~~~~~~~~~~~~~~~~

      Note: The hacked site reports stay, especially with some cool hits by
            groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed

          * Hackers Against Racist Propaganda (See issue #7)

     
      Haven't heard from Catharsys in a while for those following their saga visit
      http://frey.rapidnet.com/~ptah/ for 'the story so far'...
      
     
     
     Latest cracked pages courtesy of attrition.org
     
     

     [99.08.23] NT [ ]                    MediaMark (www.mediamark.com)
     [99.08.23] So [bl0w team]            Thinking Pictures, Inc. (www.thinkpix.com)
     [99.08.23] So [bl0w team]            Rock.com's Rolling Stone's Web site  (www.stones.com)
     [99.08.23] NT [v00d00]               Odin Radiators (www.odinradiators.com.au)
     [99.08.23] BI [team_hM]              Monica Lewinsky's site (www.monicalewinsky.com)
     
     [99.08.23] NT [139_r00ted]           Concept Reseau   (www.concept-reseau.fr)
     [99.08.23] Li [Uneek Tech]           Ruchi Group (www.ruchigroup.com)
     [99.08.23] NT [139_r00ted]           Phoenix Data Systems (www.phoenixds.at)
     
     [99.08.23] NT [139_r00ted]           Concept Reseau (www.concept-reseau.fr)
     [99.08.23] Li [Uneek Tech]           Ruchi Group (www.ruchigroup.com)
     [99.08.23] NT [139_r00ted]           Phoenix Data Systems (www.phoenixds.at)
     
     [99.08.25] NT [wkD]                  PC Guk (www.pcguk.com)
     [99.08.25]    [DISO]                 Nullsoft SHOUTcast (yp.shoutcast.com)
     [99.08.24] Ir [Uneek Tech]           Aston Packaging (www.astonpackaging.co.uk)
     [99.08.24] Ir [Uneek Tech]           All Art (www.allart.co.uk)
     [99.08.24] NT [ ]                    1st Stop Inc (www.1ststopinc.com)
     [99.08.24] NT [139_r00ted]           Scanres (SE) (www.scanres.se)
     [99.08.24] Li [GOD]                  #2 Madison Square Garden (www.thegarden.com)
     
         
     [99.08.26]    [HwC]              M   Zipper (www.zipper.de)
     [99.08.26] NT [aL3X]             M   Cindy Jackson (www.cindyjackson.co.uk)
     [99.08.26] Li [stormtrooper]         Red Hat Indonesia (www.redhat.or.id)
     [99.08.26] Fb [ ]                    No Such Agency (www.nsa.org)
     [99.08.26] NT [Fuby]                 CyberElf (www.cyberelf.com)
     [99.08.26] Fb [ ]                    Official Web site of Limp Bizkit
     (www.limpbizkit.com)
     [99.08.26] So [ ]                    Cornell Theory Center
     (cedar.tc.cornell.edu)
     [99.08.26]    [wkD]              M   Lookie Here (lookiehere.com)
     [99.08.26]    [ ]                    OE Pages (www.oe-pages.com)
     [99.08.26] NT [cynic]                Peter Mueller's Web Site
     (www.petermueller.com)
     [99.08.26] NT [v00d00]               WoodSBC (www.woodsbc.com.au)
     [99.08.25]    [ ]                    TLM (www.tlm.com.br)            
     [99.08.25] NT [139_r00ted]       M   IT Media Design (www.itmediadesign.com)
     [99.08.25] NT [Uneek Tech]           Tomrods LTD Steel Stockholders (www.tomrods.co.uk)
     [99.08.25] Ir [Uneek Tech]           Sescoi (www.sescoi.co.uk)
     [99.08.25] NT [Uneek Tech]           Litho Supplies (www.litho.co.uk)
     
     

     [99.08.26]    [HwC]              M   Zipper (www.zipper.de)
     [99.08.26] NT [aL3X]             M   Cindy Jackson (www.cindyjackson.co.uk)
     [99.08.26] Li [stormtrooper]         Red Hat Indonesia (www.redhat.or.id)
     [99.08.26] Fb [ ]                    No Such Agency (www.nsa.org)
     [99.08.26] NT [Fuby]                 CyberElf (www.cyberelf.com)
