Copy Link
Add to Bookmark
Report
Phrack Inc. Volume 07 Issue 50 File 15
.oO Phrack 50 Oo.
Volume Seven, Issue Fifty
15 of 16
PWN PWN PNW PNW PNW PNW PNW PNW PNW PNW PNW PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Compiled by disorder/alhambra PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Intro: As usual there are literally hundreds of interesting articles
that could be put here. I have tried to narrow the focus to
hacker/security related stuff only. Enjoy.
Sources: Access All Areas mail list:
echo "help" | mail majordomo@access.org.uk
CSP (run by Frosty):
Computer Underground Digest:
echo "subscribe cu-digest" | mail cu-digest-request@weber.ucsd.edu
Cyberwire Dispatch:
echo "subscribe" | mail cwd-l-request@cyberwerks.com
Defcon Stuff:
echo "subscribe" | mail majordomo@dis.org
Half a dozen other mail lists, elite people who forward me
neat shit, and various news type web pages.
Phrack World News #50 -- Index
01. Computer Attack Slows Service at New York Times' Web Site
02. [Chinese Hacker Convicted]
03. Phone 'Super Scanner' Alert
04. Computer Hacking Whiz Pleads Guilty To Electronic Break-And-Enter
05. Hackers release two upcoming U2 songs on Internet
06. Computer Crime Prompts New Parole Restrictions
07. [Evil Hacker SYN-Flood's WebCom]
08. German Police Seek 12 After Raids On Computer Gang
09. The tale of the Russian Hacker
10. Expert Warns Of Lax Security On Web
11. [Man pleads guilty to writing AOL hacking soft]
12. Hackers Hack Crack, Steal Quake
13. Hackers Sabotage Blair's Internet Image
14. Police looking into hacking of Government web site
15. Programmer Accused Of Breaking Into California State Contract Data
16. [Australian Phone Worker Rigs Radio Contest]
17. Hacker challenges `dark side' book
01. The 1997 Summer Security Conference
02. Hacking In Progress
03. Defensive Information Warfare And Systems Assurance
04. Second International Workshop on Enterprise Security
05. DEF CON V Convention Announcement #1.00 (02.26.97)
[=-------------------------------------------------------------------------=]
title: Computer Attack Slows Service at New York Times' Web Site
author:
source: The Wall Street Journal Interactive Edition
date: November 7, 1996
Numerous World Wide Web sites offering political information found
themselves overwhelmed by requests for election information from Tuesday
night. But the New York Times' Web site also had to deal with waves of
requests for access apparently generated by a computer hacker.
Nancy Nielsen, a New York Times Co. spokeswoman, noted that the attacks
-- which continued Wednesday -- only slowed the Times' computers, which
were still able to serve a record number of users on Tuesday.
The attack was similar to a September incident that virtually paralyzed
Public Access Networks Corp., or Panix, an Internet-access provider that
hosts nearly a thousand corporate Web sites. In that incident, a computer
hacker bombarded the service's computers with requests to send information.
Such attacks, presumably generated by malicious computer programs, work
by sending repeated requests -- sometimes more than a hundred per second --
seeking to establish a connection to send or receive information. The
requests contain fake Internet addresses, which the site's computers waste
valuable resources attempting to establish contact with. This process
prevents the computers from handling legitimate requests from Internet
users for access.
Such attacks are, in effect, similar to campaigns used by some activist
groups to flood a politician's switchboard with phone calls. So much time
is spent sorting out the bogus calls -- in this case, the hacker's false
requests for an electronic "handshake" with a site's machines -- that the
legitimate ones can't get through. The attacks can be differentiated from
heavy volume on a site because of the fake Internet addresses and the
regularity with which such requests come in.
Attacks such as the ones directed at Panix and the New York Times
underscore a key vulnerability of the Internet.
"This is the first major attack of a kind that I believe to be the final
Internet security problem," said William Cheswick, an Internet security
expert at the Bell Laboratories unit of Lucent Technologies Inc., in the
wake of the attack on Panix.
Mr. Cheswick, who assisted Panix during the attacks, said at the time
that while there had been a few previous reports of such incidents, the
Panix episode was the most severe.
Internet computers have no quick way of distinguishing a bogus request
for information from a real one, Mr. Cheswick noted. While upgrades to the
software controlling these computers could ease the problem, hackers could
respond with even more intensive attacks.
"There's going to be the usual arms race" between better security
measures and hackers, Mr. Cheswick predicts.
Panix tried to find the source of the attack by working backward through
the labyrinthine network of phone lines and specialized "router" computers
that form the Internet. But there is no easy way to trace such hackers, Mr.
Cheswick noted.
[=-------------------------------------------------------------------------=]
title: (none) [Chinese Hacker Convicted]
author: Magdalen Chow
source: South China Morning Post
Computer hacker who enjoyed free access to the Internet by using other
people's accounts was fined HK$125,000 (about US$16,000) in Hong Kong
Monday.
Judge Gareth Lugar-Mawson also ordered David Yip Shu-chew, 27, to pay
HK$40,400 in compensation to Hong Kong Star Internet Ltd. and HK$404
to one of the people whose accounts he had used.
The judge said he would not order Yip to pay the costs of approximately
HK$2.6 million incurred in the prosecution and investigation of the case,
but threatened him with jail if he misused the Internet again.
Yip is the first person to be charged with accessing a computer with
criminal or dishonest intent under the Crimes Ordinance.
[=-------------------------------------------------------------------------=]
title: Phone 'Super Scanner' Alert
source: The London Telegraph
date: 12th November 1996
Cellphone fraud, which already costs the British cellphone industry 200
million a year, is increasing because of a new device that makes it
easier than ever for criminals to "clone" phones, writes Aisling
Irwin.
The new "super-scanner" can soak up all the identification numbers of
vulnerable analogue phones within half a mile. Each phone contains two
numbers: its phone number and a secret verification code. When a call is
made, the phone transmits the two numbers to the nearest of a network of
base stations, which checks that the phone is legitimate before allowing
the call to go ahead.
Normally, thieves pick up the numbers as they are transmitted at the
beginning of each call. Until now, such thefts have been possible only
when victims are making calls - and stealing numbers has taken much
longer.
But the new technique, which is far more powerful, only requires mobile
phones to be switched on to obtain their identification numbers.
By sending out a signal identical to that of a real base station, the
super-scanner gets the cellphones to yield their numbers. These are
received by the scanner, passed to a computer and can then be programmed
into stolen phones.
According to the Federation of Communication Services, which represents
leading cellphone companies, the new technology has evolved over the
past few months. "Its impact is really being felt heavily," said a
spokesman. The FCS has launched a campaign to make the advertising,
sale, ownership or use of cloning equipment illegal.
Although the FCS says the technique cannot be used to clone digital
phones, New Scientist reported last week that criminals may be close to
cloning these as well. If so, the problem will be magnified because
these can be used abroad.
[=-------------------------------------------------------------------------=]
title: Computer Hacking Whiz Pleads Guilty To Electronic Break-And-Enter
ST. LOUIS (Nov 15, 1996 11:12 a.m. EST) -- A computer whiz deemed so
cunning he could control almost any computer system has accepted a plea
bargain for hacking his way into the secret files of two major
communications companies.
Christopher Schanot, 20, was linked to the Internet Liberation Front, a
group of hackers who have claimed responsibility for some high-profile
computer pranks and who decry the commercialization of cyberspace.
In exchange for a reduced sentence, Schanot pleaded guilty Thursday to
two counts of computer fraud and one count of illegal wiretapping. He
faces up to 15 years in prison and $750,000 in fines at his sentencing
on Jan. 31.
Prosecutors said Schanot broke into national computer networks and had
passwords to military computers, the credit reporting service TRW and
the phone company Sprint. They gave no indication he tried to profit
from his intrusion.
His hacking caused security breaches that companies said cost tens of
thousands of dollars to repair.
The break-ins took place between October 1994 and April 1995, when
Schanot was an honor student at a Catholic boys' school in suburban St.
Louis. He vanished after graduating in May 1995.
Authorities caught up with Schanot last March and arrested him at the
suburban Philadelphia apartment he shared with a 37-year-old woman,
Netta Gilboa, the publisher of Gray Areas. The magazine professes to
explore subject matter that is "illegal, immoral and/or controversial."
In April, Schanot was placed under 24-hour house arrest and ordered to
not even talk about computers.
Originally accused in a five-count indictment, he pleaded guilty to
charges surrounding break-ins at Southwestern Bell and Bellcore, a
communications research company owned by seven regional telephone
companies.
Mike Schanot said his son made the plea bargain only after prosecutors
threatened him with a wider range of charges.
[dis: You can find a wide variety of other article on Schanot. Check
your favorite search engine to find them.]
[=-------------------------------------------------------------------------=]
title: Hackers release two upcoming U2 songs on Internet
source: The Associated Press
LONDON - Hackers have distributed two unreleased U2 songs on the Internet,
possibly after tapping into computers at the Irish rock group's recording
studio, the Sunday Times said.
The songs, Discotheque and Wake Up Dead Man, have appeared on Internet sites in
at least four countries, the newspaper said. The songs are to appear on an album
scheduled for release in the spring.
Since their illicit appearance on the Internet, the songs have also been copied
onto compact discs, the Times said. The bootleg CDs are going for $10 at street
markets in Ireland and Britain.
"It is an infringement of our copyright," Marc Marot, managing director of
Island Records, told the Times.
Island Records did not immediately return calls for comment Sunday. The Sunday
Times said the record company is trying to shut down the Internet sites.
Conventional, low-tech theft of the songs has been ruled out, the newspaper
said.
Band managers are investigating the possibility that hackers tapped into
computers at U2's Dublin studio, it said. They may have gained access through
cables that have been feeding images of the band's recording sessions to an
Internet site maintained by Island Records.
Since 1981, U2 has sold 70 million records and grossed more than $1.5 billion.
[=-------------------------------------------------------------------------=]
title: Computer Crime Prompts New Parole Restrictions
WASHINGTON (Dec 17, 1996 07:42 a.m. EST) -- The U.S. Parole Commission
has approved restrictions on the use of computers by certain high-risk
parolees.
The Justice Department announced Monday that the panel voted this month
to authorize such restrictions as requiring certain parolees to get
prior written approval from the commission before using an Internet
service provider, computerized bulletin board system or any public or
private computer network.
Other restrictions would: prohibit particular parolees from possessing
or using data encryption programs, require some parolees to agree to
unannounced inspection of computers by probation officers, require some
parolees to compile daily logs of computer use or to pay for equipment
to monitor their computer use.
"Unrestricted access to the Internet and other computer online services
can provide sophisticated offenders with new opportunities for crime and
criminal associations," said Edward F. Reilly Jr., commission chairman.
"We cannot ignore the possibility that such offenders may be tempted to
use computer services to repeat their crimes."
The commission noted a surge in "how-to" information on child
molestation, hate crime and the illegal use of explosives available on
the Internet and on computer online services.
[=-------------------------------------------------------------------------=]
title: (none) [Evil Hacker SYN-Flood's WebCom]
SAN FRANCISCO - The FBI says it is investigating charges that sabotage
caused a 40-hour outage last weekend on Web Communications, (WebCom) a
Silicon Valley service hosting 3,000 World Wide Web sites.
WebCom said it believes a hacker using a college computer network in
British, Columbia, Canada, flooded its server in San Jose with
requests for connections from phony addresses. It said the attack
ended Sunday after MCI Net, a unit of MCI Communications, blocked
telephone traffic between WebCom and CA-Net of Canada at the request
of WebCom and its local service provider.
