textfiles/hacking/issm204.hac

ÚÄÄÄÄÄÄ InformationÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿
³                          °°°Û   °°°°°Û  °°°°°Û   °°Û       °°Û     ³
ÃÄÄÄÄÄÄ Systems ÄÄÄÄÄÄÄÄÄÄÄ °Û ÄÄ °°°Û ÄÄ °°°Û ÄÄÄ °°°°Û ÄÄ °°°Û ÄÄÄÄ´
³                           °Û    °°°°°Û  °°°°°Û   °°°°°°°°°°°°Û     ³
ÃÄÄÄÄÄÄ Security ÄÄÄÄÄÄÄÄÄÄ °Û ÄÄÄÄÄ °°Û ÄÄÄ °°Û Ä °°Û Ä°°Û Ä°°Û ÄÄÄÄ´
³                          °°°Û   °°°°°Û  °°°°°Û   °°Û       °°Û     ³
ÀÄÄÄÄÄÄ Monitor ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

           "Dedicated to the pursuit of security awareness."


======================================================================
Volume 2 Number 4                                         October 1992
======================================================================


/////////////////////////// In this Issue \\\\\\\\\\\\\\\\\\\\\\\\\\\\


BPD Security BBS Interview

Did You Know That...

Public Debt "Hackers"

Clyde's Hall Of Fame

"Dear Clyde..."

Computer Speak

Voice Mail Toll Fraud

Computer Security Day


///////////////////////////////////////////////////////////////////////
   

BPD SECURITY INTERVIEW

Editor's Note:  The following interview was conducted by Jim
Thomas, Department of Sociology, NIU, Dekalb, Il., editor of
Computer underground Digest (CuD),  August 12, 1992.  Permission
to reprint the article has been given by the editors of CuD.
Computer Underground Digest is an open forum dedicated to sharing
information among computerists and to the presentation and debate
of diverse views. 

(MODERATOR's NOTE:  We heard about the AIS BBS from several
readers, and checked it out.  We were impressed by the collection
of text files, the attempt to bring different groups together for
the common purposes of security and civilizing the cyber frontier,
and the professionalism with which the board is run.  AIS BBS is
a first-rate resource for security personnel who are concerned with
protecting their systems). 

THOMAS:  What is this Board?  (Name, number, who runs it (dept &
sysop).  What kind of software are you using? When did the board
go on-line? 

CLANCY:  The Bulletin Board System (BBS) is run by the Bureau of
the Public Debt's Office of Automated Information System's Security
Branch.  The mission of the Bureau is to administer Treasury's debt
finance operations and account for the resulting debt.  The OAIS
Security Branch is responsible for managing Public Debt's computer
systems security.  The AIS BBS is open to the public and the phone
number for the Board is (304) 420-6083.  There are three sysops,
who manage the Remote Access software.  The BBS  operates on a
stand-alone PC and is not connected to any other Public Debt
system.  The Board is  not used to disseminate sensitive
information, and has been up operating for the past 15 months.   

THOMAS:  What are the goals and purposes of the Board?   

CLANCY:  The BBS was established to help manage Public Debt's
security program.  Security managers are located throughout Public
Debt's offices in Parkersburg, WV and Washington DC.  The security
programmers saw a need to disseminate large amounts of information
and provide for communication between program participants in
different locations.   Because the Board was established for
internal purposes, the phone number was not published.  However,
the number was provided to others in the computer security
community who could provide information and make suggestions to
help improve the Bureau's security program. Gradually, others
became aware of the Board's existence. 

THOMAS:  What kinds of files and/or programs do you have on the
Board? Why/how do you choose the files you have on-line?  

