Mitnick, Netcom, & 20,000 Credit Card #s
Mike Anderson
approximately 20,000 credit card numbers belonging to customers of
Netcom. Anybody know how he did it?
It's a little unnerving, knowing that someone can get into a company as
big as Netcom and grab customer data like that. I've given my credit
card # by voice to a number of online services for billing purposes, and
I'd hate to think THAT info could easily hacked.
If you don't know, feel free to take a wild guess! Let's see what we can
come up with!
Mike Anderson
mik...@eskimo.com
Matthew Osborne
: Yesterday's NY Times article mentioned Kevin Mitnick had grabbed
: Netcom. Anybody know how he did it?
: It's a little unnerving, knowing that someone can get into a company as
: big as Netcom and grab customer data like that. I've given my credit
: card # by voice to a number of online services for billing purposes, and
: I'd hate to think THAT info could easily hacked.
site in the middle of no where. Mitnick could have grabbed it, and well..
Acctually, someone else already said that this happened. I don't remember
where, accept it was in one of the Mitnick threads. Oh well.
--
"I may be dumb, But I'm not a dweeb" -offspring Self Esteem
Paul Cox
>From: mik...@eskimo.com (Mike Anderson)
>Subject: Mitnick, Netcom, & 20,000 Credit Card #s
>Date: Fri, 17 Feb 1995 14:16:01 GMT
>Yesterday's NY Times article mentioned Kevin Mitnick had grabbed
>approximately 20,000 credit card numbers belonging to customers of
>Netcom. Anybody know how he did it?
>It's a little unnerving, knowing that someone can get into a company as
>big as Netcom and grab customer data like that. I've given my credit
>card # by voice to a number of online services for billing purposes, and
>I'd hate to think THAT info could easily hacked.
Actually, given what idiots they seem to have at Netcom, it's not too
surprising.
Further, in a company that big, it'd be hard to have any one person have a
good idea of what's going on with their network. Here, it's such a smaller
scale, things are much more safe.
The moral of the story is that no matter what you do, if you use a credit
card, there's a chance it could get hacked. Of course, they're of no value if
you don't use them occasionally, so I guess that means we just gotta live with
a little risk in our lives. :}
--
Paul Cox
agtc...@eskimo.com
----------------------------------------------------------------------------
This space intentionally left blank.
----------------------------------------------------------------------------
Charlie Mingo
(Matthew Osborne) wrote:
> Mike Anderson (mik...@eskimo.com) wrote:
> : Yesterday's NY Times article mentioned Kevin Mitnick had grabbed
> : approximately 20,000 credit card numbers belonging to customers of
> : Netcom. Anybody know how he did it?
>
> Who says he did it?
Caught red-handed. The FBI found all 20,000 numbers on a printout in his
room. How did netcom's credit card numbers make their way from California
to Mitnick's apartment in North Carolina? Hard to think of an innocent
explanation.
> : It's a little unnerving, knowing that someone can get into a company as
> : big as Netcom and grab customer data like that. I've given my credit
> : card # by voice to a number of online services for billing purposes, and
> : I'd hate to think THAT info could easily hacked.
>
> Ummm. Someone else could have done it, and put it on some big bad ftp
> site in the middle of no where. Mitnick could have grabbed it, and well..
Remember a few facts:
-- Shimomura's files were found in a private account on well.com,
which had been cracked without the account owner's knowledge.
Shimomura traced the hacker who was using that account and found
Mitnick on the other end of the line.
-- Mitnick has been a fugitive since 1988, when he broke parole in
California. Since then, he has also been wanted on federal felony
charges. He has been living in hiding, under an assumed name.
-- Shimomura did not know where Mitnick lived, or that he was involved.
All Shimomura did was trace the hacker's phone calls, and they led
directly to Mitnick's apartment, outside Raleigh NC.
-- Your hypothetical "someone else" would have had to (i) know where
Mitnick was, (ii) trick Mitnick into breaking into well.com (so
that Shimomura could catch him red-handed), and (iii) would have
had to trick Shimomura into thinking that there was only a single
hacker involved.
