863 lines
40 KiB
Plaintext
863 lines
40 KiB
Plaintext
|
||
|
||
****************************************************************************
|
||
>C O M P U T E R U N D E R G R O U N D<
|
||
>D I G E S T<
|
||
*** Volume 1, Issue #2.00 (Aug 25, 1990) **
|
||
****************************************************************************
|
||
|
||
MODERATORS: Jim Thomas / Gordon Meyer (TK0JUT2@NIU.bitnet)
|
||
ARCHIVISTS: Bob Krause / Alex Smith
|
||
USENET readers can currently receive CuD as alt.society.cu-digest.
|
||
|
||
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
|
||
information among computerists and to the presentation and debate of
|
||
diverse views. CuD material may be reprinted as long as the source is
|
||
cited. It is assumed that non-personal mail to the moderators may be
|
||
reprinted, unless otherwise specified. Readers are encouraged to submit
|
||
reasoned articles relating to the Computer Underground.
|
||
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||
DISCLAIMER: The views represented herein do not necessarily represent the
|
||
views of the moderators. Contributors assume all responsibility
|
||
for assuring that articles submitted do not violate copyright
|
||
protections.
|
||
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||
|
||
CONTENTS:
|
||
File 1: Moderators' Corner
|
||
File 2: EFF mailing #3: About the Electronic Frontier Foundation
|
||
File 3: Len Rose's Search Warrant
|
||
File 4: What to Read When the SS is at the Door
|
||
File 5: CU in the News: More on the NY Raids
|
||
|
||
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
||
|
||
----------------------------------------------------------------------
|
||
|
||
********************************************************************
|
||
*** CuD #2.00, File 1 of 5: Moderators' Comments ***
|
||
********************************************************************
|
||
|
||
Date: August 24, 1990
|
||
From: Moderators
|
||
Subject: Moderators' Corner
|
||
|
||
++++++++++
|
||
In this file:
|
||
1) NATIONAL COMPUTER SECURITY CONFERENCE
|
||
2) LEN ROSE/DR. RIPCO UPDATES
|
||
|
||
++++++++++++++++++
|
||
National Computer Security Conference
|
||
++++++++++++++++++
|
||
|
||
Dorothy Denning has reminded us that the 13th National Computer Security
|
||
Conference will be held Oct. 1-4 in Washington, D.C. Dorothy will be
|
||
moderating a panel titled "Hackers: Who are They?"
|
||
The panelists will be:
|
||
|
||
Frank Drake, editor of W.O.R.M.
|
||
Emmanuel Goldstein, editor of 2600
|
||
Katie Hafner, author
|
||
Gordon Meyer, co-editor of CuD
|
||
Craig Neidorf, former publisher of Phrack
|
||
Sheldon Zenner, attorney
|
||
|
||
The panel will be on Oct. 4 at 9:00am. In addition, Dorothy will present
|
||
my paper "Concerning Hackers Who Break into Computer Systems" on Wednesday
|
||
afternoon.
|
||
|
||
For more information, call Tammie Grice at 301-975-2775. Highlights of the
|
||
program are in RISKS DIGEST 10.22, which can be read on comp.risks. The
|
||
complete program can be obtained by FTP from cert.sei.cmu.edu. It is file
|
||
ncsc.1990.program in directory pub/virus-l/docs.
|
||
|
||
------------------------------
|
||
|
||
+++++++++++++++++++
|
||
Len Rose / Dr. Ripco Updates
|
||
+++++++++++++++++++
|
||
|
||
Progress is often slow, and there is little to report about the Len Rose
|
||
and Dr. Ripco situations. Although the cases are unrelated, both raise
|
||
similar issues about law enforcement handling of alleged computer abuse.
|
||
Dr. Ripco still remains uncharged, his equipment remains unreturned. Len
|
||
Rose still faces trial in February. But, the EFF is currently looking into
|
||
both cases to see what legal issues they raise.
|
||
|
||
********************************************************************
|
||
>> END OF THIS FILE <<
|
||
***************************************************************************
|
||
|
||
------------------------------
|
||
|
||
From: well!eff-news-request@APPLE.COM
|
||
Subject: EFF mailing #3: About the Electronic Frontier Foundation
|
||
Date: Sun, 19 Aug 90 21:02:14 PDT
|
||
|
||
********************************************************************
|
||
*** CuD #2.00: File 2 of 5: EFF Update ***
|
||
********************************************************************
|
||
|
||
[Our story so far: If you're getting this message, you either asked to be
|
||
added to the EFF mailing list, or asked for general information about the
|
||
EFF. We have sent out two mailings before this one; if you missed them and
|
||
want copies, send a request to eff-news-request@well.sf.ca.us. We now have
|
||
two Usenet newsgroups set up, in the "inet" distribution. The moderated
|
||
newsgroup, comp.org.eff.news, will carry everything we send to this mailing
|
||
list, plus other things of interest. If your site gets the newsgroup and
|
||
you want to read this stuff there instead of through the mailing list, send
|
||
a request to eff-news-request@well.sf.ca.us and I'll be happy to take you
|
||
off the list. And now...]