WebCom Executive Vice President Thomas Leavitt said the sites the
company hosts were unreachable much of Saturday Dec. 14 and Sunday
Dec. 15, causing customers, some of who operate retail sites, to
suffer "extensive" damages,
"One customer said he lost about $20,000 in revenue due to a special
event that was not able to occur. Others said they lost business on
one of the busiest shopping weekends of the year," Leavitt said.
WebCom said the incident was due to a common type of Internet sabotage
known as "denial of service" or "SYN flood," in which a computer
hacker jams a server with requests for connections from addresses that
do not exist. These types of attacks are easy to carry out and hard to
trace, Leavitt said.
"You can fake where the messages are coming from," Leavitt said, and
almost any with access to the Internet and some technical
sophistication can do it.
Others in the industry have experienced similar attacks, WebCom said.
Public Access Networks of New York City experienced a SYN flood attack
in September.
WebCom, headquartered in Santa Cruz, said its own investigation helped
by three Internet service providers traced the origin of the flooding
message to a computer on a college network in British Columbia linked
to BC-Net, a local Internet service provider there.
Leavitt said that a network administrator at Malaspina
University-College in Nanaimo, British Columbia, has identified the
computer used for the sabotage and that it was broken into by someone
without authorized access to that computer or to the college network.
The individual has not been identified.
FBI spokesman George Grotz said that the FBI is working with the
information tracing the requests for connection to British Columbia
but noted the actual perpetrator may nothing to do with the college or
BC-Net. "BC-Net may just be another link in the case," he said.
The FBI has jurisdiction over such cases under Title 18 section 1030,
which deals with falsely perpetrating denial of service on a computer
network.
Leavitt said if the industry, or specifically Internet service
providers, adopt certain "source filtering" coding they can prevent
people from using one network to send messages that appear to come
from somewhere else.
The U.S. Department of Energy's Computer Incident Advisory Capability
has an advisory warning about SYN Floods.
[=-------------------------------------------------------------------------=]
title: German Police Seek 12 After Raids On Computer Gang
MUNICH, Germany (Nov 28, 1996 3:36 p.m. EST) - European police are
seeking 12 members of an international computer chip counterfeiting gang
that was smashed this week in Germany and nine other countries, Bavarian
law officials said Thursday.
The raids, part of an operation code-named "Goldfish," resulted in the
arrest of 12 others suspected of selling counterfeit Pentium chips and
pirated software programs as well as fraud, money-laundering and tax
evasion, Bavarian prosecutor Hubert Vollmann told a news conference.
Police did not release the names of the suspects.
The highly-organized ring specialized in smuggling old Intel Corp
Pentium chips into Europe and selling them as new, Vollmann said. It
also sold illegal copies of Microsoft Corp programs and counterfeit
Hercules graphics adapters, he said.
Vollmann said the ring caused damages of several millions of dollars in
lost sales.
Tuesday and Wednesday, more than 2,000 law enforcement officals
confiscated "truckloads" of files, computer disks and equipment in
Germany, France, Italy and Belgium, he said.
The raids centered on offices and apartments near Munich in southern
Germany, and in the state of North Rhine-Westphalia, Vollmann said.
Three Germans and five Asians were arrested in Germany. Four other
arrests were made in France.
The raids were the culmination of a three-year probe that began when a
Laotian businessman reported he was robbed of almost $20,000 in 1993. He
came under suspicion after two of his attackers told police they had
robbed him of 500,000 marks.
A series of unusually large bank transactions by the man's companies led
to an investigation into tax evasion and money laundering, police said.
In addition to the 12 individuals under arrest and the 12 still at
large, 16 others were arrested in the raids on charges unrelated to chip
counterfeiting, Vollmann said.
The chip counterfeiting ring operated a multi-tiered organization that
bought used 133-megahertz Pentium chips in Asia and retouched them in
Hong Kong to look like new 166- megahertz processors, Vollmann said.
The group shipped the chips to Europe by courier to avoid customs and
taxes, and sold them to personal computer companies, he said.
[=-------------------------------------------------------------------------=]
title: The tale of the Russian Hacker
Everyone wants to know how Vladimir Levin did it, writes Hugo Cornwall.
In mid-1994, as a 26-year-old computer scientist in St Petersburg, he is
supposed to have led a gang that hacked into Citibank in New Jersey, and
organised more than 40 wire transfers from customer accounts. Russia's
Mafia is said to have been involved.
Levin is still denying his involvement and, for the past 21 months, he
has been in prison in south London, fighting extradition. On Sunday, he
speaks for the first time to Channel 4's Equinox programme.
Could Levin really be living proof of the "professional hacker" so often
celebrated in movies, books and lurid conference presentations? Is he
a product of a KGB school of super hackers now turned loose on the
world as part of Russian criminal enterprise? If that turned out to be
true, it would delight the information warriors, the cyber-SWAT teams
set up by the US armed forces whose most recent claims on federal
budgets have been on the basis of threats to the global information
infrastructure. Equally pleased will be the platoons of consultants,
the sales forces of computer companies and the organisers of high-
price exclusive conferences.
Equinox tells a different story. The programme's researchers found a
Russian "recreational" hacker group called Megazoid. The Citibank fraud
because a group of hackers worldwide compiled files on the VAX/VMS
operating system, and some Russian hackers found a Citibank computer
with which they could play and use as a free jumping-off point to
other computers. One of them says that, for $100, he sold details to
Levin and his friends who ran a computer import/export business. In
reality Levin appears to have been an average-ability programmer
with entrepreneurial ambitions.
The Citibank fraud was possible only because of a number of coincidences -
poor security management, a group of Russian hackers getting lucky
and their information falling into the hands entreprenurs with the
right connections. This is the pattern of much computer crime.
[=-------------------------------------------------------------------------=]
title: Expert Warns Of Lax Security On Web
SAN FRANCISCO - An outspoken computer security expert, citing his
just-completed study, says up to two-thirds of certain Web sites,
including reputable institutions like banks and the media, are
vulnerable to hacker attacks.
Dan Farmer -- who stirred controversy in 1995 as co-author of software
dubbed SATAN that enables people with basic skills to infiltrate
computer systems -- surveyed more than 2,200 Web sites.
The survey released last week covered a relatively small portion of
the sprawling Web but focused on sites where security is more of a
concern.
Farmer probed 660 bank sites around the globe, 312 North American
online newspaper sites, 274 credit union sites, 47 U.S. federal
government sites and 451 Internet sex clubs.
In a summary, Farmer said that, out of his sample of about 1,700 Web
sites he selected, "over 60 percent could be broken into or
destroyed." As a control, he probed a random sample of 469 sites.
Farmer said he used relatively crude, non-intrusive methods and did
not actually break into the sites. He also said he would not publish
the names of the sites he surveyed.
"I barely electronically breathed on these (computer) hosts," he said
in his report, adding that, considering more intrusive tests, some 70
percent to 80 percent of sites may have security flaws.
Other computer security experts found Farmer's results credible and
authoritative, David Kennedy, director of research, education and
consulting at the National Computer Security Association, said in a
telephone interview.
Experts and computer industry executives said the study shed more
light on a problem well known within the industry but insufficiently
understood by the public at large.
The threat of hacker attacks was highlighted earlier this year when
intruders broke into the Justice Department and Central Intelligence
Agency Web sites and altered them, prompting the CIA to close its site
temporarily.
Farmer stressed that Web sites are being used primarily for marketing
and advertising purposes and that, although some bank sites may allow
visitors to look up balances, the sites do not provide access to
internal financial systems.
Deborah Triant, president of CheckPoint Software Technologies' U.S.
operating unit in Redwood City, Calif., said banks routinely keep Web
sites on separate computer systems.
"Our experience is the banks are so paranoid that they won't even
allow the access that they should be able to allow and would be quite
safe if you had a modern firewall" protecting their networks from
intruders, said Triant, whose company is the market leader in firewall
technology.
"So, if their Web site is vulnerable, that doesn't mean that anything
else at the bank is vulnerable, or that their customers' accounts or
the transactions their customers are doing are vulnerable," she said.
Nevertheless, with the advent of electronic commerce over the Internet
expected to gain momentum in 1997, lax security remains a critical
issue, experts said.
Farmer separated security flaws into two categories -- a red category
where he said a site was "essentially wide open to any potential
attacker" and a yellow category deemed less serious but with potential
for disastrous consequences.
Of the 660 bank sites, 68 percent were deemed vulnerable and nearly 36
percent were in the red category.
Some 51 percent of credit unions were vulnerable, 62 percent of the
federal sites, nearly 70 percent of newspapers and 66 percent of sex
clubs. Sites in the red category ranged from 20 percent for credit
unions to 38 percent for federal sites and 39 percent for online
newspapers.
Of the random sample of 469 Web sites used as the control, a far
smaller percentage -- 33 percent -- were found to be vulnerable, and
17 percent of the group was in the red category.
Farmer said part of the problem is that Web sites are trying to do too
much at once, increasing their complexity and making security far more
difficult to achieve.
But, even with security concerns, credit card transactions over the
Net are much safer than those carried out in shopping malls, said the
security association's Kennedy.
Farmer also said he plans to incorporate some newer testing tools into
a new version of SATAN, which stands for Security Administrator Tool
for Analyzing Networks, early next year.
The program enables people who manage corporate networks to locate
weaknesses and fix them. But it has been controversial because it can
also easily be used by malevolent intruders trying to cause damage.
Triant said there have been no reported security breaches at any of
the more than 15,000 institutions with CheckPoint network security
installed and said such precautions should provide adequate
protection.
[=-------------------------------------------------------------------------=]
title: (none) [Man pleads guilty to writing AOL hacking soft]
source: Reuters World ReportJanuary 8, 1997 14:55:00
WASHINGTON, Jan 8 (Reuter) - A Yale University student pleaded guilty
Wednesday to committing computer fraud for developing a programme that
allowed him to use America Online Inc. without paying, the Justice Department
said.
Prosecutors said Nicholas Ryan, 20 of Victor, New York, entered the
guilty plea at a federal court hearing in Alexandria, Virginia. He faces
up to five years in prison and a $250,000 fine at sentencing, scheduled at
the end of March.
Prosecutors said Ryan in June 1995 developed the programme, called
"AOL4FREE," and frequently used it through December 1995, avoiding having
to pay the firm's rate of $2.95 per hour.
Ryan, who identified himself as "Happy Hardcore," also made the
programme available to other America Online users, and it circulated within
AOL chat rooms, prosecutors said.
As the company made changes to stop the use of the programme, Ryan
modified it and made the updated version available to other online service
users, the prosecutors said.
They said the heaviest use of the programme took place from September
through December 1995. America Online estimated that on a single day
individuals using the programme logged onto the system about 2,000 times,
the prosecutors said.
The case was brought by the U.S. Attorney's office and the Justice
Department's computer crime section.
[=-------------------------------------------------------------------------=]
title: Hackers Hack Crack, Steal Quake
author: Annaliza Savage
8:00 pm PST - Hackers broke into the Web server and file server of Crack dot
Com, a Texas gaming company, on Wednesday, stealing the source code for
id's Quake 1.01, as well as Crack's newest project, Golgatha, and older games
Abuse and Mac Abuse.
Although the hackers left a trail that may make them easy to track, the
theft did its damage. "Quake's raw engine market value dropped several
hundred thousand dollars," said Dave Taylor, who formed Crack dot Com
after leaving id Software, where he worked on Doom and Quake. But Barrett
Alexander of id denies that the financial loss will be so great, saying
that the code for Quake's unique engine is recognizable, making it hard
for anyone to be able to use without id's knowledge.
