textfiles/news/hcknews.hac

         
CGA SOFTWARE PRODUCTS GROUP ON COMPUTER CRIME 
 
    INTERNAL COMPUTER CRIME PROVES GREATER THREAT THAN 'HACKERS'
    NEW YORK, July 17 /PRNewswire/ -- For every outsider who accesses 
Pentagon telephone numbers or makes fraudulent credit card purchases, 
like the seven New Jersey teenagers arrested recently, it is
estimated that far greater numbers of disgruntled or dishonest
employees damage their employers' computer systems internally every 
day.
    "Teenage 'hackers' are just the tip of the computer crime 
iceberg," says Carol Molloy, a computer security specialist with CGA
Software Products Group, Holmdel, N.J.  "These computer crimes get
the spotlight because the perpetrators get caught and the victims are 
willing to prosecute."
    More insidious data fraud and malicious damage occurs inside
corporations than any hacker ever committed, Molloy continues.
"Employees have far greater access to sensitive information, and many 
times are so well acquainted with procedures and security features
that they leave no trail at all," she adds.  "Unhappy employees can 
leave a programming 'time bomb' in a computer that causes trouble 
long after they are fired or leave for another job."
    Carelessness, rather than malice, often causes even more
problems, according to Molloy.  "Many computer security systems are 
based on passwords, and people can be very lax about protecting 
them."
    Employee computer crimes, however, receive far less attention 
than outside break-ins, Molloy says, because victimized organizations 
are unwilling to publicize the matter through arrest and prosecution. 
"Revealing damage from internal sources doesn't do much for a 
company's image," she says. 
    "Customers, corporations feel, will start to wonder about just
how secure relevant information may be and may decide to go 
elsewhere.  Also, insurance premiums often go up afte2 a theft is 
revealed."
    The question facing data processing and information managers is 
not whether a security system should be installed, but how to go
about it, says Molloy.  "Many organizations believe that security is
solely the concern of the managers," she says.  "They don't realize 
that implementing security requires extensive internal support."
    Security systems also demand ongoing maintenance, she says. 
"Just installing the system doesn't mean data is secure from then 
on," she points out.

UPI Dmestic News Wire
Wednesday July 17, 1985
 
      More may be charged in ``hacker'' ring, prosecutor says 
	   NEW BRUNSWICK, N.J. (UPI) _ More people may be charged with using 
home computers to make free long-distance calls and reportedly try to 
break into Pentagon computers, a prosecutor said Wednesday. 
	   Meanwhile, the executive director of the state chapter of the 
American Civil Liberties Union charged the Middlesex County Prosecutor's
Office with ``trampling'' on the rights of one of the seven youths
charged in the scheme Tuesday.
	   The youths used their computers and electronic ``bulletin boards''
to exchange information on computer codes, including some that would
cause communications satellites to ``change position'' and possibly 
interrupt intercontinental communications, Middlesex County Prosecutor
Alan Rockoff said.
	   ``Though it may sound like a copycat of (the movie) `WarGames,' 
things like this are happening in our society,'' Rockoff said, accusing 
the youths of obtaining thousands and ``possibly millions'' of dollars
in telephone and informational services.
	   A spokesman for American Telephone & Telegraph Co. said there was 
no indication that any of its satellites had been moved, or that even an
attempt to move them was made.
	   Assistant Prosecutor Frank Graves said investigators still had
``six more computers and 9 million floppy discs'' to look through.
	   ``We had 300 names in one computer and we charged seven,'' Graves 
said. ``We have no idea what's in the other computers and won't know for
a while.''
	   The youths, whose names were withheld because of their ages, are
charged with juvenile delinquency by reason of conspiracy to commit 
theft.
	   South Plainfield police detective George Green said four of the 
defendants operated electronic bulletin boards, which are used for the
exchange of legitimate information by hundreds of people. 
	   The youths also had a special code that provided illegal access to
restricted information, Green said, and only those who used these parts 
of the bulletin boards were arrested. 
	   Rockoff said the investigation began in April when postal officials 
informed the South Plainfield police that someone using a post office 
box under a fictitious name apparently had been using a computer to gain
illegal access to the computer of a Connecticut credit company. 
	   Rockoff turned over the results of the investigation to the Secret
Service since the bulletin boards contained telephone numbers in a
military defense communications system in the Defense Department, The 
New York Times reported Wednedsay.
	   Plainfield patrolman Michael Grennier, a computer expert, said the
youths also were able to break into an American Telephone & Telegraph 
computer after obtaining a manual from a AT&T trash bin.
	   The investigation led to a South Plainfield youth, whose computer 
was seized in June. After Grennier and Green spent about 100 hours
looking through his computer, the other six were arrested Friday _ in 
Hillsdale, Westwood, Warren Township, Martinsville, Dover and Edison. 
	   But Jeffrey Fogel of the ACLU office in Newark said the Dover 
youth, whom he declined to identify, was unfairly singled out.
	   ``He has an electronic bulletin board and arresting him and seizing 
his computer amounts to seizing a printing press,'' Fogel said. ``It
would be like if someone put a stolen credit card number in a newspaper 
classified. Would you close down the newspaper?'' 