CLANCY:  There is a wide variety of files posted.  In the
beginning, we posted policy documents, newsletter articles from our
internal security newsletter, bulletins issued by CERT, such as
virus warnings, and others for internal use.  I located some
"underground" files that described  techniques for circumventing
security on one of the systems we manage.  The information, from
Phrack magazine, was posted for our security managers to use to
strengthen security. When we were called by others with the same
systems, we would direct them to those files as well. 
Unexpectedly, the "hacker" that had written the file contacted me
through our BBS.  In his article he mentioned several automated
tools that had helped him take advantage of the system. I requested
that he pass on copies of the  programs for our use.  He agreed. 
This is how our "hacker file areas" came to be.  Other hackers have
done the same, and we have also received many files that may be
useful.  It is, indeed, an unusual situation when hackers and
security professionals work together to help secure systems. 
However, this communication has been beneficial in strengthening
an already secure system.   

THOMAS: Since you and the Secret Service are both part of the U.S.
Treasury, was the Board set up to catch "hackers?"  

CLANCY:  No, the BBS was designed to manage our internal security
program.  We do not allow individuals to sign on with "handles." 
We do not know if people are hackers when they sign on unless they
identify themselves.   

THOMAS: How did you get the idea to set it up?   

CLANCY:  The security branch accesses many BBSs on a daily basis
for research purposes, information retrieval and to communicate
with others. Since our security program is decentralized, the BBS
seemed to be an effective way of communicating with program
participants in diverse locations. 

THOMAS: What distinguishes your board from sources like CERT, or
from "underground" BBSes?

CLANCY:  First, there is a wide diversity to our files, ranging
from CERT advisories to the 40Hex newsletters. Also, many of the
files on our system are posted as a resource we use for the
implementation of our security program.  For example, the Board
lists computer based training modules that we have developed,
policy documents, and position descriptions.  These are files that
other security programs can use to implement or help start their
programs.  On the message side of the BBS, what distinguishes it
would have to be the open interaction between hackers, virus
writers, phone phreaks and the security community. 

THOMAS: What kinds of difficulties or problems have you
encountered, either from superiors or from users, in operating the
Board?   

CLANCY:  I can recall few, if any, difficulties from anyone, users
or superiors.  Upper management understands the value of the
technology and has been extremely supportive.  All  users have been
courteous, professional, and supportive.  Security professionals
constantly thank us for providing "underground" information for
them.  It allows others in the field to gain access to valuable
information without having to access "underground" systems.  Users
appreciate the opportunity to share their knowledge with others and
seem grateful to have an avenue to communicate with security
professionals who will listen to "hackers" experiences. 

THOMAS: Can you describe any unusual or humorous experiences you
have had with users while running the Board?   

CLANCY:  It is unusual for "hackers" and security professionals to
work together to help secure systems, but that is what is occurring
on our system.  I have had requests from other government agencies
asking for resumes of "hackers" that may assist them.   I have been
contacted by numerous government and private agencies asking for
our "contacts."  I just direct them to the BBS and advise that they
post messages regarding the questions they need answered.  If
anyone is interested in helping, they will respond.  It is an
unusual situation, but, in my opinion, I can attest that the
information we have received has been very useful to our security
program.   

THOMAS: What future plans do you have for improving the hardware,
such as upgrading modem, number of lines, or storage capacity, or
for developing the services of the Board?   

CLANCY:  Starting July 13th, the Board will be down periodically
for system upgrades.  We are adding an additional phone line, and
a 315 mb hard drive.  Also, we are going to make a few changes to
reorganize files. It is hoped that group information will be more
efficient in this manner.  We are also adding RIME relay net
conferences and will carry topics such as Data Protection. 

THOMAS: What should potential users know about the Board or your
policies before attempting to receive access?   

CLANCY:  Users must be aware that we do not allow handles on the
BBS.  If they sign on with a handle it will be deleted.  We also
reserve the right to review all E-mail, public and private.  All
users have access to the BBS upon sign on.  If a user wants access
to the "hacker" file area, they need to send a message to the sysop
requesting access.  Potential users should know they are welcome
to call in and communicate with us and others. 
    
 
----------------------- End of Article ---------------------------------

DID YOU KNOW THAT...