Crack dot Com is also worried that its unreleased techniques, developed for
Golgotha, could make their way into the hands of other game competitors, who
could copy bits of code into their own software.
The hackers, who were able to get through the Crack's firewall, left intact a
bash-history file that recorded all their movements. They even logged onto
IRC's #quake to brag about their exploits, and made Quake's source available
on Crack dot Com's homepage (it is no longer there).
The hackers, who identified themselves as being from the group FEH,
probably broke through Crack's firewall through their Web site. The former
editor of the now defunct hacker magazine FEH denies any knowledge of the
event, and has already posted a disclaimer.
[=-------------------------------------------------------------------------=]
title: Hackers Sabotage Blair's Internet Image
author: Robert Uhlig, Technology Correspondent
source: The Telegraph
date: 10th December 1996
The Labour Party has called for a police inquiry after computer hackers
made repeated attacks on its Internet site, replacing a picture of Tony
Blair with his Spitting Image puppet and headlining the site with "New
Labour - Same Politicians. Same Lies".
A group of British hackers, calling itself the Digital Anarchists,
infiltrated the Labour publicity site for the second time yesterday and
said it would continue to attack the Labour Web site this week. "We're
going to keep doing it again and again until further notice. And we're
going to hit some other sites as well," a spokesman for the group said
last night.
The hackers later infiltrated the Labour site a third time, while
computer experts were attempting to rectify the second attack. The Web
site has now been closed until future notice to prevent more further
embarrassing alterations of its content.
It is believed that the hackers will attack other political parties
including the Conservatives, Liberal Democrats, Scottish National Party
and Plaid Cymru. Internet sites belonging to other public organisations,
blue-chip companies and newspapers may also be affected.
The first attack, which promised free drugs and beer to young voters,
was made on Saturday while the British hacker community was staging a
Christmas party in Manchester.
The Labour leader's response to the Budget was replaced with a live sex
show of women wearing the "demon eyes" masks seen in the Tory
advertising campaign. The hackers also changed the title "The road to
the Manifesto" to "The road to nowhere" and altered links to other parts
of the site so they read "The Labour Party sex shop".
[=-------------------------------------------------------------------------=]
title: Police looking into hacking of Government web site
author: Adeline Goh
source: The Straits Times
date: Dec 10 1996
POLICE are investigating how the Singapore government's Web site on the
Internet was modified without authorisation.
In the incident on Sunday, someone replaced the site's contents with a
list of more than 100 user identities (IDs) of people from various
government bodies.
Yesterday, the Commercial Crime Division (CCD) of the Criminal
Investigation Department told The Straits Times that three officers from
its computer crime team had started work on the case.
It added that the first step would be to trace the identity of the hacker
by checking the log files of the computer in which the Web site is housed.
These log files keep track of people who access it.
The web site -- at http://www.gov.sg -- is the on-line version of the
Singapore Government directory and has links to the Web sites of various
bodies such as the ministries.
The original contents of the site were restored by the National Computer
Board (NCB) on Sunday afternoon. When contacted yesterday, NCB, which
maintains the computer that houses the Web site, said that the hackers did
not gain access to any government networks which contain sensitive data.
It added that the computer where the Web site was stored did not contain
sensitive information.
It declined to give further details about the incident, saying that it had
referred the matter to the CCD.
Several computer experts contacted yesterday said that electronic networks
could be broken into with special computer programs.
They are placed into a network by hackers and they capture a user's log-in
password, which can then be retrieved.
Those contacted added that passwords which are proper English words were
easy for hackers to crack.
This is because there are also programs which try to log on by trying
words found in English dictionaries.
One of the experts, Mr A. I. Chow, 32, a partner in a computer firm, said
perpetrators could even impersonate computer system administrators and ask
a particular user on the network to change his password to one supplied by
them. "When the user changes his password, the hacker can then access the
network easily with the user's account."
Those contacted said data on Internet computers could be made more secure
if system administrators allowed Web pages to be updated only during
certain times or from computers within an organisation.
Security could also be improved, they said, if passwords were generated
randomly and refreshed constantly.
[=-------------------------------------------------------------------------=]
title: Computer Programmer Accused Of Breaking Into California
State Contract Data
SACRAMENTO, Calif. (Jan 17, 1997 00:36 a.m. EST) -- The Bay Area
computer programmer who was arrested for hacking into the state
Department of Information Technology computer system tapped into
confidential information dealing with nearly a half million dollars
worth of government contracts, court records show.
David Ernesto Salas of Alameda, who faces four years in prison,
allegedly told others he had obtained confidential communication between
a contractor and department officials and he was going to use it in a
lawsuit against the department, said documents on file in Sacramento
Superior Court.
Salas, 34, who is free on $50,000 bail, was arraigned Tuesday in
Sacramento on three felony counts of computer hacking, including one
count which alleges he attempted to destroy the department's computer
system after his hacking was discovered.
Although some data was lost in the crash and the department's computer
system was down for two days in September, nearly everything has been
re-created by a backup computer system. Damage was estimated about
$10,000, officials said.
The incident, however, has been an embarrassment to department officials
and is viewed with concern because Information Technology oversees $2.2
billion in computer projects throughout state government.
The department was established last year after a series of audits and
investigations showed that millions in public funds were wasted on
bungled state computer projects.
Kenneth Keller, Salas's San Francisco attorney, has said his client, who
was a subcontractor hired to develop and install the department's
computer system, will eventually be vindicated.
Keller, who couldn't be reached for comment Thursday, said last week
that Salas had permission to be using the computer.
But according to court documents, Salas lost his authority to access the
computer when he lost his contract after a dispute with another
contractor in August. Beginning shortly before 11 p.m. Sept. 25 and into
the following day, Salas gained access to the department's computer. To
this day, it is not known exactly what he did once he entered the
system.
The backup computer, unbeknownst to Salas, did capture a trail of
changed passwords that led to the highest administrative level, giving
Salas full access to the entire computer system, documents said.
"Electronic mail (E-mail) regarding state service contracts worth
approximately $400,000 between (a contractor) and DOIT resided on the
DOIT system," said a summary of the facts in the case prepared for
Salas's arrest.
Special Agent Fred Adler of the Sacramento Hi-Tech Crimes Task Force,
which arrested Salas, said Thursday the case is still under
investigation and another arrest is possible.
In his affidavit for the search warrant, Adler said on Sept. 9, Salas
told Information Technology deputy director and chief counsel Alexis
Schatten that he had contacted an attorney to initiate a lawsuit against
a competing contractor for slandering him and other subcontractors.
Adler said there were witnesses who had seen Salas "bringing up
privileged information on (his computer) screen" and that Salas had
"alluded" to others that he possessed confidential information about
Information Technology's business dealings, court records show.
Department officials told investigators that "numerous confidential
communications exist on the their system relative to procurement,
installation and maintenance of multi-million dollar, state computer
systems," the affidavit said.
"Knowledge of these communications could prove to be financially
advantageous to firms involved in these processes," the affidavit said.
Rich Halberg, department spokesman, declined to comment on the search
warrant out of fear it might jeopardize an ongoing prosecution and
investigation.
He did say, however, that the department computer system does not
contain actual contracts, but he did say that there may be E-mail
pertaining to such contracts.
"We are doing the right thing by going after this guy," Halberg said.
"It is all too common in large companies and government to not want to
go after the hacker because it is difficult to prove. Hopefully, this
guy won't be in a position to do this again to another government
agency," Halberg said.
[=-------------------------------------------------------------------------=]
title: (none) [Australian Phone Worker Rigs Radio Contest]
source: COMTEX Newswire
date: 12/10/96 7:48 PM
SYDNEY, Dec. 11 (UPI S) -- An Australian telephone company worker who won
$50,000 Australian (U.S. $40,000) in a radio station's phone-in
competition has been charged with fraud after allegedly hacking into the
phone line. Brian Ronald Francis, who police say used his expertise to
ensure he was the 10th caller in the competition, has also been charged
with two more offenses relating to two other radio competitions he won
this year.
[=-------------------------------------------------------------------------=]
title: Hacker challenges `dark side' book
author: Simson Garfinkel
Special to the Mercury News
KEVIN Poulsen was one of the most talented "dark side hackers" ever to
phreak a phone call.
For more than two years, Poulsen lived the life of a fugitive as part
of the seedy Los Angeles underground. He made money by reprogramming
Pacific Bell's computers for pimps and escort services, re-activating
old telephone numbers and building a voice-mail network pairing
prostitutes with their johns.
And he cleaned up by messing with the phones used by Los Angeles radio
stations, rigging their call-in contests so that he would always win
the big bucks or the car.
But Poulsen got caught and he spent more than five years in jail.
Behind bars in 1993, Poulsen did what any phone phreak would do: He
picked up the pay phone and started making collect calls. But these
calls where different: they went to Jonathan Littman, a journalist in
Mill Valley who had just published a magazine article about Poulsen's
crimes and exploits and was about to write a book on the same topic.
Poulsen wanted to make sure that Littman got the story right. He felt
that Littman had made a lot of mistakes in the magazine article.
Today, Poulsen feels somewhat betrayed by the journalist to whom he
gave total access. After reading an advance copy of Littman's book,
Poulsen says Littman has twisted the truth in order to make a more
compelling story.
"Most of my complaints about Littman's book are small things," said
Poulsen, who is on parole and living in Sherman Oaks, a Los Angeles
suburb. "He has major events right but then he changes the meaning of
them by changing minor events and making up quotes."
Littman stands by his work.
The book, "The Watchman: The Twisted Life and Crimes of Serial Hacker
Kevin Poulsen," is due to be published next month by Little, Brown and
Co. It's an insider's look at the world of a criminal computer hacker,
one of the most detailed yet published.
"He was one of the first to hack the Internet and get busted for it,"
said Littman, referring to Poulsen's 1984 arrest for breaking into
university computers on the ARPAnet, predecessor to today's Internet.
"They decided not to prosecute him because he was 17" when he was
arrested, Littman said. Instead, Poulsen was hired by a Silicon Valley
defense contractor. "It was every hacker's dream -- to commit a crime
and instead of going to jail, to get a job with what was a top think
tank and defense contractor," Littman said.
Soon, however, Poulsen was back to his old tricks -- with a vengeance,
according to the book. He started physically breaking into Pacific
Bell offices, stealing manuals and writing down passwords. Much of
what he found went into a storage locker. But Poulsen couldn't handle
his finances, and got behind in his rent. When the locker company
broke open Poulsen's lock his stash was discovered and a trap was
laid. As the FBI closed in, Poulsen left town, a fugitive on the run.
Guilty plea
He was caught June 21, 1991, and spent nearly three years in pre-trial
detention. On June 14, 1994, in federal court in Southern California,
he pleaded guilty to seven counts of computer fraud, interception of
wire communications, mail fraud, money laundering and obstruction of
justice. He was then transferred to Northern California to face a
spying charge, based on his possession of material the government
called classified. He pleaded guilty to fraud, possession of
unauthorized access devices and fraudulent use of a Social Security
number, and was released June 4, last year.
The Watchman is Littman's second book on the computer hacker
underground. His first, "The Fugitive Game," followed the exploits of
hacker Kevin Mitnick, who was on the run and eventually caught by
computer security expert Tsutomu Shimomura and New York Times reporter
John Markoff. Shimomura and Markoff wrote their own book describing
the chase, and they both objected to Littman's version of the events.
For his part, Poulsen seems most angry about the implication of the
new book's title -- that he was somehow obsessed with eavesdropping
and largely acted alone.