NEW HACKER CASE RAISES FEARS: 
  Computer hackers "have the capability of doing a great deal of
damage," says Rep. William J. Hughes, D-N.J., commenting on the 
case of 7 N.J. youths charged with breaking into Pentagon computers 
and stealing satellite codes. Hughes is sponsoring federal computer 
crime bills to help fight the problem. (USA TODAY, July 18, P.1A) 

KAYPRO WINS PC COMPARISON:
  The Kaypro IIx personal computer is the best machine for home use 
costing less than $1,500, says Consumer Reports. It beat the Apple
IIe Professional and the discontinued TRS-80 Model 4P. Kaypro was 
picked for its disk capacity (800 kilobytes) and the large amount 
of software that comes with it. (Consumer Reports, August, P.467) 

COMPUTER CALLS ABSENT STUDENTS: 
  Kettering, Ohio, school officials are using a Texas Instruments 
computer to call the homes of absent students as part of the
state's Missing Children Act. System makes 75 calls an hour.
Computer voice tells parents their child is absent and asks for a 
response, which is recorded like an answering machine. (USA TODAY,
P.5B) 

From
PR NEWSWIRE
Thursday  July 18, 1985

DOWTY ELECTRONICS SAFEGUARDS U.K. DEFENSE SECRETS 
 
            UK "SHOULD BE SAFE" FROM DATABASE BURGLARS
    NEWBURY, England, July 18 /PRNewswire/ -- British Ministry of 
Defence secrets need never be at risk from home computer "hackers" -- 
microchip technology's equivalent of cat burglars -- an electronics 
expert claimed today. 
    Following disclosures of teenage hackers breaking into military 
information banks at the Pentagon -- the U.S Defense Department 
headquarters -- Bruce Brain, general manager and director of Dowty
Electronics' Information Technology Division, said:  "It need never 
happen here." 
    The U.K. faced similar problems to America, said Brain. "But the
introduction of Dowty's 'Horatius' dialback data security system -- 
an anti-hacker box -- means that no-one would be able to break into 
sensitive or confidential databases, even with the knowledge of 
ex-directory phone numbers. 
    "Horatius allows only authorized users to access a computer 
system, and they must also call from a pre-cleared phone number 
within an agreed time-frame," he explained. 
    Horatius -- designed and manufactured in the U.K. -- is selling 
well, says Dowty, which is currently negotiating to introduce the 
system to the U.S.A through its New Jersey-based subsidiary, Dowty
RFL Inc.
         PAPER FINDS 2 HACKER BOARDS:
  2 electronic bulletin boards have been found to contain access
codes for computers at military, research facilities. The boards,
"Fatland" and "Dark Side of the Moon," - both based in Virginia
-held access numbers for the Naval Ship R&D Center, NASA's Ames
Research Center. No arrests reported. (Online Today)

