Computer underground Digest Tue June 24, 1997 Volume 9 : Issue 49 ISSN 1004-042X Editor: Jim Thomas (cudigest@sun.soci.niu.edu) News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu) Archivist: Brendan Kehoe Shadow Master: Stanton McCandlish Shadow-Archivists: Dan Carosone / Paul Southworth Ralph Sims / Jyrki Kuoppala Ian Dickinson Field Agent Extraordinaire: David Smith Cu Digest Homepage: http://www.soci.niu.edu/~cudigest CONTENTS, #9.49 (Tue, June 24, 1997) File 1--Senate Votes to Block Bomb-Making Info File 2--PGP: Breaking the Crypto Barrier File 3--ACLU Cyber-Liberties Update, June 19, 1997 File 4--Notes from the Underground: 2 interviews with Se7en File 5--Cu Digest Header Info (unchanged since 7 May, 1997) CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION APPEARS IN THE CONCLUDING FILE AT THE END OF EACH ISSUE. --------------------------------------------------------------------- Date: Fri, 20 Jun 1997 16:13:32 -0400 (EDT) From: Thomas Grant Edwards To: fight-censorship@vorlon.mit.edu Subject: File 1--Senate Votes to Block Bomb-Making Info From WIRED news www.wired.com: Senate Votes to Block Bomb-Making Info by Rebecca Vesely 12:09pm 20.Jun.97.PDT The Senate has voted 94-0 to tack onto a Defense Department spending bill an amendment that would prohibit the distribution of bomb-making instructions in the United States. Although the word "Internet" is not mentioned in the four-page amendment, the legislation would outlaw Web sites, newspapers, zines, and books that publish instructions on how to make a bomb - such as The Anarchist's Cookbook and The Terrorist Handbook. Violators would face fines and prison sentences of up to 20 years. Sponsored by Senator Dianne Feinstein (D-California), who has been trying to get the legislation on the books since 1995, the amendment passed Thursday is narrowly written to include only the distribution of material that has an "intent to harm." ... [see the rest at www.wired.com] ------------------------------ Date: Fri, 20 Jun 1997 12:53:37 -0800 From: "--Todd Lappin-->" Subject: File 2--PGP: Breaking the Crypto Barrier Source - fight-censorship@vorlon.mit.edu An interesting wrinkle to this story... Last Wednesday, during the Bernstein hearing here in SF, a debate took place between the DoJ's lawyer and Judge Patel regarding the "publication" of source code in printed form vs. electronic form. The DoJ lawyer argued that the printed code was not considered much of a threat, because it is a laborious and time-consuming process to compile the code into software. The irony, of course, is that even as he was speaking to Judge Patel, the source code to PGP 5.0 was being scanned into computers in Holland. --Todd--> From Wired News: www.wired.com Breaking the Crypto Barrier by Chris Oakes 5:03am 20.Jun.97.PDT Amid a striking convergence of events bearing on US encryption policy this week, one development underlined what many see as the futility of the Clinton administration's continuing effort to block the export of strong encryption: The nearly instantaneous movement of PGP's 128-bit software from its authorized home on a Web server at MIT to at least one unauthorized server in Europe. Shortly after Pretty Good Privacy's PGP 5.0 freeware was made available at MIT on Monday, the university's network manager, Jeffrey Schiller, says he read on Usenet that the software had already been transmitted to a foreign FTP server. Ban or no ban, someone on the Net had effected the instant export of a very strong piece of code. On Wednesday, Wired News FTP'd the software from a Dutch server, just like anyone with a connection could have. A Commerce Department spokesman said his office was unaware of the breach. The event neatly coincided with the appearance of a new Senate bill that seeks to codify the administration's crypto policy, and an announcement Wednesday that an academic/corporate team had succeeded in breaking the government's standard 56-bit code. The software's quick, unauthorized spread to foreign users might have an unexpected effect on US law, legal sources noted. "If [Phil] Zimmermann's [original PGP] software hadn't gotten out on the Internet and been distributed worldwide, unquestionably we wouldn't have strong encryption today," said lawyer Charles Merrill, who chairs his firm's computer and high-tech law-practice group. Actions like the PGP leak, he speculated, may further the legal flow of such software across international borders. Said Robert Kohn, PGP vice president and general counsel: "We're optimistic that no longer will PGP or companies like us have to do anything special to export encryption products." The Web release merely sped up a process already taking place using a paper copy of the PGP 5.0 source code and a scanner - reflecting the fact it is legal to export printed versions of encryption code. On Wednesday, the operator of the International PGP Home Page announced that he had gotten his hands on the 6,000-plus-page source code, had begun scanning it, and that a newly compiled version of the software will be available