Public Debt's ISSMs recently completed Disaster Recovery Training
at classes held in both Parkersburg and Washington.  The classes
consisted of both disaster recovery theory  and the use of the
Bureau's purchased software product "DISASTAR", which is to be used
to prepare each application's own portion of a Bureau wide recovery
plan...
There is an ISSM meeting that is held every month.  Your ISSM would
be happy to hear from you about any computer security questions,
issues or concerns that you may have so that they can be addressed
at that meeting...


----------------------- End of Article ---------------------------------



PUBLIC DEBT "HACKERS"


  After reading the article in this issue of the ISSM about our
bulletin board system, it is no secret that we actively use hacking
tools against our computer systems to test their security.  One
tool I have used to test our security is called GETIT.COM. (later 
known as THIEF) .  It is a program floating around the underground
community designed to capture logonids and passwords for Novell
Networks.  I must say I found the program pretty impressive.  It
is extremely easy to use and install and it works wel
  Another file not included states that this program can be easily
spoofed if a user types "login userid".  This allows the program
to only capture a password and not the logonid associated with it. 
Of course, capturing passwords is not a good thing to let happen
but at least it does not give a person all the pieces at once. 
Following is the documentation for the program.
 Thief is a TSR (Terminate and Stay Resident) utility written in
8086 assembly language that attempts to steal Novell passwords. 
It originates from a site with consummate hackers and a long,
colorful history of mischief: George Washington High School in
Denver, Colorado.
  The school is well endowed with a large variety of IBM
microcomputers.  Five rooms of about 30 computers each are all tied
together on a Novell network.  Four of the five rooms solely use
boot proms* for initializing the workstations.  However, the fifth
houses IBM PS/2 model 80s with hard drives.  The power users tend
to congregate in this area, including the "administrators" with
Supervisor equivalence.  These machines do not use boot proms.
  So it was on one of these computers where the "thief" was first
discovered because it takes advantage of weaknesses in the security
at the boot phase.  Into the regular flow of action in the
AUTOEXEC.BAT file, the creator inserted a line that executes the
(hidden) program copied onto the boot disk.  The TSR remains in the
background and the process continues.  Visual signs of thebreak-in
are imperceptible.
  Then, as soon as a program named LOGIN is executed, the thief
springs to life and records all the keystroke action into a hidden
file on the boot disk.  The human thief may then later return to
the computer and see what the trap caught.    Before a more
detailed description of the "metabolism" of the thief, consider now
the weaknesses that led to the breach: 
  
  o  a localized boot process, or at least one that is corruptible.

  o  physical access  to a sensitive computer.
  
  Both are controllable, of course.  The boot prom is a solution
for the former, and lock and key (on the computer or a room that
surrounds it) is for the latter.    Now return to the "metabolism". 
Surprisingly, THIEF uses the same "hook" that the Novell shell
does!  That is, it captures the centralized portal to DOS interrupt
21h.**  Then, it intercepts all function calls.  Specifically, it
checks for the EXECute file function call and the "terminate"
interrupt. 
  Whenever an EXEC call is made with a filename LOGIN, THIEF
springs to life and records keystrokes until the program
terminates.  This is somewhat sophisticated; however, an even more
effective method could be realized:  it could simply wait for the
specialized Novell function call to log in, and record the calling
parameters.  Note that the above technique requires the program to
be loaded subsequent to the Netware shell.
  By no means are these types of programs new; they have been
around as long as password-based program security.  Here, however,
is an example that is tangible and immediate.  Study of it is
beneficial because knowledge of Netware security is one thing;
knowledge of how to defeat it is quite another!  The latter demands
cutting-edge sophistication and comprehension.  The future will
certainly see improved identification techniques, and timeless,
devious ingenuity will be there to greet them.
Note: THIEF was formerly named GETIT by its creator, who was
careless and cocky enough to leave the source code. 
*  "Boot proms", for those not familiar, are accessory chips that
reside on network interface cards; they redirect local drive
activity to the server during the boot process, thus allowing a
workstation to initialize without a (boot) disk. 
**  Interrupt 21h is that used by any program when requesting a DOS
function.  The Netware shell, of course, intercepts this regular
flow.  It may pass the information directly along to DOS or process
the call  itself.