NEW JERSEY HACKER CASE MAY BE A TEST
OF SYSOPS' FREE SPEECH PROTECTION

     The attorney for one of seven New Jersey teenagers charged
with conspiring to use their computers to exchange stolen credit card numbers
and make free long-distance calls says he will argue that his client is
protected by the constitutional guarantee of free speech.
     Jeffrey E. Fogel, executive director of the New Jersey chapter of
the American Civil Liberties Union, told BULLETIN BOARD SYSTEMS that he an
associate will defend a teenager who operated the Private Sector BBS.
     "We are relying on his representation that all he did was run
a bulletin board, that he didn't make a calls or use stolen credit card
numbers," Fogel said. If that is true, he added, "I don't think there is
any liability."
     The defendants, all under 18, were charged July 16 with juvenile
delinquency based on an underlying charge of conspiracy to commit theft.
Police confiscated the computers and software of some of the defendants.
     Middlesex County Prosecutor Alan A. Rockoff told reporters
that the individuals exchanged information that would allow them to access
commercial computers without authorization and that some of them had codes that
could cause communications satellites to ''change position.''
However, spokesmen for AT&T and other carriers said their
systems are secure and denied that any satellites had been moved.
     Rockoff said the investigation began in April when postal
officials informed police that someone using a post office box
under a fictitious name apparently had been using a computer
to gain illegal access to the computer of a Connecticut credit
company.
     Fogel said he believes that the prosecution will have to show that
his client actually used the credit card numbers or telephone access codes
to prove his case. Allowing the information to be posted on his client's
bulletin board, he said, is not a criminal act.
     "There's nothing illegal about those messages being there," he said.
     "Let's say you find an AT&T calling card on the street and you put an
ad (listing the number) in the New York Times. I'm confident that the
New York Times is not liable.
     "Bulletin boards are the same as a free press," Fogel said. "They are
like electronic magazines in which the users can publish what they choose."
     Fogel drew an analogy to two well-known free press cases: the
publication of plans for a hydrogen bomb in Progressive magazine and
publication of the Pentagon Papers by the Times.
     "What really gets me upset in this case is they seized the
'printing press.' I don't think they had the right to seize his
computer, Fogel said.
     The concept of First Amendment protection for bulletin board
operators has yet to be tested in court. Last year Los Angeles
sysop Tom Tcimpidis was charged with telephone fraud when Pacific Bell
investigators found a calling card number posted on his BBS. But the charges
were dropped in February before the case came to trial.
     Rockoff said his case is the first major prosecution under
recent New Jersey law that makes it a crime to obtain data
from a computer without authorization.


COMPUTER LAWS VARY FOR STATES:
  Computer break-ins catches states with varying laws. Example:
Tapping into computer is felony in California, but no N.Y. law
rules "hacker" abuse, except federal statutes on interstate
information theft. UCLA student who tapped N.Y. college system
faces prison for "malicious computer entry" under Calif. law.
(Gannett News Service)

L.A. Times, Tuesday, September 3, 1985  San Diego Section (Editorials)
----------------------------------------------------------------------
``Garbage In, Garbage Out''