-- There is no direct evidence that anyone other than Mitnick was
involved. No evidence that Mitnick or Shimomura was tricked.
No evidence that anyone knew where Mitnick was (if anyone had
known, why not just turn him in and collect the reward for info
leading to arrest of a federal fugitive). And Mitnick was found
with Shimomura's files, netcom's credit card numbers, etc in his
possession.
Mitnick made the same mistake as Ramzi Yusef (the recently-captured WTC
bombing suspect): if you are a fugitive from justice, don't do things
likely to attract attention to yourself. By breaking into Shimomura's
computers, Mitnick led investigators directly to his apartment. Real
dumb.
Sean Donelan
> It's a little unnerving, knowing that someone can get into a company as
> big as Netcom and grab customer data like that. I've given my credit
> card # by voice to a number of online services for billing purposes, and
> I'd hate to think THAT info could easily hacked.
What a strange reaction people have to credit card numbers. People throw
their credit card receipts in the trash all the time. Yet they are surprised
when someone looks in the trash.
The difference between the Internet and other communications network
is people on the Internet are willing to talk about the problems. Public
Data Networks (PDN's), which transmit a lot more credit card numbers in
the clear, have gotten broken into in the past. But those stories rarely
make the front page of the New York Times. Just ask TYMNET about XRAY.
What's amazing isn't that it is so easy to hack the systems. Its amazing
it doesn't happen more.
What's frightening is the computer-related (especially Internet related)
companies are the ones most aware of these threats, and have done the most
to protect against them. The same threats exist on every single computer
network. Just because your system isn't connected to the Internet doesn't
mean its safe. It only means you are less likely to hear about it.
--
Sean Donelan, Data Research Associates, Inc, St. Louis, MO
Affiliation given for identification not representation
Patrick Horgan
They were in a file, he made a copy.
Patrick
--
These opinions are mine, and not Amdahl's (except by coincidence;).
~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~
/ | | (\ \
| Patrick J. Horgan | Amdahl Corporation | \\ Have |
| pat...@oes.amdahl.com | 1250 East Arques Avenue | \\ _ Sword |
| Phone : (408)992-2779 | P.O. Box 3470 M/S 316 | \\/ Will |
| FAX : (408)773-0833 | Sunnyvale, CA 94088-3470 | _/\\ Travel |
\ | O16-2294 | \) /
~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~
Gary Harland
Ronald Austin
: > Who says he did it?
: Caught red-handed. The FBI found all 20,000 numbers on a printout in his
: room.
"In his room"? Doubtful. Why would he print out 20,000 cc #'s. I think you
have made this up. I challenge you to produce a reference. If I'm wrong
then I'll apologize.
: Remember a few facts:
^
of John Markoff's
: -- Shimomura's files were found in a private account on well.com,
: which had been cracked without the account owner's knowledge.
: Shimomura traced the hacker who was using that account and found
: Mitnick on the other end of the line.
What has the Well said about the validity of this?
: -- Mitnick has been a fugitive since 1988, when he broke parole in
: California. Since then, he has also been wanted on federal felony
: charges. He has been living in hiding, under an assumed name.
Which, of course, proves that he did everything the NYT alleges.
: -- Shimomura did not know where Mitnick lived, or that he was involved.
: All Shimomura did was trace the hacker's phone calls, and they led
: directly to Mitnick's apartment, outside Raleigh NC.
Mitnick was suspected as far back as the Sonoma conference which was
prior to the CERT release and NYT article. The statementin the NYT that
it wasn't known until last Saturday about Mitnick strains the credibility of
the author of the article.
: -- Your hypothetical "someone else" would have had to (i) know where
: Mitnick was, (ii) trick Mitnick into breaking into well.com (so
: that Shimomura could catch him red-handed), and (iii) would have
: had to trick Shimomura into thinking that there was only a single
: hacker involved.
I agree that they got the right guy and that this "someone else" theory,
while it might work for OJ, fails dismally here. Question is, what did
he really do? Since it all took place on the internet shouldn't we be
able to come to a conclusion without relying on what the NYT feeds us?