in a few months. Norwegian Stale Schumaker, who maintains the site, said several people emailed and uploaded copies of the program to an anonymous FTP server he maintains. But he said he deleted the files as soon as he was aware of them, because he wants to "produce a version that is 100 percent legal" by scanning the printed code. The paper copy came from a California publisher of technical manuals and was printed with the cooperation of PGP Inc. and its founder, Phil Zimmermann. Schumaker says he does not know who mailed his copy. "The reason why we publish the source code is to encourage peer review," said PGP's Kohn, "so independent cryptographers can tell other people that there are no back doors and that it is truly strong encryption." Schumaker says his intentions are farther-reaching. "We are a handful of activists who would like to see PGP spread to the whole world," his site reads, alongside pictures of Schumaker readying pages for scanning. "You're not allowed to download the program from MIT's Web server because of the archaic laws in the US. That's why we exported the source-code books." Copyright 1993-97 Wired Ventures, Inc. and affiliated companies. All rights reserved. ------------------------------ Date: Thu, 19 Jun 1997 21:33:35 GMT From: "ACLU Cyber-Liberties Update Owner"@newmedium.com Subject: File 3--ACLU Cyber-Liberties Update, June 19, 1997 Setback in Efforts to Secure Online Privacy FOR IMMEDIATE RELEASE Thursday, June 19, 1997 WASHINGTON -- A Senate committee today setback legislative efforts to secure online privacy, approving legislation that would restrict the right of businesses and individuals both to use encryption domestically and to export it. On a voice vote, the Senate Commerce Committee adopted legislation that essentially reflects the Clinton Administration's anti-encryption policies. The legislation approved today on a voice vote by the Senate Commerce Committee was introduced this week by Senate Commerce Committee Chairman John McCain, Republican of Arizona, and co-sponsored by Democrats Fritz Hollings of South Carolina; Robert Kerry of Nebraska and John Kerry of Massachusetts. Encryption programs scramble information so that it can only be read with a "key" -- a code the recipient uses to unlock the scrambled electronic data. Programs that use more than 40 bits of data to encode information are considered "strong" encryption. Currently, unless these keys are made available to the government, the Clinton Administration bans export of hardware or software containing strong encryption, treating these products as "munitions." Privacy advocates continue to criticize the Administration's stance, saying that the anti-cryptography ban has considerably weakened U.S. participation in the global marketplace, in addition to curtailing freedom of speech by denying users the right to "speak" using encryption. The ban also violates the right to privacy by limiting the ability to protect sensitive information in the new computerized world. Today's committee action knocked out of consideration the so-called "Pro-CODE" legislation, a pro-encryption bill introduced by Senator Conrad Burns, Republican of Montana. Although the Burns legislation raised some civil liberties concerns, it would have lifted export controls on encryption programs and generally protected individual privacy. "Privacy, anonymity and security in the digital world depend on encryption," said Donald Haines, legislative counsel on privacy and cyberspace issues for the ACLU's Washington National Office. "The aim of the Pro-CODE bill was to allow U.S. companies to compete with industries abroad and lift restrictions on the fundamental right to free speech, the hallmark of American democracy." "Sadly, no one on the Commerce Committee, not even Senator Burns, stood up and defended the pro-privacy, pro-encryption effort," Haines added. In the House, however, strong encryption legislation that would add new privacy protections for millions of Internet users in this country and around the world has been approved by two subcommittees. The legislation -- H.R. 695, the "Security and Freedom Through Encryption Act" or SAFE -- would make stronger encryption products available to American citizens and users of the Internet around the world. It was introduced by Representative Robert W. Goodlatte, Republican of Virginia. "We continue to work toward the goal of protecting the privacy of all Internet users by overturning the Clinton Administration's unreasonable encryption policy," Haines concluded ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ACLU Cyber-Liberties Update Editor: Lisa Kamm (kamml@aclu.org) American Civil Liberties Union National Office 125 Broad Street New York, New York 10004 To subscribe to the ACLU Cyber-Liberties Update, send a message to majordomo@aclu.org with "subscribe Cyber-Liberties" in the body of your message. To terminate your subscription, send a message to majordomo@aclu.org with "unsubscribe Cyber-Liberties" in the body. ------------------------------ Date: Sun, 