     [99.08.26] Fb [ ]                    Official Web site of Limp Bizkit  (www.limpbizkit.com)
     [99.08.26] So [ ]                    Cornell Theory Center   (cedar.tc.cornell.edu)
     [99.08.26]    [wkD]              M   Lookie Here (lookiehere.com)
     [99.08.26]    [ ]                    OE Pages (www.oe-pages.com)
     [99.08.26] NT [cynic]                Peter Mueller's Web Site  (www.petermueller.com)
     [99.08.26] NT [v00d00]               WoodSBC (www.woodsbc.com.au)
     [99.08.25]    [ ]                    TLM (www.tlm.com.br)            
     [99.08.25] NT [139_r00ted]       M   IT Media Design (www.itmediadesign.com)
     [99.08.25] NT [Uneek Tech]           Tomrods LTD Steel Stockholders  (www.tomrods.co.uk)
     [99.08.25] Ir [Uneek Tech]           Sescoi (www.sescoi.co.uk)
     [99.08.25] NT [Uneek Tech]           Litho Supplies (www.litho.co.uk)
          
    
     Defaced: http://www.cmtc.7atc.army.mil/ (7th Army Training Command, Bavaria, Germany)
     By: 139_rooted
     Mirror: http://www.attrition.org/mirror/attrition/mil/www.cmtc.7atc.army.mil/
     OS: NT 
     
      
     Hacked: http://vax.mtc.irisz.hu
     By: Elfoscuro
     Mirror: http://www.attrition.org/mirror/attrition/hu/vax.mtc.irisz.hu/
     OS: NT   
  
  
     Defaced: http://www.mndm.gov.on.ca 
     Ontario Ministry of Northern Development and Mines
     By: Sarin
     Mirror: http://www.attrition.org/mirror/attrition/ca/www.mndm.gov.on.ca
     OS: NT
     

     Hacked: http://www.thegarden.com (Madison Square Garden)
     By: Kindred Hackers
     Mirror: http://www.attrition.org/mirror/attrition/com/www.thegarden.com/
     OS: Linux
     
     Hacked: http://www.webdoctor.com
     By: Sistom
     Mirror: http://www.attrition.org/mirror/attrition/com/www.webdoctor.com/
     OS: Linux

     Hacked: http://www.uis.wayne.edu
     By: Unknown
     Mirror: http://www.attrition.org/mirror/attrition/edu/www.uis.wayne.edu/
     OS: NT
     
     ---
     
     Hacked: http://www.prim-nov.si
     By: Mozy
     Mirror: http://www.attrition.org/mirror/attrition/si/www.prim-nov.si/
     OS: NT

     This is the first Web defacement for the country of Slovenia. Slovenia
     is surrounded by Austria to the northwest, Hungary to the northeast,
     Italy to the west, and Croatia to the southeast.

     More info about Slovenia here:
     http://www.odci.gov/cia/publications/factbook/si.html
     
     ---
     
     Hacked: http://vax.mtc.irisz.hu
     By: Elfoscuro
     Mirror: http://www.attrition.org/mirror/attrition/hu/vax.mtc.irisz.hu/
     OS: NT
     
     Hacked: http://mp3town.com
     By: w4t0
     Mirror: http://www.attrition.org/mirror/attrition/com/mp3town.com/
     OS: Linux
     
     Hacked: http://www.westga.edu
     By: W4t0
     Mirror: http://www.attrition.org/mirror/attrition/edu/www.westga.edu/
     OS: Solaris
     
      
     Ontario Ministry of Northern Development and Mines
     (www.mndm.gov.on.ca) 
     Zipper (www.zipper.de) 
     Cindy Jackson (www.cindyjackson.co.uk) 
     Red Hat Indonesia (www.redhat.or.id) 
     No Such Agency (www.nsa.org) 
     CyberElf (www.cyberelf.com) 
     Official Web site of Limp Bizkit (www.limpbizkit.com) 
     Cornell Theory Center (cedar.tc.cornell.edu) 
     Lookie Here (lookiehere.com) 
     OE Pages (www.oe-pages.com) 
     Peter Mueller's Web Site (www.petermueller.com) 
     WoodSBC (www.woodsbc.com.au) 
     TLM (www.tlm.com.br) 
     IT Media Design (www.itmediadesign.com) 
     Tomrods LTD Steel Stockholders (www.tomrods.co.uk) 
     Sescoi (www.sescoi.co.uk) 
    
     The message from the Monica Lewinsky hack;
      
      Greetings bastards.
