1930 lines
51 KiB
Plaintext
1930 lines
51 KiB
Plaintext
|
The Information Systems Security Monitor
|
|||
|
|
|
|||
|
|
_______ /--------\ /--------\ \ /|
|
|||
|
|
| | | | \ / |
|
|||
|
|
| | | | \ / |
|
|||
|
|
| \_______ \_______ | \ |
|
|||
|
|
| \ \ | |
|
|||
|
|
| | | | |
|
|||
|
|
| | | | |
|
|||
|
|
| \________/ \________/ | |
|
|||
|
|
-------
|
|||
|
|
Dedicated to the pursuit of security awareness............
|
|||
|
|
=================================================================
|
|||
|
|
Volume 2 Number 2 April 1992
|
|||
|
|
=================================================================
|
|||
|
|
////////////////////// In this Issue \\\\\\\\\\\\\\\\\\\\\\\\\\\
|
|||
|
|
|
|||
|
|
Choosing the Right Password
|
|||
|
|
|
|||
|
|
Comptroller General Decision on EDI
|
|||
|
|
|
|||
|
|
Security Hall of Fame
|
|||
|
|
|
|||
|
|
OAIS Employees Judge Student Contest
|
|||
|
|
|
|||
|
|
Cyberspace: A Hacker's Response
|
|||
|
|
|
|||
|
|
Quick Fix Security
|
|||
|
|
|
|||
|
|
Dear Clyde
|
|||
|
|
|
|||
|
|
Computer Speak
|
|||
|
|
|
|||
|
|
What's New
|
|||
|
|
----------------------------------------------------------------
|
|||
|
|
|
|||
|
|
|
|||
|
|
Hacker Lists Passwords Hackers Look For
|
|||
|
|
Choosing the Right Password!
|
|||
|
|
|
|||
|
|
Imagine a hacker entering a system with your id and password
|
|||
|
|
because you did not take the time to choose a good password, this
|
|||
|
|
is something that can be completely prevented if people would take
|
|||
|
|
a few minutes to choose a good password. You must be creative when
|
|||
|
|
choosing a password not lazy. Since a password is usually the
|
|||
|
|
first line of defense against unauthorized access to a computer
|
|||
|
|
system, when the first line is broken the rest only take time. The
|
|||
|
|
average user usually has a password that is easy to select and easy
|
|||
|
|
to remember. Any word that is easy to select or is contained in
|
|||
|
|
a dictionary is a poor and insecure selection for a password. The
|
|||
|
|
reason this makes a poor selection is because these words are the
|
|||
|
|
first ones an intruder will try when attempting to compromise your
|
|||
|
|
system. For instance, if your name is Tom Smith and your logon id
|
|||
|
|
is TSMITH your password should not contain any variation of these
|
|||
|
|
two words (Tom & Smith). A hacker will try TSMITH, SMITHT,
|
|||
|
|
TOMSMITH, SMITHTOM, TSMITH1, HTIMST, etc. before anything else.
|
|||
|
|
As far as the length of a password goes its definitely the longer
|
|||
|
|
the better. To demonstrate this point I give you the following
|
|||
|
|
table:
|
|||
|
|
|
|||
|
|
# of Possible Average Time
|
|||
|
|
Characters Combinations To Discover Example
|
|||
|
|
|
|||
|
|
1 36 6 min q
|
|||
|
|
2 1,300 4 hrs bt
|
|||
|
|
3 47,000 5 days tyu
|
|||
|
|
4 1,700,000 6 months insw
|
|||
|
|
5 60,000,000 19 years potnb
|
|||
|
|
etc...
|
|||
|
|
|
|||
|
|
The greater the number of possibilities a hacker must sort through,
|
|||
|
|
the better the chances of a password remaining undiscovered.
|
|||
|
|
|
|||
|
|
The best passwords are those that contain a combination of letters
|
|||
|
|
and numbers or are a combination of two or more unrelated words
|
|||
|
|
i.e. TREEFLOOR, TVBOOK, RADIOSHOE, etc. Another possibility is to
|
|||
|
|
select the initials of your two grandmothers combined with the
|
|||
|
|
number of times you have seen your favorite movie to come up with
|
|||
|
|
a password that resembles PAWH07, 07WHPA, PA07WH, etc.
|
|||
|
|
|
|||
|
|
If you think that you have chosen a password that is hard to guess
|
|||
|
|
or would take too much time to guess keep in mind that hackers have
|
|||
|
|
automated the process. There have been programs written for the
|
|||
|
|
sole purpose of guessing passwords, they take a list similar to the
|
|||
|
|
one in this article and try each and every one of them
|
|||
|
|
These are the types of passwords that are hard to guess and will
|
|||
|
|
most likely not be found in any dictionary or word list. I am
|
|||
|
|
enclosing a list of common passwords that most hackers have a
|
|||
|
|
variation of, under no circumstances should you ever use a word
|
|||
|
|
contained in this list. All forms of profanity should also be
|
|||
|
|
included in this list. 100
|
|||
|
|
666
|
|||
|
|
6969
|
|||
|
|
aaa
|
|||
|
|
abc
|
|||
|
|
abel
|
|||
|
|
academia
|
|||
|
|
academic
|
|||
|
|
academie
|
|||
|
|
access
|
|||
|
|
ada
|
|||
|
|
adele
|
|||
|
|
adeline
|
|||
|
|
adelphe
|
|||
|
|
admin
|
|||
|
|
adrian
|
|||
|
|
aerobic
|
|||
|
|
aerobics
|
|||
|
|
agathe
|
|||
|
|
agnes
|
|||
|
|
aide
|
|||
|
|
aime
|
|||
|
|
aimee
|
|||
|
|
airplane
|
|||
|
|
alain
|
|||
|
|
alban
|
|||
|
|
albanie
|
|||
|
|
albany
|
|||
|
|
albatros
|
|||
|
|
albatross
|
|||
|
|
albert
|
|||
|
|
alex
|
|||
|
|
alexander
|
|||
|
|
alexandre
|
|||
|
|
alf
|
|||
|
|
algebra
|
|||
|
|
algebre
|
|||
|
|
alias
|
|||
|
|
aliases
|
|||
|
|
alice
|
|||
|
|
alida
|
|||
|
|
alix
|
|||
|
|
alpha
|
|||
|
|
alphabet
|
|||
|
|
alphonse
|
|||
|
|
ama
|
|||
|
|
amadeus
|
|||
|
|
amandine
|
|||
|
|
ambroise
|
|||
|
|
amedee
|
|||
|
|
ami
|
|||
|
|
amorphe
|
|||
|
|
amorphous
|
|||
|
|
amour
|
|||
|
|
amy
|
|||
|
|
an
|
|||
|
|
analog
|
|||
|
|
analogue
|
|||
|
|
ananas
|
|||
|
|
anchor
|
|||
|
|
ancre
|
|||
|
|
andre
|
|||
|
|
andromache
|
|||
|
|
andy
|
|||
|
|
angele
|
|||
|
|
angerine
|
|||
|
|
anicet
|
|||
|
|
animals
|
|||
|
|
animaux
|
|||
|
|
anne
|
|||
|
|
annie
|
|||
|
|
annonciation
|
|||
|
|
anselme
|
|||
|
|
answer
|
|||
|
|
anthelme
|
|||
|
|
antoine
|
|||
|
|
antoine-marie
|
|||
|
|
anvils
|
|||
|
|
anything
|
|||
|
|
aout
|
|||
|
|
apollinaire
|
|||
|
|
apolline
|
|||
|
|
apotre
|
|||
|
|
aquin
|
|||
|
|
arc
|
|||
|
|
aria
|
|||
|
|
ariane
|
|||
|
|
aristide
|
|||
|
|
armand
|
|||
|
|
armel
|
|||
|
|
arnaud
|
|||
|
|
arrow
|
|||
|
|
arsene
|
|||
|
|
arthur
|
|||
|
|
ascension
|
|||
|
|
asd
|
|||
|
|
asm
|
|||
|
|
assise
|
|||
|
|
assomption
|
|||
|
|
athena
|
|||
|
|
athenes
|
|||
|
|
atmosphere
|
|||
|
|
aubin
|
|||
|
|
aude
|
|||
|
|
audrey
|
|||
|
|
augustin
|
|||
|
|
automne
|
|||
|
|
autoroute
|
|||
|
|
avent
|
|||
|
|
avila
|
|||
|
|
avion
|
|||
|
|
avril
|
|||
|
|
aymar
|
|||
|
|
aymard
|
|||
|
|
aztecs
|
|||
|
|
aztecs
|
|||
|
|