|
||
|
||
|
||
************************************************************
|
||
About the EFF
|
||
General Information
|
||
Revised August 1990
|
||
************************************************************
|
||
|
||
The EFF (formally the Electronic Frontier Foundation, Inc.) has been
|
||
established to help civilize the electronic frontier; to make it truly
|
||
useful and beneficial not just to a technical elite, but to everyone; and
|
||
to do this in a way which is in keeping with our society's highest
|
||
traditions of the free and open flow of information and communication.
|
||
|
||
The EFF now has legal status as a corporation in the state of
|
||
Massachusetts. We are in the process of applying to the IRS for status as
|
||
a non-profit, 501c3 organization. Once that status is granted contributions
|
||
to the EFF will be tax-deductible.
|
||
|
||
************************************************************
|
||
Mission of the EFF
|
||
************************************************************
|
||
|
||
1. to engage in and support educational activities which increase
|
||
popular understanding of the opportunities and challenges posed by
|
||
developments in computing and telecommunications.
|
||
|
||
2. to develop among policy-makers a better understanding of the issues
|
||
underlying free and open telecommunications, and support the creation of
|
||
legal and structural approaches which will ease the assimilation of these
|
||
new technologies by society.
|
||
|
||
3. to raise public awareness about civil liberties issues arising from
|
||
the rapid advancement in the area of new computer-based communications
|
||
media and, where necessary, support litigation in the public interest to
|
||
preserve, protect, and extend First Amendment rights within the realm of
|
||
computing and telecommunications technology.
|
||
|
||
4. to encourage and support the development of new tools which will
|
||
endow non-technical users with full and easy access to computer-based
|
||
telecommunications.
|
||
|
||
************************************************************
|
||
Current EFF Activities
|
||
************************************************************
|
||
|
||
> We are helping educate policy makers and the general public.
|
||
|
||
To this end we have funded a significant two-year project on computing and
|
||
civil liberties to be managed by the Computer Professionals for Social
|
||
Responsibility. With it, we aim to acquaint policy makers and law
|
||
enforcement officials of the civil liberties issues which may lie hidden in
|
||
the brambles of telecommunications policy.
|
||
|
||
Members of the EFF are speaking at computer and government conferences and
|
||
meetings throughout the country to raise awareness about the important
|
||
civil liberties issues.
|
||
|
||
We are in the process of forming alliances with other other public interest
|
||
organizations concerned with the development of a digital national
|
||
information infrastructure.
|
||
|
||
The EFF is in the early stages of software design and development of
|
||
programs for personal computers which provide simplified and enhanced
|
||
access to network services such as mail and netnews.
|
||
|
||
Because our resources are already fully committed to these projects, we are
|
||
not at this time considering additional grant proposals.
|
||
|
||
> We are helping defend the innocent.
|
||
|
||
We gave substantial legal support in the criminal defense of Craig Neidorf,
|
||
the publisher of Phrack, an on-line magazine devoted to telecommunications,
|
||
computer security and hacking. Neidorf was indicted on felony charges of
|
||
wire fraud and interstate transportation of stolen property for the
|
||
electronic publication of a document which someone else had removed,
|
||
without Neidorf's participation, from a Bell South computer. The
|
||
government contended that the republication of proprietary business
|
||
information, even if the information is of public significance, is illegal.
|
||
The EFF submitted two friend of the court briefs arguing that the
|
||
publication of the disputed document was constitutionally protected speech.
|
||
We also were instrumental in locating an expert witness who located
|
||
documents which were publicly available from Bell South which contained all
|
||
the information in the disputed document. This information was critical in
|
||
discrediting the government's expert witness. The government dropped its
|
||
prosecution in the middle of the trial, when it became aware that its case
|
||
was untenable.
|
||
|
||
EFF attorneys are also representing Steve Jackson Games in its efforts to
|
||
secure the complete return and restoration of all computer equipment seized
|
||
in the Secret Service raid on its offices and to understand what might have
|
||
been the legal basis for the raid.
|
||
|
||
We are not involved in these legal matters as a "cracker's defense fund,"
|
||
despite press reports you may have read, but rather to ensure that the
|
||
Constitution will continue to apply to digital media. We intend to
|
||
demonstrate legally that speech is speech whether it finds form in ink or
|
||
in ASCII.
|
||
|
||
************************************************************
|
||
What can you do?
|
||
************************************************************
|
||
|
||
For starters, you can spread the word about EFF as widely as possible, both
|
||
on and off the Net. Feel free, for example, to distribute any of the
|
||
materials included in this or other EFF mailings.
|
||
|
||
You can turn some of the immense processing horsepower of your distributed
|
||
Mind to the task of finding useful new metaphors for community, expression,
|
||
property, privacy and other realities of the physical world which seem up
|
||
for grabs in these less tangible regions.