Only two wiretaps
In the book, Littman has Poulsen listening to dozens of conversations
-- even wiretapping the telephones of people trying to sell used
equipment through newspaper classified ads, to see if they are being
honest with their prices.
Poulsen insists that he wiretapped the telephones of only two people:
another hacker who was also an FBI informant and his high-school
girlfriend.
"He also reports that I obsessively followed the details of every
escort date, including details of the tricks," Poulsen says, among
other complaints. "He made that up. Totally made that up."
Littman denies making up quotes, and insists that everything in the
book was told to him by one of the participants.
"I've written a book about a very complicated story about
controversial people who had very different versions of what
happened," Littman said. "I've done the best I can to view them
objectively. Somebody else might view them differently, and the
participants obviously have a subjective perspective. My views are in
the book."
But Poulsen says that Littman's fundamental premise is flawed. "John
had a problem in writing this book," Poulsen said. "He wanted to sell
it as the troubled loner-hacker-stalker guy. The problem is I had five
co-defendants and it is hard to portray someone as a troubled loner
when you have five other people making it happen."
Not a loner
Ron Austin, Poulsen's friend and co-conspirator, agrees. "Littman has
to write an interesting book, I guess," he said. "He downplays the
role of a lot of people, but I think that's because he is writing a
book about Kevin. My role is downplayed." Austin also said the role of
Justin Petersen, a hard-rocking hacker and co-conspirator is
underplayed.
Austin, also on parole, said he is concerned that the controversy
regarding Littman's portrayal of Poulsen might obscure some of the
more important issues raised by Littman's book: That the FBI engaged
in widespread wiretapping of foreign consulates in the San Francisco
area, the FBI's apparent hiring of an informant to commit illegal acts
on the agency's behalf, and that the FBI's apparent ability to decrypt
files on Poulsen's computer that had been encrypted with the
U.S. government's Data Encryption Standard, a popular data-scrambling
algorithm.
The FBI office in Los Angeles declined to comment on the Poulsen
case. A representative of the FBI's Washington office said, "We
normally do not comment on books that are coming out until we have had
an opportunity to review the book."
As a condition of his plea bargain, Poulsen is prohibited from
discussing FBI wiretaps.
Littman said he feels "lucky as a writer to have been able to spend
some time with Poulsen and these other characters in the story."
"One thing about Poulsen is he really had a very highly developed
ethical model that he believed in," Littman said. "He found it
challenged by his circumstances and the people he associated with. I
found it fascinating to see how he resolved this age-old computer
hacker ethic with a changing world."
Cellular Code-breakers Blame Standards Process
577 Words
4312 Characters
04/03/97
TR Wireless News
Copyright (c) 1997 BRP Publications, Inc.
Computer scientists claim they have demonstrated how to break the
industry-standard code that encrypts cellular phone calls-a discovery
they termed "a setback to the U.S. cellular telephone industry." The
code-breakers included Bruce Schneier of Counterpane Systems, a
Minneapolis consulting firm, and graduate student David Wagner of the
University of California at Berkeley.
They criticized the wireless industry's technical standards-setting
process for establishing what they consider a weak standard, and they
attacked the government for "hamstringing emerging cellular security
technology." Release of their announcement and academic paper was timed
to coincide with congressional hearings on encryption policy.
The researchers' press release observes that the digital cellular
system uses encryption to "scramble voice communications." Their paper,
Cryptanalysis of the Cellular Message Encryption Algorithm (CMEA),
concerns cellular phone keypad entries, but not voice conversations. Mr.
Schneier told TRWN that the digital cellular voice encryption standard
is "so incredibly vulnerable" to decryption that it was "not worth
writing about." The voice standard's fundamental code was broken by the
"Union Army in the Civil War," he added.
The researchers didn't challenge either the subscriber
"authentication" or the "fingerprinting" antifraud procedures now common
in the cellular service. Authentication and fingerprinting technologies
"are not compromised by the cryptography announced today," according to
the Cellular Telecommunications Industry Association.
The technical paper describes a cryptographic "attack" on the CMEA.
Such an attack, in practice, would require analysis of data recovered
from recorded calls, received on radios capable of decoding digital
cellular transmissions. Such radios aren't easily available; the common
"scanner" can't receive them.
"We did not touch a cellular phone in our analysis, and there is no
commercial equipment available that could receive digital cellular
signals. We worked with a paper standard only," Mr. Schneier said. The
attack took "minutes or hours" on a Pentium-class personal computer, and
to comply with U.S. laws and who agreed not to "misuse" the
information. Federal agencies, including NSA, had certain
"sensitivities" as to the encryption power of CMEA and its lawful export
under then-current laws, he said. These concerns led to CMEA's being
somewhat less "robust" than the authentication algorithm.
Updating CMEA to address the concerns raised by the cryptographers'
announcement has become the "highest priority" for the TR45 committee at
its upcoming meetings, Mr. Marinho said. He added that the shift in
federal jurisdiction over encryption from the State Department to the
Commerce Department has enabled TIA to move forward in improving CMEA.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
TRENDS IN BRIEF...
285 Words
2117 Characters
04/07/97
Report on Microsoft
Copyright 1997 Information Access Company. All rights reserved.
A trade publication reports that a "major" security flaw has been
uncovered in Microsoft's network operating system, Windows NT.
The flaw could enable a user dialing in from a remote location to
unscramble encrypted information -- including a corporate network's
entire registry of user passwords -- and display it as plain text. EE
Times Online (http://www.eet.com) said the discovery is especially
troublesome for Microsoft because it has tried to position NT as more
secure network server than alternatives such as Unix. Two professional
security technologists wrote the code for the "hack" that found the
flaw.
The code has been verified by several experts and is making the
rounds on the Internet via an mailing list frequented by skilled
hackers with an interest in NT-security issues. The potentially
password-cracking code is the third major security flaw found in NT in
as many months and follows recent revelations of security holes in
Microsoft's Internet Explorer Web browser. The software giant's
security technology has come under closer scrutiny by the hacking
community as NT and Internet Explorer have found broader market
acceptance... At least a dozen major companies have joined the race to
buy, invest or strike strategic alliances with small Java developers,
according to a trade publication report. Driven by the growing
popularity of Java and the need to get products to market more quickly
than they can be developed internally, these vendors frequently are
courting the same developers to shore up their Java offerings. One
developer, while declining to comment on any talks his company has had,
named Sun Microsystems Inc., Microsoft, Novell Inc., Netscape
Communications Corp. and IBM/Lotus as the top Java hunters, followed by
a second tier of tools vendors that include Symantec Corp.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Social Security officials insist Web info is secure
April 8, 1997
Web posted at: 12:10 a.m. EST
WASHINGTON (CNN) -- Social security records now available through the
Internet pose few security threats to the individuals who request them
administration officials said Monday.
For the past month, Americans have had the option of having their Personal
Earnings and Benefit Estimate Statement (PEBES) sent to them electronically.
The information previously had to be mailed to them in a process that took as
long as six weeks -- and at a cost of millions of dollars in postage each year.
Phil Gambino, a spokesman for the Social Security Administration, said the top
priority of the new program is maintaining privacy, and several security
features have been built into the new system to do just that.
"The information going back and forth between the requester and Social Security
is encrypted, so if it gets intercepted in the middle, it can't be interpreted -- it
would look like jibberish," he said.
Auditors also are able to trace the origin of a request to the exact personal
computer used to make it, he said.
Still, critics concerned about privacy rights are worried.
"As soon as crooks start exploiting this service to get other people's
information, Social Security is going to have a real problem on its hands,"
Evan Hendricks, chairman of the U.S. Privacy Council in Washington, told USA
Today.
The newspaper identified various types of potential abuse: potential employers
could get the salary history of job applicants; co-workers could determine how
much fellow employees make; landlords could use the information to determine
whether someone can afford an apartment.
While Gambino insisted someone would have to "go through a great deal of
effort" to steal information, even the PEBES Web page offers a disclaimer: "We
cannot absolutely guarantee that the information you are sending will not be
intercepted by others and decrypted."
Indeed, one person in January decoded an encryption code similar to the one
used to secure the Social Security information.
Responding to a challenge from a computer security firm, a graduate student
cracked the code in 3 1/2 hours. He used 250 work stations to do test 100
billion code combinations per hour to crack a 40-bit electronic key. The
PEBES page is encrypted with at least a 40-bit key, although it could have
128 bits or more.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Web authors linked to suicide sect
By Alan Boyle and Paul Chavez
MSNBC
Members of the religious community who died in Rancho Santa Fe
earned money by designing business sites on the World Wide Web and
may have tied their death pact to coincide with the return of the
Hale-Bopp comet.
Farewell tape shows cultists' calm resolve Cult built an 'earth ship' of
old tires Rendezvous with mortality Cults growing on the Net How to know if a
loved one is in a cult Talk about this story in our News BBS.
The group did business as Higher Source Contract Enterprises and
designed a variety of sites, including the San Diego Polo Clubs home
page on the World Wide Web.
Commander Al Fulmer of the San Diego County Sheriffs Office said
during a Thursday press conference that the group also called itself
Heavens Gate. A Web site using that name makes a connection
between the Hale-Bopp comet, which last visited Earth about 4,200
years ago, and a time of closure.
The Heavens Gate site was found under several addresses
Thursday, including one Internet address located in Romania. Most of
the sites were either pulled off the World Wide Web later Thursday or
were made inaccessible because of high volumes of Internet traffic.
Katie Greene, a spokesperson for Internet service provider
Concentric Network, located in Californias Silicon Valley south of San
Francisco, said they have been providing Internet service to the group
since March 1995.
A section of one Heavens Gate site outlined the groups beliefs and
said that 2,000 years ago a crew member of the kingdom of heaven took
over the body of Jesus. This Christ-like member prepared others for
departure into the kingdom of heaven.
The site said the groups mission was the same.
I am in the same position to todays society as was the One that
was in Jesus then, the sites author wrote. My being here now is
actually a continuation of that last task as was promised, to those who
were students 2,000 years ago. ... Our only purpose is to offer the
discipline and grafting required of this transition.
Another section of the site described two leaders, a male and
female, who in the early 1970s took over two bodies, which they called
vehicles.
The Heavens Gate group may be a high-tech reincarnation of a
1970s community that had been dubbed the UFO Cult.
Strong similarities exist between the 1970s group and information
found on World Wide Web sites connected to Heavens Gate. The two
leaders of the the so-called UFO cult have been previously identified in
news reports as Houston residents. News reports also said the female
leader is dead.
One page called Last Chance to Evacuate Earth Before Its
Recycled outlined the groups history and mission. The author of the
page identified himself as Do as in the musical tone.
The author said he was related to the Ti and Do that made news in
1975 as the UFO cult. The author also said that his female partner, Ti,
left earth in 1985.
Much of the information on the site outlined how representatives
from a Kingdom Level Above Human were on Earth to escort others to
the higher level.
The site also had a section detailing its position against suicide by
non-members. Larry Trachte, professor of religion at Wartburg College, said
that suicide often has a different meaning among religious groups and cults.
Death is seen more in an Eastern perspective, Trachte said. So
there isnt a sense that all this is tragic. Its more the spiritual, mental
orientation of these people that believe this way. They believe this life
is just one in an ongoing cycle or series or wheel of life. And ending this
life is like opening a window or door and moving into another existence.
Trachte said he took some solace in the news that no children were
involved with the group.
He also was not surprised with the connection to the Hale-Bopp comet.
Throughout history, the heavens and the signs of the stars and
peculiar events like comets have signified extraterrestrial powers,
Trachte said. Its not totally surprising that a comet would trigger such a
response.