azur
|
|||
|
|
azure
|
|||
|
|
bacchus
|
|||
|
|
badass
|
|||
|
|
bailey
|
|||
|
|
balance
|
|||
|
|
banana
|
|||
|
|
bananas
|
|||
|
|
banane
|
|||
|
|
bande
|
|||
|
|
bandit
|
|||
|
|
banks
|
|||
|
|
banque
|
|||
|
|
baptiste
|
|||
|
|
barbara
|
|||
|
|
barber
|
|||
|
|
barbier
|
|||
|
|
bariton
|
|||
|
|
baritone
|
|||
|
|
barnabe
|
|||
|
|
barnard
|
|||
|
|
bart
|
|||
|
|
barthelemy
|
|||
|
|
bartman
|
|||
|
|
basic
|
|||
|
|
basile
|
|||
|
|
bass
|
|||
|
|
basse
|
|||
|
|
basson
|
|||
|
|
bassoon
|
|||
|
|
batch
|
|||
|
|
batman
|
|||
|
|
baudouin
|
|||
|
|
beach
|
|||
|
|
beater
|
|||
|
|
beaute
|
|||
|
|
beauty
|
|||
|
|
beaver
|
|||
|
|
beethoven
|
|||
|
|
belier
|
|||
|
|
beloved
|
|||
|
|
benedicte
|
|||
|
|
benoit
|
|||
|
|
benz
|
|||
|
|
beowulf
|
|||
|
|
berkeley
|
|||
|
|
berlin
|
|||
|
|
berline
|
|||
|
|
berliner
|
|||
|
|
bernadette
|
|||
|
|
bernard
|
|||
|
|
bernardin
|
|||
|
|
bertille
|
|||
|
|
bertrand
|
|||
|
|
beryl
|
|||
|
|
beta
|
|||
|
|
everly
|
|||
|
|
bicameral
|
|||
|
|
bienheureux
|
|||
|
|
bienvenue
|
|||
|
|
bishop
|
|||
|
|
bitch
|
|||
|
|
blaise
|
|||
|
|
bob
|
|||
|
|
boris
|
|||
|
|
bradley
|
|||
|
|
brian
|
|||
|
|
brice
|
|||
|
|
brigitte
|
|||
|
|
broadway
|
|||
|
|
bruno
|
|||
|
|
bsd
|
|||
|
|
bumbling
|
|||
|
|
burgess
|
|||
|
|
cad
|
|||
|
|
cafe
|
|||
|
|
calude
|
|||
|
|
camarade
|
|||
|
|
campanile
|
|||
|
|
cancer
|
|||
|
|
cantor
|
|||
|
|
capricorne
|
|||
|
|
cardinal
|
|||
|
|
careme
|
|||
|
|
carine
|
|||
|
|
carmel
|
|||
|
|
carmen
|
|||
|
|
carole
|
|||
|
|
carolina
|
|||
|
|
caroline
|
|||
|
|
carson
|
|||
|
|
cartouche
|
|||
|
|
cascades
|
|||
|
|
casimir
|
|||
|
|
cassis
|
|||
|
|
castle
|
|||
|
|
castle
|
|||
|
|
cat
|
|||
|
|
catherine
|
|||
|
|
cayuga
|
|||
|
|
cecile
|
|||
|
|
celine
|
|||
|
|
celtics
|
|||
|
|
cendres
|
|||
|
|
cerulean
|
|||
|
|
challenger
|
|||
|
|
change
|
|||
|
|
chantal
|
|||
|
|
charles
|
|||
|
|
charlotte
|
|||
|
|
charmant
|
|||
|
|
charming
|
|||
|
|
charon
|
|||
|
|
chat
|
|||
|
|
chateau
|
|||
|
|
chem
|
|||
|
|
chemin
|
|||
|
|
chemistry
|
|||
|
|
chess
|
|||
|
|
chester
|
|||
|
|
cheval
|
|||
|
|
chevalier
|
|||
|
|
chien
|
|||
|
|
chou
|
|||
|
|
christ
|
|||
|
|
christian
|
|||
|
|
christine
|
|||
|
|
christophe
|
|||
|
|
cible
|
|||
|
|
cigar
|
|||
|
|
cigare
|
|||
|
|
citroen
|
|||
|
|
claire
|
|||
|
|
clarisse
|
|||
|
|
class
|
|||
|
|
classic
|
|||
|
|
classique
|
|||
|
|
claude
|
|||
|
|
clemence
|
|||
|
|
clement
|
|||
|
|
clotilde
|
|||
|
|
cluster
|
|||
|
|
clusters
|
|||
|
|
code
|
|||
|
|
coeur
|
|||
|
|
coffee
|
|||
|
|
coke
|
|||
|
|
colette
|
|||
|
|
collins
|
|||
|
|
come
|
|||
|
|
computer
|
|||
|
|
comrade
|
|||
|
|
comrades
|
|||
|
|
conception
|
|||
|
|
condo
|
|||
|
|
condom
|
|||
|
|
connect
|
|||
|
|
console
|
|||
|
|
constant
|
|||
|
|
constantin
|
|||
|
|
conversion
|
|||
|
|
cookie
|
|||
|
|
cooper
|
|||
|
|
corinne
|
|||
|
|
cornelius
|
|||
|
|
couscous
|
|||
|
|
create
|
|||
|
|
creation
|
|||
|
|
creosote
|
|||
|
|
crepin
|
|||
|
|
cretin
|
|||
|
|
criminal
|
|||
|
|
croix
|
|||
|
|
cshrc
|
|||
|
|
cyrille
|
|||
|
|
daemon
|
|||
|
|
dame
|
|||
|
|
damien
|
|||
|
|
dancer
|
|||
|
|
daniel
|
|||
|
|
danny
|
|||
|
|
dapper
|
|||
|
|
data
|
|||
|
|
dave
|
|||
|
|
davy
|
|||
|
|
deb
|
|||
|
|
debbie
|
|||
|
|
deborah
|
|||
|
|
december
|
|||
|
|
decembre
|
|||
|
|
default
|
|||
|
|
defoe
|
|||
|
|
defunts
|
|||
|
|
delphine
|
|||
|
|
deluge
|
|||
|
|
denis
|
|||
|
|
denise
|
|||
|
|
desperate
|
|||
|
|
develop
|
|||
|
|
device
|
|||
|
|
dial
|
|||
|
|
diane
|
|||
|
|
didier
|
|||
|
|
diet
|
|||
|
|
dieter
|
|||
|
|
dieu
|
|||
|
|
digital
|
|||
|
|
dimanche
|
|||
|
|
dimitri
|
|||
|
|
disc
|
|||
|
|
discovery
|
|||
|
|
disk
|
|||
|
|
disney
|
|||
|
|
dog
|
|||
|
|
dominique
|
|||
|
|
donald
|
|||
|
|
donatien
|
|||
|
|
dos
|
|||
|
|
drought
|
|||
|
|
duncan
|
|||
|
|
dupond
|
|||
|
|
dupont
|
|||
|
|
durand
|
|||
|
|
dwladys
|
|||
|
|
eager
|
|||
|
|
earth
|
|||
|
|
easier
|
|||
|
|
easy
|
|||
|
|
eatme
|
|||
|
|
eau
|
|||
|
|
edges
|
|||
|
|
edinbourg
|
|||
|
|
edinburgh
|
|||
|
|
edith
|
|||
|
|
edmond
|
|||
|
|
edouard
|
|||
|
|
edwige
|
|||
|
|
edwin
|
|||
|
|
egghead
|
|||
|
|
eiderdown
|
|||
|
|
einstein
|
|||
|
|
elephant
|
|||
|
|
elisabeth
|
|||
|
|
elisee
|
|||
|
|
elizabeth
|
|||
|
|
ella
|
|||
|
|
ellen
|
|||
|
|
email
|
|||
|
|
emeline
|
|||
|
|
emerald
|
|||
|
|
emeraude
|
|||
|
|
emile
|
|||
|
|
emilie
|
|||
|
|
emma
|
|||
|
|
enclumes
|
|||
|
|
endeavour
|
|||
|
|
enemy
|
|||
|
|
engin
|
|||
|
|
engine
|
|||
|
|
engineer
|
|||
|
|
entreprise
|
|||
|
|
enzyme
|
|||
|
|
epiphanie
|
|||
|
|
erenity
|
|||
|
|
eric
|
|||
|
|
ersatz
|
|||
|
|
establish
|
|||
|
|
estate
|
|||
|
|
estelle
|
|||
|
|
ete
|
|||
|
|
eternity
|
|||
|
|
etienne
|
|||
|
|
euclid
|
|||
|
|
euclide
|
|||
|
|
eudes
|
|||
|
|
eugenie
|
|||
|
|
evelyn
|
|||
|
|
evrard
|
|||
|
|
extension
|
|||
|
|
eymard
|
|||
|
|
fabrice
|
|||
|
|
facile
|
|||
|
|
fairway
|
|||
|
|
famille
|
|||
|
|
felicia
|
|||
|
|
felicie
|
|||
|
|
felicite
|
|||
|
|
fender
|
|||
|
|
ferdinand
|
|||
|
|
fermat
|
|||
|
|
fernand
|
|||
|
|
ferrari
|
|||
|
|
fete
|
|||
|
|
fevrier
|
|||
|
|
fiacre
|
|||
|
|
fidele
|
|||
|
|
fidelite
|
|||
|
|
fidelity
|
|||
|
|
field
|
|||
|
|
file
|
|||
|
|
filet
|
|||
|
|
fini
|
|||
|
|
finite
|
|||
|
|
firmin
|
|||
|
|
fishers
|
|||
|
|
flakes
|
|||
|
|
fleche
|
|||
|
|
fleur
|
|||
|
|
fleurs
|
|||
|
|
float
|
|||
|
|
flocon
|
|||
|
|
flocons
|
|||
|
|
florent
|
|||
|
|
florentin
|
|||
|
|
flower
|
|||
|
|
flowers
|
|||
|
|
foolproof
|
|||
|
|
football
|
|||
|
|
foresight
|
|||
|
|
format
|
|||
|
|
forsythe
|
|||
|
|
fourier
|
|||
|
|
fraise
|
|||
|
|
framboise
|
|||
|
|
francine
|
|||
|
|
francois
|
|||
|
|
francoise
|
|||
|
|
fred
|
|||
|
|
frederic
|
|||
|
|
friend
|
|||
|
|
frighten
|
|||
|
|
fulbert
|
|||
|
|
fun
|
|||
|
|
function
|
|||
|
|
fungible
|
|||
|
|
gabin
|
|||
|
|
gabriel
|
|||
|
|
gaetan
|
|||
|
|
games
|
|||
|
|
gardner
|
|||
|
|
garfield
|
|||
|
|
gaston
|
|||
|
|
gateau
|
|||
|
|
gatien
|
|||
|
|
gatt
|
|||
|
|
gauss
|
|||
|
|
gautier
|
|||
|
|
gemeaux
|
|||
|
|
genevieve
|
|||
|
|
geoffroy
|
|||
|
|
george
|
|||
|
|
georges
|
|||
|
|
gerard
|
|||
|
|
geraud
|
|||
|
|
germain
|
|||
|
|
germaine
|
|||
|
|
gertrude
|
|||
|
|
ghislain
|
|||
|
|
gibson
|
|||
|
|
gilbert