: -- There is no direct evidence that anyone other than Mitnick was
: involved. No evidence that Mitnick or Shimomura was tricked.
: No evidence that anyone knew where Mitnick was (if anyone had
: known, why not just turn him in and collect the reward for info
: leading to arrest of a federal fugitive). And Mitnick was found
: with Shimomura's files, netcom's credit card numbers, etc in his
: possession.
Reward???
: Mitnick made the same mistake as Ramzi Yusef (the recently-captured WTC
: bombing suspect): if you are a fugitive from justice, don't do things
: likely to attract attention to yourself. By breaking into Shimomura's
: computers, Mitnick led investigators directly to his apartment. Real
: dumb.
By the time the press is done with him he might as well be Ramzi Yusef.
Between the two I'd rather be Ramzi. Mitnick has been labeled a
"terrorist" far more often.
RMA
firebug
: Mike Anderson (mik...@eskimo.com) wrote:
: : Yesterday's NY Times article mentioned Kevin Mitnick had grabbed
: : approximately 20,000 credit card numbers belonging to customers of
: : Netcom. Anybody know how he did it?
: WHo says he did it?
Netcom and the FBI.
Alan L. Bostick
>Mike Anderson
>mik...@eskimo.com
It is my opinion that Mitnick got the Netcom credit card numbers via
his trick of IP spoofing to get past firewalls.
Netcom's credit card database is (or was) kept behind a firewall, so
that normally only privileged users (root or some other admin accounts)
could access it.
Shortly before the widely-publicized break-in of the computer in San Diego
on Christmas Day, Netcom experienced a rash of hacking-type events. It
is my speculative opinion that Mitnick was refining the IP-spoofing attack
then, and used it to grab the credit card database.
(n.b.: At the time of the hack events in December, Netcom assured its
users that the hacks were not done using privileged access, and in
particular the credit card database was uncompromised. On January
3, account information provided on login suddenly went away, possibly
because Netcom noticed the theft and took the database completely
offline.)
--
Alan Bostick | The nice thing about quotes is that they give
abos...@netcom.com | a nodding acquaintance with the originator
finger for PGP public key | which is often socially impressive.
Key fingerprint: | Kenneth Williams
50 22 FB 46 41 A3 17 9D F7 33 FF E1 4E 1C 89 79 +legal_kludge=off
Joe Flodin
surprise that they got hacked. I suspect Eskimo North is a harder
target...
I'm wondering if Mitnick is one of the people they were talking about a
couple of weeks ago when they were talking about fooling servers into
thinking they were talking to other local servers (or whatever that was)?
--
"You are in a maze of twisty little messages, all different."
"Kinky: What I do. Perverted: What you do that I won't."
"You know when I get in the mashed potatoes with my doorknob, all she do is cry and cry cause the little volleyball don't have no liver or lungs..."
Peter G. Strangman
mi...@panix.com "Charlie Mingo" writes:
> Everyone agrees that Mitnick appears not to have -used- the credit card
> numbers, but he took them and kept them. I believe they will
> substantially enhance his sentence under the federal guidelines (because
> they make his crimes ones of significant financial gain).
Uh, where is the 'significant financial gain' if he didn't use them?
--
Peter G. Strangman | Wer weiss was die wohl glauben,
Pe...@adelheid.demon.co.uk | Die uns zum Glauben schrauben?
http://134.220.198.66:8000 | (Friedrich von Logau)
Ronald Austin
: In article <3i41op$9...@news.primenet.com>, aus...@primenet.com (Ronald
: Austin) wrote:
: > : > Who says he did it?
: >
: > : Caught red-handed. The FBI found all 20,000 numbers on a printout in his
: > : room.
: >
: > "In his room"? Doubtful. Why would he print out 20,000 cc #'s. I think you
: > have made this up. I challenge you to produce a reference. If I'm wrong
: > then I'll apologize.
: What are you, his lawyer? New York Times, Thursday Feb 16, page D17.
No. I'm not a lawyer. The NYT article does not state that he had 20,000
numbers on a printout in his room. As we differ on what constitutes fact
regarding the actions of Mr. Mitnick, I have taken up all of your other
points with you via e-mail.
