436 lines
23 KiB
Plaintext
436 lines
23 KiB
Plaintext
|
|
|
|
****************************************************************************
|
|
>C O M P U T E R U N D E R G R O U N D<
|
|
>D I G E S T<
|
|
*** Volume 1, Issue #1.02 (April 2, 1990) **
|
|
****************************************************************************
|
|
|
|
MODERATORS: Jim Thomas / Gordon Meyer
|
|
REPLY TO: TK0JUT2@NIU.bitnet
|
|
SUBSCRIBE TO: INTERNET:TK0JUT2@NIU.BITNET@UICVM.uic.edu
|
|
|
|
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
|
|
information among computerists and to the presentation and debate of
|
|
diverse views.
|
|
--------------------------------------------------------------------
|
|
DISCLAIMER: The views represented herein do not necessarily represent the
|
|
views of the moderators. Contributors assume all responsibility
|
|
for assuring that articles submitted do not violate copyright
|
|
protections.
|
|
--------------------------------------------------------------------
|
|
|
|
-------------------------------------------------------------------
|
|
IN THIS ISSUE:
|
|
|
|
File 1: Messages Received
|
|
File 2: Hacking in England (news article)
|
|
File 3: The FBI and BBS Surveillance (PHRACK Reprint)
|
|
--------------------------------------------------------------------
|
|
|
|
This is the third issue, and if you haven't received either of the first
|
|
two even though you have subscribed, let us know. It means that mail is not
|
|
getting through the gateway. If you know of anybody who has added their
|
|
name to the mailing list but has not received any issues yet, let us know.
|
|
We apologize for the problems, especially duplicate files, in the CuD 1.02
|
|
mailing. We are still working out mailing glitches.
|
|
|
|
As some of you noticed, file headers still contain the addresses of all
|
|
those to whom the batch is sent. We have broken the batches down into
|
|
groups of about 25, so you are only seeing a portion of the list. However,
|
|
this is still unacceptable. We are working on the problem. Until then, we
|
|
will either break batches down into groups of 5, or, most likely, send them
|
|
out individually, which is a drag with about 150 subscribers. We are
|
|
experimenting with LISTSERV, and have asked comserve for suggestions.
|
|
|
|
If you know of anybody who has added their name to the mailing list but has
|
|
not received any issues yet, let us know. We apologize for the problems,
|
|
especially duplicate files, in the CuD 1.02 mailing. We are still working
|
|
out mailing glitches.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
We have received many, many requests of the files we listed. Providing an
|
|
archive service may not have been one of our better ideas. At the moment
|
|
(middle of the term) we don't have the time to comply with the heavy
|
|
request load. But, we remain convinced that such an archival service is
|
|
needed, because such files are not currently preserved in libraries. So,
|
|
we are exploring options. We have encountered the following problems:
|
|
|
|
1. Time (or lack of it) and digging out files on an ad hoc basis
|
|
|
|
2. Size: Most of the ascii files are over 100 K, and some systems have
|
|
kicked these back. A complete set of some files would run as high as 5
|
|
megs, and to send these out would jam most systems, even if sent out over a
|
|
few days.
|
|
|
|
Possible solutions:
|
|
|
|
1. Upload them to a local (DeKalb) BBS from which they could be downloaded.
|
|
We would have to obtain university permission, but there is currently a
|
|
multi-line BBS here that could handle such requests.
|
|
|
|
2. Send them out by snail mail to anybody who wanted to send disks and a
|
|
self-addressed, stamped envelop. We could then put them in a ZIP file to
|
|
reduce space by about 60 percent and return them.
|
|
|
|
Any other suggestions??
|
|
|
|
From the material we're getting, it looks like we can put an issue out
|
|
about once a week. We will send them in the early part of the week to avoid
|
|
weekend mail-jams.
|
|
|
|
--------------------------------------------------------------------
|
|
|
|
"COMPUTER ABUSE" OR "CONTROLOGY?"