|
||
|
||
And you can try to communicate to technically unsophisticated friends the
|
||
extent to which their future freedoms and well-being may depend on
|
||
understanding the broad forms of digital communication, if not necessarily
|
||
the technical details.
|
||
|
||
Finally, you can keep in touch with us at any of the addresses listed
|
||
below. Please pass on your thoughts, concerns, insights, contacts,
|
||
suggestions, and news. And we will return the favor.
|
||
|
||
************************************************************
|
||
Staying in Touch
|
||
************************************************************
|
||
|
||
Send requests to be added to or dropped from the EFF mailing list or other
|
||
general correspondence to eff-request@well.sf.ca.us. We will periodically
|
||
mail updates on EFF-related activities to this list.
|
||
|
||
If you receive any USENET newsgroups, your site may carry two new
|
||
newsgroups in the INET distribution called comp.org.eff.news and
|
||
comp.org.eff.talk. The former is a moderated newsgroup of announcements,
|
||
responses to announcements, and selected discussion drawn from the
|
||
unmoderated "talk" group and the mailing list.
|
||
|
||
Everything that goes out over the EFF mailing list will also be posted in
|
||
comp.org.eff.news, so if you read the newsgroup you don't need to subscribe
|
||
to the mailing list.
|
||
|
||
Postings submitted to the moderated newsgroup may be reprinted by the EFF.
|
||
To submit a posting, you may send mail to eff@well.sf.ca.us.
|
||
|
||
There is an active EFF conference on the Well, as well as many other
|
||
related conferences of interest to EFF supporters. As of August 1990,
|
||
access to the Well is $8/month plus $3/hour. Outside the S.F. Bay area,
|
||
telecom access for $5/hr. is available through CPN. Register online at
|
||
(415) 332-6106.
|
||
|
||
A document library containing all of the EFF news releases, John Barlow's
|
||
"Crime and Puzzlement" and others is available on the Well. We are working
|
||
toward providing FTP availability into the document library through an EFF
|
||
host system to be set up in Cambridge,
|
||
Mass. Details will be forthcoming.
|
||
|
||
Our Address:
|
||
|
||
The Electronic Frontier Foundation, Inc.
|
||
One Cambridge Center, Suite 300
|
||
Cambridge, MA 02142
|
||
|
||
(617) 577-1385
|
||
(617) 225-2347 (fax)
|
||
|
||
After August 25, 1990:
|
||
|
||
The Electronic Frontier Foundation, Inc.
|
||
155 Second Street
|
||
Cambridge, MA 02142
|
||
|
||
We will distribute the new telephone number once we have it.
|
||
************************************************************
|
||
|
||
Mitchell Kapor (mkapor@well.sf.ca.us)
|
||
John Perry Barlow (barlow@well.sf.ca.us)
|
||
|
||
Postings and email for the moderated newsgroup should be sent
|
||
to "comp-org-eff-news@well.sf.ca.us".
|
||
|
||
********************************************************************
|
||
>> END OF THIS FILE <<
|
||
***************************************************************************
|
||
|
||
------------------------------
|
||
|
||
Date: Undated
|
||
From: Anonymous
|
||
Subject: Len Rose's Search Warrant
|
||
|
||
********************************************************************
|
||
*** CuD #2.00: File 3 of 5: Len Rose's Search Warrant ***
|
||
********************************************************************
|
||
|
||
|
||
|
||
UNITED STATES DISTRICT COURT
|
||
|
||
|
||
District of Maryland
|
||
APPLICATION AND AFFIDAVIT
|
||
FOR SEARCH WARRANT
|
||
In the matter of the Search of:
|
||
|
||
Residence of
|
||
7018 Willow Tree Drive CASE NUMBER: 90-0002G
|
||
Middletown, Maryland
|
||
|
||
|
||
I Timothy Foley being duly sworn depose and say:
|
||
|
||
I am a Special Agent and have reason to believe that on the property or
|
||
premises known as: the residence at 7018 Willow Tree Drive, Middletown,
|
||
Maryland (see attachment B) in the District of Maryland there is now
|
||
concealed a certain person or property ,namely (see attachment A) which is
|
||
concerning a violation of Title 18 United States code,Sections 2314 and 1030.
|
||
The facts to support a finding of Probable Cause are as follows: (see
|
||
attachment C)
|
||
|
||
|
||
|
||
Sworn to before me and subscribed in my presence
|
||
|
||
February 1,1990 at Baltimore Maryland
|
||
|
||
Clarence F. Goetz,U.S. Magistrate
|
||
|
||
|
||
|
||
|
||
|
||
ATTACHMENT A
|
||
|
||
computer hardware (including central processing unit(s),monitors,memory
|
||
devices, modem(s), programming equipment,communications equipment,disks,
|
||
prints,and computer software (including but not limited to memory disks,
|
||
floppy disks, storage media) and written material and documents relating
|
||
to the use of the computer system (including networking access files,
|
||
documentation relating to the attacking of computer and advertising the
|
||
results of the computer attack (including telephone numbers and location
|
||
information), which constitute evidence,instrumentalities and fruits of
|
||
federal crimes, including interstate transportation of stolen property
|
||
(18 USC 2314) and interstate transportation of computer access information
|
||
(18 USC 1030(a)(6)). This warrant is for the seizure of the above described
|
||
computer and computer data and for the authorization to read information
|
||
stored and contained on the above described computer and computer data.