     Many people have worried for years about what will happen when government
finds a big computer that can catalogue everything about everybody, every scrap
of information - true or false - would then be available at a push of a button.
That day is not here yet, but experience with the FBI's National Crime Inform-
ation Center, the nation's centralized computer data-base, indicates that such
fears for the future are not groundless.
     A continuing series of FBI audits of the data base has found that it sends
12,000 false or inaccurate reports on individual suspects every day to law-
enforcement agencies around the country.  It's not really the FBI's fault.  The
erroneous information that the computer spews out was put in by state and local
law enforcers in the first place.  There appears to be not much quality control
in crime information, and, as one of the oldest lines in computerdom assers,
``Garbage in, garbage out.''
     But the information in that computer is more than accounting data or the 
marketing forecasts of strategic planners.  This is vital personal information
that affects people's lives.  There have been cases, and not just a few of them
in which the wrong person has been arrested and jailed because of bad informa-
tion from a computer.  Police officers are more likely to take the word of the
FBI's computer than of a person who claims it's all a mistake.
     About 62,000 criminal-justice agencies throughout the country seek infor-
mation from the FBI's crime computer nearly 500,000 times a day.  The FBI says
that a 2.4% error ratio isn't so bad when you consider that the system results
in the apprehension of more than 70,000 wanted felons a year.  Tell that to 
people that have erroneous information about them sent to the local cops.
     And the police are not the only ones who get this information.  A growing
number of employers, such as day-care centers and schools, also use the FBI
crime computer to run background checks on prospective employees.  There is a
legitimate social need to do that, but, if the information is wrong, a person's
livelihood, carreer, and reputation may be irrepairably damaged.
     As with many ills, it is easier to describe the problem than to fix it.
But it's clear that the accuracy of the information maintained by the FBI needs
more scrutiny.
     Rep.Charles E. Schumer (D-N.Y.) has proposed giving the states more money
to beef up their record-keeping.  That would help.  But no ammount of
effort and attention can ever eliminate all errors from a human system.  People
have always made mistakes, and always will make mistakes.  The trouble is that
the computer makes it possible to give those mistakes nationwide distribution.
     Still, things can be improved, and it is vital to the FBI and to all law
enforcement that they be improved.  The future of the National Information 
Center depends on reducing the error rate so that both the police and the 
public are confident that information obtained from the computer is correct.
-------------------------------------------------------------------------------
Dutifully typed by Henry Spire, C.I.A.
-------------------------------------------------------------------------------

              LAWYERS' MICRO USERS GROUP NEWSLETTER
                         September, 1985

COMPUTER SECURITY -- DIGITAL PATHWAY'S SECURENET FAMILY OF PRODUCTS

Computer security is on everyone's mind these days. Recently, hackers had
at it on several BBS's in the Chicago area.  And we read almost daily about
Hacker attacks on governmental and or financial institution computers.
Digital Pathways Inc. at 1060 East Meadow Circle, Palo Alto, California
94303 (415) 493-5544, through it's Defender II family of products provides a
unified approach to preventing unauthorized dial-in access to computers. One
of these units is installed between your computer and the telephone line.
There is a dial-in/call back feature, so when someone dials up your
computer, this device calls the proper telephone number of the caller back.
A synthesized voice answers each call-in and requests the caller's ID.  The
ID is entered via Touch Tone.  If the ID is valid, the system looks up the
parameters of the user and arranges for a call-back.  Prices start at $3,600
at quantity one.  Although not inexpensive for a small BBS operation,
obviously a law firm using a computer for client contact and/or for lawyers
to call in from remote locations should seriously consider this kind of
investment.

THE HACKERS - FROM CURIOUS TO CRIMINAL

The original computer hackers who broke into databases and networks were
careful to leave no traces of their entry and not to disturb the data.  This
soon changed as less sophisticated and more malicious computer hackers came
on the scene.

The malicious Hacker horror stories have filled newspapers and magazines for
over a year.  Often the less responsible computer "Hackers" prowl the
electronic alleyways at night, when many firms leave their computer systems
on and attached to phone lines to transmit large blocks of data when the
phone rates are cheaper.  With nobody in the office, penetration of data
bases which lack proper security is often only a matter of time and
patience.

Some Hackers have been amazed to discover that firms which have installed
password protection schemes to prevent unauthorized access have failed to
change the original password which came with the system - "PASSWORD."  What
can happen if your system is easy to penetrate?  While not all Hackers are
data thiefs or vandals, some few malicious modem miscreants have been known
to penetrate a computer system and not only steal but also scramble the
data.

Imagine switching on your terminal one morning only to discover 300 pages
of text had been transformed into a series of seemingly random numbers?

As is often the case, the best sense of Hacking and Hacker morality comes
from the literature of that subculture itself.  Here are excerpts from three
articles in a recent issue (Number 91!) of the original newsletter for
Hackers and "Phone Phreaks" called, appropriately "TAP: The Hobbyist's
Newsletter for the Communications Revolution."