RMA
Charlie Mingo
> : > Who says he did it?
>
> : Caught red-handed. The FBI found all 20,000 numbers on a printout in his
> : room.
>
> "In his room"? Doubtful. Why would he print out 20,000 cc #'s. I think you
> have made this up. I challenge you to produce a reference. If I'm wrong
> then I'll apologize.
What are you, his lawyer? New York Times, Thursday Feb 16, page D17.
Everyone agrees that Mitnick appears not to have -used- the credit card
numbers, but he took them and kept them. I believe they will
substantially enhance his sentence under the federal guidelines (because
they make his crimes ones of significant financial gain).
> : -- Shimomura's files were found in a private account on well.com,
> : which had been cracked without the account owner's knowledge.
> : Shimomura traced the hacker who was using that account and found
> : Mitnick on the other end of the line.
>
> What has the Well said about the validity of this?
The Well was freaking out, because they had agreed to leave Mitnick
undisturbed so he could be watched and traced, but this meant leaving the
Well completely vulnerable to Mitnick's doings.
Wednesday morning, Mitnick erased ALL the Well's accounting records, which
shut them down for a few hours, and brought some real soul-searching about
whether they could continue to risk letting Mitnick ravage their system.
A few hours later Mitnick was arrested.
Source: NY Times, Friday Feb 17, at D1.
> : -- Mitnick has been a fugitive since 1988, when he broke parole in
> : California. Since then, he has also been wanted on federal felony
> : charges. He has been living in hiding, under an assumed name.
>
> Which, of course, proves that he did everything the NYT alleges.
It means that Shimomura (or your imaginary "someone else") couldn't find
Mitnick to frame him. It's very hard to set up someone you can't
contact. If you espouse a frame-up theory, you have to deal with the
facts that contradict it.
> Question is, what did
> he really do? Since it all took place on the internet shouldn't we be
> able to come to a conclusion without relying on what the NYT feeds us?
The NYT gives you the facts; you are free to draw your own conclusions.
What he did: he broke into and trashed shimomura's computer (stealing many
programs). He broke into and trashed the well (doing a lot of damage even
before he finally started erasing things that didn't belong to him). He
broke into netcom and stole 20,000 credit card numbers.
He is also wanted on another federal felony warrent related to computer
break-ins a few years ago. And he is still wanted by the state of
California for breaking parole in 1988.
> By the time the press is done with him he might as well be Ramzi Yusef.
> Between the two I'd rather be Ramzi. Mitnick has been labeled a
> "terrorist" far more often.
Mitnick isn't violent like Yusef, but he is also facing many, many years
in prison because he couldn't lay low. Both of them had made a clean
getaway and were in no danger of capture, as long as they refrained from
attracting attention.
It was really stupid of Mitnick to resume cracker activities while a
fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
so he could insult Tsutomu? He must be sick (so addicted to computer
breakins, he can't stop himself even when it's in his self-interest to
refrain). It's just not worth it.
Paul D. Robertson
[snip]
: Regarding Mitnick being tracked down - a report on CNN said he was operating
: from a pick up truck with a cellphone. Is this right, or did I not hear wrong?
Most reports have him in his apartment.
: If it was a cellphone, how difficult are these to track down? Do you need a
: scanner that follows the channels with a directional aerial? Or can it be done
Yep, directional.
: from the base stations by measuring timing differences? And if it is this easy,
: why aren't the phone companies cracking down on cloned cellphones?
Most cloned cell users don't spend HOURS on a call.
: One last question - any ideas on what sort of prison will Mitnick end up in?
Federal.
: Gary
--
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
prob...@clark.net which may have no basis whatsoever in fact."
PSB#9280
Paul D. Robertson
[snip]
: Apparently the files that Mitnick broke in to the guy's machine
: specifically to get were Shimomura's detailed hacker files on
: how to hack cellular systems. I want to know what he was doing
: with those in the first place. Markoff mentioned that Shimomura
Probably designing ways around them. I have Crack, BruteForce,
CrackerJack, and a few more programs on my system. That doesn't
mean I'm going to try to break into your computer.