22 Jun 1997 19:30:57 From: Richard Thieme Subject: File 4--Notes from the Underground: 2 interviews with Se7en NOTES FROM UNDERGROUND AN INTERVIEW WITH SE7EN BY RICHARD THIEME At DefCon IV, the annual hackers' convention in Las Vegas this July, they called him "se7en." He's twenty-eight years old, an old man of the hacker scene, and he has just "come out" into the public eye after seventeen years underground. It's the second day of DefCon and Se7en has already given more than a dozen interviews to television crews. The attention is wearing him down. "Don't call me se7en," he said as we entered Spago's, an upscale restaurant in Caesar's Palace for dinner. "I don't want to be hassled." "What should we call you?" I said. "Nine?" Before he could answer, a young waiter approached our table. "Good evening. Are you all here for a convention? Yes, we said, opening our menus. The waiter leaned closer and said in a conspiratorial whisper, "I understand the elevators at the Tropicana [site of DefCon III] still don't stop at the right floor. The blueprints for the Monte Carlo [this year's hotel] disappeared two weeks ago. The management is in a panic." So much for anonymity. Waiters, taxi drivers, desk clerks -- everybody in Vegas knew DefCon was back in town. Why did se7en come out? Why did he leave the hacker underground and tunnel up at the age of twenty-eight into the bright lights of camera crews, the blank pitiless glare of the desert sun? "I'd been playing around with the idea of retiring for a long time. I wanted to come out before I retired. There are a lot of things I want to say, a lot of people I want to know -- I didn't have a game plan, exactly, but I wanted to be above ground for six months before I dropped out. At DefCon I wanted to meet a lot of people whose email addresses I had seen for years." ? Does it weigh on you, being underground? "It does, yes. It's very isolating. You don't quite know what else is going on out there, you feel like you're in your own little world, and as your world starts to fall apart, as mine did -- people going above ground, people retiring -- my world was getting a lot smaller. We needed new talent, more than the little group we had left, and I was getting older. I wanted to mentor some of the younger hackers. Help them the way others helped me." [In the world of hacking, a generation lasts about a decade. Many hackers go on to work as computer professionals in security, intelligence, or business. Participating whole-heartedly in the community of hackers, with its rigorous code of ethics, networks of mentors, and accumulated expertise, is often the only way to learn what no school knows how to teach.] "There's a lot to be learned from people, not just in the hacking underground, but life in general. In respect to the technology and the knowledge I had, it was limiting to relate to so few people. There were new things to learn, new perspectives - so much to get being out there and I was missing that. It was isolating." ? How old were you when you got into computers? "I was eleven when I got my first computer, a TRS-80. Seventeen years ago. First thing I did was play games. Remember, this was new to the entire world, and all you could do was play games at that point. I had no interest in programming then. The computer was a fancy expensive toy. It wasn't something to use to balance your checkbook or use as a communications device." ? When did you become aware of communications as a possibility? "About 1982, using an Apple IIe. I heard of modems, that you could use them to call up other computers and talk to them. That was exciting. I was into game cracking before bulletin boards. We were messing around with Apples with machine language, just screwing around with very little knowledge of what we were doing. We cracked our first game by accident. We started playing with different call registers, and next thing we knew, we had something. Copy protection was very simple then so it was not very impressive as a technical feat but when you're eleven years old and you cracked your first game and it was an accident on top of that ..." ? It was a power rush, wasn't it? "That's what it was. A power rush. There was a big apple computer store that opened then in my home town. It was mom-and-pop store, not a franchise or a chain. They hosted Apple clubs. One group talked about new hardware, another about software, arguing about language and coding, then there was a little circle of warez kiddies copying games they had cracked. We were a precursor to hacking groups, phreaking groups, 2600, No one thought of it as crime then. It was a new technology that was like a great big toy. The difference between cracking games, cracking programs and cracking systems was very little. They were all part of a big complex puzzle we wanted to solve. It was just a question of how big a chunk of the puzzle did you want to tackle? We wanted to break games, that's what was interesting to us then, Engineers wanted to break the whole system. They wanted to know everything about it. These