|
|
|
|
In a forthcoming article (CONTEMPORARY CRISES, 1990), Ray Michalowski and
|
|
Erdwin Pfuhl argue that in the years following the 1986 passage of the
|
|
federal computer abuse laws, and despite additional state laws, there were
|
|
very few prosecutions or indictments of hackers. Yet, in recent months,
|
|
hacker prosecutions seem to be making local and national news. Is there
|
|
*really* an upsurge in abuse, or are law enforcement authorities
|
|
over-reacting to media hype and hysteria by dramatizing their "concern"
|
|
through over-enforcement? Jason Ditton (in his book CONTROLOGY) and Mark
|
|
Fishman have argued that too often "crime waves" are do not reflect an
|
|
increase in unacceptable behaviors as much as they do social responses to
|
|
public fears or publicity surrounding a given type of incident. More
|
|
simply, there are often not "crime waves," but rather "control waves." To
|
|
dramatize competency and effectiveness, government agencies and law
|
|
enforcement officials respond to images of "danger" by dramatizing their
|
|
concern in the form of "crackdowns." The current Draconian anti-drug
|
|
legislation is one example. We suppose that the good news is that whenever
|
|
the government declares war on something, it's been lost (witness the "war
|
|
on poverty," the "war on crime," the "war on drugs"). This military
|
|
metaphor does not work well as a social policy, but the repercussions are a
|
|
fiscal drain and a gradual loss of Constitutional freedoms. If you come
|
|
across stories in your local papers on any aspect of computer prosecution
|
|
(use of computers in felonies, prosecution, indictments, or arrests of
|
|
hackers, confiscation of computer equipment, etc.), please transcribe the
|
|
articles (including source, date and page numbers), and pass them along.
|
|
HOWEVER, BE SURE NO COPYRIGHTS ARE INFRINGED. We assume that contributors
|
|
have checked, because we cannot check every article that comes in. Thanks.
|
|
|
|
J&G
|
|
|
|
--------------------------------------------------------------------
|
|
|
|
|
|
|
|
***************************************************************
|
|
*** Computer Underground Digest Issue #1.02 / File 1 of 3 ***
|
|
***************************************************************
|
|
|
|
From: mnemonic@walt.cc.utexas.edu(Mike Godwin)
|
|
Message-Id: <9003311359.AA25162@vondrake.cc.utexas.edu>
|
|
To: TK0JUT2%NIU.BITNET@UICVM.uic.edu
|
|
Subject: Re: Computer Underground Digest, Issue 1.01
|
|
|
|
Writes Mark Seiden:
|
|
|
|
"(Note for the Tomorrow File: A new source of revenue for lawyers: store
|
|
your hacker-client's backup tapes, which would then be protected as
|
|
privileged communication?)"
|
|
|
|
Unfortunately, backup tapes probably are probably not "privileged communication"
|
|
within the meaning of attorney-client privilege. A court or magistrate could
|
|
almost certainly order its production by the attorney in whose custody it was.
|
|
The only possible theory of non disclosure that comes to mind is the
|
|
work-product doctrine, and even that doctrine would apply only if the backup
|
|
were made specifically for the purpose of preparing for litigation.
|
|
|
|
In general, attorney-client privilege only applies to things that clients
|
|
SAY (or write) to their attorneys, not things they GIVE to their attorneys.
|
|
|
|
And, incidentally, the attorney-client privilege cannot, in itself, be "a
|
|
source of revenue" for lawyers. Once you've contracted for an attorney-client
|
|
relationship, your attorney has to keep privileged communications secret even
|
|
if you *don't* ask him to or pay for him to.
|
|
|
|
(You can, of course, give him specific permission to disclose such information.)
|
|
|
|
|
|
--Mike
|
|
|
|
==============================================================================
|
|
|
|
----------------------------------
|
|
Pat Townson of TELECOM DIGEST passed the following along to us. %eds%.
|
|
Any responses?!?
|
|
--------------------
|
|
|
|
Subject: More L.O.D.
|
|
To: "Submission to comp.dcom.telecom" <telecom@eecs.nwu.edu>
|
|
Date: Mon, 2 Apr 90 16:03:54 EST
|
|
From: Don H Kemp <dhk@teletech.uucp>
|
|
Message-Id: <9004021603.AA12172@teletech.UUCP>
|
|
|
|
As reported in AT&T's Consultant Liason Program electronic
|
|
newsletter "Newsbriefs":
|
|
|
|
>
|
|
> LEGION OF DOOM -- ... A government affadavit alleged that in June
|
|
> hackers believed to be Legion of Doom members planted software
|
|
> "time bombs" in AT&T's 5ESS switching computers in Denver, Atlanta
|
|
> and New Jersey. These programs ... were defused by AT&T security
|
|
> personnel before they could disrupt phone service. ... New York
|
|
> Newsday, p. 15, 4/1.