------------------------ End of Article --------------------------------


CLYDE'S SECURITY HALL OF FAME


Office of Public Debt Accounting (OPDA) inducted to Hall of Fame:

  Through their dedication and commitment to information security,
they have helped Public Debt's security program grow.  OPDA
management has dedicated the time and resources to ensure that
security issues are addressed to the utmost degree of accuracy and
completeness.  OPDA management recently mandated that all of their
users receive a two hour end user security training class.  This
was above and beyond the security training requirements currently
being fulfilled with the ISSM newsletter.  OPDA ISSMs, Sa
ndra Woods, Mike Goodwin, and Alex Kendjoria-Ganoe have assisted
the AIS Security Branch in developing procedures and guidelines
that will assist other ISSMs when its "their turn" to complete the
same tasks.  Their dedication and assistance has been extremely
beneficial to the development of Public Debt's security program. 
OPDA'a ISSMs have gone out of their way to tutor themselves in
computer security topics.  They have utilized the automated lesson
plans made available on our LAN and made extensive use of our
security library books, magazines, videos and audio tapes.  OPDA
has shown that the ISSM program works when the proper time and
resources are dedicated to the management of information systems
security.

Submitted by Kim Clancy, Manager of the AIS Security Branch


------------------------ End of Article --------------------------------


"DEAR CLYDE..."

(Responses to questions for those who are searching for the truth.)


Dear Clyde;
I have a personal computer (PC) on my desk in the office.  What
types of security controls do I need to protect my computer?

PC (perplexed and confused)

Dear PC;
The greatest measure of security you can provide to your PC is to
physically secure it so that no one can gain access to it.  If that
is not possible, look for methods that will prevent someone from
powering up the computer or using the keyboard.  If I can gain
access to your computer, I have the capability to load programs
(called trojan horses, these are not the same trojan horses from
my day but follow the same logic) that can capture you logonids and
passwords as you sign on to systems.  That means I can act as you
on the computer and everything I do will be traced to you, not me. 
If you leave your PC on at night with a modem set up so that you
can call in from home, you've made it possible for me to load the
same programs without having to gain physical access to your
computer.  That type of configuration should be reviewed by your
ISSM before setting it up.

-------------------------- End of Article ------------------------------


COMPUTER SPEAK COMPUTER TERMS AND THEIR MEANINGS


CYBER -  As in CYBERSPACE   
      Term used to describe the electronic "playground" in which 
      computerists use, publish and share information with distant
      computer users and electronic bulletin boards.
SUPERVISOR -  
      1)  Network Supervisor - Person responsible for the smooth
      operation of the entire network.  The supervisor may also  
      install the network, maintain the network, reconfiguring and
      updating it as the need arises.
      2)  SUPERVISOR (as user) - Special username that is        
      automatically created when a file server is initialized.   
      This user is permanent and cannot be deleted or renamed.   
      The user SUPERVISOR has all rights in all file server volumes
      and directories, and these rights cannot be revoked.  
CERT - Computer Emergency Response Team