were people that by every definition of the word were hackers. They never called themselves that, but they were going to get into that system, no matter what. The words that are feared today -- crackers, phreakers -- were never brought up in the press back then. The TRS-80. the apple IIe was still brand new to the world. Very few people had them,. It was not like Nintendo today where everybody gets one. They were expensive game machines. They were new and people didn't know quite what to make of them. The only people who really knew them were people who used them at work." ? When did you become conscious of yourself as a hacker or phreaker? "Not for many years. I had my own group of friends through bulletin boards or school, we were just doing our own thing. We never thought of ourselves as hackers or crackers or a conspiracy or the underground or trying to be elite. We thought of ourselves as friends. We kept to ourselves and didn't cause trouble. We never consciously thought of ourselves as hackers or crackers but in retrospect we fit the definition. We were our own little mini- software piracy ring. No one ever questioned photocopying something - obviously not defense secrets or corporate secrets, of course. But what we meant by "information wants to be free" is, we would email it to ourselves or send a friend a disk. In seventeen years of hacking I never made a cent until I made a speech this week." ? What kinds of speaking are you doing? "I define the various types and sub-types that the media labels hacker, cracker or phreaker. I describe the types of people in each group, their motivations, how they differ from one another, their ideologies." ? Do you discuss technique? "No, these [his recent talk was for engineers in a space program] are UNIX-heads. They know UNIX is inherently weak. One joke I heard when I came in was, "UNIX and security are an oxymoron." That made me feel good, because I knew I was talking to people who knew that you can't fix security in UNIX. The public is screaming, "Oh my god, hackers are getting in, they need to fix security," but they're clueless! UNIX is insecure, period. End of story. The engineers' concerns about security were twofold: (1) Their approach to security has been to be as obscure as possible. They wanted to be invisible. They had very few problems because their systems aren't even on the books. At this point, they don't exist. Now their program is about to get a lot of press and they will no longer enjoy obscurity, so they want to tighten their system up as much as possible. They know that some people will still get in, but if people are going to get in, it will only be people who are talented enough to do it. Not someone who accidentally got in or used a simple hole to get in. (2) When they do catch a person inside the system, how do they know what their intention is? The biggest fear of hackers and crackers everywhere is, what is their intention? You find one, you don't know what the hell they're doing and that scares the hell out of you. They felt a lot more comfortable after I told them the basic types of hackers. Now, they see someone in their system, they're more likely after a few minutes of tracking them to know who they are, what they're after, whether to worry about them or not. You can usually tell what a hacker's after from what they do when they get in. They start to look for directories like "nuke" and "secret" that might be a problem. But then again it might not. These guys knew the concept of "trophy-grabbing." There might be a kid who downloads the plans for a Stealth fighter to his computer and puts them on a diskette and throws it up on the wall. 'Hey, I got a trophy!' He isn't going to sell it to a spy. He wouldn't know who to sell it to if his life depended on it. To him, it's just, 'Hey, I got a copy of a stealth fighter sitting on my bookshelf!'" se7en was a well-known phreaker who knew his way around the telephone system. I asked how he got into phreaking. "My introduction to phreaking was being taken around by someone a few years older than me who said, hey, we're going to go dig in the trash of the telephone company. I was like, well what the hell for? He goes, 'Trust me. This will blow your mind.' Well, it did, it blew my mind for the next ten years. We went through the trash, and in my eyes, all we had was a bunch of paper. I was not impressed. But he was sorting them and saying, OK, these are good, these are bad, these are good. He was trying to get me interested in something I saw no interest in. I was young,. I was about fifteen years old. To me it was basically worthless, looking at a hunch of food and trash, and it wasn't until I went over to the guy's house the next night, and he says, remember these five or six pieces of paper I grabbed? He fires it up and boom! there we are, we're in the phone company. 