     
       Over the last few months, we have been lead to believe that Slobodan Milosevic , the leader of the former Yugoslavia is the worst violator of Human Rights in the
      world. Well, that isn't an entirely true statement. Although Slobodan Milosevic is a huge violator of Human Rights, there is a much bigger problem in China, and it's
       been going on for decades. However, the politicians of America decide to overlook their violations just because of large campaign contributions and trade value.
      Since the days of the Carter administration China has been openly abusing its people. They limit how many children a family can have , and how the people can live
      their lives. The Chinese government kills anyone who opposes or speaks out against it. The Chinese government defies international Human Rights laws openly and
       admits to it. The Chinese government has a worse Human Rights record than Slobodan Milosevic , yet nobody questions them. Just last month , its been reported
      that political prisoners in China have been subjected to sexual tortures and later executed. In fact, earlier this month, President Clinton actually had Chinese Premier
      Zhu Rongji to the white house for talks on entering the World Trade Organization.Bill Clinton even said at a press confrence with China's Premier Zhu Rongji ,"We
       honor China's remarkable achievements, its greater prosperity and the greater range of personal choices available to its citizens, as well as the movement toward
       local democracy". When in fact there has been no change in China's view of human rights. The Chinese Government has placed severe restrictions on freedom of
        speech, the press, assembly, association, religion, privacy, as well as worker rights. Also , China has the most favored nation trade status. All of this has a lot of
       people wondering why there is a war in Yugoslavia , but none in China. However the answer to that is all too apparent , greed. It is true that Slobodan Milosevic,
      and his army, are carrying out horrible acts against people. They aren't being condoned at all. But, China engages in these same activities on a much larger scale, and
     just because they have money it's deemed acceptable by American political and corporate interests. Bill Clinton was eager to wage war when it would take the focus
       off of his bedroom practices, but he isn't so eager to do so when it will cost him valuable campaign contributions, and who knows what else. The Chinese people
      have attempted to cry out for help through The Internet and televison shows. However those caught emailing anyone outside of China are immediately imprisoned .
      Chinese Internet access is limited very strictly to pro-chinese sites, the government prevents anyone inside China from viewing anything else by cutting off the outside
       Internet. This is comparative to Slobodan Milosevic's use of the television to only display movies and shows which he chooses, or for him to spread political lies
     about other nations. However , there is one difference between China and Yugoslavia's use of censorship. China is a valuable trade nation, so there's must be all right
      , at least that's the message that is sent out by the United States Government. A lot of Human Rights are asking how these two nations , with very similar tendencies
       can be treated so much differently. Perhaps if China would have been the only ones in violation around the time of the Monica Lewinsky scandal things would be
       different. Or perhaps if they didn't have so many large investments in American corporations and government they would be being punished for their actions. It's
       terrible that Human Rights is like a commodity , to be sold to the highest bidder. In the end it all seems to be just another example of money controlling everything.
      As long as someone turns a profit, it's acceptable. But what if someone were getting right, by letting your government mistreat and abuse you? You would probably
      expect someone to stand up and defend you. But how can anyone expect that if they wont extend the same courtesy to someone else? Innocent people are allowed
      to be executed and persecuted just because their government can pay for it. It saddens me deeply to see that more people haven't taken a stand against the Chinese.