--------------------------- End of Article -----------------------------


VOICE MAIL TOLL FRAUD

  For computer hackers, PBX toll fraud has become an annual $500
million boon.  For corporations, it's become a $500 million
nightmare.  Since only a fraction  of PBX toll fraud is actually
reported and compiled, this $500 million per  year estimate is a
rather modest one.   Historically, hackers broke into a PBX through
its Direct Inward System Access  (DISA) feature.  DISA allows
travelling employees to call into a switch and  avail themselves
of a company's long distance services.  All too often, it is  now
offering hackers the same privilege. 
  Once a hacker has cracked a four- or six-digit DISA code, he can
commandeer  the long distance lines for his own unauthorized use. 
DISA-based toll fraud  remains the simplest and most prevalent form
of PBX toll fraud.  Until  recently, it was considered the ony
form.
  Jim Ross is president of Ross Engineering (Sterling, VA), a
surveillance  counter-measures firm.  During the past month, he
received two highly unusual  complaints of PBX toll fraud.  Instead
of using DISA, the culprits broke into  the PBX through the
voice-mail system.  They were able to whisk right through  voice
mail, obtain dialtone and make thousands of dollars worth of 
international calls.
  "In the first instance," Jim recall, "the toll fraud artists
dialed into an  Octel voice-mail system with Aspen software and
attached to an AT&T System 75  PBX.  After hours, incoming 800
callers could grab dialtone after punching in  any three digit
sequence with '75' in it and dial into the outside world." The 
company was taken for a $170,000 long distance ride. 
  Jim stresses that all voice-mail systems "have some kind of
vulnerability and,  sooner or later, the hackers are going to
pinpoint it."  In fact, he is quite  surprised that it has taken
them so long to discover this new point of entry.   "The easiest
way to prevent these assaults is to program your PBX to shut down 
immediately whenever the caller reaches a second dialtone," he
advises.   "Without the second dialtone, their hands are tied." 

Evasive Tactics

  Toll fraud felons are experts in evasion.  Typically, they'll
bounce the call from one to another, switching 
interexchange carriers several times before  they invade the
targeted PBX.  They'll make the calls from transient numbers,  as
opposed to their home phones.  These evasive tactics make them
quite  difficult, and sometimes impossible to trace. 
  Jim Ross provides an intriquing example.  "A few years back, a
Harrisburg, PA, company called us for assistance.  They were
getting burned badly.  Every night, the hackers dialed up their
DISA number and made thousands of dollars of calls to a single
number in Columbia."
  Although the company had recognized the problem, and had changed
the DISA access code from four to six digits, they could not stop
the deluge of unauthorized outbound calls.  They eventually had to
shut their PBX down while the local phone company investigated the
matter.
  The investigation led from the local telco to AT&T, the
interexchange carrier, and on to the originating telco, New York
Tel.  By the time New York Tel managed to locate the originating
numbers, they had been terminated.  But they were able to outline
the makings of a clever, evasive and quite successful method of PBX
toll fraud.
   According to New York Tel records, a mysterious company had put
in a request for 12 new telephone lines.  The company claimed to
be a construction  firm. Although they were planning to put up a
major  office tower, they had no references, and no credit history
to speak of.
   New York Tel demands a healthy deposit to service such a shaky
entity.  The company paid the deposit in cash.  New York Tel duly
installed the 12 lines at a trailer on the edge of the alleged
construction site.
   After a month, the company abandoned the deposit and the site. 
But not before running up thousands of dollars in long-distance
charges on the Harrisburg PBX.  And probably several other switches
as well.