|
|
>
|
|
|
|
--
|
|
Don H Kemp "Always listen to experts. They'll
|
|
B B & K Associates, Inc. tell you what can't be done, and
|
|
Rutland, VT why. Then do it."
|
|
uunet!uvm-gen!teletech!dhk Lazarus Long
|
|
|
|
|
|
|
|
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
|
|
+ END THIS FILE +
|
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|
|
|
|
|
***************************************************************
|
|
*** Computer Underground Digest Issue #1.02 / File 2 of 3 ***
|
|
***************************************************************
|
|
|
|
------------------------------------
|
|
|
|
Some English Members of Parliament seem as hell-bent on hysteria-mongering
|
|
as some here in the U.S. The following was passed on from a Southerner who
|
|
thought it of interest %eds%.
|
|
--------------------------------------------------------
|
|
Civil Liberties
|
|
HACKED TO PIECES
|
|
Jolyon Jenkins Refuses to Panic over Computer Crime
|
|
|
|
%From NEW STATESMAN & SOCIETY, Feb. 9, 1990: p. 27%
|
|
|
|
Why should anyone other than spotty youths and hi-tech fraudsters care
|
|
about new legislation to ban computer hacking? For this reason: laws made
|
|
in response to moral panic usually fail to catch the real villains and end
|
|
up pushing back civil liberties for everyone else. The Computer Misuse
|
|
Bill, published two weeks ago by Tory MP Michael Colvin and likely to
|
|
become law, is just such a measure.
|
|
|
|
The debate over hacking is like the panic over video nasties: a new
|
|
technology which people view with suspicion, ill-founded anecdotal
|
|
research, and overblown language. Emma Nicholson MP, who set this hare
|
|
running with a private member's bill last year, is the chief culprit. In a
|
|
recent interview with the SUNDAY CORRESPONDENT MAGAZINE she said that
|
|
hackers were "malevolent, nasty, evil-doers" who "fill the screens of
|
|
amateur %computer% users with pornography". She claimed that European
|
|
Greens hack into the comupters of large companies and use the information
|
|
they extract to carryout "bombings and fires". When asked to justify the
|
|
allegations she produced a back copy of an anarchist magazine called
|
|
INSURRECTION, whose contents fell somewhat short of the required proof, and
|
|
then cited "unofficial secret-service trackers close to the Dutch
|
|
government", who could not be named.
|
|
|
|
Nicholson has produced a dossier of "hacking incidents" that she insists
|
|
are so confidential that she refuses to reveal the sources to anyone, even
|
|
the Law Commission, which recently completed an investigation of the
|
|
subject. This makes it hard to assess the quality of her information. But
|
|
one of the cases is identifiable and does not inspire confidence in the
|
|
rest. It concerns someone who allegedly put a "logic bomb" in the computer
|
|
system of a British airline. This is almost certainly the case of Jim
|
|
McMahon who was prosecuted last year at Isleworth Crown Court. After three
|
|
and a half weeks the judge stopped the case because he was satisfied that
|
|
McMahon was innocent and that the most likely suspect was the chief
|
|
prosecution witness. The police had fingered the wrong man--not because of
|
|
any gap in the law but because they carried out their investigation
|
|
incompetently. Nonetheless, the case apparently remains in the Nicholson
|
|
dossier.
|
|
|
|
The Colvin bill proposes to punish with six months in prison anyone who
|
|
gains, or tries to gain, "unauthorised access" to information stored on a
|
|
computer. Emma Nicholson is not wholly to blame, because the English Law
|
|
Commission produced similar proposals last year. But they are still
|
|
objectionable, for several reasons. First, it is like criminalising
|
|
trespass. Someone who gains unauthorised access to PHYSICAL premises has
|
|
not normally thereby committed a criminal offence, but only a tort, and it
|
|
is up to the aggrieved part to start civil proceedings against the
|
|
trespasser.
|
|
|
|
Second, it means that information held on computer becomes property. In
|
|
general, information is not protected by law: if I steal a piece of paper
|
|
that has valuable facts written on it, it is only the paper I steal, not
|
|
the facts. Information held in confidence can be protected (to an
|
|
increasing extent) by law; copyright protects the FORM in which information
|
|
is held; but you cannot copyright a fact--and the Colvin bill erodes that
|
|
principle.