|
|||
|
|
gildas
|
|||
|
|
gilles
|
|||
|
|
ginger
|
|||
|
|
gisele
|
|||
|
|
glacier
|
|||
|
|
gnu
|
|||
|
|
golf
|
|||
|
|
golfer
|
|||
|
|
gontran
|
|||
|
|
gorgeous
|
|||
|
|
gorges
|
|||
|
|
gosling
|
|||
|
|
gouge
|
|||
|
|
goutte
|
|||
|
|
graham
|
|||
|
|
grahm
|
|||
|
|
gras
|
|||
|
|
gregoire
|
|||
|
|
group
|
|||
|
|
gryphon
|
|||
|
|
gucci
|
|||
|
|
guenole
|
|||
|
|
guess
|
|||
|
|
guest
|
|||
|
|
guillaume
|
|||
|
|
guitar
|
|||
|
|
guitare
|
|||
|
|
gumption
|
|||
|
|
guntis
|
|||
|
|
guy
|
|||
|
|
gwladys
|
|||
|
|
habib
|
|||
|
|
hack
|
|||
|
|
hacker
|
|||
|
|
hal
|
|||
|
|
hamlet
|
|||
|
|
handily
|
|||
|
|
happening
|
|||
|
|
harmonie
|
|||
|
|
harmony
|
|||
|
|
harold
|
|||
|
|
harvey
|
|||
|
|
hawaii
|
|||
|
|
hebrides
|
|||
|
|
heinlein
|
|||
|
|
helene
|
|||
|
|
hello
|
|||
|
|
help
|
|||
|
|
henri
|
|||
|
|
herbert
|
|||
|
|
hermann
|
|||
|
|
hermes
|
|||
|
|
herve
|
|||
|
|
hiawatha
|
|||
|
|
hibernia
|
|||
|
|
hidden
|
|||
|
|
hippolyte
|
|||
|
|
hiver
|
|||
|
|
homework
|
|||
|
|
honey
|
|||
|
|
honore
|
|||
|
|
honorine
|
|||
|
|
horse
|
|||
|
|
horus
|
|||
|
|
hubert
|
|||
|
|
hugues
|
|||
|
|
humbert
|
|||
|
|
hutchins
|
|||
|
|
hyacinthe
|
|||
|
|
hydrogen
|
|||
|
|
ibm
|
|||
|
|
ida
|
|||
|
|
ignace
|
|||
|
|
igor
|
|||
|
|
imbroglio
|
|||
|
|
imbroglio
|
|||
|
|
immaculee
|
|||
|
|
imperial
|
|||
|
|
include
|
|||
|
|
inconnue
|
|||
|
|
ines
|
|||
|
|
info
|
|||
|
|
ingres
|
|||
|
|
ingress
|
|||
|
|
ingrid
|
|||
|
|
inna
|
|||
|
|
innocent
|
|||
|
|
innocuous
|
|||
|
|
internet
|
|||
|
|
invite
|
|||
|
|
irene
|
|||
|
|
irenee
|
|||
|
|
irishman
|
|||
|
|
irlande
|
|||
|
|
isabelle
|
|||
|
|
isidore
|
|||
|
|
isis
|
|||
|
|
jacqueline
|
|||
|
|
jacques
|
|||
|
|
janvier
|
|||
|
|
japan
|
|||
|
|
japon
|
|||
|
|
jean
|
|||
|
|
jean-baptiste
|
|||
|
|
jean-claude
|
|||
|
|
jean-francois
|
|||
|
|
jean-michel
|
|||
|
|
jean-pierre
|
|||
|
|
jean-yves
|
|||
|
|
jeanclaude
|
|||
|
|
jeanfrancois
|
|||
|
|
jeanmichel
|
|||
|
|
jeanne
|
|||
|
|
jeanpierre
|
|||
|
|
jeanyves
|
|||
|
|
jerome
|
|||
|
|
jessica
|
|||
|
|
jester
|
|||
|
|
jeudi
|
|||
|
|
jixian
|
|||
|
|
joel
|
|||
|
|
johnny
|
|||
|
|
joseph
|
|||
|
|
joshua
|
|||
|
|
jour
|
|||
|
|
judas
|
|||
|
|
judicael
|
|||
|
|
judith
|
|||
|
|
juggle
|
|||
|
|
juillet
|
|||
|
|
juin
|
|||
|
|
jules
|
|||
|
|
julia
|
|||
|
|
julien
|
|||
|
|
julienne
|
|||
|
|
juliette
|
|||
|
|
jumeaux
|
|||
|
|
jupiter
|
|||
|
|
juste
|
|||
|
|
justin
|
|||
|
|
justine
|
|||
|
|
kathleen
|
|||
|
|
kermit
|
|||
|
|
kernel
|
|||
|
|
kevin
|
|||
|
|
key
|
|||
|
|
kirkland
|
|||
|
|
kiwi
|
|||
|
|
knight
|
|||
|
|
ladle
|
|||
|
|
lambda
|
|||
|
|
lamination
|
|||
|
|
landry
|
|||
|
|
lapin
|
|||
|
|
larissa
|
|||
|
|
larkin
|
|||
|
|
larry
|
|||
|
|
laurent
|
|||
|
|
lazare
|
|||
|
|
lazarus
|
|||
|
|
lea
|
|||
|
|
lebesgue
|
|||
|
|
lee
|
|||
|
|
leger
|
|||
|
|
leland
|
|||
|
|
leon
|
|||
|
|
leonce
|
|||
|
|
leroy
|
|||
|
|
lewis
|
|||
|
|
library
|
|||
|
|
licorne
|
|||
|
|
light
|
|||
|
|
lion
|
|||
|
|
lisa
|
|||
|
|
lisp
|
|||
|
|
loch
|
|||
|
|
lock
|
|||
|
|
lockout
|
|||
|
|
louis
|
|||
|
|
louise
|
|||
|
|
lourdes
|
|||
|
|
love
|
|||
|
|
luc
|
|||
|
|
lucie
|
|||
|
|
lucien
|
|||
|
|
lumiere
|
|||
|
|
lundi
|
|||
|
|
lune
|
|||
|
|
lydie
|
|||
|
|
macintosh
|
|||
|
|
mack
|
|||
|
|
madeleine
|
|||
|
|
madelene
|
|||
|
|
maggot
|
|||
|
|
magic
|
|||
|
|
magique
|
|||
|
|
mai
|
|||
|
|
mail
|
|||
|
|
maint
|
|||
|
|
malcolm
|
|||
|
|
malcom
|
|||
|
|
manager
|
|||
|
|
mangue
|
|||
|
|
marc
|
|||
|
|
marcel
|
|||
|
|
marcelle
|
|||
|
|
marcellin
|
|||
|
|
mardi
|
|||
|
|
marguerite
|
|||
|
|
marie
|
|||
|
|
marie-madeleine
|
|||
|
|
marietta
|
|||
|
|
mariette
|
|||
|
|
marina
|
|||
|
|
marius
|
|||
|
|
mark
|
|||
|
|
markus
|
|||
|
|
mars
|
|||
|
|
marthe
|
|||
|
|
martial
|
|||
|
|
martin
|
|||
|
|
martine
|
|||
|
|
martinien
|
|||
|
|
marty
|
|||
|
|
marvin
|
|||
|
|
master
|
|||
|
|
math
|
|||
|
|
mathilde
|
|||
|
|
matthias
|
|||
|
|
matthieu
|
|||
|
|
maurice
|
|||
|
|
maxime
|
|||
|
|
medard
|
|||
|
|
melaine
|
|||
|
|
mellon
|
|||
|
|
memory
|
|||
|
|
mercredi
|
|||
|
|
mercure
|
|||
|
|
mercury
|
|||
|
|
meres
|
|||
|
|
merlin
|
|||
|
|
metro
|
|||
|
|
mets
|
|||
|
|
mgr
|
|||
|
|
michael
|
|||
|
|
michel
|
|||
|
|
michelle
|
|||
|
|
mike
|
|||
|
|
minimum
|
|||
|
|
minsky
|
|||
|
|
mit
|
|||
|
|
modem
|
|||
|
|
modeste
|
|||
|
|
mogul
|
|||
|
|
moguls
|
|||
|
|
monique
|
|||
|
|
mont
|
|||
|
|
moose
|
|||
|
|
morley
|
|||
|
|
morts
|
|||
|
|
mouse
|
|||
|
|
mozart
|
|||
|
|
mutant
|
|||
|
|
nadege
|
|||
|
|
nagel
|
|||
|
|
naissance
|
|||
|
|
nancy
|
|||
|
|
napoleon
|
|||
|
|
narcisse
|
|||
|
|
nasa
|
|||
|
|
natacha
|
|||
|
|
nathalie
|
|||
|
|
nationale
|
|||
|
|
nativite
|
|||
|
|
navette
|
|||
|
|
nepenthes
|
|||
|
|
neptune
|
|||
|
|
ness
|
|||
|
|
nestor
|
|||
|
|
net
|
|||
|
|
network
|
|||
|
|
new
|
|||
|
|
news
|
|||
|
|
newton
|
|||
|
|
next
|
|||
|
|
nicolas
|
|||
|
|
nina
|
|||
|
|
ninon
|
|||
|
|
nobody
|
|||
|
|
noel
|
|||
|
|
norbert
|
|||
|
|
notre
|
|||
|
|
novembre
|
|||
|
|
noxious
|
|||
|
|
nuclear
|
|||
|
|
nutrition
|
|||
|
|
nyquist
|
|||
|
|
oceanography
|
|||
|
|
ocelot
|
|||
|
|
october
|
|||
|
|
octobre
|
|||
|
|
odette
|
|||
|
|
odile
|
|||
|
|
odilon
|
|||
|
|
office
|
|||
|
|
olive
|
|||
|
|
olivetti
|
|||
|
|
olivia
|
|||
|
|
olivier
|
|||
|
|
open
|
|||
|
|
operator
|
|||
|
|
oracle
|
|||
|
|
orca
|
|||
|
|
orwell
|
|||
|
|
osiris
|
|||
|
|
outlaw
|
|||
|
|
oxford
|
|||
|
|
pacific
|
|||
|
|
pacifique
|
|||
|
|
pad
|
|||
|
|
padoue
|
|||
|
|
painless
|
|||
|
|
pakistan
|
|||
|
|
pam
|
|||
|
|
paper
|
|||
|
|
papers
|
|||
|
|
papiers
|
|||
|
|
paques
|
|||
|
|
parfait
|
|||
|
|
pascal
|
|||
|
|
pass
|
|||
|
|
password
|
|||
|
|
pat
|
|||
|
|
paterne
|
|||
|
|
patrice
|
|||
|
|
patricia
|
|||
|
|
patrick
|
|||
|
|
paul
|
|||
|
|
paule
|
|||
|
|
paulin
|
|||
|
|
peche
|
|||
|
|
pecheur
|
|||
|
|
pecheurs
|
|||
|
|
peggy
|
|||
|
|
pelagie
|
|||
|
|
pencil
|
|||
|
|
penguin
|
|||
|
|
penis
|
|||
|
|
pentecote
|
|||
|
|
peoria
|
|||
|
|
percolate
|
|||
|
|
peres
|
|||
|
|
persimmon
|
|||
|
|
persona
|
|||
|
|
pete
|
|||
|
|
peter
|
|||
|
|
peugeot
|
|||
|
|
peur
|
|||
|
|
philip
|
|||
|
|
philippe
|
|||
|
|
phoenix
|
|||
|
|
phone
|
|||
|
|
pierre
|
|||
|
|
pizza
|
|||