  Some External Measures 

  In addition to implementing toll restriction, daily diagnostics
and other PBX procedures, there are several external ways to
control toll fraud.  A few companies are now issuing DISA smart
cards, with ID numbers which change every minute.  These cards are
virtually impervious to outside meddling.
  Smart cards are not cheap.  They are an administrative pain.  And
it is often quite difficult to get the card back after an employee
resigns or quits. However, it remains one of the most effective
alternatives currently available.
   Our own solution was to get rid of DISA altogether.  In its
place, we'd distribute corporate credit calling cards.  Each card
would be attached to the company account, not to its CO trunks. 
Each would have a unique credit card number.
   Thus, when an employee is terminated, so is his credit card
number.  If the card is stolen, the employee will report it
immediately and the other travelling execs could make calls as
usual.  If $500 worth of calls were made to Pakistan in the course
of an hour, the carrier could call the user's beeper or the company
headquarters.  If neither responded, they could void the card
automatically.
   "As far as the telecom industry is concerned, that's an
excellent idea," responds Jim Ross.  "But it won't be acceptable
to the travelling executives.
   "You've got to understand.  These guys get to be such big wigs
and muckety-mucks that they don't want to fool around with a nine
digit credit card number, plus the seven-digit long distance
number.  The idea of dialing a few extra digits is an intolerable
burden to them.
   "As a corollary, you may remember that former  secretary of
state Alexander Haig made a number of calls to the While House from
Air Force One.  This exchange was recorded by short wave radio
enthusiasts, who handed it over to the media."  Faced with the
flak, the goverment contended that the encryption equipment in the
plane was just not compatible with that in the White House.   
  "Nonsense," says Jim.  "Like many executives and high officials,
Haig just didn't want to go through the hassle of using the
encrytion equipment or the hardship of listening to a warped,
encrypted voice.  Look at (Virginia) Governor Wilder.  He talks
about his nemesis, Senator Robb, in the clear."
   Jim asserts that there is only one foolproof method to eliminate
toll fraud. "If the FCC would demand that all interexchange
carriers and local telcos implement comprehensive, compulsory
caller identification, then you've done away with the problem. 
You've also done away with bomb threats, harassment and obscene
phone calls, as well."
   Even the most evasive hackers would be instantly identified at
each point along their tortuous journey -- from town to town, and
from carrier to carrier.  And they would open themselves to
exposure and apprehension, in real time.
   Furthermore, hackers can not mask  Automatic Number
Identification (ANI) by obscuring digits.  Because caller
identification data is entered from your exchange, and not from
your phone, it is impervious to meddling.  Hackers could only avoid
ANI detection by dialing for live operator assistance.  Which
carries its own threat of exposure.
   "Unfortunately, universal, compulsory caller identification is
'pie-in-the-sky' at this juncture," laments Mr. Ross.  The
Pennsylvania Supreme Court has already prohibited caller ID, citing
right to privacy violations.  Even where the service is currently
offered, subscribers have the right to withhold their phone numbers
from public inspection.
   The CIA would be a fine source for toll fraud prevention. 
"Without doubt, our neighbors in Langley have purchased practically
every modern PBX and voice mail system to see what their weaknesses
are," assents Jim.  "I wish that this information would be made
public.  I think it should be made public, since it is paid for
with our tax dollars."
   That's only one of several things the CIA does that the American
people get no value from, the interviewer quipped.   

Reprinted with permission of Teleconnect Magazine 800-799-0345
Subscription $15 per year 


------------------------ End of Article --------------------------------


COMPUTER SECURITY DAY

  December 1, 1992 will mark the fifth annual nation-wide
observance of Computer Security Day.   Computer Security Day is our
opportunity to focus attention on our agenda - Computer Security. 
Computer Security Day is the first  workday in December, although
official observances vary to avoid conflicts in some countries or
in some organizations.  Computer  Security Day keeps everyone alert
to proper computer security  procedures as the holiday season
approaches and security might  otherwise become lax.             
  The Bureau of Public Debt will participate this year in Computer
Security Day by holding a contest to select the best security 
slogan as submitted by the ISSM Newsletter readership.
  The slogan can relate to any computer security-related topic,
such as access security ("Logoff! - An open terminal is a hacker's 
terminal!"), or password security ("Share a Password, Share your
Protection!").
  First through third prizes will be awarded and will consist of
basketball hoop security reminders, as displayed throughout BPD,
Parkersburg.  Winning and runner-up slogans, plus the name of the
submitter, will be printed in future issues  of the ISSM
Newsletter, & be posted on physical security bulletin boards
throughout the building.       

----------------------------- End of Article ---------------------------

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

The AIS Security Branch Runs an Electronic BBS. Give us a call at
(304) 420-6083. An electronic version of the ISSM is posted on the
board and can be downloaded. Articles in the electronic version may
include more detail in that we are not limited by space constraints
as we are in the paper copy. 


>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

The ISSM is a quarterly publication of the Department of Treasury, 
Bureau of the Public Debt, AIS Security Branch, 200 3rd Street, 
Parkersburg, WV 26101 (304) 420-6368.
Editors: Jim Heikkinen, Ed Alesius, Kim Clancy, Joe Kordella, Mary Clark


Downloaded From P-80 International Information Systems 304-744-2253