He said the group was unique in that it apparently mixed modern
phenomena, such as UFOs, computers, the comet and the Internet, with
age-old beliefs of being swept into heaven.
Even in the Christian experience you have that recorded experience
of people from another country following a heavenly display or
revelation, which to them pointed to the birth of Christ, Trachte said.
The Heavens Gate group also designed pages publicizing
Pre-Madonna, an album of Madonnas early songs;
1-800-HARMONY, a music and video mail-order operation; British
Masters, a clearinghouse for auto parts; and Keep the Faith, a site
devoted to contemporary Christian music and news.
The group used advanced Web page design and technology,
including Java and Javascript, animated images and virtual reality
modeling language.
Beverly Hills businessman Nick Matzorkis, who runs the
Pre-Madonna site, told authorities that he now employs a former
member of the Higher Source group. Matzorkis said that members sent
the employee whom he identified only as Rio two videotapes this week
that described their intentions to commit suicide.
Members of Heavens Gate believed it was time to shed their
containers, perhaps to rendezvous with a UFO they believed was
traveling behind the Hale-Bopp comet, Matzorkis told NBCs Today
show.
The author identified as Do said on the Heavens Gate site, dated
Sept. 29, 1996, that time was short.
The end of this civilization is very close, the site said. The end of
a civilization is accompanied by a spading under, refurbishing the
planet in preparation for another civilization. And the only ones who
can survive that experience have to be those who are taken into the
keeping of the Evolutionary Level Above Human.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Hecklers hack at human bugs that crawl the Web
A couple of weeks ago the U.S. public was distracted by issues of
Internet pornography. The U.S. Supreme Court was considering the
Communications Decency Act, a law meant to control obscenity
supposedly bombarding youthful computer users.
Meanwhile Marshall Herff Applewhite and 38 members of the Heaven's
Gate cult were updating their Web site, laying in a supply of new
Nike sneakers, and preparing to kill themselves.
Politicians and clergy had a firm grip on the anti-porn franchise.
Who, on the other hand, was tackling murderous mass delusion?
The answer: a few skeptics and hecklers, and they did a good job
of it.
Their postings continue to collect in the forums of Usenet where
cult followers put their prophecies about the alien spaceship that
supposedly follows the comet Hale-Bopp.
"It seems odd that a higher life form would prefer us paltry
humans to wear black Nikes with a white "swoosh' as our ceremonial
sending off garb," sneers a contributor to sci.astro, a group of
otherwise sensible astronomers. "What is wrong with Reebok or
Adidas? Is there a conspiracy here?"
Criticism also focused on syndicated radio host Art Bell, who has
promoted the astronaut-messiah movement. He used to talk more about
evil government, until the Oklahoma City federal building bomb went
off. Lately his agenda has been heavier on spaceships.
"Art's role in their deaths was that of a liar and snake oil
salesman, trafficker in junk science, a promoter of charlatans and
their wares, and a parasitic peddler of pernicious poppycock," says a
contributor "decieving you're some sort of chosen spokesman
for some trumped-up alien scam so you can sell your booklet," says
another.
A preacher surrounding himself with goons in a sealed-off temple,
a con artist fleecing followers in a distant commune, even an
infomercial huckster on radio or television, is protected from
opponents who might distract his victims.
But how many of Jim Jones' followers might have been deterred from
going to Guyana with him, and tasting his deadly brew, had the
Internet been in wider use 20 years ago, complete with its noisy
skeptics countering his preachings?
Jones took more than 900 lives with him. Applewhite only got 38
to go along. That's progress.
"Think of it as evolution in action. Or maybe they were right and
are aboard the mothership now. Either way, it's 39 fewer idiots
cluttering up the planet," says another contributor. This does not
encourage copycats.
Skeptical argument is not limited to religious themes. In
Usenet's thousands of newsgroups, forums cover politics, social life,
dating and marriage, most of the arts and sciences, journalism and
international relations. To some degree, they are all the scenes of
noisy, sometimes sarcastic and even profane debate. Group members
even patrol for porn, often vigorously repelling sexual-oriented
postings with the same forensic muscle.
Anyone can join in soc.couples, alt.fan.rush-limbaugh,
alt.politics.clinton, alt.politics.british, alt.history.what-if,
rec.arts.movies, sci.military, alt.journalism and other cyberbrawls.
They argue feminism, political campaign funding, TV violence,
landmines, sex and Nazism. There is even a fun group that regularly
argues the perennial subject of world domination by hamburger
franchise (it's called alt.nuke.the.usa).
Heckling and skepticism? Indeed, as it should be.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Netly News Network
April 3, 1997
IRS raids a cypherpunk
by Declan McCullagh (declan@well.com)
Jim Bell's first mistake was publishing an
essay describing how disgruntled citizens could
kill off Federal government agents by using
anonymous betting pools and digital cash. His
second mistake was informing the IRS that the
agency had no legal authority to tax him.
About twenty armed
IRS agents and other
Federal police swarmed into Bell's home in
Washington state on Tuesday morning, hunting for
evidence that Bell's "Assassination Politics"
essay had come to fruition. They expropriated
Bell's three computer systems, two guns and even
a solitary mouse cable. The Feds were taking no
chances: Since Bell's voluminous Net postings
mentioned tax collectors, agents from the BATF,
FBI, DEA, and local police forces joined the
raid.
[...]
The raid stemmed from a six-month tussle
between Bell and the IRS, which began in November
1996 when the 38-year old computer engineer
demanded a hefty tax refund and threatened to
convene his own "common-law court" if it was
refused. That grabbed the Feds' attention. (So
did the actions of the "Multnomah County Common
Law Court," which apparently met in January to
convict IRS agents and Attorney General Janet
Reno of "theft by deception.") In February, IRS
agents seized Bell's 1986 Honda as payment for
back taxes -- and found inside it a printout of
his "Assassination Politics" essay. "
[...]
And it was, ultimately, a Federal magistrate
who signed the search warrant on 9:02 am on March
28 at the request of the IRS. Jeffrey Gordon, an
inspector in the IRS' Internal Security Division,
details in an 10-page affidavit how he traced
Bell's use of allegedly fraudulent Social
Security Numbers, how he learned that Bell had
been arrested in 1989 for "manufacturing a
controlled substance," how he found out that Bell
possessed the home addresses of a handful of IRS
agents. Gordon's conclusion: Bell planned "to
overthrow the government." The IRS investigator
says in his affidavit that Bell's "essay details
an illegal scheme by Bell which involves plans to
assassinate IRS and other government officals...
I believe that Bell has begun taking steps to
carry out his Assassination Politics plan."
[...]
[=-------------------------------------------------------------------------=]
Security/Hacker Conferences
[=-------------------------------------------------------------------------=]
The 1997 Summer Security Conference
"SUMMERCON IX.V"
May 31st, 1997
Atlanta, GA
This is the official announcement and open invitation to the nine
and 1/2 summer security conference, Summercon. A long time ago,
Summercon was an invite-only hacker gathering held annually in St.
Louis, Missouri. Starting in 1995, SummerCon became an open event to
any and all interested parties: Hackers, Phreaks, Pirates, Virus
Writers, System Administrators, Law Enforcement Officials,
Vigilantes, Neo-Hippies, Secret Agents, Teachers, Disgruntled
Employees, Telco Flunkies, Journalists, New Yorkers, Programmers,
Conspiracy Nuts, Musicians, Nudists, and Rug Sucking Wannabes.
This con is going to be different than previous SummerCons. First
off, there are two other major cons happening this summer, Defcon
and Beyond HOPE. If you want to see good technical speakers, meet a
ton of hackers, and have a good time for a couple days, I suggest
you go to one or both of those cons. DefCon information is at
http://www.defcon.org, Beyond HOPE info is at http://www.2600.com.
So why have SummerCon at all? Well, its a tradition, and most
of the people I talked to said we should have it anyways. But,
because of the other 2 cons, I am really aiming just to make this
a fun weekend with yer friends in a new city, not a technical
hacker gala. If you want to learn something, go to HOPE or
Defcon. If you want to meet hackers, go to HOPE or DefCon. If
you have to choose one con to go to this summer, this one should
NOT be it. If you are already going to DefCon and HOPE, and still
have one more weekend you want to waste this summer, this is the
perfect place for you.
If you are a criminal, if you are an anarchist, if you are
interested in pulling fire alarms or breaking things, don't come
to this con; we don't want you here and you wouldn't like us
anyhow.
Why 9.5? Well, SummerCon X should be this huge major security
conference, but with HOPE this year, we didn't think it was the
right year to do another one of those. So, we'll have SummerCon X
next year, this one is just going to be a little party.
LOCATION
It will be held in Atlanta, GA, but we haven't actually figured
out WHERE in Atlanta. That's because this is a pre-release of the
announcement, when this becomes official, we'll fill in the
details.
DIRECTIONS
Fly to Hartsfield International Airport, look for the hackers.
CONFERENCE INFO
It has always been our contention that cons are for socializing.
"Seekret Hacker InPh0" is never really discussed except in private
circles, so the only way anyone is going to get any is to meet new
people and take the initiative to start interesting conversations.
Because of this, the formal speaking portion of Summercon will be
held on one day, not two or three, leaving plenty of time for
people to explore the city, compare hacking techniques, or go
trashing and clubbing with their heretofore unseen online
companions. Futhermore, except for maybe getting Mudge up on
stage to blow us all away with some cool technical details, it is
probably a pretty good bet that the speeches will end up being
boring, long, and a complete waste of time. Don't come to
SummerCon to learn anything, because you won't.
If you are coming from out of town and want the full
hacker/tourist experience, we will be having a specially scheduled
2600 meeting Friday, May 30th, at 6pm at Lenox Mall food court.
If you don't know how to get there, just ask, everyone in Atlanta
knows.
The formal conference will be held on Saturday, May 31st, 1997,
from 10am to 5pm (with a break for lunch). There will be a
variety of speakers, panel discussions, demonstrations, and other
events that will hopefully keep everyone entertained; if not you
can always start drinking early.
No video or audio tapes will be allowed in the conference room.
No still photography will be permitted in the conference room
without prior permission of all those being photographed.
Violation of these policies will result in you being asked to
leave the conference.
There will be no selling of t-shirts, disks, firewalls, payphones,
etc. in or around the conference area without prior permission of
the organizers, and you WON'T get permission. We can't keep you
from selling t-shirts in your hotel room, but we can keep you away
from the actual conference area, and we can probably get you
kicked out of the hotel for soliciting, and if we can, we will.
T-Shirt sales is where we make up all the money we spend putting
on the conference, and so we will be the only ones selling them.
If you want to sell t-shirts, go have your own con.
If you are interested in demoing or selling something, please
contact us at the address listed at the bottom. If you offer us
money, we might let you do it.
SPEAKERS
The speakers list for Summercon X is still being finalized, but it
is sure to be much less interesting than previous years. In fact,
right now we have NO speakers, and probably we won't until the day
of the con. So again, don't come to summercon for the speakers.
If you are an expert in some aspect of computer, network, or telco
security and are interested in speaking at Summercon, please
contact us to discuss the possibility further at the address
listed at the end of this document.. We won't pay you, don't ask.
We are also going to be having short speeches by real hackers or
phreakers giving their own perspective on some issue or insight
into a new technology. This is an open invitation for you hackers
to be heard; just provide us with a brief outline of the topic you
will be covering and the amount of time you will take (suggested:
5 - 15 minutes) at the address listed below.
COSTS
Costs for SummerCon X are as follows, these are same rates as last
year, which I think is pretty good. There will be NO refunds, and
if you annoy any of the organizers, we reserve the right to throw
you out, and you won't get your money back.