|
|
plane
|
|||
|
|
playboy
|
|||
|
|
plover
|
|||
|
|
pluto
|
|||
|
|
pluton
|
|||
|
|
plymouth
|
|||
|
|
poire
|
|||
|
|
poisson
|
|||
|
|
poissons
|
|||
|
|
polynomial
|
|||
|
|
pomme
|
|||
|
|
pondering
|
|||
|
|
porc
|
|||
|
|
pork
|
|||
|
|
porsche
|
|||
|
|
poster
|
|||
|
|
power
|
|||
|
|
praise
|
|||
|
|
precious
|
|||
|
|
prelude
|
|||
|
|
presence
|
|||
|
|
presto
|
|||
|
|
prevision
|
|||
|
|
prince
|
|||
|
|
princeton
|
|||
|
|
printemps
|
|||
|
|
prisca
|
|||
|
|
priv
|
|||
|
|
private
|
|||
|
|
privs
|
|||
|
|
professor
|
|||
|
|
profile
|
|||
|
|
program
|
|||
|
|
prosper
|
|||
|
|
protect
|
|||
|
|
protozoa
|
|||
|
|
prudence
|
|||
|
|
pub
|
|||
|
|
public
|
|||
|
|
pumpkin
|
|||
|
|
puppet
|
|||
|
|
quentin
|
|||
|
|
qwerty
|
|||
|
|
rabbit
|
|||
|
|
rainbow
|
|||
|
|
raindrop
|
|||
|
|
raissa
|
|||
|
|
raleigh
|
|||
|
|
rameaux
|
|||
|
|
random
|
|||
|
|
raoul
|
|||
|
|
rap
|
|||
|
|
rascal
|
|||
|
|
raymond
|
|||
|
|
reagan
|
|||
|
|
really
|
|||
|
|
rebecca
|
|||
|
|
regional
|
|||
|
|
reine
|
|||
|
|
remi
|
|||
|
|
remote
|
|||
|
|
renaud
|
|||
|
|
renault
|
|||
|
|
rene
|
|||
|
|
reponse
|
|||
|
|
requin
|
|||
|
|
reseau
|
|||
|
|
richard
|
|||
|
|
rick
|
|||
|
|
ripple
|
|||
|
|
risc
|
|||
|
|
rje
|
|||
|
|
robert
|
|||
|
|
robot
|
|||
|
|
robotics
|
|||
|
|
rochester
|
|||
|
|
rodent
|
|||
|
|
rodolphe
|
|||
|
|
rodrigue
|
|||
|
|
roger
|
|||
|
|
roi
|
|||
|
|
roland
|
|||
|
|
rolande
|
|||
|
|
rolex
|
|||
|
|
romain
|
|||
|
|
romano
|
|||
|
|
romaric
|
|||
|
|
romeo
|
|||
|
|
romuald
|
|||
|
|
ronald
|
|||
|
|
root
|
|||
|
|
rosalie
|
|||
|
|
rose
|
|||
|
|
rosebud
|
|||
|
|
roseline
|
|||
|
|
rosemary
|
|||
|
|
roses
|
|||
|
|
rosine
|
|||
|
|
ruben
|
|||
|
|
rules
|
|||
|
|
ruth
|
|||
|
|
sabine
|
|||
|
|
sacre
|
|||
|
|
sade
|
|||
|
|
sagittaire
|
|||
|
|
sainte
|
|||
|
|
sal
|
|||
|
|
sales
|
|||
|
|
salome
|
|||
|
|
samedi
|
|||
|
|
samson
|
|||
|
|
sandrine
|
|||
|
|
saturn
|
|||
|
|
saturne
|
|||
|
|
saturnin
|
|||
|
|
saxon
|
|||
|
|
scamper
|
|||
|
|
scheme
|
|||
|
|
school
|
|||
|
|
scorpion
|
|||
|
|
scott
|
|||
|
|
scotty
|
|||
|
|
sebastien
|
|||
|
|
secret
|
|||
|
|
security
|
|||
|
|
seigneur
|
|||
|
|
sensor
|
|||
|
|
septembre
|
|||
|
|
serenity
|
|||
|
|
serge
|
|||
|
|
service
|
|||
|
|
sesame
|
|||
|
|
severin
|
|||
|
|
sex
|
|||
|
|
sharc
|
|||
|
|
shark
|
|||
|
|
sharks
|
|||
|
|
sharon
|
|||
|
|
sheffield
|
|||
|
|
sheldon
|
|||
|
|
shell
|
|||
|
|
shiva
|
|||
|
|
shivers
|
|||
|
|
shuttle
|
|||
|
|
sidoine
|
|||
|
|
signature
|
|||
|
|
silvere
|
|||
|
|
simon
|
|||
|
|
simple
|
|||
|
|
simpsons
|
|||
|
|
singer
|
|||
|
|
single
|
|||
|
|
smile
|
|||
|
|
smiles
|
|||
|
|
smooch
|
|||
|
|
smother
|
|||
|
|
snatch
|
|||
|
|
snoopy
|
|||
|
|
soap
|
|||
|
|
socrate
|
|||
|
|
socrates
|
|||
|
|
solange
|
|||
|
|
somebody
|
|||
|
|
sophie
|
|||
|
|
sossina
|
|||
|
|
sourire
|
|||
|
|
souris
|
|||
|
|
souvenir
|
|||
|
|
sparrows
|
|||
|
|
spit
|
|||
|
|
spring
|
|||
|
|
springer
|
|||
|
|
squires
|
|||
|
|
stanislas
|
|||
|
|
strangle
|
|||
|
|
stratford
|
|||
|
|
student
|
|||
|
|
stuttgart
|
|||
|
|
subway
|
|||
|
|
succes
|
|||
|
|
success
|
|||
|
|
summer
|
|||
|
|
sun
|
|||
|
|
super
|
|||
|
|
superuser
|
|||
|
|
support
|
|||
|
|
supported
|
|||
|
|
surfer
|
|||
|
|
suzanne
|
|||
|
|
swearer
|
|||
|
|
sylvain
|
|||
|
|
sylvere
|
|||
|
|
sylvestre
|
|||
|
|
sylvie
|
|||
|
|
symmetry
|
|||
|
|
sys
|
|||
|
|
sysadmin
|
|||
|
|
system
|
|||
|
|
tangerine
|
|||
|
|
tanguy
|
|||
|
|
tape
|
|||
|
|
target
|
|||
|
|
tarragon
|
|||
|
|
tatiana
|
|||
|
|
taureau
|
|||
|
|
taylor
|
|||
|
|
tech
|
|||
|
|
telephone
|
|||
|
|
temptation
|
|||
|
|
tennis
|
|||
|
|
tentation
|
|||
|
|
terminal
|
|||
|
|
terre
|
|||
|
|
test
|
|||
|
|
thailand
|
|||
|
|
thailande
|
|||
|
|
thecle
|
|||
|
|
theodore
|
|||
|
|
theophile
|
|||
|
|
therese
|
|||
|
|
thibault
|
|||
|
|
thibaut
|
|||
|
|
thierry
|
|||
|
|
thomas
|
|||
|
|
tiger
|
|||
|
|
tigre
|
|||
|
|
toggle
|
|||
|
|
tomate
|
|||
|
|
tomato
|
|||
|
|
topography
|
|||
|
|
tortoise
|
|||
|
|
tortue
|
|||
|
|
toussaint
|
|||
|
|
toxic
|
|||
|
|
toyota
|
|||
|
|
trails
|
|||
|
|
transfer
|
|||
|
|
transfiguration
|
|||
|
|
travail
|
|||
|
|
trivial
|
|||
|
|
trombone
|
|||
|
|
tty
|
|||
|
|
tuba
|
|||
|
|
tubas
|
|||
|
|
tuttle
|
|||
|
|
ulrich
|
|||
|
|
umesh
|
|||
|
|
unhappy
|
|||
|
|
unicorn
|
|||
|
|
unix
|
|||
|
|
unknown
|
|||
|
|
uranus
|
|||
|
|
urbain
|
|||
|
|
urchin
|
|||
|
|
util
|
|||
|
|
utility
|
|||
|
|
uucp
|
|||
|
|
valentin
|
|||
|
|
vasant
|
|||
|
|
venceslas
|
|||
|
|
vendredi
|
|||
|
|
venus
|
|||
|
|
ver
|
|||
|
|
veronique
|
|||
|
|
verseau
|
|||
|
|
vertige
|
|||
|
|
vertigo
|
|||
|
|
vianney
|
|||
|
|
vicky
|
|||
|
|
victoire
|
|||
|
|
victor
|
|||
|
|
victorien
|
|||
|
|
vierge
|
|||
|
|
village
|
|||
|
|
vincent
|
|||
|
|
virgin
|
|||
|
|
virginia
|
|||
|
|
virginie
|
|||
|
|
virus
|
|||
|
|
visitation
|
|||
|
|
visitor
|
|||
|
|
viviane
|
|||
|
|
vivien
|
|||
|
|
volvo
|
|||
|
|
wargames
|
|||
|
|
warren
|
|||
|
|
water
|
|||
|
|
weenie
|
|||
|
|
whatever
|
|||
|
|
whatnot
|
|||
|
|
whiting
|
|||
|
|
whitney
|
|||
|
|
wholesale
|
|||
|
|
wilfried
|
|||
|
|
will
|
|||
|
|
william
|
|||
|
|
willie
|
|||
|
|
winston
|
|||
|
|
wisconsin
|
|||
|
|
wizard
|
|||
|
|
wombat
|
|||
|
|
woodwind
|
|||
|
|
word
|
|||
|
|
work
|
|||
|
|
wormwood
|
|||
|
|
wyoming
|
|||
|
|
xavier
|
|||
|
|
xaviere
|
|||
|
|
xfer
|
|||
|
|
xmodem
|
|||
|
|
xyz
|
|||
|
|
yaco
|
|||
|
|
yang
|
|||
|
|
yin
|
|||
|
|
yosemite
|
|||
|
|
yves
|
|||
|
|
yvette
|
|||
|
|
zap
|
|||
|
|
zimmerman
|
|||
|
|
zita
|
|||
|
|
zmodem
|
|||
|
|
zzz
|
|||
|
|
|
|||
|
|
Written by "The Butler", a hacker at heart, a Systems Administrator
|
|||
|
|
in real life who enjoys learning as much as possible about any
|
|||
|
|
given system including how to circumvent its security measures. He
|
|||
|
|
has written articles for various hacker magazines that deal with
|
|||
|
|
computer security. He currently administers a PC Network for a
|
|||
|
|
medium size business (250 people). He also lectures to various
|
|||
|
|
groups including Local EDP Auditors Association, User Groups, and
|
|||
|
|
Private Corporations on how to protect their systems from hackers
|
|||
|
|
like himself but who use their knowledge for mischievous purposes.