      But most people figure that since it isn't them it doesn't really happen. They think that if it were really that bad , something would have been done about it. They don't
      have the time to worry about other people. They sit back and watch the Politicians of America line their pockets with the blood of the Chinese people. It's become
      more and more apparent that society has no regard for the feelings and well being of others. But what if your freedom and rights were just dollars in someone else's
                       pocket, and you lived as the Chinese people do. Things would probably be a little different then, at least in your eyes. 
     
     
     
     
                                            another fine message brought to you by team_hM 

                                                           nEoGoD 
          
     
     
   
           
      and more sites at the attrition cracked web sites mirror:
                   
                    http://www.attrition.org/mirror/attrition/index.html 

       -------------------------------------------------------------------------
       
  A.0                              APPENDICES
       _________________________________________________________________________



  A.1 PHACVW, sekurity, security, cyberwar links
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       The links are no longer maintained in this file, there is now a
      links section on the http://welcome.to/HWA.hax0r.news/ url so check
      there for current links etc.

      The hack FAQ (The #hack/alt.2600 faq)
      http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html
      
      Hacker's Jargon File (The quote file)
      http://www.lysator.liu.se/hackdict/split2/main_index.html
      
      New Hacker's Jargon File.
      http://www.tuxedo.org/~esr/jargon/ 
      
      
      
      HWA.hax0r.news Mirror Sites around the world:
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      http://www.attrition.org/hosted/hwa/
      http://www.attrition.org/~modify/texts/zines/HWA/
      http://www.hackunlimited.com/files/secu/papers/hwa/ ** NEW **
      http://www.ducktank.net/hwa/issues.html. ** NEW **
      http://www.alldas.de/hwaidx1.htm ** NEW **
      http://www.csoft.net/~hwa/ 
      http://www.digitalgeeks.com/hwa.*DOWN*
      http://members.tripod.com/~hwa_2k
      http://welcome.to/HWA.hax0r.news/
      http://www.attrition.org/~modify/texts/zines/HWA/
      http://archives.projectgamma.com/zines/hwa/.  
      http://www.403-security.org/Htmls/hwa.hax0r.news.htm
      http://viper.dmrt.com/files/=E-Zines/HWA.hax0r.news/
      http://hwa.hax0r.news.8m.com/           
      http://www.fortunecity.com/skyscraper/feature/103/  
      

      International links:(TBC)
      ~~~~~~~~~~~~~~~~~~~~~~~~~

      Foreign correspondants and others please send in news site links that
      have security news from foreign countries for inclusion in this list
      thanks... - Ed

      
          
      Belgium.......: http://bewoner.dma.be/cum/              
      
      Brasil........: http://www.psynet.net/ka0z              
            
                      http://www.elementais.cjb.net           
            
      Canada .......: http://www.hackcanada.com
      
      Columbia......: http://www.cascabel.8m.com              
      
                      http://www.intrusos.cjb.net             
                      
      Finland ........http://hackunlimited.com/                
                      
      Germany ........http://www.alldas.de/
                      http://www.security-news.com/
      
      Indonesia.....: http://www.k-elektronik.org/index2.html 
      
                      http://members.xoom.com/neblonica/      
      
                      http://hackerlink.or.id/                
      
      Netherlands...: http://security.pine.nl/                
      
      Russia........: http://www.tsu.ru/~eugene/              
      
      Singapore.....: http://www.icepoint.com                 
      
      South Africa ...http://www.hackers.co.za       
                      http://www.hack.co.za            
                      http://www.posthuman.za.net 
 
                      
      Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first and best security related e-zine.
      
                      
                       
                      
                      
                      
    .za (South Africa) sites contributed by wyzwun tnx guy...                  
      
      


    Got a link for this section? email it to hwa@press.usmc.net and i'll
    review it and post it here if it merits it.

    @HWA
    

  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
    --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--

    © 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t }
    
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-                       
     --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
   [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
       [45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65]    