|
||
|
||
|
||
|
||
|
||
ATTACHMENT B
|
||
|
||
|
||
Two level split-foyer style house with a upper story overhang on either
|
||
side of a central indentation for the front door. House is white upper
|
||
with red brick lower portion under the overhanging upper story. Front
|
||
door is white. There is a driveway on the lefthand side of the house as
|
||
you face the front. Mail box is situated on a post adjacent to the
|
||
driveway and mailbox displays the number 7018.
|
||
|
||
|
||
|
||
|
||
ATTACHMENT C
|
||
|
||
|
||
State of Maryland )
|
||
) SS
|
||
County of Frederick )
|
||
|
||
AFFIDAVIT
|
||
|
||
1. I, Timothy Foley, am a Special Agent of the United States Secret Service
|
||
and have been so employed for the past two years. I am presently assigned
|
||
to the Computer Fraud Section of the United States Secret Service in
|
||
Chicago. Prior to that I was employed as an attorney of law practicing
|
||
in the City of Chicago and admitted to practice in the State of Illinois.
|
||
I am submitting this affidavit in support of the search warrant for the
|
||
premises known as the residence of Leonard Rose at 7018 Willow Tree Drive
|
||
in Middletown, Maryland.
|
||
|
||
2. This affidavit is based upon my investigation and information provided
|
||
to me by Special Agent Barbara Golden of the Computer Fraud Section of
|
||
the United States Secret Service in Chicago. S.A. Golden has been
|
||
employed by the Secret Service for 13 years, and has been a Special Agent
|
||
with the Secret Service for 3 years and by other agents of the United
|
||
States Secret Service.
|
||
|
||
3. I have also received technical information and investigative assistance
|
||
from the experts in the fields of telecommunications, computer technology,
|
||
software development and computer security technology, including:
|
||
|
||
a. Reed Newlin, a Security Officer of Southwestern Bell, who has numerous
|
||
years of experience in operations,maintenance and administration of
|
||
telecommunication systems as an employee of the Southwestern Bell
|
||
Telephone Company.
|
||
|
||
b. Henry M. Kluepfel, who has been employed by the Bell System or its
|
||
divested companies for the last twenty-four years. Kleupfel is
|
||
presently employed by Bell Communications Research, (Bellcore) as
|
||
a district manager responsible for coordinating security technology
|
||
and consultation at Bellcore in support of its owners, the seven (7)
|
||
regional telephone companies, including BellSouth Telephone Company
|
||
and Southwestern Bell Telephone Company. Mr. Kleupfel has participated
|
||
in the execution of numerous Federal and State search warrants relative
|
||
to telecommunications and computer fraud investigations. In addition,
|
||
Mr. Kleupfel has testified on at least twelve (12) occasions as an
|
||
expert witness in telecommunications and computer fraud related
|
||
crimes.
|
||
|
||
c. David S. Bauer, who has been employed by Bell Communications Research,
|
||
(Bellcore) since April 1987. Bauer is a member of the technical staff
|
||
responsible for research and development in computer security
|
||
technology and for consultation in support for its owners, the seven
|
||
(7) regional telephone companies, including BellSouth. Mr. Bauer is
|
||
an expert in software development,communications operating systems,
|
||
telephone and related security technologies. Mr. Bauer has conducted
|
||
the review and analysis of approximately eleven (11) computer hacking
|
||
investigations for Bellcore. He has over nine (9) years of professional
|
||
experience in the computer related field.
|
||
|
||
d. At all times relevant to this affidavit, "computer hackers" were
|
||
individuals involved with the unauthorized access of computer systems
|
||
by various means. The assumed names used by the hackers when contacting
|
||
each other were referred to as "hacker handles."
|
||
|
||
Violations Involved
|
||
-------------------
|
||
|
||
5. 18 USC 2314 provides federal criminal sanctions against individuals
|
||
who knowingly and intentionally transport stolen property or property
|
||
obtained by fraud, valued at $5,000.00 or more, in interstate commerce.
|
||
My investigation has revealed that on or about January 8, 1990
|
||
Leonard Rose, using the hacker handle Terminus, transported a stolen
|
||
or fraudulently obtained computer program worth $77,000.00 from
|
||
Middletown, Maryland to Columbia, Missouri.