|
|||
|
|
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
|
|||
|
|
Dear Clyde Responses to
|
|||
|
|
questions for
|
|||
|
|
those who are
|
|||
|
|
searching for
|
|||
|
|
the truth.
|
|||
|
|
|
|||
|
|
Send your comments or questions to Clyde c/o the AIS Security
|
|||
|
|
Branch in Parkersburg, Room 1011, or leave them in Clyde's mailbox
|
|||
|
|
located on the Security bulletin boards throughout the Parkersburg
|
|||
|
|
office.
|
|||
|
|
|
|||
|
|
Dear Clyde,
|
|||
|
|
What is the proper way to dispose of diskettes which are no longer
|
|||
|
|
able to be used? Are there security concerns here?
|
|||
|
|
Peggy
|
|||
|
|
Dear Peggy,
|
|||
|
|
Yes there are security concerns as the data stored on the diskettes
|
|||
|
|
may still be readable, if someone wants to take the effort to
|
|||
|
|
retrieve it. Therefore the diskettes should be disposed of
|
|||
|
|
properly. Any method of destroying the diskette can be used.
|
|||
|
|
Cutting it up as you do a credit card that is no longer to be used
|
|||
|
|
is one method. However the important thing is to make certain the
|
|||
|
|
disk surface, that is the inner contents of the envelope or plastic
|
|||
|
|
case, is destroyed.
|
|||
|
|
|
|||
|
|
(Note: I personally prefer giving the disk several good whacks with
|
|||
|
|
my sword and lance to render it unusable.)
|
|||
|
|
|
|||
|
|
|
|||
|
|
Clyde ....... Sir Clyde?
|
|||
|
|
Rumor has it that Clyde is to be recognized for his continuing
|
|||
|
|
efforts in the arena of computer security by being knighted. There
|
|||
|
|
will be more on this in the next issue, stay tuned.
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
...........................................................
|
|||
|
|
A Journey Behind (further behind) . . .
|
|||
|
|
.
|
|||
|
|
. . . . . ..
|
|||
|
|
.
|
|||
|
|
. The Dark Side of CYBERSPACE . . ..
|
|||
|
|
. .
|
|||
|
|
. . . . . .
|
|||
|
|
.
|
|||
|
|
Hackers in Their Illusive World: . A Response .
|
|||
|
|
. .
|
|||
|
|
|
|||
|
|
...........................................................
|
|||
|
|
|
|||
|
|
A Response by: Dispater
|
|||
|
|
Editor in Chief of Phrack Inc. Magazine
|
|||
|
|
InterNet: phracksub@stormking.com
|
|||
|
|
|
|||
|
|
First of all, I would like to thank Kim Clancy for providing me
|
|||
|
|
with the opportunity to reply to her article in the previous issue
|
|||
|
|
of the ISSM. I find myself agreeing with her on more issues than
|
|||
|
|
not. I read her piece on Cyberspace... Most of the article was
|
|||
|
|
good, but I felt unclear about what she was saying in the section
|
|||
|
|
titled "The Dark Side." So I have attempted to present a few
|
|||
|
|
things from this hacker's viewpoint and make a few points where I
|
|||
|
|
have disagreed with her. The ">" indicates Kim's previous
|
|||
|
|
writings.
|
|||
|
|
|
|||
|
|
>...What is scary to me in regard to some of the avenues is
|
|||
|
|
>the ability for individuals to get to so many different
|
|||
|
|
>types of information...
|
|||
|
|
|
|||
|
|
What scares me are the kinds of people who have access to
|
|||
|
|
the most personal parts of our lives compiled into data
|
|||
|
|
bases (like Information America) that are for sale to anyone
|
|||
|
|
who wants to pay the money or has the "power" to access it.
|
|||
|
|
Why does the government need to know my unlisted phone number? Is
|
|||
|
|
it really any insurance agency's right to know that I have a son
|
|||
|
|
or daughter that is about to turn age 16, and will soon need to buy
|
|||
|
|
auto insurance? I think I have the right not to be bothered by an
|
|||
|
|
onslaught of people that think they have something I want to
|
|||
|
|
purchase from them. If you really enjoy junk mail and computerized
|
|||
|
|
telephone sales calls you can thank these kinds of databases.
|
|||
|
|
|
|||
|
|
>I am not stating that I think information should be
|
|||
|
|
>shielded from individuals.
|
|||
|
|
|
|||
|
|
The more diverse sources of information we can all access, the
|
|||
|
|
better off society will become. If we look at the past we can see
|
|||
|
|
how accuracy in books was improved drastically by the creation of
|
|||
|
|
the printing press. The scribes of kings and church figures were
|
|||
|
|
no longer relied upon as authorities of various subject matter.
|
|||
|
|
Information was made cheap and easily possessed by the common man.
|
|||
|
|
Therefore if someone disagreed with some book that was printed, he
|
|||
|
|
and his guild could write their version of what THEY found to be
|
|||
|
|
true. This promoted truth, accuracy, a deluge of human
|
|||
|
|
interaction, and free thought.
|
|||
|
|
|
|||
|
|
>...I once went to a presentation about hackers. The
|
|||
|
|
>presenter told a story about a mother who took her child's
|
|||
|
|
>computer modem out into the driveway and ran over it after
|
|||
|
|
>her son had been arrested for hacking...
|
|||
|
|
|
|||
|
|
What was the parent doing while her child was hacking?
|
|||
|
|
Another thing we need to clarify is the use of the word
|
|||
|
|
"child." These are not often children. There is a certain
|
|||
|
|
level of mental development that must occur first. I don't
|
|||
|
|
know much about child psychology, but I'd say that most kids
|
|||
|
|
under the age of 13 would have a bit of difficult time
|
|||
|
|
understanding computer networking. Most people in the
|
|||
|
|
computer underground are at least 16. If they are not
|
|||
|
|
16 years old almost every sysop I know, kicks them off the
|
|||
|
|
system. The young person should be allowed to explore in areas the
|
|||
|
|
parent might not agree with as long as he/she is willing to
|
|||
|
|
talk about it with the parent afterward. Why are required to
|
|||
|
|
water down and censor all information so that is safe and
|
|||
|
|
easily understandable to the "little children?" If there is
|
|||
|
|
a 12 year old that has network access and is reading USENET's
|
|||
|
|
ALT.SEX.BONDAGE, I think there is a greater problem involved than
|
|||
|
|
the type of information the nets carry!!
|
|||
|
|
|
|||
|
|
>While hackers spend time developing their skills and
|
|||
|
|
>learning how to master cyberspace they also use cyberspace
|
|||
|
|
>to share information about what they have learned.
|
|||
|
|
|
|||
|
|
This is the great benefit of getting involved. Everyone
|
|||
|
|
should own a computer because of this reason.
|
|||
|
|
|
|||
|
|
>Information has been found on how to steal long distance
|
|||
|
|
>phone calls from the phone company, how to make a pipe bomb
|
|||
|
|
>and how to perform satanic rituals before sitting down to
|
|||
|
|
>hack.
|
|||
|
|
|
|||
|
|
It is not illegal to know how to do any of the previously
|
|||
|
|
mentioned things. As you mention later the information can
|
|||
|
|
also be found in such places like libraries. We need to
|
|||
|
|
keep a few things in perspective here. MOST of the
|
|||
|
|
information readily available on phone phreaking is so out
|
|||
|
|
dated, one couldn't hope to implement the use of such
|
|||
|
|
knowledge without most surely getting caught in an ESS(Electronic
|
|||
|
|
Switching System environment. Most of the United State's
|
|||
|
|
telephones are on such a system.
|
|||
|
|
|
|||
|
|
Secondly, most of the information available on explosives is
|
|||
|
|
very crude. Most of it isn't worth the time it took to
|
|||
|
|
download. Actually there is more information available in
|
|||
|
|
the library on that subject than in all the data bases in
|
|||
|
|
the world. I personally think this kind of thing is simply
|
|||
|
|
stupid. I will not print that kind of thing in Phrack.
|
|||
|
|
That kind of information is typed in from books, by people
|
|||
|
|
who don't have anything else to do.
|
|||
|
|
|
|||
|
|
In regards to "satanic rituals", it is difficult to make any
|
|||
|
|
comments about this because in all my years of calling BBS's
|
|||
|
|
and talking to other hackers, I have never seen such an
|
|||
|
|
animal. I have seen *THREE* articles on the Wiccan religion
|
|||
|
|
which is similar to white witchcraft, but it's not even
|
|||
|
|
close to anything satanic. However, other than this
|
|||
|
|
minuscule tidbit in cyberspace, the only things I've seen
|
|||
|
|
were things that were written as pranks and for joke
|
|||
|
|
purposes. It amazes me that if one person has written
|
|||
|
|
something or done something it is representative of the
|
|||
|
|
whole community. This is definitely not a responsible
|
|||
|
|
conclusion. If some people would just open their eyes to
|
|||
|
|
reality, they would not see a computer underground filled
|
|||
|
|
with "satanic, child molesting anarchists".
|
|||
|
|
|
|||
|
|
>I hesitate to write the above because I don't want people
|
|||
|
|
>to avoid the technology. Everything I have found is in
|
|||
|
|
>most libraries, but the accessibility of it through
|
|||
|
|
>computers makes it much easier to obtain.
|
|||
|
|
|
|||
|
|
You hesitate with good reason and you are correct about all
|
|||
|
|
that information being already in your local library. The
|
|||
|
|
problem boils down to "digital censorship." Some people are
|
|||
|
|
saying it's OK for a library to have the aforementioned
|
|||
|
|
information, but it's NOT OK for it to be on my computer's
|
|||
|
|
hard drive.