: did security consulting work for the NSA. (Which also strikes me
: as weird because I thought he was a Japanese national, and that
: we foreigners had a snowball's chance in hell of ever working for
: the NSA...) I think there's a whole angle to this story that's
: still to come out.
He is a Japaneese national. I'd guess that NSA would use anyone who was
usefull, that doesn't mean he'd be given access to anything important.
US national consultants WITH security clearances aren't even given full
run of the mill.
: G
Paul.
Marcus J Ranum
>Since it all took place on the internet shouldn't we be
>able to come to a conclusion without relying on what the NYT feeds us?
How about the simple reason that just because it happened on
the Internet doesn't mean that you or I *KNOW* anything about it??
Whether or not you believe what NYT is saying or not is up to you, but
they are offering things purporting to be facts, and you are offering
mere speculation. Making things up and saying "it could have happened
like this" or "I don't believe it" is a very easy position to take and
defend, since it doesn't entail actually adding anything useful to the
discussion.
mjr.
Neil Woods
: I think the real story here that's gone uncommented is Shimomura...
: Apparently the files that Mitnick broke in to the guy's machine
: specifically to get were Shimomura's detailed hacker files on
: how to hack cellular systems. I want to know what he was doing
: with those in the first place. Markoff mentioned that Shimomura
: did security consulting work for the NSA. (Which also strikes me
: as weird because I thought he was a Japanese national, and that
: we foreigners had a snowball's chance in hell of ever working for
: the NSA...) I think there's a whole angle to this story that's
: still to come out.
Is it true Mitnick hacked Shimomura's home computer? I find this
difficult to believe, given Shimomura's talents noted in this thread.
Also, I'm sure that Shimomura would have encrypted such sensitive
files, was Mitnick monitoring his keystrokes?
Cheers,
Neil
--
Let the Mystery Be, So Watcha Want, Longing In Their Hearts, Hate My Way,
M-Bike, Safari, Uncle June and Aunt Kiyoti, Daisy Dead Petals, Tuff Gnarl.
...like a badger with an afro throwing sparklers at the Pope...
Timothy Brown
you can track them down pretty easy (I would think they'd have to
know/estimate/whatever where the hell he was). He was probably
stationary, and the only thing they'd have to do is figure out what cell
site he was on.
how...@world-net.sct.fr wrote:
: >It was really stupid of Mitnick to resume cracker activities while a
: >fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
: >so he could insult Tsutomu? He must be sick (so addicted to computer
: >breakins, he can't stop himself even when it's in his self-interest to
: >refrain). It's just not worth it.
: Most crimes are committed by people who are not expecting to get caught,
: whether it be burglary, murder or hacking. This is why deterrents don't work.
: Regarding Mitnick being tracked down - a report on CNN said he was operating
: from a pick up truck with a cellphone. Is this right, or did I not hear wrong?
: If it was a cellphone, how difficult are these to track down? Do you need a
: scanner that follows the channels with a directional aerial? Or can it be done
: from the base stations by measuring timing differences? And if it is this easy,
: why aren't the phone companies cracking down on cloned cellphones?
: One last question - any ideas on what sort of prison will Mitnick end up in?
: Gary
--
Timothy C. Brown <t...@inlink.COM> | US Mail: 2733 McClay Valley Blvd
Independent Computer Consultant | St. Peters, MO 63376
(314) 928-5545: Voice (After 3pmCST) |
(314) 670-9464: 24 Hour Emergency Pager | Information available by finger
--
Geek Code v2.1: GCM/CS/S/AT
d- H S+:- !g p1 !au a15 w+ v++ C++++ UB++++ LB++++ P--- L+++
3+++ E---- N+++ K---- W M++ V-- po+++ Y+ t+++ 5 j R+ G? tv++
b+++ D+++ B--- e++++ u* h! f+ r n---- y+
firebug
: Netcom's credit card database is (or was) kept behind a firewall, so
: that normally only privileged users (root or some other admin accounts)
: could access it.
It is currently, so they say. But in the past it was not. I'm not sure if
they've admitted this or not, but many users have indicated that the nature
of the accounting programs made it clear that it was not behind a firewall.