|
||
|
||
6. 18 USC 1030(a) (6) provides federal criminal sanctions against
|
||
individuals who knowingly and with intent to defraud traffic in
|
||
interstate commerce any information through which a computer may be
|
||
accessed without authorization in interstate commerce. My investigation
|
||
has revealed that on or about January 8,1990 Leonard Rose trafficked
|
||
a specially modified copy of AT&T Unix source code SVR 3.2 in interstate
|
||
commerce from Middletown, Maryland to Columbia,Missouri. (Source code
|
||
is a high level computer language which frequently uses English letters
|
||
and symbols for constructing computer programs. Programs written in
|
||
source code can be converted or translated by a "compiler" program into
|
||
object code for use by the computer.) This Unix source code SVR 3.2 had
|
||
been specially modified so that it could be inserted by a computer hacker
|
||
into any computer using a Unix operating system and thereafter enable the
|
||
hacker to illegally capture logins and passwords used by legitimate
|
||
users of the computer.
|
||
|
||
Discovery of the Altered Unix Source Code
|
||
-----------------------------------------
|
||
|
||
7. For the past seven (7) months I have been one of the United States
|
||
Secret Service agents involved in a national investigation into attacks
|
||
on telephone computer switches by various computer "hackers" including
|
||
an organization referred to as the Legion of Doom (LOD).
|
||
|
||
8. My investigation to date has disclosed that hackers have stolen sensitive
|
||
proprietary information from various telecommunications organizations
|
||
and published this information in "hacker" publications such as "Phrack"
|
||
newsletter. On Janurary 18,1990 Craig Neidorf (hacker handle Knight
|
||
Lightning) the editor and co-publisher of "PHRACK" was caught in
|
||
possession of various stolen computer files including the source code
|
||
for UNIX SVR3.2 and the text file for the Bell South's enhanced 911 (E911)
|
||
system.
|
||
|
||
9. On January 18,1990 Reed Newlin, Southwestern Bell, and I conducted an
|
||
examination of the computer files of Craig Neidorf, a hacker known to us
|
||
as Knight Lightning,at the University of Missouri at Columbia in Columbia,
|
||
Missouri (referred to hereafter simply as Neidorf computer files).
|
||
Newlin's examination of the Neidorf computer files extended from the night
|
||
of January 18 into the early morning hours of January 19. Later on
|
||
January 19 Newlin advised me that his examination of the Neidorf computer
|
||
files had disclosed the existence of what he believed to be proprietary
|
||
AT&T UNIX SVR3.2 source code in among Neidorf's computer files. He further
|
||
advised me that the AT&T source code appeared to have been modified into
|
||
a hacker tutorial which would enable a computer hacker to illegally
|
||
obtain password and login information from computers running on a UNIX
|
||
operating system.
|
||
|
||
10. On January 29, 1990 I interviewed Craig Neidorf and he advised me that
|
||
Leonard Rose (hacker handle "Terminus") had provided him with the AT&T
|
||
UNIX SVR3.2 source code which had been taken by me from his computer
|
||
files on the computers at the University of Missouri. (Neidorf is soon to
|
||
be indicted in Chicago for violations of 18 USC 1030,1343, and 2314.
|
||
Neidorf's interview took place while he was aware of the potential
|
||
charges which might be brought against him.)
|
||
|
||
11. Neidorf's identification of Leonard Rose (Terminus) as his source for
|
||
the stolen UNIX source code is corroborated by the physical evidence.
|
||
That evidence also shows that Terminus knew the code was stolen. On
|
||
January 20, 21, and 31, 1990 I personally examined the 19 pages of AT&T
|
||
UNIX SVR3.2 found in the Neidorf computer files by Newlin. On pages one
|
||
and two of the AT&T document the author of the file identifies himself
|
||
by the hacker handle "Terminus". On the first page of the document
|
||
Terminus advised Neidorf that the source code came originally from AT&T
|
||
"so it's definitely not something you wish to get caught with".
|
||
Terminus also inserts the following warning into the text of the program
|
||
on the first page: "Warning: this is AT&T proprietary source code. Do
|
||
NOT get caught with it.." On page 26 of the program Terminus also states:
|
||
|
||
"Hacked by Terminus to enable stealing passwords.. This is obviously
|
||
not a tool for initial system penetration, but instead will allow you
|
||
to collect passwords and accounts once it's been installed. Ideal for
|
||
situations where you have a one-shot opportunity for super user
|
||
privileges.. This source code is not public domain..(so don't get
|
||
caught with it).
|
||
|
||
In addition to these warnings from Terminus the AT&T source code also
|
||
carries what appears to be the original warnings installed in the
|
||
program by AT&T on pages 2,5,6,7,26 and 28:
|
||
|
||
Copyright (c) 1984 AT&T
|
||
All rights reserved
|
||
THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T
|
||
The copyright notice above does not evidence and actual or intended
|
||
publication of the source code.
|
||
|
||
12. On January 26 and 30, 1990 copies of the UNIX SVR 3.2 source code
|
||
found in the Neidorf computer files and discussed above were sent to
|
||
UNIX experts with AT&T (Mr. Al Thompson) and Bellcore (Mr. David Bauer
|
||
and Mr. Hank Kleupfel) for their evaluation.
|
||
|
||
13. On January 30, 1990 Al Thompson of AT&T advised me that his initial
|
||
review of the document and the initial review of the document by AT&T's
|
||
software licensing group had disclosed the following:
|
||
|
||
a. The document was in fact a copy of the AT&T UNIX SVR3.2 source
|
||
code login program.