'We're in the phone company?' Yeah, he said. I can do anything I want in here. He had found a dialup. He already knew quite a bit about the phone system. But he warned me, Don't be one of those punks or lusers that makes free phone calls. Learn how it works. Be one of the people who learns how it works. That was our goal: to understand how things work. The things we did used to be considered normal teenage behavior, remember, teenage pranks, Now it's a felony. Now you're part of a conspiracy. It's more complex today. Even if they don't send you to jail, they'll confiscate your equipment. They like to scare the hell out of you. You become an annoyance, they'll take your computers and you'll never get them back, no matter what you do. That's pretty good for knocking a lot of kids out. But it can have the opposite effect. Some people like the Legion of Doom or the other hackers that have gotten busted, the government did that to shut them up, but they all came back and they came back angry. The last thing the government needs is someone they don't understand coming back with an agenda. There were a lot of great discoveries through the years, but for me, the greatest was how I grew in knowledge and power in my own eyes. The giant telephone company and many of the all-knowing corporations really had very little clue as to what they were doing. The government, the all-powerful government -- starting wars, controlling your life -- did not have a clue as to what a computer is or what it can do. The realization that all these people that as a kid you're told to respect and fear, in a lot of ways you have it more together and are a lot smarter than many of these people.... It's a power rush, that's what it is. You find out there's absolutely nothing special about these people. Here you are, some little fifteen or sixteen year old kid, you can do things that the phone company can't even do, or the government can't even do. The phone company doesn't even know what you're talking about when you tell them something you've been doing for years. That's the greatest discovery. ? Today the real power belongs to people who have knowledge, who know how to do things. The others are hiding behind an illusion of power? Behind smoke and mirrors? Exactly. (c) Richard Thieme 1997. All Rights reserved Se7en: The Sequel Richard Thieme Se7en is out in the light and air now, up from seventeen years underground. He's one of the new variety of human being -- homo sapiens hackii -- who has learned from working with computers at every level, from code language to point-and-click, to think in ways that fit how computers organize information. Se7en is on the road now, delivering seminars to technicians about hackers -- how they think, how they behave. He works with organizations that are favorite targets of hackers because of their work or status. He speaks to groups of 30-50 people at a time, cross- disciplinary groups consisting of engineers, security personnel, administrators -- people who deal with the Internet on a daily basis. Naturally, they're concerned about security. On his first round of talks, he discussed basic security, making his clients aware of what's out there. He helped them distinguish hackers in search of trophies from thieves working for governments and businesses. On his second round of seminars, Se7en is focused on the details of security, the technical end. The technicians are set up in networks and shown how to scan their own services, searching their networks for security holes. "Basically we set up our own network of fifteen machines and taught them how to break root, showing them how easy it was with UNIX. It was important for them to get hands on experience, get the feel of it. We showed them how to grab a password file and run it through Crack. We introduced them to SYN flooding and explained the concept behind it. We showed them some of the scripts that are NOT available out there. We didn't launch an attack, because that would have been lethal, but we got them to the point from which they could launch it." They set up encrypted Internet sessions and ran them through the whole gamut of hacker behaviors. It was all hands-on, technical training. The engineers are learning a lot. They return to work more capable of securing their systems and also better equipped to talk to the managers who make decisions. Se7en believes as a result of his experience on the road that the hands-on technical people who work on the front lines of the Internet and understand it are seldom promoted into management positions where decisions are made. So managers often lack experience on the front lines. Because they don't deal with the issues on a day to day basis, they often don't understand the problems brought to them. Ironically that makes them hesitant to promote technical experts into management positions. They would leave no one to fix things when they break. Se7en is seeing similar problems at all of the places he visits. Most come from outsiders scanning the system, port- sniffing, testing for vulnerabilities. It's a big inconvenience. The systems operated by multi-national corporations or government organizations are immense, incorporating numerous protocols and computers. They're too complicated