                            Dunn and Bradstreet:
                    Do they know something that we don't

                          by BIOC Agent 003 & Tuc

In issue #90, we explained how to use the Dunn and Bradstreet system (which
is now known as Dunsprint).  A week after the issue was mailed a phellow
phreak found out that a copy of the issue had fallen into the hands of our
"friends" at D & B.  To say the least, they weren't exactly thrilled about
it.  In fact, they did not even believe that they had a security problem!
Well, that just goes to prove that if you are good (or they are incredibly
stupid, whichever the case may be) no will know that you are there!

In a big effort to defeat hackers, they called in an outside service to
spruce up their "security."  Fortunately for us, we were able to find out
about the new system!  This was really not a problem,, though.  First,
they had the new dial-ups posted when you logged on. Secondly, they have a
nice little place on Telenet!  (Where we do most of our "work"--[deleted])

                  Sorry D & B ....Good news travels fast!

                A lesson in Phreaking and Hacking Morality:
                               by Big Brother

I find it truly discouraging when people, intelligent people seeking
intellectual challenges, must revert to becomming common criminals.  The
fine arts of hacking and boxing have all but died out. Though you
newcomers, you who have appeqred on the scene in the last year or two, may
not realize it, we had it much better.  People didn't recognize our
potential for destruction and damage because we never flaunted it, nor did
we exercise it.

For hacking, it was the intellectual challenge which drove us to do it.  The
thrill of bypassing breaking through someone's computer security was
tremendous.  It wasn't a case of getting a password from a friend, logging
on, and destroying and entire database.  We broke in for the challenge of
getting in and snooping around WITHOUT detection.  We loved the potential
for destruction that we gave ourselves but never used.

Today, after so much publicity, the fun has turned to true criminality.
Publicity we have received is abhorring.  From WarGames to the headlined
October Raids, to the 414's, the Inner Circle, Fargo 4A, and the recent NASA
breakins--not to mention all the local incidents that never made the big
newspapers, like breakins at school computers or newspaper computers.  TRW
credit information services claims hackers used the three stolen accounts to
aid them in abusing stolen credit cards.  The thrill of entering and looking
around has shifted to criminal practicality--how can I make my bank account
fatter--how may I use this stolen credit card to its fullest--how could I
take revenge upon my enemies.




                   by Cheshire Catalyst, Managing Editor

The corporate types should realize that if a teenaged hacker is getting into
their system, an industrial spy could have logged in regularly for the past
3 years.  While I may not particularly care for a TRW or [Citibank] having
"Confidential information" about me, I especially don't like the idea of
unauthorized people spreading the data around.

There are no quick answers, because computer security is not just a matter
of hardware, software, locks, and walls.  Security is a people problem.
When you put in locks, you watch the people you give the keys to (notice an
analogy to encryption here).  If these people FEEL they're being watched,
they may get "disgruntled".  Needless to say, a disgruntled employee is
worse than almost anything else you could be combating.

Any of our corporate subscribers who would like to wake up their management
to the vulnerabilities of computer systems should be made aware that I am
available for lectures and consulting.  Just drop me a line at the TAP
maildrop, or via MCI Mail (username: TAP), or telex number 650-119-5732.



SUGGESTED PRACTICES TO FOLLOW FOR COMPUTER SECURITY

In light of the importance of a password, the following practices should be
followed by every user of a multiuser computer system.

1. DON'T USE A LOGICAL PASSWORD THAT IS EASY TO FIGURE OUT. Someone intent
on impersonating you will try the easy password guesses first. For example,
I would never use a password consisting of any part of my name or a close
family member's name, my address, my auto license, etc. This information is
too easy to obtain and if an imposter has targeted you as his "doorway" to
the system, he or she can probably get this information. Use a password that
is either a combination of letters and numbers that are only meaningful to
you (for example, your phone number converted to the first letter assigned
to each number on the telephone. Please do not use this method now that it
has been published).

2. CHANGE YOUR PASSWORD OFTEN. If your password remains the same for a long
period of time, the odds that a persistent imposter will hit hit upon it are
greatly decreased. Again, don't get lazy and change your password to one
that violates the first consideration.