|
||
|
||
b. The program's value was approximately $75,000.00
|
||
|
||
c. Neither Leonard Rose nor Craig Neidorf were licensed to own or
|
||
possess the source code in question.
|
||
|
||
d. The source code provided to him had been made into a tutorial
|
||
for hackers which could be used to install "trap doors" into
|
||
a computer and it's operating system. These trap doors would
|
||
enable a hacker to illegally obtain the passwords and logins
|
||
of the legitimate users of a computer running on a UNIX
|
||
operating system.
|
||
|
||
Identification of Leonard Rose as Terminus
|
||
------------------------------------------
|
||
|
||
14. The AT&T Unix SVR3.2 source code described in paragraphs 9 through
|
||
13 above reflected that a hacker named Terminus was the author of
|
||
the modifications.
|
||
|
||
15. On January 15 and 30, 1990 David Bauer of Bellcore advised me that
|
||
Terminus is the hacker handle for an individual named Leonard Rose
|
||
who resides in Maryland. Bauer advised me that in e-mail between
|
||
Terminus and a hacker known as the Prophet (Robert Riggs), on October
|
||
9, 1988 Terminus had identified himself as:
|
||
|
||
Len Rose
|
||
Len@Netsys.COM,postmaster@Netsys.COM
|
||
301-371-4497
|
||
Netsys,Inc. 7018 Willowtree Drive Middletown MD 21769
|
||
|
||
16. In addition, Bauer's examination disclosed that Terminus received
|
||
e-mail at the following addresses: "len@ames.arc.nasa.gov" or
|
||
"len@netsys.com". The address "len@ames.arc.nasa.gov" indicates
|
||
that the author has the account "len" on the system named "Ames"
|
||
in the domain "arc" that is owned and operated by the National
|
||
Air and Space Agency of the United States government.
|
||
|
||
17. My continuing review on January 25,1990 of the Neidorf computer files
|
||
disclosed that Rose was continuing to send e-mail to Neidorf and to
|
||
receive e-mail from Neidorf. On December 28,1989,Leonard Rose
|
||
(Terminus) sent an e-mail message to Neidorf in which Rose gives his
|
||
address as 7018 Willowtree Drive in Middletown, Maryland 21769 and
|
||
gives his e-mail address as follows:
|
||
|
||
"len@netsys.netsys.com"
|
||
|
||
18. On January 30, 1990 I was advised by individuals with the Computer
|
||
Emergency Reaction team (CERT) that the e-mail address
|
||
"len@netsys.netsys.com" is located at 7018 Willowtree Drive,Middletown,
|
||
Maryland 21769. CERT is an organization located at the Carnegie-Mellon
|
||
Institute and funded by the Defense Advanced Research Projects Agency.
|
||
It records contain information about the location of many computers
|
||
in the United States.
|
||
|
||
19. There is additional evidence identifying Terminus as Leonard Rose.
|
||
On January 30, 1990 I received a May 24,1987 copy of "Phrack"
|
||
magazine from Hank Kluepfel of Bellcore wherein hacker Taran King
|
||
(Randy Tischler) interviewed and "profiled" Terminus (a/k/a Leonard
|
||
Rose). The personal background information in the article included
|
||
the following:
|
||
|
||
Handle: Terminus
|
||
Call him: Len
|
||
Past Handles: Terminal Technician
|
||
Handle Origin: Terminal Technician originated because of
|
||
Len's view of himself as a hacker. Terminus
|
||
was an offshoot of that and, although it
|
||
is an egotistical view, it means he has
|
||
reached the final point of being a
|
||
proficient hacker.
|
||
Date of birth: 1/10/59
|
||
Age at current date: 29
|
||
Height: 5'9"
|
||
Weight: About 190 lbs.
|
||
Eye Color: Hazel
|
||
Hair Color: Brown
|
||
Computers: 6800 home brew system, Apple II,Altair
|
||
S100, 2 Apple II+s,IBM PC,IBM XT,IBM 3270,
|
||
IBM AT, and 2 Altos 986's
|
||
Sysop/Co-Sysop: MetroNet,MegaNet, and NetSys Unix
|
||
|
||
Terminus is further described as an electronic engineer and he designs
|
||
boards for different minicomputers like PDP-11s,Data Generals,Vaxes,
|
||
and Perkin-Elmer who also writes software and writes computer code in
|
||
machine language.
|
||
|
||
20. My January 25 review of the Neidorf computer files also disclosed a
|
||
January 9,1990 e-mail message from Rose to Neidorf at 12:20 am which
|
||
corroborated the fact that Rose had sent Neidorf the UNIX SVR3.2
|
||
source code on or around January 7,1990. In this message Rose tells
|
||
Neidorf that he (Rose) lost his copy of what he sent to Neidorf the
|
||
other night because his (Rose's) hard drive had crashed.