for fledgling hackers to penetrate as a rule. Even more experienced ones have trouble getting in. That means that the ones who do break through are seriously talented hackers. The ones to watch are the ones you never hear about. Se7en thinks hackers in the "visible underground" make an essential contribution to computing. He laughed at some of the conversation among technicians about firewalls, because he knows that systems always have holes. Hacking organizations such as the LOpht, TNo, and the Guild (the current publishers of Phrack Magazine) release UNIX security vulnerability scripts to the public all the time. Their research into SecurID's (a one-time password hardware product) and most recently, the SYN flooder script, have been devastating. Now they're looking into Windows NT. They promise results. These genuinely "elite" groups have friendly script wars with one another. They compete to see who can release the most scripts the fastest. The LOpht in particular has promised to put out five new vulnerability scripts per week. They accumulate scripts, waiting until they have about a dozen, then drop them in one big bombshell. Companies like Microsoft know, of course, that there are numerous holes in their operating systems, but don't know what they are. As applications are developed, working versions are periodically compiled for testers. The testers try to find as many bugs as they can, but the testing environment can never reveal the problems that will be found in the real world. A million people using Windows NT for a year will turn up bugs that a controlled environment will never find. Mainstream hackers keep the global network as clean and secure as it can be kept. It's a yin yang kind of thing. If hackers didn't know that and wanted to keep vulnerabilities from the companies themselves, they wouldn't release scripts publically through so many different loops. When the Guild discovered the SYN flood exploit and wrote the corresponding script for it, for example, they published it in Phrack, on the Internet, and in other magazines. That's not something a hacker would do if he's looking for a way to exploit the vulnerability. The Network, then, including the Internet, is the REAL testing environment, and that's where groups like the LOpht are performing a valuable service. Either the holes will be found by groups looking for them and making them public or they'll be found by more dangerous crackers working behind the scenes. Hard core crackers, engaging in serious crime and espionage, will not publish articles in 2600 or Phrack. That's why, Se7en says, you never hear of the people who do hard crime. When someone is forced to the surface, he says, it's always someone the underground has never heard of before. After years in the business, he knows the rosters as well as anyone. Se7en described an intrusion of a particular server in detail, then went on to discuss the organizational response. He was not surprised when they responded the way Se7en and his friends responded when someone tried to mailbomb their list. The organization asked them politely to stop their annoying activity, and when they didn't, they cut them off. The best way to respond to nuisance intrusions is the legitimate way. Try to reason with the intruders, then talk to the systems administrators in charge of the computers they're using. Most often, the sysadmins don't know what's going on, and once they find out, they shut them down. Se7en lived and worked in South Africa when he was younger and thinks the "official" (i.e. non-governmental) hacking scene is just coming alive. South Africans have not generally had wide access to the Internet or hacking publications, Now everyone has access to hacker web sites, but Se7en thinks most of those are a waste of time -- links to other sites, doctrinal positioning, and a lot of old warez for "warez puppies" to download and use without creativity or insight. Contrary to the image of hackers as anti- social, Se7en is keenly aware of the social systems that keep the flow of information free and open -- frequent hacking conventions, mailing lists, magazines, and the vast informal network of contacts. Some of the resources on the Net are useful, but the good ones are harder and harder to find. Se7en finds five or six useful web sites or mailing lists in a year, and he has to wade through a lot of garbage to get there. But that's no different, he acknowledges, than the hours he spent sifting through trash in rubbish bins. Persistence! he says, sounding like an experienced businessman. "Honestly, that's what it takes: Persistence. Doing it weekend after weekend after weekend, every Sunday night, going through the trash knowing that if you miss a week, that's the week when all the dial-ins for the switches are thrown away. Eventually you'll find some gold that you can use. The same thing goes for web searches. You have to wade through tons of garbage, but if you're persistent and just keep at it and at it and at it, eventually you'll find little gold nuggets here and there." He