|
|||
|
|
|
|||
|
|
In regards to that argument I say it is much easier to get
|
|||
|
|
the information from a library than the computer. Let's
|
|||
|
|
take a look at they facts. First of all, most libraries are
|
|||
|
|
FREE. On the other hand the average computer system
|
|||
|
|
(386/33) costs around $1500. Your typical 8th grader
|
|||
|
|
doesn't usually have that kind of cash.
|
|||
|
|
|
|||
|
|
The problem is that reality and virtual reality is the same
|
|||
|
|
for some of us. We will promptly ignore silly rules like
|
|||
|
|
"it's ok for some people to know certain things, but it's
|
|||
|
|
not ok for me to know the same bit of information."
|
|||
|
|
In the information age we are all becoming much more aware
|
|||
|
|
of each other's presence. We are finding out that we are
|
|||
|
|
all very different. We each have some ideas that can
|
|||
|
|
easily shock others. These ideas can and are being
|
|||
|
|
challenged by the other people we interact with. Therefore,
|
|||
|
|
we should NEVER take the step back into the "electronic dark
|
|||
|
|
age."
|
|||
|
|
|
|||
|
|
The really funny thing about all this is, everyone in the
|
|||
|
|
United States IS a part of cyberspace, even though most of
|
|||
|
|
them don't want to recognize this fact. If your name is on
|
|||
|
|
a computer somewhere, you are in cyberspace! So you'd
|
|||
|
|
better become aware of your existence. Use it to learn and
|
|||
|
|
question why its there!
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
OAIS Employees Volunteer to Judge Student Contest
|
|||
|
|
|
|||
|
|
Every October, the Computer Learning Foundation, a non-profit
|
|||
|
|
educational foundation serving the United States and Canada, hosts
|
|||
|
|
Computer Learning Month. During that month, among other numerous
|
|||
|
|
activities, the foundation hosts numerous contests designed to
|
|||
|
|
encourage students, educators, and community members to explore new
|
|||
|
|
areas of using technology and to share their knowledge with others.
|
|||
|
|
These contests for students provide parents and teachers with an
|
|||
|
|
activity children can do today to begin thinking and learning about
|
|||
|
|
what it means to be a responsible user of technology. One of this
|
|||
|
|
year's contests was a student writing contest focusing on Adult
|
|||
|
|
Attitudes on the Value of Technology and Ethical Issues. Students
|
|||
|
|
were to interview one parent and one other adult, write a summary
|
|||
|
|
of their opinions on the value of technology in our lives and the
|
|||
|
|
ethical issues involved with using technology, then the students
|
|||
|
|
evaluated what they thought of the comments and opinions expressed
|
|||
|
|
by the adults they interviewed.
|
|||
|
|
The Bureau of the Public Debt participated in this program with
|
|||
|
|
several OAIS employees, Gretchen Bergmann, Kim Clancy, Bill Dobson,
|
|||
|
|
Zephery Ellerson, Joe Kordella, Gary Smith, and Ed Alesius,
|
|||
|
|
volunteering their time to judge the students entries.
|
|||
|
|
While the use of a computer was not required to create the
|
|||
|
|
critique many submissions showed an adept usage of various word
|
|||
|
|
processing, desktop publishing and graphics software.
|
|||
|
|
This interchange between the professional environment and schools
|
|||
|
|
proved to be very enlightening. It is refreshing to see a group
|
|||
|
|
dedicate its effort to a much needed task, keeping schools up with
|
|||
|
|
technology and its responsible use.
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
QUICK FIX SECURITY
|
|||
|
|
|
|||
|
|
The following is a listing of some easy to do security controls
|
|||
|
|
that help a lot....
|
|||
|
|
|
|||
|
|
1. Set modem to answer after 4-5 rings.
|
|||
|
|
2. Select a dial-up number from a different prefix or out of order
|
|||
|
|
from the rest of your office.
|
|||
|
|
3. Use call back features.
|
|||
|
|
4. Use proprietary software for your communications e.g.,
|
|||
|
|
PC Anywhere IV.
|
|||
|
|
5. Use special modems for encryption and access control e.g.,
|
|||
|
|
Leemah Datacom.
|
|||
|
|
6. Disconnect after a certain period of inactivity.
|
|||
|
|
7. Do not allow certain userids' to have dial-up access.
|
|||
|
|
8. Use caller id and call tracking.
|
|||
|
|
9. Display a blank screen when a connection is made so the user
|
|||
|
|
has no clue what they have connected to.
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
COMPUTER SPEAK
|
|||
|
|
COMPUTER TERMS AND THEIR MEANINGS
|
|||
|
|
access n. The ability of a subject to view, change, or
|
|||
|
|
communicate with an object in a computer system. Typically, access
|
|||
|
|
involves a flow of information between the subject and the object
|
|||
|
|
(for example, a user reads a file, a program creates a directory).
|
|||
|
|
cyberspace n. The world that is created by the connection of
|
|||
|
|
computers. Travels thru this environment can be vast and undefined
|
|||
|
|
just as space travel can be. This is the environment Cyberpunks
|
|||
|
|
call home.
|
|||
|
|
database n. A collection of data items processible by one or more
|
|||
|
|
programs.
|
|||
|
|
phreaking v. The art and science of cracking the phone network
|
|||
|
|
(so as, for example, to make free long-distance calls). By
|
|||
|
|
extension, security-cracking in any other context (especially, but
|
|||
|
|
not exclusively, on communications networks).
|
|||
|
|
virtual reality n. 1. Computer simulations that use 3-D graphics
|
|||
|
|
and devices such as the Dataglove to allow the user to interact
|
|||
|
|
with the simulation. 2. A form of network interaction incorporating
|
|||
|
|
aspects of role-playing games, interactive theater, improvisational
|
|||
|
|
comedy, and "true confessions' magazines. In a virtual reality
|
|||
|
|
session, interaction between the participants is written like a
|
|||
|
|
shared novel.
|
|||
|
|
Phrack Inc. Magazine n. An electronically published and
|
|||
|
|
distributed magazine that focuses on technical issues.
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
Comptroller General Decision on EDI
|
|||
|
|
|
|||
|
|
The Comptroller General of the United States has issued a decision
|
|||
|
|
that electronic data interchange (EDI) technologies, with
|
|||
|
|
enhancements such as message authentication and digital signatures,
|
|||
|
|
can create valid legal contractual obligations between the U.S.
|
|||
|
|
Government and the party with whom the agency contracts.
|
|||
|
|
|
|||
|
|
Digest
|
|||
|
|
Contracts formed using Electronic Data Interchange technologies may
|
|||
|
|
constitute valid obligations of the government for purposes of 31 U.S.C.
|
|||
|
|
1501, so long as the technology used provides the same degree of
|
|||
|
|
assurance and certainty as traditional "paper and ink" methods of
|
|||
|
|
contract formation.
|
|||
|
|
|
|||
|
|
Decision
|
|||
|
|
By letter dated September 13, 1991, the Director, Computer Systems
|
|||
|
|
Laboratory, National Institute of Standards and Technology (NIST), asked
|
|||
|
|
whether federal agencies can use Electronic Data Interchange (EDI)
|
|||
|
|
technologies, such as message authentication codes and digital
|
|||
|
|
signatures, to create valid contractual obligations that can be recorded
|
|||
|
|
consistent with 31 U.S.C. 1501. For the reasons stated below, we
|
|||
|
|
conclude that agencies can create valid obligations using properly
|
|||
|
|
secured EDI systems.
|
|||
|
|
|
|||
|
|
Background
|
|||
|
|
EDI is the electronic exchange of business information between
|
|||
|
|
parties, usually via a computer, using an agreed upon format. EDI
|
|||
|
|
is being used to transmit shipping notices, invoices, bid requests, bid
|
|||
|
|
quotes and other messages. Electronic contracting is the use of
|
|||
|
|
EDI technologies to create contractual obligations. EDI allows the
|
|||
|
|
parties to examine the contract, usually on video monitors, but
|
|||
|
|
sometimes on paper facsimiles, store it electronically (for example on
|
|||
|
|
magnetic tapes, on discs or in special memory chips), and recall
|
|||
|
|
it from storage to review it on video monitors, reproduce it on paper or
|
|||
|
|
even mail it via electronic means. Using EDI technologies, it is
|
|||
|
|
possible for an agency to contract in a fraction of the time that
|
|||
|
|
traditional practices take.
|
|||
|
|
As NIST pointed out in its request, the "paperless" nature of the
|
|||
|
|
technology has raised the question of whether electronic contracts
|
|||
|
|
constitute obligations which may be recorded against the government.
|
|||
|
|
NIST is in the process of developing standards for electronic signatures
|
|||
|
|
to be used in various applications,*1 including the formation of
|
|||
|
|
contracts, but has been advised that section 1501 imposes a barrier to
|
|||
|
|
the use of electronic technologies by federal agencies in this regard.
|
|||
|
|
|
|||
|
|
Discussion
|
|||
|
|
Section 1501 establishes the criteria for recording obligations
|
|||
|
|
against the government. The statute provides, in pertinent part, as
|
|||
|
|
follows:
|
|||
|
|
"(a) An amount shall be recorded as an obligation of the United
|
|||
|
|
States Government only when supported by documentary evidence of-
|
|||
|
|
|
|||
|
|
(1) a binding agreement between an agency and another person
|
|||
|
|
(including an agency) that is--
|
|||
|
|
|
|||
|
|
(A) in writing, in a way and form, and for a purpose
|
|||
|
|
authorized by law. . . ."
|
|||
|
|
|
|||
|
|
31 U.S.C. 1501(a) (1) (A).
|
|||
|
|
|
|||
|
|
Under this provision, two requirements must be satisfied: first, the
|
|||
|
|
agreement must bind both the agency and the party with whom the agency
|
|||
|
|
contracts; second, the agreement must be in writing.
|
|||
|
|
|
|||
|
|
Binding Agreement
|
|||
|
|
The primary purpose of section 1501 (a) (1) is "to require that there
|
|||
|
|
be an offer and an acceptance imposing liability on both parties." 39
|
|||
|
|
Comp. Gen. 829, 831 (1960) (emphasis in original). Hence the government
|
|||
|
|
may record an obligation under section 1501 only upon evidence that both
|
|||
|
|
parties to the contract willfully express the intent to be bound. As
|
|||
|
|
explained below, EDI technology provides both the agency and the
|
|||
|
|
contractor the means to electronically "sign" a contract.