|
||
|
||
21. My January 25 review also disclosed a second e-mail message from Rose
|
||
to Neidorf on January 9,1990, at 3:05 pm . This message indicates that
|
||
Neidorf had sent a copy of the requested source code back to Rose as
|
||
requested (see paragraph 20 above). Rose's message began:
|
||
"RE: UNIX file" and stated that the copy of the stolen source code
|
||
received back from Neidorf had some type of "glitch".
|
||
|
||
22. These messages reflect that Rose still has at least one copy of the
|
||
UNIX SVR3.2 source code in his possession.
|
||
|
||
23. On January 29,1990 Craig Neidorf advised me that on or around January
|
||
9, 1990 he received a copy of the Unix SVR3.2 source code which was
|
||
telecommunicated to him via Bitnet from Leonard Rose in Maryland.
|
||
|
||
24. On January 30,1990, Hank Kluepfel of Bellcore advised me that based
|
||
upon his background experience and investigation in this case and
|
||
investigating approximately 50 other incidents this year involving
|
||
the unauthorized use of other computer systems,hackers that run
|
||
computer bulletin boards typically keep and use the following types
|
||
of hardware,software and documents to execute their fraud schemes and
|
||
operate their bulletin boards:
|
||
|
||
a. Hardware - a central processing unit,a monitor, a modem,a keyboard,
|
||
a printer, and storage devices (either floppy disks or auxiliary
|
||
disk units),telephone equipment (including automatic dialing
|
||
equipment,cables and connectors), tape drives and recording equipment.
|
||
|
||
b. Software - hard disks, and floppy disks containing computer programs,
|
||
including, but not limited to software data files, e-mail files,
|
||
UNIX software and other AT&T proprietary software.
|
||
|
||
c. Documents - computer related manuals, computer related textbooks,
|
||
looseleaf binders, telephone books,computer printouts,videotapes
|
||
and other documents used to access computers and record information
|
||
taken from the computers during the above referred to breakins.
|
||
|
||
25. Based upon the above information and my own observation, I believe
|
||
that at the residence known as 7018 Willow Tree Drive, Middletown,
|
||
Maryland there is computer hardware (including central processing
|
||
unit(s),monitors,memory devices,modem(s),programming equipment,
|
||
communication equipment,disks,prints and computer software (including
|
||
but not limited to memory disks,floppy disks,storage media) and
|
||
written material and documents relating to the use of the computer
|
||
system (including networking access files,documentation relating to the
|
||
attacking of computer and advertising the results of the computer
|
||
attack (including telephone numbers and location information.) This
|
||
affidavit is for the seizure of the above described computer and
|
||
computer data and for the authorization to read information stored
|
||
and contained on the above described computer and computer data
|
||
which are evidence of violations of 18 USC 2314 and 1030, as well as
|
||
evidence,instrumentalities or fruits of the fraud scheme being
|
||
conducted by the operator of the computer at that location.
|
||
|
||
Location to be Searched
|
||
|
||
26. On January 31, 1990 I was advised by S.A. John Lewis, USSS in
|
||
Baltimore that 7018 Willow Tree Drive in Middletown, Maryland
|
||
is a two-level split-foyer style house with an upper story
|
||
overhang on either side of a central indentation for the front door.
|
||
The front door is white. There is a driveway on the left side of the
|
||
house as you face the front. A mail box is situated on a post next
|
||
to the driveway and displays the number 7018.
|
||
|
||
27. Request is made herein to search and seize the above described
|
||
computer and computer data and to read the information contained
|
||
in and on the computer and computer data.
|
||
|
||
|
||
|
||
Special Agent TIMOTHY FOLEY
|
||
United States Secret Service
|
||
|
||
|
||
|
||
|
||
Sworn and Subscribed to before
|
||
me this 1st day of February, 1990
|
||
|
||
|
||
Clarence E. Goetz
|
||
United States Magistrate
|
||
|
||
|
||
********************************************************************
|
||
>> END OF THIS FILE <<
|
||
***************************************************************************
|
||
|
||
------------------------------
|
||
|
||
Date: Mon, 20 Aug 90 21:03 EDT
|
||
From: <DARKMAGE@PRECIPICE.UUNET.UU.NET>
|
||
Subject: What to Read When the SS is at the Door
|
||
|
||
********************************************************************
|
||
*** CuD #2.00: File 4 of 5: Cyber Reading List ***
|
||
********************************************************************
|
||
|
||
********************
|
||
Mr. Mage is our resident cyberczar, and he passed along the following list
|
||
of his favorite cyber-related books and games for those wanting more info
|
||
on what it's all about (J&G).
|
||
*********************
|
||
|
||
|
||
Cyberpunk Book List
|
||
|
||
"Remember, What was once science fiction usually ends up as science.."
|
||
|
||
Title Author
|
||
-----------------------------------------------------------------------
|
||
Johnny Zed Betancourt, John Gregory
|
||
When Gravity Fails Effinger, George Alec
|
||
The Long Orbit Farren, Mick
|
||
The Company Man Faust, Clifford
|
||
A Death of Honor Faust, Clifford
|
||
Cyber Way Foster, Alan Dean
|
||
Neuromancer Gibson, William
|
||
Mona Lisa Overdrive Gibson, William
|
||
Count Zero Gibson, William
|
||
Burning Chrome Gibson, William
|
||
Barking Dogs Green, Terrence M.