has been impressed with the increasing number of South Africans interfacing with the mailing lists. They're connecting with people who have been hacking ten or fifteen years, he cautions. Naturally, with only one or two years experience, they have a lot of questions. He understands where they are -- he remembers being there himself -- but has some advice for those who encounter flames when they ask too many questions or the wrong ones. Basic netiquette requires that you research thoroughly everything you can before you ask questions. RTFM. Read the fucking manual. Learn everything you can FIRST, and only when you're stuck, ask a question. Do your best to answer it yourself before putting it on a mailing list going to fifteen hundred people. Don't expect others to do your homework. Tell the list you tried to find the answer and couldn't. Don't just go out there saying, where can I find this or that? That's a sure way to get flamed. In the end, it comes down to people, not technology. Ultimately, Se7en says with a laugh, computer security is a hopeless pursuit. The Internet is just too big, too complicated, too specialized, for every system to be secure. Security is inconvenient, and inconvenience makes people uncomfortable. It's always a trade off between convenience and security. The moment you allow legitimate users onto a site from outside the system, you're doomed. All someone has to do is duplicate what that legitimate user is allowed to do. The weakest link in any chain is and always has been people. "You can have the most secure system in the world, and if I call up and pretend to be from the help desk and ask for your log-in password, and you give it to me, then the best security in the world won't help you. "If you don't know anything about computers, and don't know that the System Administrator never needs to know your password, how can you know if someone's conning you?" It comes down, Se7en says, to awareness and accountability - - managers who understand the real issues and insist on accountability throughout the system for knowledge about the network and procedures that must be followed. Without that, all it takes is a little "social engineering" and the most expensive firewall won't mean a thing. Richard Thieme ThiemeWorks ... professional speaking and business consulting: ThiemeWorks P. O. Box 17737 the impact of computer technology Milwaukee Wisconsin on people in organizations: 53217-0737 helping people stay flexible voice: 414.351.2321 and effective during times of accelerated change. ------------------------------ Date: Thu, 7 May 1997 22:51:01 CST From: CuD Moderators Subject: File 5--Cu Digest Header Info (unchanged since 7 May, 1997) Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are available at no cost electronically. CuD is available as a Usenet newsgroup: comp.society.cu-digest Or, to subscribe, send post with this in the "Subject:: line: SUBSCRIBE CU-DIGEST Send the message to: cu-digest-request@weber.ucsd.edu DO NOT SEND SUBSCRIPTIONS TO THE MODERATORS. The editors may be contacted by voice (815-753-6436), fax (815-753-6302) or U.S. mail at: Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115, USA. To UNSUB, send a one-line message: UNSUB CU-DIGEST Send it to CU-DIGEST-REQUEST@WEBER.UCSD.EDU (NOTE: The address you unsub must correspond to your From: line) Issues of CuD can also be found in the Usenet comp.society.cu-digest news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT libraries and in the VIRUS/SECURITY library; from America Online in the PC Telecom forum under "computing newsletters;" On Delphi in the General Discussion database of the Internet SIG; on RIPCO BBS (312) 528-5020 (and via Ripco on internet); CuD is also available via Fidonet File Request from 1:11/70; unlisted nodes and points welcome. In ITALY: ZERO! BBS: +39-11-6507540 UNITED STATES: ftp.etext.org (206.252.8.100) in /pub/CuD/CuD Web-accessible from: http://www.etext.org/CuD/CuD/ ftp.eff.org (192.88.144.4) in /pub/Publications/CuD/ aql.gatech.edu (128.61.10.53) in /pub/eff/cud/ world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/ wuarchive.wustl.edu in /doc/EFF/Publications/CuD/ EUROPE: nic.funet.fi in pub/doc/CuD/CuD/ (Finland) ftp.warwick.ac.uk in pub/cud/ (United Kingdom) The most recent issues of CuD can be obtained from the Cu Digest WWW site at: URL: http://www.soci.niu.edu/~cudigest/ COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted for non-profit as long as the source is cited. Authors hold a presumptive copyright, and they should be contacted for reprint permission. It is assumed that non-personal mail to the moderators may be reprinted unless otherwise specified. Readers are encouraged to submit reasoned articles relating to computer culture and communication. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Digest contributors assume all responsibility for ensuring that articles submitted do not violate copyright protections. ------------------------------ End of Computer Underground Digest #9.49 ************************************