|
|
|
|
Third, it won't prevent hacking. Emma Nicholson admitted as much in a
|
|
debate at Imperial College last month. But she said that it was important
|
|
that society should express its moral disapproval of hacking. Experience
|
|
suggests that unenforceable moral disapproval is as likely to lead to an
|
|
increase in the frowned-on activity as to a reduction.
|
|
|
|
Fourth, almost all serious computer misuse can be brought before the courts
|
|
under existing laws, such as fraud, criminal damage, or theft of
|
|
electricity. And in a few years time, hacking by telephone will become
|
|
virtually impossible, because System X phone exchanges will be able to tell
|
|
the manager of a computer system the number someone is calling from.
|
|
|
|
Many successful hacks depend on nothing more sophisticated than correctly
|
|
guessing a password--such as when I correctly guessed that an ITN
|
|
journalist had chosen as his password "ITN". The remedy may be equally
|
|
straightforward: use less easily guessable passwords. Further restricting
|
|
freedom of information is not the answer.
|
|
|
|
---- END ----
|
|
|
|
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
|
|
+ END THIS FILE +
|
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|
|
|
|
|
***************************************************************
|
|
*** Computer Underground Digest Issue #1.02 / File 3 of 3 ***
|
|
***************************************************************
|
|
|
|
Following the discussion of FBI surveillance in CuD 1.02, the
|
|
following was sent in. The contributor's anonymity is protected %eds.%
|
|
-----------------------
|
|
Date: Sun, 01 Apr 90 17:06 CDT
|
|
Subject: FBI BBS Surveillence (PHRACK Article)
|
|
|
|
----------------------
|
|
|
|
==Phrack Inc.==
|
|
|
|
Volume Two, Issue 23, File 10 of 12
|
|
|
|
In The Spirit Of The Vicious Circle Trilogy...
|
|
Phrack Inc. Presents
|
|
|
|
*****************************************
|
|
*** ***
|
|
*** Big Brother Online ***
|
|
*** ***
|
|
*** by Thumpr Of ChicagoLand ***
|
|
*** ***
|
|
*** June 6, 1988 ***
|
|
*** ***
|
|
*** Special Thanks To Hatchet Molly ***
|
|
*** ***
|
|
*****************************************
|
|
|
|
The United States Government is monitoring the message activity on several
|
|
bulletin boards across the country. This is the claim put forth by Glen L.
|
|
Roberts, author of "The FBI and Your BBS." The manuscript, published by The
|
|
FBI Project, covers a wide ground of FBI/BBS related topics, but unfortunately
|
|
it discusses none of them in depth.
|
|
|
|
It begins with a general history of the information gathering activities of the
|
|
FBI. It seems that that the FBI began collecting massive amounts of
|
|
information on citizens that were involved with "radical political" movements.
|
|
This not begin during the 1960's as one might expect, but rather during the
|
|
1920's! Since then the FBI has amassed a HUGE amount of information on
|
|
everyday citizens... citizens convicted of no crime other than being active in
|
|
some regard that the FBI considers potentially dangerous.
|
|
|
|
After discussing the activities of the FBI Roberts jumps into a discussion of
|
|
why FBI snooping on BBS systems is illegal. He indicates that such snooping
|
|
violates the First, Fourth, and Fifth amendments to the Constitution. But he
|
|
makes his strongest case when discussing the Electronic Communications Privacy
|
|
Act of 1987. This act was amended to the Federal Wiretapping Law of 1968 and
|
|
But as with all good laws, it was written in such broad language that it can,
|
|
and does, apply to privately owned systems such as Bulletin Boards. Roberts
|
|
(briefly) discusses how this act can be applied in protecting *your* bulletin
|
|
board from snooping by the Feds.
|
|
|
|
How to protect your BBS: Do NOT keep messages for more than 180 days. Becaus
|
|
the way the law is written, messages less then 180 days old are afforded more
|
|
protection then older messages. Therefore, to best protect your system purge,
|
|
archive, or reload your message base about every 150 days or so. This seems
|
|
silly but will make it harder (more red tape) for the government to issue a
|
|
search warrant and inform the operator/subscriber of the service that a search
|
|
will take place. Roberts is not clear on this issue, but his message is state
|
|
emphatically... you will be better protected if you roll over your message bas
|
|
sooner.