|
||
The Glass Hammer Jeter, K.W.
|
||
Farewell Horizontal Jeter, K.W.
|
||
Bad Voltage Littel, Jonathan
|
||
Armageddon Blues Moran, Daniel Keys
|
||
Emerald Eyes Moran, Daniel Keys
|
||
Yesterdays Pawn Quick, W.T.
|
||
Dreams of Flesh and Sand Quick, W.T.
|
||
Dreams of Gods and Men Quick, W.T.
|
||
Systems Quick, W.T.
|
||
Eclipse Penumbra Shirley, John
|
||
Eclipse Shirley, John
|
||
Little Heroes Spinrad, Norman
|
||
Other Americas Spinrad, Norman
|
||
Islands in the Net Spinrad, Norman
|
||
Mercedes Nights Weaver, Michael D.
|
||
Angel Station Williams, Walter Jon
|
||
Hardwired Williams, Walter Jon
|
||
Voice of the Whirlwind Williams, Walter Jon
|
||
|
||
These book are listed in alph order by author. Be careful since some
|
||
of these books are parts of a series and are not in order. ALSO, BEWARE
|
||
that these books deal with the genre of science fiction called Cyberpunk
|
||
and have been called questionable by the U.S. government.
|
||
|
||
Some Cyberpunk Roleplaying Games:
|
||
|
||
Cyberpunk by R. Talsorian Games Inc.
|
||
CyberSpace by I.C.E
|
||
ShadowRun by FASA Corp.
|
||
GURPS Cyberpunk by Steve Jackson Games
|
||
|
||
If you come across other Cyberpunk books or games not on this list,
|
||
please send a note to the CuD moderators and they will send it on to me.
|
||
Thanks.
|
||
|
||
Dark Mage
|
||
|
||
|
||
********************************************************************
|
||
>> END OF THIS FILE <<
|
||
***************************************************************************
|
||
|
||
------------------------------
|
||
|
||
Date: Thu, 23 Aug 90 00:48:21 EDT
|
||
From: Michael Rosen <CM193C@GWUVM.BITNET>
|
||
Subject: More on the NY Raids
|
||
|
||
********************************************************************
|
||
*** CuD #2.00: File 5 of 5: CU in the News ***
|
||
********************************************************************
|
||
|
||
|
||
"NY State Police Round up Hackers"
|
||
Computerworld, August 20, 1990, pg. 99, (by Michael Alexander)
|
||
|
||
The New York State Police rounded up 13 alleged computer hackers last week
|
||
- including a 14-year-old boy who is accused of breaking into a U.S. Air
|
||
Force computer at the Pentagon - and charged them with computer tampering
|
||
and computer trespassing.
|
||
|
||
The Hackers are suspected of altering some files and deleting others in a
|
||
mainframe computer at City University in Bellevue, Wash., according to
|
||
Donald Delaney, senior investigator and supervisor of the major case squad
|
||
at the state police barracks in East Farmingdale, N.Y.
|
||
|
||
The hackers allegedly used an 800 number to break into the computer, making
|
||
it easy to identify them, Delaney said. More than 40 hackers reportedly
|
||
broke into the system, but only those who allegedly spent "an extended
|
||
period of time," in the computer were arrested.
|
||
|
||
Eight of those arrested were juveniles, Delaney said. Police plan to
|
||
arrest three more hackers this week and "probably more" later, he said.
|
||
|
||
Police seized computers, modems and other gear used in the break-ins from
|
||
the homes of the 13 hackers.
|
||
|
||
Pentagon break-in
|
||
|
||
One of the hackers, a 14-year-old boy who used the handle Zod, is also
|
||
accused of breaking into a Unix-based superminicomputer at the Pentagon.
|
||
|
||
He is alleged to be a member of a hacker group called MOD, an acronym for
|
||
Masters of Disasters and Mothers on Drugs, among other appellations.
|
||
|
||
"The information gleaned from the computer is of unclassified,
|
||
administrative nature," said Major Steve Headley of the Air Force Base in
|
||
Washington, D.C. "However, the office of special investigations of the Air
|
||
Force is concerned primarily that the act was criminal in itself
|
||
and...while it was innocuous, unclassified stuff, in aggregate, over a long
|
||
period of time, it could have meaning or be perhaps sensitive." How and
|
||
why the break-in occurred remains to be determined, Headley said.
|
||
|
||
The arrests came after a two-month investigation by a number of agencies,
|
||
including the New York State Police, the Air Force Office of Special
|
||
Investigations and the U.S. Secret Service.
|
||
|
||
********************************************************************
|
||
|
||
------------------------------
|
||
|
||
**END OF CuD #2.00**
|
||
********************************************************************
|
||
|
||
|
||
|