|
|||
|
|
A signature traditionally has provided such evidence. See generally
|
|||
|
|
65 Comp. Gen. 806, 810 (1986). Because of its uniqueness, the
|
|||
|
|
handwritten signature is probably the most universally accepted evidence
|
|||
|
|
of an agreement to be bound by the terms of a contract. See 65 Comp.
|
|||
|
|
Gen. at 810. Courts, however, have demonstrated a willingness to accept
|
|||
|
|
other notations, not necessarily written by hand. See, e.g., Ohl & Co.
|
|||
|
|
v. Smith Iron Works, 288 U.S. 170, 176 (1932) (initials); Zacharie v.
|
|||
|
|
Franklin, 37 U.S. (12 Pet.) 151, 161-62 (1838) (a mark);Benedict v.
|
|||
|
|
Lebowitz, 346 F. 2d 120 (2nd Cir. 1965) (typed name); Tabas v. Emergency
|
|||
|
|
Fleet Corporation, 9 F.2d 648, 649 (E.D. Penn. 1926) (typed, printed or
|
|||
|
|
stamped signatures); Berryman v. Childs, 98 Neb. 450, 153 N.W. 486, 488
|
|||
|
|
(1915) (a real estate brokerage used personalized listing contracts which
|
|||
|
|
had the names of its brokers printed on the bottom of the contract in the
|
|||
|
|
space where a handwritten signature usually appears).
|
|||
|
|
As early as 1951, we recognized that a signature does not have to be
|
|||
|
|
handwritten and that "any symbol adopted as one's signature when affixed
|
|||
|
|
with his knowledge and consent is a binding and legal signature. B-
|
|||
|
|
104590, Sept. 12, 1951. Under this theory, we approved the use of
|
|||
|
|
various signature machines ranging from rubber stamps to electronic
|
|||
|
|
encryption devices. See 33 Comp. Gen. 297 (1954); B-216035, Sept. 20,
|
|||
|
|
1984. For example, we held that a certifying officer may adopt and use
|
|||
|
|
an electronic symbol generated by an electronic encryption device to sign
|
|||
|
|
vouchers certifying payments. B-216035, supra. The electronic symbol
|
|||
|
|
proposed for use by certifying officers, we concluded, embodied all of
|
|||
|
|
the attributes of a valid, acceptable signature: it was unique to the
|
|||
|
|
certifying officer, capable of verification, and under his sole control
|
|||
|
|
such that one might presume from its use that the certifying officer,
|
|||
|
|
just as if he had written his name in his own hand, intended to be bound.
|
|||
|
|
EDI technology offers other evidence of an intent to be bound with the
|
|||
|
|
same attributes as a handwritten signature. We conclude that EDI systems
|
|||
|
|
using message authentication codes which follow NIST's Computer Data
|
|||
|
|
Authentication Standard (Federal Information Processing Standard (FIPS)
|
|||
|
|
113*2 or digital signatures following NIST's Digital Signature Standard,
|
|||
|
|
as currently proposed, can produce a form of evidence that is acceptable
|
|||
|
|
under section 1501.
|
|||
|
|
Both the message authentication code and the digital signature are
|
|||
|
|
designed to ensure the authenticity of the data transmitted. They
|
|||
|
|
consist of a series of characters that are cryptographically linked to
|
|||
|
|
the message being transmitted and correspond to no other message. There
|
|||
|
|
are various ways in which a message authentication code or digital
|
|||
|
|
signature might be generated. For example, either could be generated
|
|||
|
|
when the sender inserts something known as a "smart card"*3 into a system
|
|||
|
|
and inputs the data he wants to transmit. Encoded on a circuit chip
|
|||
|
|
located on the smart card is the sender's private key. The sender's
|
|||
|
|
private key is a sequence of numbers or characters which identifies the
|
|||
|
|
sender, and is constant regardless of the transmission. The message
|
|||
|
|
authentication code and the digital signature are functions of the
|
|||
|
|
sender's private key and the data just loaded into the system. The two
|
|||
|
|
differ primarily in the cryptographic methodology used in their
|
|||
|
|
generation and verification.
|
|||
|
|
After loading his data into the system, the sender notifies the system
|
|||
|
|
that he wants to "sign" his transmission. Systems using message
|
|||
|
|
authentication codes send a copy of the data to the chip on the smart
|
|||
|
|
card; the chip then generates the message authentication code by applying
|
|||
|
|
a mathematical procedure known a cryptographic algorithm. Systems using
|
|||
|
|
digital signatures will send a condensed version of the data to the smart
|
|||
|
|
card, which generates the digital signature by applying another
|
|||
|
|
algorithm, as identified in NIST's proposed standard. The card returns
|
|||
|
|
the just-generated message authentication code or digital signature to
|
|||
|
|
the system, which will transmit it and the data to the recipient.
|
|||
|
|
Under either approach, when an offeror or a contracting officer
|
|||
|
|
notifies the system that he wants to "sign" a contract being transmitted,
|
|||
|
|
he is initiating the procedure for generating a message authentication
|
|||
|
|
code or digital signature with the intention of binding his company or
|
|||
|
|
agency, respectively, to the terms of the contract.*4 The code or the
|
|||
|
|
digital signature evidences that intention, as would a handwritten or
|
|||
|
|
other form of signature. Both, generated using the sender's private key,
|
|||
|
|
are unique to the sender; and, the sender controls access to and use of
|
|||
|
|
his "smart card," where his key is stored.
|
|||
|
|
They are also verifiable. When the recipient receives the contract,
|
|||
|
|
either on his computer monitor or in paper facsimile, it will carry,
|
|||
|
|
depending on which approach is used, a notation which constitutes the
|
|||
|
|
message authentication code or the digital signature of the sender,
|
|||
|
|
necessary information to validate the code or the signature and, usually,
|
|||
|
|
the sender's name. The recipient can confirm the authenticity of the
|
|||
|
|
contract by entering the data that he just received and asking his system
|
|||
|
|
to verify the code or the digital signature. The system will then use
|
|||
|
|
the information provided by the sender and either verify or reject it.*5
|
|||
|
|
Both approaches use a key to verify the message just received; however,
|
|||
|
|
the digital signature requires application of a different key from that
|
|||
|
|
used to verify a message authentication code. The change of any data
|
|||
|
|
included in the message as transmitted will result in an unpredictable
|
|||
|
|
change to the message authentication code or the digital signature.
|
|||
|
|
Therefore, when they are verified, the recipient is virtually certain to
|
|||
|
|
detect any alteration.
|
|||
|
|
|
|||
|
|
Writing
|
|||
|
|
To constitute a valid obligation under section 1501(a)(1)(A), a
|
|||
|
|
contract must be supported by documentary evidence "in writing." As NIST
|
|||
|
|
pointed out, some have questioned whether EDI, because of the paperless
|
|||
|
|
nature of the technology, fulfills this requirement. We conclude that it
|
|||
|
|
does.
|
|||
|
|
Prior to the enactment of section 1501, originally section 1311 of the
|
|||
|
|
Supplemental Appropriations Act of 1955, *6 there was no "clean cut
|
|||
|
|
definition of obligations." H.R. Rep. No. 2266, 83rd Cong., 2d Sess. 50
|
|||
|
|
(1954). Some agencies had recorded questionable obligations, including
|
|||
|
|
obligations based on oral contracts, in order to avoid withdrawal and
|
|||
|
|
reversion of appropriated funds. See 51 Comp. Gen. 631, 633 (1972).
|
|||
|
|
Section 1501 was enacted not to restrict agencies to paper and ink in the
|
|||
|
|
formation of contracts, but because, as one court noted, "Congress was
|
|||
|
|
concerned that the executive might avoid spending restrictions by
|
|||
|
|
asserting oral contracts." United States v. American Renaissance Lines,
|
|||
|
|
494 F.2d 1059, 1062 (D.C. Cir. 1974), cert, denied, 419 U.S. 1020 (1974).
|
|||
|
|
The purpose of section 1501 was to require that agencies submit evidence
|
|||
|
|
that affords a high degree of certainty and lessens the possibility of
|
|||
|
|
abuse. See H.R. Rep. No. 2266 at 50.
|
|||
|
|
While "paper and ink" offers a substantial degree of integrity, it is
|
|||
|
|
not the only such evidence. Some courts, applying commercial law (and
|
|||
|
|
the Uniform Commercial Code in particular), have recognized audio tape
|
|||
|
|
recordings, for example, as sufficient to create contracts. See e.g.,
|
|||
|
|
Ellis Canning Company v. Bernstein, 348 F. Supp. 1212 (D. Colo. 1972).
|
|||
|
|
The court, citing a Colorado statute, stated that the tape recording of
|
|||
|
|
the terms of a contract is acceptable because it is a "reduction to
|
|||
|
|
tangible form." *7 Id. at 1228. In a subsequent case, a federal Court
|
|||
|
|
of Appeals held that an audio tape recording of an agreement between the
|
|||
|
|
Gainesville City Commission and a real estate developer was sufficient to
|
|||
|
|
bind the Commission. Londono v. City of Gainesville, 768 F.2d 1223 (11th
|
|||
|
|
Cir. 1985). The court held that the tape recording constituted a "signed
|
|||
|
|
writing." Id. at 1228.
|
|||
|
|
In our opinion, EDI technology, which allows the contract terms to be
|
|||
|
|
examined in human readable form, as on a monitor, stored on electronic
|
|||
|
|
media, recalled from storage and reviewed in human readable form, has an
|
|||
|
|
integrity that is greater than an audio tape recording and equal to that
|
|||
|
|
of a paper and ink contract. Just as with paper and ink, EDI technology
|
|||
|
|
provides a recitation of the precise terms of the contract and avoids the
|
|||
|
|
risk of error inherent in oral testimony which is based on human
|
|||
|
|
memory.*8 Indeed, courts, under an implied-in-fact contract theory, have
|
|||
|
|
enforced contracts on far less documentation than would be available for
|
|||
|
|
electronic contracts. See Clark v. United States, 95 U.S. 539 (1877).
|
|||
|
|
See also Narva Harris Construction Corp. v. United States, 574 F.2d 508
|
|||
|
|
(Ct. Cl. 1978).