Secret Service / FBI Rate: $500.00
Government / Institutional Rate: $ 80.00
Hacker / Individual Rate: $ 20.00
Members of the United States Secret Service or Federal Bureau of
Investigations, and anyone that has in the past or currently is
providing information or services to the Secret Service or FBI are
required to pay the 'Secret Service / FBI Rate'.
Employees of a local, state, or federal government, members and
associates of any L.E.O., must pay the 'Government / Institutional
Rate'.
Anyone that does not fit into one of the above categories is
eligible for the 'Individual / Hacker Rate'.
Due to historical lack of interest, there will not be
pre-registration for the conference. Registration will begin at
10am the day of the conference, and will continue for the duration
of the conference or until the meeting facilities have reached their
capacity. Since the latter is likely to occur, it is suggested you
don't oversleep.
No purchase orders, checks, money orders, foreign currency, stock
certificates, IOUs, or coins will be accepted for registration.
Secret Service agents, small unmarked bills only, please.
Bring money for t-shirts, they are cool, and this year we will make
enough for everyone (we hope).
HOTEL INFORMATION
Still working on this part.
The cost for a double occupancy room at the hotel is $XX. There is
no special conference rate, there is no need to mention you are with
a conference at all, the people in reservations probably won't know
what you are talking about anyhow.
If the hotel is damaged in any manner, you are going to pay for it,
and you will probably end up in jail. And even if you are lucky
enough to get away with it, the rest of the hackers staying at the
hotel will end up paying for it, and I'm sure that's going to make
you a well-liked and respected hacker, especially among some of the
bigger hackers who might feel tempted to inflict bodily harm on
someone who causes any damage to the hotel. Please act responsibly,
don't drink and drive, chew all your food before you swallow, don't
swallow your gum, and recycle.
Anyhow, if you pull a fire alarm, if you damage a room, if you spit
on the floor, and any of the organizers, or any of their friends
find out, we are going to call the police and have you arrested. In
fact, we are making a game out of it. If anyone does any damage to
the hotel, we will give whoever tells us what person or persons did
it $100 in cash if we are able to get that person taken to jail.
CONTACTING SUMMERCON ORGANIZERS
You can contact the Summercon organizers through e-mail. If you
haven't figured out e-mail yet, you probably shouldn't be coming to
Summercon.
As a final note, if you are planning on coming to Summercon, we
would appreciate you sending e-mail to us with the subject of "GOING
TO SCON" or something similar, just so that we have a rough idea of
how many people are going to show up.
E-mail: scon@2600.com
[=-------------------------------------------------------------------------=]
--== Hacking In Progress ==--
8th, 9th and 10th of August 1997
Near Almere, Netherlands
http://www.hip97.nl/
info@hip97.nl
Welcome to the HIP announcement list. We are not
alone! More than 1600 (!) of you subscribed to this
list.
As you probably already know what HIP is about, this
announcement will focus on how you can help us and how
you can stay informed about HIP. Please read the FAQ
for more common questions.
What is HIP?
------------
HIP is a place for hackers, artists, activists and
many, many others to network themselves, both in the
social and electronic sense of the word. HIP is a
do-it-yourself event. We, the organizers, will provide
the infrastructure, such as large tents, showers,
toilets and large amounts of reliable electrical power
and network connectivity. We'll also arrange for a
basic set of workshops and lectures, mainly dealing
with the social and political aspects of information
technology, security, Internet, access to technology,
new developments, cryptography and other 'hacker-
related' topics that come to mind. We are open to
suggestions for other fields of interest.
At this moment we are working on discussions and
workshops about smartcard security, Tempest attacks,
the SPAM threat, virtual communities, cryptography and
the law (Trusted Third Parties and Key Recovery), a
tele-presence experiment, activism on the Net, and
much more.
A do-it-yourself event?
-----------------------
We will absolutely need your help setting up
everything once we're there. HIPcamp will open on
August 5th, three days before HIP starts. If you
decide to join in that early expect some pretty
primitive circumstances. If you don't care about that,
or think that's the best part, you can help build
HIPnet and all other facilities.
We also urgently need you to think now about what it
is you would like to see and do at HIP. Just like
Hacking at the End of the Universe in 1993, we need
lots of people that have ideas for organizing their
own small part of HIP and the organizational talent to
do this without too much help from us.
One of the proven recipes for fun:
* GET a group of friends together in an early stage;
arrange how you're going to get there if you're far
away.
* THINK: Is there something you and your friends would
like to show others, discuss or do there?
* If so: TELL us about it, so we can coordinate, help
or announce things.
* Maybe BUY a nice big army surplus tent for almost
nothing.
* BRING lots of computers and other electronics.
* HOOK it all up once you get there.
* Check out what others have been doing and MEET nice
people, hang out, have fun!
Of course you can also come alone and have lots of
fun, and there will be a huge exhibition tent to set
up computers in. In another big tent there will be
near to a thousand chairs where you can listen to and
participate with panel discussions.
This event will be big, and as said, in this stage
we're looking for people to organize their own chaotic
little part of it. So don't mail us saying "put me on
the list, I want to be a volunteer" when you could say
"I'm xxx and I'd like to do yyy." Tell us what you
need us to do. We could put your workshop or whatever
it is you'd like to do in one of our announcements and
on the website, so people can communicate with you
beforehand. We could make sure there is enough room if
your project requires a lot of space. You name it.
You can use the newsgroup alt.hacking.in.progress to
find people to work with at HIP. Or you can use the
notice board at the website to search for someone to
travel with to HIP. Use it to ask for help or offer
some.
As the days get longer, there will be parts of the
overall organization that need coordination with
volunteers some time before the actual event (workshop
coordination, audiovisual stuff, registration-desk,
bar, network), but now is not yet the time.
This isn't going to be passive entertainment, we all
work together to make it work. Also: HIP is not the
event to buy a computer or get advice on buying one,
and there're not going to be any beginner courses on
using the Internet. If you're not into networking of
some sort, you'll think it's boring.
But if you're very technically inclined, part of some
remote community on the edge of the net, or if the
politics surrounding information technology are just
your thing, HIP is definitely made for you (and by
you, we hope).
HIPcamp will open on August 5th, three days before HIP
starts. If you decide to join in that early expect pretty
primitive circumstances. If you don't care about that,
or think that's the best part, you can help build HIPnet
and all other facilities.
How to stay in contact:
-----------------------
* Check out the website http://www.hip97.nl/
* Participate in alt.hacking.in.progress
* Read the FAQ on the website or the newsgroup
* Mail us at info@hip97.nl
Snailmail us at:
HIP
Postbus 1035
1000 BA Amsterdam
Netherlands
Tel. +31 20 5352081
Fax. +31 20 5352082
[=-------------------------------------------------------------------------=]
Defensive Information Warfare
And Systems Assurance
For Community, Company and Country
September 11-12, 1997
Sheraton Premier, Tysons Corner, VA
Call for Papers
Sponsors:
National Computer Security Association
http://www.ncsa.com
and
Winn Schwartau, Interpact, Inc.
http://www.infowar.com
http://www.info-sec.com
Interested parties from government, law enforcement, academia,
corporations and individuals from all nations are invited to submit
papers or concepts for papers/presentation to be given at
InfoWarCon 7 and published on http://www.infowar.com. The following
Solutions Oriented topics are of special interest to the conference,
but all papers will be considered:
Case studies and real world successes are strongly encouraged.
New technologies, systems, models and approaches to provide higher
levels of information and systems assurance in a world where
conflict has moved to Cyberspace. (Commercial, Law Enforcement and
Government).
Detect and Response Solutions
Denial of Service Methods and Protection
New Info-Sec Models for Local and Global Enterprises
Demonstrations of New Emerging Technologies
Encryption, Access Control, and Identification
The technical and social convergence of the military, law enforcement
and private sectors in the interest of National Security: defensive
mechanisms, policies and cooperative efforts.. (Commercial and
Government)
Electronic Civil Defense Policies
Alternative National Defense and Intelligence Mechanisms
National vs. International Policy Development
Educating Populations for Support
Dealing with the Non-nation State Actor
Cooperative legal, ethical and political means by which to interest,
create and sustain international cooperation for the discovery and
prosecution of computer crimes and cyber-terrorism. (Law enforcement
and Government)
Redefining the State
Case Studies of Prosecution; Successful and Not
Corporate Vigilantism and Self-Preservation
Electronic Bills of Rights for Nation States
United Nations of Cyberspace
Legal Conundra
Multi-media presentations, real-time scenarios or gaming, audience
participation and highly interactive topics are more likely to be
accepted. English is the conference language and all sessions will
be unclassified.
Submissions are to be in Word 6.0 or greater, Powerpoint, or other
popular formats, sent by email to: betty@infowar.com
Submission Deadline: May 16, 1997
Acceptance Date: June 9, 1997
For complete information on attendance:
Registration: Conferences@ncsa.com
Sponsorships: Sponsors@ncsa.com
Questions/Help: betty@infowar.com
[=-------------------------------------------------------------------------=]
Second International Workshop on Enterprise Security
June 18-20, 1997
Massachusetts Institute of Technology (MIT),
Cambridge, Massachusetts, USA
Co-sponsored by the IEEE Computer Society and the
Concurrent Engineering Research Center (CERC) at
West Virginia University
==============================================================================
Enterprises are increasingly dependent on their information systems to
support their business and workflow activities.
There is a need for universal electronic connectivity to support
interaction and cooperation between multiple organizations.
This makes enterprise security and confidentiality more important,
but more difficult to achieve, as the multiple organizations may
have differences in their security policies and may have to interact
via an insecure Internet. These inter-organizational enterprise systems
may be very large and so tools and techniques are needed
to support the specification, analysis and implementation of security.
This workshop will focus on the problems and challenges relating to
enterprise security in inter-organizational systems. We aim to bring
together principal players from both the internetwork and enterprise
security community and will provide plenty of time for discussion. Topics
to be addressed include:
- Internet/Intranet security
- Security infrastructure and protocols
- Java Security
- Specifying and Analyzing Enterprise Security Policy
- Role-Based Access Control
- Supporting enterprise security over the Internet
- Conflicts and harmonization of inter- and intra-organizational
Security
- Distributed Database Security
- Secure Transactions
- Security in Workflow Process
- Object-Oriented and CORBA Security
- Secure Applications and Environments
- Integrating Heterogeneous Security Environments
- Managing inter-organizational Enterprise Security
- Internet Security protocols
- Security Algorithms
This workshop will be part of the IEEE Sixth Workshops on Enabling
Technologies: Infrastructure for Collaborative Enterprises (WET-ICE
96) organized by the Concurrent Engineering Research Center (CERC)/
West Virginia University.
Important Dates:
================
Papers Due March 25, 1997
Panel Proposals March 18, 1997
Authors notified of acceptance April 21, 1997
Workshop June 18-20, 1997
Camera Ready June 28, 1997
INFORMATION FOR AUTHORS OF PAPERS TO BE INCLUDED IN THE PROCEEDINGS
===================================================================
Mail six copies of an original (not submitted or published elsewhere)
paper (double-spaced) of 3000-5000 words to one of the PC co-chairs.
Include the title of the paper, the name and affiliation of each author, a
150-word abstract and no more than 8 keywords. The name, position,
address, telephone number, and if possible, fax number and e-mail
address of the author responsible for correspondence of the paper must
be included.
An e-mail submission in postscript format will be accepted.
INFORMATION FOR PANEL ORGANIZERS
================================
Send six copies of panel proposals to one of the PC co-chairs.