3. NEVER GIVE YOUR PASSWORD TO ANOTHER USER OR ENTER IT INTO A SYSTEM IF YOU
ARE UNCERTAIN AS TO THE REASON FOR THE REQUEST.  Otherwise, you may have
given someone else the irrevocable authority to act on your behalf.
Furthermore, because of the nature of computer systems, you cannot prove
that your "agent" was not you. You are initially responsible for everything
that that person does while acting as you. There are several methods used by
imposters or hackers to acquire a valid user's password directly from the
user.  One method is to use a system's communication's mode to send a
message to another user. This method causes some form of message to appear
on the user's screen indicating that something technically meaningless has
occurred and the user should reenter the password. The hacker then watches
what the user types. Another method involves setting up a program which
follows the same technique as above, but the program then stores the
password in a file and the hacker will check for a password later. A
recently used method is to set up a system to collect passwords. This
recently happened in the Chicago area when a bulletin board was set up by
hackers. It gave the appearance of legitimacy, but was later used by the
hackers to access other system because their users had the same password on
several systems. Which leads to the last rule of password usage.

4. NEVER USE THE SAME PASSWORD ON DIFFERENT COMPUTERS. Using the key analogy
above, if all of the locks on your personal possessions have the same key,
you wouldn't entrust that key to anyone. Why use the same password on
several systems? If you do, you run the risk that someone will get your
password and then use that information to access all of the systems you
access. You will soon be unwelcome on several systems (if not a suspect in a
computer crime case).

VIRGINIA LAW HELPS SYSOP GET REVENGE
 
        A Virginia sysop used a new state computer crime law to help prosecute
a teenage hacker who invaded and vandalized his bulletin board. 
        Allen Knapp runs Washington Networks from his home in Vienna, VA, and 
charges $10 for a system password. Last January, Knapp's board got a call from
a 14-year-old Montgomery County, MD, youth who used the handle Phineas Phreak.
        According to Knapp, Phineas discovered Knapp's own password and 
obtained access to the system files and operating program. The caller erased
part of the board's stored files and transferred others to his own computer.
The youth then called Knapp's answering machine and made several demands for
the return of the files.
        However the answering machine tape allowed the Chesapeake & Potomac 
Telephone Co. to trace the call.
        The boy was charged with a misdemeanor under a section of Vigninia's
computer crime law that is designed to discourage erasing or altering computer
data. He was allowed to plead "not innocent" and was sentenced last month 
to one year probation and ordered to pay Knapp $300 for the damages.
        Knapp estimated that the files the boy erased or stole represented
about 180 hours of work.



MENSA BBS SEEKS SMART CALLERS 
 
        Most sysops check out applicants by verifying their names and 
telephone numbers. But on the MENSA BBS in Palm Beach, FL, callers face a 
much tougher screening. 
        All registered users must pass members of Mensa, Intertel or the
Triple Nine Society to receive full system access.
        Mensa is an international society in which the sole requirement for 
membership is a score at or above the 98th percentile on any of a number of 
standard IQ tests. Qualification for membership may be determined by tests
administered by Mensa or by submission of properly certified prior evidence 
to American Mensa,Ltd., 1701 West 3rd Street, Brooklyn, NY 11223. 
        INTERTEL, Inc., PO BOX 15580, Lakewood, Co., 80215, is a similar
organization that requires members to score in the 99 percentile or above on
IQ tests. The Triple Nine Society, 463 Beacon St., Boston, MA, 02115, sets
its standards even higher: the 99.9 percentile. 
        "Please do not harass us if you do not qualify for access," say 
Molly and "Pops," the boards sysops.
        The system does invite amateur radio operators to also call in (use 
your call sign to log in) and anyone who sends $100 to Connelly Corporation,
Box 1164, Palm Beach FL 33480 also can join.
        Members are invited to swap software and generally get to know each 
other through the public message section. 
        The board also serves as a convenient advertising medium for Pops'
classic cars. Among the bargains listed are a 1959 Corvette Roadster for
$19,500; a 1962 Corvette Coupe, for $14,500 or a 1963 Corvette convertible. 
        The BBS, a modified RBBS-PC, is open 24 hours at 300, 1200 or 2400
baUd. The number is 305-842-1861. You also can catch Molly on The Source, 
ST7783.