|
|||
|
|
For the purpose of interpreting federal statutes, "writing" is defined
|
|||
|
|
to include "printing and typewriting and reproductions of visual symbols
|
|||
|
|
by photographing, multigraphing, mimeographing, manifolding, or
|
|||
|
|
otherwise." 1 U.S.C. 1 (emphasis added). Although the terms of
|
|||
|
|
contracts formed using EDI are stored in a different manner than those of
|
|||
|
|
paper and ink contracts, they ultimately take the form of visual symbols.
|
|||
|
|
We believe that it is sensible to interpret federal law in a manner to
|
|||
|
|
accommodate technological advancements unless the law by its own terms
|
|||
|
|
expressly precludes such an interpretation, or sound policy reasons exist
|
|||
|
|
to do otherwise. It is evident that EDI technology had not been
|
|||
|
|
conceived nor, probably, was even anticipated at the times section 1501
|
|||
|
|
and the statutory definition of "writing" were enacted. Nevertheless, we
|
|||
|
|
conclude that, given the legislative history of section 1501 and the
|
|||
|
|
expansive definition of writing, section 1501 and 1 U.S.C. 1 encompass
|
|||
|
|
EDI technology.
|
|||
|
|
Accordingly, agencies may create valid obligations using EDI systems
|
|||
|
|
which meet NIST standards for security and privacy.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Comptroller General
|
|||
|
|
of the United States
|
|||
|
|
Sept. 13, 1990
|
|||
|
|
|
|||
|
|
General Counsel
|
|||
|
|
U.S. General Accounting Office
|
|||
|
|
441 G. Street, N.W.
|
|||
|
|
Washington, D.C. 20548
|
|||
|
|
|
|||
|
|
Dear Sir:
|
|||
|
|
|
|||
|
|
As you know, National Institute of Standards and Technology (NIST) has
|
|||
|
|
cooperated with the Department of Treasury and the General Accounting
|
|||
|
|
Office to develop an electronic certification system wherein a
|
|||
|
|
cryptographic Message Authentication Code (MAC) is used in place of a
|
|||
|
|
written signature to bind a certifying officer to a payment order.
|
|||
|
|
Several other agencies have expressed their interest in using this or a
|
|||
|
|
similar system as a substitute for a written signature. In fulfillment
|
|||
|
|
of our responsibilities under the Computer Security Act of 1987, NIST is
|
|||
|
|
now in the process of developing a public key based Digital Signature
|
|||
|
|
Standard (DSS) which is specifically designed for electronic signature
|
|||
|
|
applications and will provide at least the same degree of security as the
|
|||
|
|
MAC approach. We have attached the DSS Federal Register Announcement and
|
|||
|
|
draft DSS which is now issued for public comment.
|
|||
|
|
|
|||
|
|
We have often been told that legal impairments exist which prevent
|
|||
|
|
agencies from implementing electronic signatures to bind the federal
|
|||
|
|
government. The specific statute cited is 31 U.S.C. 1501. Before
|
|||
|
|
formally recommending these standards for contracting and financial
|
|||
|
|
management applications, I would like to request a General Accounting
|
|||
|
|
Office decision as to whether NIST standards such as Federal Information
|
|||
|
|
Processing Standard (FIPS) 113 and a finalized DSS may be used throughout
|
|||
|
|
the federal government to record obligations under 31 U.S.C. 1501. If
|
|||
|
|
you need any further information in order to make your decision please
|
|||
|
|
feel free to contact Miles Smid, (301) 975-2938, of my staff.
|
|||
|
|
|
|||
|
|
Sincerely,
|
|||
|
|
|
|||
|
|
James H. Burrows
|
|||
|
|
Director, Computer Systems Laboratory
|
|||
|
|
|
|||
|
|
Enclosures
|
|||
|
|
|
|||
|
|
*1 The Congress has mandated that NIST (formally the National Bureau of
|
|||
|
|
Standards) establish minimum acceptable practices for the security and
|
|||
|
|
privacy of sensitive information in federal computer systems. Computer
|
|||
|
|
Security Act of 1987, Pub. L. No. 100-235, section 2, 101 Stat. 1724
|
|||
|
|
(1988).
|
|||
|
|
|
|||
|
|
*2 FIPS 113 adopts American National Standards Institute (ANSI) standard
|
|||
|
|
X9.9 for message authentication. It outlines the criteria for the
|
|||
|
|
cryptographic authentication of electronically transmitted data and for
|
|||
|
|
the detection of inadvertent and/or intentional modifications of the
|
|||
|
|
data. By adopting the ANSI standard, FIPS 113 encourages private sector
|
|||
|
|
applications of cryptographic authentication; the same standard is being
|
|||
|
|
adopted by many financial institutions for authenticating financial
|
|||
|
|
transactions.
|
|||
|
|
|
|||
|
|
*3 A smart card is the size of a credit card. It contains one or more
|
|||
|
|
integrated circuit chips which function as a computer.
|
|||
|
|
|
|||
|
|
*4 NIST officials advise us that technology using message authentication
|
|||
|
|
codes and digital signatures will be available to both contractors and
|
|||
|
|
contracting officers for use in government contracting.
|
|||
|
|
|
|||
|
|
*5 For the sake of simplicity, this example does not describe the
|
|||
|
|
complicated system of controls used to ensure that (1) no human knows the
|
|||
|
|
sender's private key and (2) the information received from the sender for
|
|||
|
|
validating the message authentication code or digital signature is
|
|||
|
|
correct and accurate.
|
|||
|
|
|
|||
|
|
*6 Pub. L. No. 663, 68 Stat. 800, 830 (1954).
|
|||
|
|
|
|||
|
|
*7 Other courts, interpreting the laws of other states, have held that a
|
|||
|
|
tape recording is not acceptable. See Sonders v. Roosevelt, 102 A.D.2d
|
|||
|
|
701, 476 N.Y.S.2d 331 (1984); Roos v. Aloi, 127 Misc.2d 864, 487 N.Y.S.2d
|
|||
|
|
637 (N.Y. Sup. Ct. 1985).
|
|||
|
|
|
|||
|
|
*8 Of course, just as with any contract or other official document, an
|
|||
|
|
agency must take appropriate steps to ensure the security of the
|
|||
|
|
document, for example, to prevent fraudulent modification of the terms.
|
|||
|
|
Agencies should refer to NIST standards in this regard. See, e.g., FIPS
|
|||
|
|
113 (regarding message authentication codes). In addition, agencies
|
|||
|
|
should refer to the GSA regulations regarding the maintenance of
|
|||
|
|
electronic records, see 41 C.F.R. 201-45.2, and to the Federal Rules of
|
|||
|
|
Evidence with regard to managing electronic records to ensure
|
|||
|
|
admissibility, see generally Department of Justice Report, "Admissibility
|
|||
|
|
of Electronically Filed Federal Records as Evidence," Systems Policy
|
|||
|
|
Staff, Justice Management Division (October 1990).
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
Security Hall of Fame Established
|
|||
|
|
|
|||
|
|
Clyde's Computer Security Hall of Fame is being established to
|
|||
|
|
recognize those who contribute above and beyond the normal call of
|
|||
|
|
duty in their performance of contributing to the advancement and
|
|||
|
|
enhancement of Public Debt's computer security program.
|
|||
|
|
The first inductee to this much sought honor is Bob Settles. Bob
|
|||
|
|
came to Public Debt immediately upon his graduation from college
|
|||
|
|
in 1964. Apart from a two year stint in Vietnam, his first 18 years
|
|||
|
|
were spent with the Internal Audit Staff. Then, in 1982, he was
|
|||
|
|
selected to manage the AIS Security Branch and has served in that
|
|||
|
|
capacity ever since. During his tenure as manager, the Branch's
|
|||
|
|
responsibilities have grown steadily to keep pace with the emphasis
|
|||
|
|
placed on information systems security throughout the Government.
|
|||
|
|
Public Debt's security program is now among the most highly
|
|||
|
|
regarded in the Treasury Department.
|
|||
|
|
Bob has recently accepted a Computer Specialist position with the
|
|||
|
|
Treasury Department at its main office in Washington, D.C.
|
|||
|
|
Bob epitomized the best in seasoned management and his departure
|
|||
|
|
will be keenly felt. We wish him the best in his new position!
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
What's New?
|
|||
|
|
|
|||
|
|
ISSM's gain recognition in international publication
|
|||
|
|
The Public Debt Computer Security Program and the ISSM's received
|
|||
|
|
international recognition when an article written by Kim Clancy and
|
|||
|
|
Joe Kordella was published in ISPNews in the Jan/Feb 1992 edition.
|
|||
|
|
The article presented the role computer security plays in the
|
|||
|
|
protection of critical information assets of Public Debt in an
|
|||
|
|
environment of rapid technological change. It stressed that the
|
|||
|
|
ISSM's are key players in the implementation of the security
|
|||
|
|
program.
|
|||
|
|
|
|||
|
|
New Security Branch Manager Selected
|
|||
|
|
The selection of Kim Clancy as the Security Branch Manager
|
|||
|
|
completes the consolidation of the Branch in Parkersburg. Kim was
|
|||
|
|
previously a security analyst in the AIS Security Branch. Prior
|
|||
|
|
to that, she was a computer security analyst for the State of
|
|||
|
|
Arizona, for over three years. She was also a computer systems
|
|||
|
|
security officer in the United States Air Force.
|
|||
|
|
|
|||
|
|
========================end of article========================
|
|||
|
|
|
|||
|
|
The AIS Security Branch runs an Electronic BBS. Give us a call at
|
|||
|
|
(304) 420-6083. An electronic version of the ISSM is posted on the
|
|||
|
|
board and can be downloaded. Articles in the electronic version
|
|||
|
|
may include more detail in that we are not limited by space
|
|||
|
|
constraints as we are in the paper copy.
|
|||
|
|
|
|||
|
|
The ISSM is a quarterly publication of the Department of Treasury,
|
|||
|
|
Bureau of the Public Debt, AIS Security Branch, 200 3rd Street,
|
|||
|
|
Parkersburg, WV 26101 (304) 420-6368
|
|||
|
|
|
|||
|
|
Editors: Kim Clancy
|
|||
|
|
Joe Kordella
|
|||
|
|
Ed Alesius
|
|||
|
|
Mary Clark
|
|||
|
|
|
|||
|
|
|
|||
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|