Include the title, a 150-word scope statement, proposed session chair and
panelists and their affiliations, the organizer's affiliation,
address, telephone and fax number, and e-mail address.
INFORMATION FOR AUTHORS OF POSITION PAPERS
==========================================
Send six copies of position paper of 2-3 pages to one of the PC
co-chairs. Include the title of the paper, the name and affiliation of
each author, a 150-word abstract and no more than 8 keywords. The
name, position, address, telephone number, and if possible, fax number
and e-mail address of the author responsible for correspondence of the
paper must be included. An accepted position paper will get less
presentation time than full paper.
Workshop General Chair and Organizer
====================================
Yahya Al-Salqan, Ph.D.
Sun Microsystems
alsalqan@eng.sun.com
Program Committee
=================
Program Committee Co-Chairs
==========================
Barbara C. Davis
Director of Technology
The Applied Knowledge Group
231 Market Place, #315
San Ramon, CA 94583-2785
USA
Tel. (888) 442-2785
FAX (510) 275-9695
bcdavis@appliedknowledge.com
Douglas Moughan
National Security Agency, R23
9800 Savage Rd.
Ft. Meade, Maryland 20755-6000
USA
wdm@tycho.ncsc.mil
Workshop Program Committee (Partial List):
==========================================
Abdallah Abdallah, Birzeit University, Jerusalem
Takasi Arano, NTT Corp, Japan
Germano Caronni, ETH-Zurich, Switzerland
Taher ElGamal, Netscape Corp., USA
Stephen Farrell, Software and Systems Engineering, Ireland
Takeo Hamada, Fujitsu, Japan
Matthias Hirsch, BSI (Federal Department of Security in the Information
Technology-Germany
Cynthia L Musselman, Sandia Lab, USA
Lisa Pretty, Certicom Corp., Canada
Jeffrey Parrett, LLNL, USA
Sumitra Reddy, West Virginia University, USA
Nahid Shahmehri, Linkoping University, Sweden
Morris Sloman, Department of Computing: Imperial College, UK
Badie Taha, Al-Quds University, Jerusalem
Robert Thomys, BSI (Federal Department of Security in the Information
Technology-Germany
Tatu Ylonen, SSH Communication Security, Finlad
Nick Zhang, EIT, USA
Internet Hot-line
=================
Information on Enterprise Security Workshop may be obtained through
the WWW using the URL http://www.cerc.wvu.edu/SECWK/
For more information on WET-ICE'97, visit the URL:
http://www.cerc.wvu.edu/WETICE/WETICE97.html
One does not need to have a paper to attend the workshop.
[=-------------------------------------------------------------------------=]
-----BEGIN PGP SIGNED MESSAGE-----
READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIB
DEF CON V Convention Announcement #1.08 (04.09.97)
July 11-13th @ the Aladdin Hotel and Casino in Las Vegas
XXXXXXXXXXXXXXXXXXXXXXXX XX DEF CON V Convention Announcement
XXXXXXXxxxxXXXXXXXXXXXXXXX XX DEF CON V Convention Announcement
XXXXXXxxxxxxXXXXXX X X DEF CON V Convention Announcement
XXXXXxxxxxxxxXXXXXXX X DEF CON V Convention Announcement
XXXXxxxxxxxxxxXXXX XXXXXXXXX DEF CON V Convention Announcement
XXXxxxxxxxxxxxxXXXXXXXXXX X DEF CON V Convention Announcement
XXxxxxxxxxxxxxxxXXXXXX XX X DEF CON V Convention Announcement
XXXxxxxxxxxxxxxXXXXXXXX DEF CON V Convention Announcement
XXXXxxxxxxxxxxXXXXXXXX X XX DEF CON V Convention Announcement
XXXXXxxxxxxxxXXXXXXXXXX XX X DEF CON V Convention Announcement
XXXXXXxxxxxxXXXXXXXXX X DEF CON V Convention Announcement
XXXXXXXxxxxXXXXXXXXXXXXXXX DEF CON V Convention Announcement
XXXXXXXXXXXXXXXXXXXXXXXXXXXX X DEF CON V Convention Announcement
READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIBUTE & READ & DISTRIB
The only convention with free beer!
IN
SHORT:--------------------------------------------------------------------
WHAT: Speakers and partying in Vegas for all hackers
WHEN: July 11th - 13th
WHERE: Las Vegas, Nevada @ the Aladdin Hotel and Casino
COSTS: $30 in advance, $40 at the door
MORE INFO: http://www.defcon.org or email info@defcon.org
IN
LONG:---------------------------------------------------------------------
It's time to brave Las Vegas again for DEF CON! This is an initial
announcement and invitation to DEF CON V, a convention for the
"underground"
elements of the computer culture. We try to target the (Fill in your
favorite word here): Hackers, Phreaks, Hammies, Virii Coders, Programmers,
Crackers, Cyberpunk Wannabees, Civil Liberties Groups, CypherPunks,
Futurists, Artists, Criminally Insane, Hearing Impaired. It seems that
books about the culture are becoming more popular, so of course reporters
are also welcome. You won't be hurt. I promise. Just bring cash for
drinks.
So you heard about DEF CON IV, and want to hit part V? You heard about the
parties, the info discussed, the bizarre atmosphere of Las Vegas and want
to
check it out in person? You want to do weird shit _away_ from the hotel
where you can't get me in trouble? You have intimate knowledge of the
SWIFT
network, and want to transfer millions of dollars to the Def Con account?
Then you're just the person to attend!
What DEF CON is known for is the open discussion of all ideas, the free
environment to make new contacts and the lack of ego. More people have
made
great friends at DEF CON over the years than my brain can conceive of. DEF
CON is also known for letting the "Suits" (Government / Corporate) mix with
everyone and get an idea of what the scene is all about. The media makes
an
appearance every year and we try to educate them as to what is really going
on. Basically it has turned into the place to be if you are at all
interested in the computer underground.
[Note]----------------------------------------------------------------------
-
Now last year over 800 people showed up and threw my whole program for a
loop. I was thinking 500+ people, but when 800 showed up it got a little
crazy for the planning staff. This year I am planning for 1,000. This
way I will be able to accommodate everyone and have less logistical screw-
ups.
I would also like to apologize to everyone last year who had temporary
badges for half the convention, etc. I will do all that is possible for
maximum coolness, and minimum hassles. Anyway, enough of my shit, on with
the details.
[End
Note]-------------------------------------------------------------------
SPEAKERS:-------------------------------------------------------------------
-
Over the years DEF CON has had many notable speakers. This year there will
be more of an emphasis on technical talks. There will be a separate
smaller
room for break-out sessions of more specific topics. While the talks of
the
past have been great, it always seems some tech people drop out and general
talks fill in. I will load it tech heavy so when people do drop out there
will still be plenty of meat left for the propeller heads.
There will be some speaking on Friday evening before Hacker Jeopardy, all
day Saturday and Sunday. About 20 people will speak, plus smaller tech
sessions. If you are interested in speaking or demonstrating something
please contact me.
Current speakers include:
[> If you are interested in speaking please contact me at
dtangent@defcon.org
[> Nihil - Windows NT (in)security. The challenge response system, NT 5.0
Kerb security services, man in the middle attacks on domain controllers.
This will be a more technical discussion of NT related security.
[> Koresh - Hacking Novell Netware.
[> Yobie - Emerging infrastructures made possible by Java. He will describe
and talk about Java as the foundation for a global, object-oriented
distributed network. New concepts and computing paradigms will discussed
as well as applications for both applications development or straight-out
hacking.
[> Mudge - System Administrator for L0pht Heavy Industries. He will present
a technical talk on something cool.
[> Clovis - From the Hacker Jeopardy winning team. He will discuss issues
with security and networked object systems, looking at some of the
recent security issues found with activeX and detail some of the
potentials and problems with network objects. Topics will include
development of objects, distributed objects, standards, activex, corba,
and hacking objects.
[> Bruce Schneier - Author of Applied Cryptography and the Blowfish
algorithm - Why cryptography is harder than it looks.
[> FBI Computer Crime Squad - They will make another appearance this year
only if I can bribe them with the audio from last years convention. Can
I do it in time?
[> Richard Thieme - "The Dynamics of Social Engineering: a cognitive map for
getting what you need to know, working in networks, and engaging in
espionage quietly; the uses of paranoia, imagination, and grandiosity
to build the Big Picture.
[> G. Gillis - Packet Sniffing: He will define the idea, explain everything
from 802.2 frames down to the TCP datagram, and explain the mechanisms
(NIT, bpf) that different platforms provide to allow the hack.
[> Seven - What the feds think of us.
[> RK - Electronic countermeasures, counter espionage, risk management.
Should include a demonstration of electronic countermeasures equipment
as well as a talk on what works, what doesn't, and the industry.
[> Tom Farley the Publisher of the "Private Line" journal, and Ken
Kumasawa of TeleDesign Management - Toll Fraud in the 90s: Two
perspectives. An overview of phreaking from a hackers point of view and
an industry/security consultants point.
[> Michael Quattrocchi - The future of digital cash and a presentation about
the modernization and state of register-level debit cards; in effect
currently throughout Canada.
[> Ira Winkler - NCSA - Real life case studies of successful and
unsuccessful corporate espionage.
SCHEDULE:-------------------------------------------------------------------
-
FRIDAY: Network Setup, Sign in, Informal PGP Keysigning at the "PGP
table",
Lots of Partying. Capture the Flag Contest Starts at 16:00
On Friday there will be the demonstrations of the Radio Burst Cannon, a
"real" rail gun, and an omni-directional cell phone jammer. Times to be
announced.
10:00 - Doors open, sign in starts
10:00 - Movies start in main conference room
16:00 - Capture the Flag II starts
Breakout Tech Sessions:
19:00 - Tech Talks starts in break out room
24:00 (Midnight) Hacker Jeopardy Starts.
SATURDAY:
Speakers from 10:00 to 19:00 This is _NOT_ the order they will speak in.
10:00 - 10:50 Keynote (?)
11:00 - 11:50 Bruce Schneier
12:00 - 12:50 Yobie
13:00 - 13:50 Clovis
14:00 - 14:50 FBI Computer Crime Squad
15:00 - 15:50 Richard Theme
16:00 - 16:50 Seven
17:00 - 17:50 RK
18:00 - 18:50 Tom Farley
Breakout Tech Sessions:
Nihil
Koresh
Mudge
Weld Pond
G. Gillis
24:00 (Midnight) Final rounds of Hacker Jeopardy.
SUNDAY:
Speakers from 10:00 to 16:00 This is _NOT_ the order they will speak in.
10:00 - 10:50 Michael Q.
11:00 - 11:50 Ira Winkler
12:00 - 12:50
13:00 - 13:50
14:00 - 14:50
15:00 - 15:50
Breakout Tech Sessions:
16:00 Awards for Capture the Flag
End of it all, cleanup, etc. See you all next year!
EVENTS:---------------------------------------------------------------------
-
[> HACKER JEOPARDY:
Winn is back with Hacker Jeopardy!! The third year in the running!
Can the all-powerful Strat and his crypto-minion Erik, whose force
cannot be contained, be defeated?! Will the powers that be allow
Strat-Meister to dominate this beloved event for the third year in
a row?! Can Erik continue to pimp-slap the audience into submission
with a spoon in his mouth?!? Only Skill, Time, and booze will tell
the tail!
The Holy Cow will help supply the beer, you supply the answers.
The first round starts at 12 midnight o'clock on Friday and lasts
until it is done. The second and secret rounds will happen Saturday
at midnight.
6 teams will be picked at random and compete for the final round.