|
|
|
|
Perhaps the best way to protect your BBS is to make it a private system. This
|
|
means that you can not give "instant access" to callers (I know of very few
|
|
underground boards that do this anyway) and you can not allow just anyone to b
|
|
a member of your system. In other words, even if you make callers wait 24
|
|
hours to be validated before having access you need to make some distinctions
|
|
about who you validate and who you do not. Your BBS needs to be a PRIVATE
|
|
system and you need to take steps to enforce and proclaim this EXPECTED
|
|
PRIVACY. One of the ways Roberts suggests doing so is placing a message like
|
|
this in your welcome screen:
|
|
|
|
"This BBS is a private system. Only private citizens who are not
|
|
involved in government or law enforcement activities are authorized
|
|
gained from this system to any government agency or employee."
|
|
|
|
Using this message, or one like it, will make it a criminal offense (under the
|
|
ECPA) for an FBI Agent or other government snoop to use your BBS.
|
|
|
|
The manuscript concludes with a discussion of how to verify users and what to
|
|
do when you find an FBI agent using your board. Overall, I found Roberts book
|
|
to be moderately useful. It really just whetted my appetite for more
|
|
information instead of answering all my questions. If you would like a copy o
|
|
the book it sells for $5.00 (including postage etc). Contact;
|
|
|
|
THE FBI PROJECT
|
|
Box 8275
|
|
Ann Arbor, MI 48107
|
|
|
|
Visa/MC orders at (313) 747-7027. Personally I would use a pseudonym when
|
|
dealing with this organization. Ask for a catalog with your order and you wil
|
|
the FBI would be interested in knowing who is doing business with this place.
|
|
The manuscript, by the way, is about 20 pages long and offers references to
|
|
other FBI expose' information. The full citation of the EPCA, if you want to
|
|
look it up, is 18 USC 2701.
|
|
|
|
Additional Comments: The biggest weakness, and it's very apparent, is that
|
|
Roberts offers no evidence of the FBI monitoring BBS systems. He claims that
|
|
they do, but he does not give any known examples. His claims do make sense
|
|
however. As he states, BBS's offer a type of "publication" that is not read b
|
|
any editors before it is "published." It offers an instant form of news and
|
|
one that may make the FBI very nervous. Roberts would do well to include some
|
|
supportive evidence in his book. To help him out, I will offer some here.
|
|
|
|
* One of the Ten Commandments of Phreaking (as published in the
|
|
famous TAP Magazine) is that every third phreaker is an FBI agent.
|
|
This type of folklore knowledge does not arise without some kind of
|
|
justification. The FBI is interested in the activities of phreakers
|
|
and is going to be looking for the BBS systems that cater to them. I
|
|
your system does not, but it looks like it may, the FBI may monitor i
|
|
just to be sure.
|
|
|
|
* On April 26, 1988 the United States Attorney's Office arrested 19
|
|
people for using MCI and Sprint credit card numbers illegally. These
|
|
numbers were, of course, "stolen" by phreakers using computers to hac
|
|
them out. The Secret Service was able to arrest this people by posin
|
|
as phone phreaks! In this case the government has admitted to placin
|
|
there, the success of theis "sting" will only mean that they will try
|
|
it again. Be wary of people offering you codes.
|
|
|
|
* In the famous bust of the Inner Circle and the 414s, the FBI monitore
|
|
electronic mail for several months before moving in for the kill.
|
|
While it is true that the owners of the systems being hacked (Western
|
|
Union for one) invited the FBI to snoop through their files, it does
|
|
establish that the FBI is no stranger to the use of electronic
|
|
snooping in investigating crimes.
|
|
|
|
Conclusion: There is no reason to believe that the government is *not*
|
|
monitoring your bulletin board system. There are many good reasons to believe
|
|
that they are! Learn how to protect yourself. There are laws and regulations
|
|
in place that can protect your freedom of speech if you use them. You should
|
|
take every step to protect your rights whether or not you run an underground
|
|
system or not. There is no justification for the government to violate your
|
|
rights, and you should take every step you can to protect yourself.
|
|
|
|
I have no connections with Roberts, his book, or The FBI Project other then
|
|
being a mostly-satisfied customer. I'm not a lawyer and neither is Roberts.
|
|
No warranty is offered with this text file. Read and use it for what you thin
|
|
it is worth. You suffer the consequences or reap the benefits. The choice is
|
|
yours, but above all stay free.
|
|
|
|
|
|
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
|
|
+ END CuD #1.02 +
|
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|
! |