There can be only one! Strat's Team, the winners from last year
will defend if all the members can be found.
[> FREE BEER!
Holy Cow will provide free beer tickets! If you are over 21 prepare
to consume "hacker" beers. Actually it's whatever beer they have on
tap, but it's the best beer in Las Vegas. Follow Las Vegas Blvd. up
until you see the florescent cow with the big sunglasses. All taxi
drivers know of this Mecca. Over 1,000 free beers in all!
[> BLACK AND WHITE BALL:
We've talked it over, and the verdict is in. For the last two years
at DEF CON there has been a sort of unspoken Saturday night dress up
event. People have worn everything from party dresses and Tuxedoes
to AJ's ultra pimp Swank outfit with tiger print kilt. This year it
is official. Wear your cool shit Saturday night, be it gothic or
PVC
vinyl or Yakuza looking black MIBs. No prizes, just your chance to
be the uber-bustah pimp.
[> THE TCP/IP DRINKING GAME:
If you don't know the rules, you'll figure 'em out.
[> CAPTURE THE FLAG:
The second year of capture the flag is back. With the lessons
learned
from last year the contest should be more interesting and intense.
Up to six machines will be connected running different operating
systems. The object is to control as many machines as possible at
certain time periods. You can form teams or go it lone star. There
will be valuable cash prizes and redeemable coupons for those who
come in first and second, plus various runner up stuffs.
Four protocols (TCP/IP, NetBeui, IPX, and x.25! Yes, you heard
right, x.25) and three segments with 2 boxes per segment. Pick your
segment, protect your boxes. At all times you must have a WWW
server (port 80), finger, and mail working. There will be several
stock operating systems on the network including linux, FreeBsd,
Windows NT, Novell, Some Apple System 7.x, and who knows what else.
More specifics as time goes on.
[> VIRTUAL WORLD:
We are working on the group discounts like the last two years.
[> QUAKE COMPETITION:
http://www.ctive.com/ntech/defcon.htm
This year knightPhlight contacted me and wanted to organize a single
elimination Quake competition to find out who that badest ass 'mo
'fo
is. Check out the web site to get the rules, sign up, or to
donate a computer the greater good of destruction.
It is IMHO that Quake by id Software rules 3D action gaming. But who
rules Quake? We'll find out this July 11th-13th at the DefCon
Conference in Las Vegas. This isn't going to be a networked game
intent on quickly eliminating as many players as possible in a
single
round. Rather, one-on-one games will be played to absolutely
determine who the best really is.
Of course, you already know your the best so why would you feel
obligated to prove it? Because we'll give the first place winner
$750. Now, being the wily person you are, I bet you would like to
know where I got the money for the prizes. It'll come from your
registration fee of $7.50. Any half wit can do the math and see the
10,000% return for the winner. But just for entering you'll be in a
drawing for really kewl stuff. If you don't think its kewl you can
just give us your email address and we'll be happy to send you a
couple hundred thousand messages explaining why the prizes are
great.
[> NET CONNECTION:
This year we are pre-building many of the network boxes so the net
can go up first thing Friday. It looks like we will have a T1 line
and we will break it out to 10 BaseT hubs. If you want in on the
network bring along the appropriate cables and adapters.
More Net Madness! The T1 bandwidth will allow us to do the
following cool stuff:
- Have several color quickcams and a CU-SeeMe reflector site set
up so people not at the con can check out what's going on. During
the convention check out the DEF CON web site to get the location
of the reflector site. You should get and install the software
needed to view CU-SeeMe streams in advance!
- Have a RealAudio server set up to stream the speakers talks to
those who can not attend.
- Potentially play a competitive multi user game(s) over the net.
NOTE! If you wish to participate interactively with the convention
please e-mail me and we can coordinate something. It would be
great to get people from all over the world involved.
[> 5th ANNUAL SPOT THE FED CONTEST:
The ever popular paranoia builder. Who IS that person next to you?
"Like a paranoid version of pin the tail on the donkey, the
favorite sport at this gathering of computer hackers and phone
phreaks seems to be hunting down real and imagined telephone
security and Federal and local law enforcement authorities who the
attendees are certain are tracking their every move.. .. Of course,
they may be right."
- John Markhoff, NYT
Basically the contest goes like this: If you see some shady MIB
(Men in Black) earphone penny loafer sunglass wearing Clint Eastwood
to live and die in LA type lurking about, point him out. Just get
my attention and claim out loud you think you have spotted a fed.
The people around at the time will then (I bet) start to discuss the
possibility of whether or not a real fed has been spotted. Once
enough people have decided that a fed has been spotted, and the
Identified Fed (I.F.) has had a say, and informal vote takes place,
and if enough people think it's a true fed, or fed wanna-be, or
other nefarious style character, you win a "I spotted the fed!"
shirt, and the I.F. gets an "I am the fed!" shirt.
NOTE TO THE FEDS: This is all in good fun, and if you survive
unmolested and undetected, but would still secretly like an "I am
the fed!" shirt to wear around the office or when booting in doors,
please contact me when no one is looking and I will take your
order(s). Just think of all the looks of awe you'll generate at
work wearing this shirt while you file away all the paperwork
you'll have to produce over this convention. I won't turn in any
feds who contact me, they have to be spotted by others.
[> RAIL GUN DEMONSTRATION: (Friday)
On Friday afternoon there will be a demonstration of a hand held
rail gun. This garage project should be able to fire a graphite
washer very, very fast.
[> OMNIDIRECTIONAL CELL PHONE JAMMER DEMONSTRAITON: (Friday)
Another interesting creation to be tested on Friday in the desert.
Come along and watch you cell phone antenna explode with power!
See control channels crumble before you.
[> RADIO BURST CANNON DEMONSTRATION: (Friday)
While not quite a HERF gun, this should come close. The RBC should
be able to produce up to or less than one MegaWatt for up to or less
than one second. What will this do? Who knows! Come and find out.
Obviously the above demonstrations will take place away from the
local hospitals and casinos out in the desert someplace, so be
prepared.
HOTELS:---------------------------------------------------------------------
-
[> Book your room NOW!!! We have a block of rooms, but it is first come,
[> first served. Rooms get released about one month before the convention.
[> Book by June 9th or risk it. The room rates are quite cool this year.
PRIMARY HOTEL: The Aladdin Hotel and Casino
3667 Las Vegas Blvd. South, Las Vegas, Nevada
Built in 1966 it is one of the oldest hotels in Las Vegas that
hasn't been blown up to make room for newer ones. It is quite nice
and has Tennis courts, two swimming pools, Chinese, Vietnamese and
Korean. A Seafood and steakhouse, Joe's Diner and a 24 hour coffee
shop too. It's located next to the MGM Theme park on the strip.
PHONE: 1-800-225-2632, reference the "DC Communications conference"
for reservations.
RATES: Single & Double rooms are $65 in the Garden section, $85 for
the Tower. Suites are $250 to $350. All costs are plus 8% room
tax.
Rollaway beds are available for an additional $15 a night.
STUFF IN
VEGAS:--------------------------------------------------------------
URLs
Listings of other hotels in Las Vegas, their numbers, WWW pages, etc.
http://www.intermind.net/im/hotel.html
http://vegasdaily.com/HotelCasinos/HotelAndCasinos/CasinoList.html
VENDORS / SPONSORS /
RESEARCH:-----------------------------------------------
If you are interested in selling something (shirts, books,
computers, whatever) and want to get a table contact me for costs.
If you have some pet research and you want to have the participants
fill out anonymous questioners please contact me for the best way
to do this.
If you want to sponsor any event or part of DEF CON V in return for
favorable mentions and media manipulation please contact me. For
example in the past Secure Computing has sponsored a firewall
hacking contest.
MORE
INFO:-------------------------------------------------------------------
[> DEF CON Voice Bridge (801) 855-3326
This is a multi-line voice bbs, VMB and voice conference system.
There are 5 or so conference areas, with up to eight people on each
one. Anyone can create a free VMB, and there are different voice
bbs sections for separate topics. This is a good neutral meeting
place to hook up with others.
The Voice bridge will be changing numbers soon, but the old number
will refer you to the new location. The new spot won't suffer from
"Phantom" bridges!
[> MAILING LIST
send emial to majordomo@merde.dis.org and in the body of the
message
include the following on a separate line each.
subscribe dc-stuff
dc-announce is used for convention updates and major announcements,
dc-stuff is related to general conversation, planning rides and
rooms, etc.
[> WWW Site http://www.defcon.org/
Convention updates and archives from previous conventions are
housed
here. Past speakers, topics, and stuff for sale. Also a growing
section of links to other places of interest and current events.
[> The Third Annual California Car Caravan to DEF CON!
http://exo.com/~enigma/caravan/
[> The DEF CON V Car ride sharing page: Use this site to arrange ride
sharing to the convention from all over North America. If you can
spare a seat for someone, or need to leech a ride go to the ride
sharing page set up by Squeaky.
http://www.geocities.com/ResearchTriangle/4955/defcon.html
Room Sharing Page:
[> EMAIL dtangent@defcon.org
Send all email questions / comments to dtangent@defcon.org. It has
been said that my email is monitored by various people. If you
want
to say something private, please do so with my pgp key (At the
bottom of this announcement) I usually respond to everything, if
not I'm swamped or had a system problem.
[> SNAIL MAIL
Send all written materials, pre-registrations, etc. to:
DEF CON, 2709 E. Madison, Seattle WA, 98112
If you are pre-registering for $30 please make payable to DEF CON
and include a name to which you want the registration to apply.
I don't respond to registrations unless you request.
DO YOU WANT TO
HELP?---------------------------------------------------------
Here is what you can do if you want to help out or participate in
some way:
Donate stuff for the continuous give-aways and the various
contests.
Got extra ancient stuff, or new cool stuff you don't use anymore?
Donate it to a good cause! One person was very happy over winning
an osborne "portable" computer.
ORGANIZE sharing a room or rides with other people in your area.
Join the mailing list and let people know you have floor space or
some extra seats in your car. Hey, what's the worst that can
happen besides a trashed hotel room or a car-jacking?
CREATE questions for hacker jeopardy (you know how the game is
played) and email them to winn@infowar.com. No one helped out last
year, so this year let's try. Everything from "Famous narks" to
"unix bugs" is fair game.
BRING a machine with a 10bt interface card, and get on the local
network, trade pgp signatures, etc.
FINAL CHECK LIST OF STUFF TO
BRING:------------------------------------------
MY PGP
KEY:------------------------------------------------------------------
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.1
mQCNAy6v5H8AAAEEAJ7xUzvdRFMtJW3CLRs2yXL0BC9dBiB6+hAPgBVqSWbHWVIT
/5A38LPA4zqeGnGpmZjGev6rPeFEGxDfoV68voLOonRPcea9d/ow0Aq2V5I0nUrl
LKU7gi3TgEXvhUmk04hjr8Wpr92cTEx4cIlvAeyGkoirb+cihstEqldGqClNAAUR
tCZUaGUgRGFyayBUYW5nZW50IDxkdGFuZ2VudEBkZWZjb24ub3JnPg==
=ngNC
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBM07aS8tEqldGqClNAQFuSAQAjwGLBdDKA9TKTNAxewgeluvRXPFu+cLf
hQ74qJFtGybyik+Te4FPQI3Uw+wjir/4ES1imyjQ9n9oIOh+E0L3moYxbcQKN7iT
/VWAJXwPNJR8guxGcrRNYO85KXSB2qFrU9JwCwJ/8C5lEi/5FVjqRewpliw68+SW
9jHqxFccQUs=
=PPpy
-----END PGP SIGNATURE-----
EOF