Bruce Miller
articles you've read, lived in the U District until about Oct 27 1994,
when his apartment was searched by law enforcement. At the time,
they didn't know the apartment they were searching was really Mitnick's.
They left the search warrant on the table and he returned, and split
town.
how...@world-net.sct.fr
>fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
>so he could insult Tsutomu? He must be sick (so addicted to computer
>breakins, he can't stop himself even when it's in his self-interest to
>refrain). It's just not worth it.
Most crimes are committed by people who are not expecting to get caught,
Graham Toal
> What he did: he broke into and trashed shimomura's computer (stealing many
> programs). He broke into and trashed the well (doing a lot of damage even
> before he finally started erasing things that didn't belong to him). He
> broke into netcom and stole 20,000 credit card numbers.
I think the real story here that's gone uncommented is Shimomura...
Apparently the files that Mitnick broke in to the guy's machine
specifically to get were Shimomura's detailed hacker files on
how to hack cellular systems. I want to know what he was doing
with those in the first place. Markoff mentioned that Shimomura
did security consulting work for the NSA. (Which also strikes me
as weird because I thought he was a Japanese national, and that
we foreigners had a snowball's chance in hell of ever working for
the NSA...) I think there's a whole angle to this story that's
still to come out.
G
Graham Toal
> It was really stupid of Mitnick to resume cracker activities while a
> fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
> so he could insult Tsutomu? He must be sick (so addicted to computer
> breakins, he can't stop himself even when it's in his self-interest to
> refrain). It's just not worth it.
He's been cracking all the time he was on the run. A friend in
England was under intense scrutiny by Mitnick all last year while
he was manager of a VMS security company. Received 'social-
engineering' phone calls from him from the US and everything.
G
Peter G. Strangman
> Markoff mentioned that Shimomura
> did security consulting work for the NSA. (Which also strikes me
> as weird because I thought he was a Japanese national, and that
> we foreigners had a snowball's chance in hell of ever working for
> the NSA...) I think there's a whole angle to this story that's
> still to come out.
I have absolutely no doubt the NSA will use *any* means at
their disposal.
If there is a tool to do a job, which a security agency needs
doing, the agency will have *no* hesitation in using that tool,
no matter where it originates.
The people who run such agencies are amongst the most devious,
coniving ba****ds that have ever been born - they have to be.
The above applies to all such agencies, throughout the world.
--
| Es ist ein Volk, das heisst Statisten,
Peter G. Strangman | Ist von Verstand und scharfen Listen;
Pe...@adelheid.demon.co.uk | Doch meinen viel, es ist nicht Christen.
media
last several days. A big part of the reason Mitnick got so far was that
the operators of the Well (and probably others) agreed to open their
networks completely - to let him operate unimpeded - and eventually trap
him. Fascinating stuff - like something out of the old west. By the way
I think the operators of the Well deserve a round of applause from all of
us for cooperating with the efforts to catch this nut.
Paul
Mike Kenney
Alan L. Bostick <abos...@netcom.com> wrote:
>mik...@eskimo.com (Mike Anderson) writes:
>
>>Yesterday's NY Times article mentioned Kevin Mitnick had grabbed
>>approximately 20,000 credit card numbers belonging to customers of
>>Netcom. Anybody know how he did it?
>
>>It's a little unnerving, knowing that someone can get into a company as
>>big as Netcom and grab customer data like that. I've given my credit
>>card # by voice to a number of online services for billing purposes, and
>>I'd hate to think THAT info could easily hacked.
>
>>If you don't know, feel free to take a wild guess! Let's see what we can
>>come up with!
>
>>Mike Anderson
>>mik...@eskimo.com
>
>It is my opinion that Mitnick got the Netcom credit card numbers via
>his trick of IP spoofing to get past firewalls.
Don't forget, this "trick" relied on the target machine having a root
account with a .rhosts file ... IMHO a very bad idea. Did Netcom make
this sloppy mistake as well?
--
Mike Kenney
mi...@apl.washington.edu
Edicius
On 20 Feb 1995, Richie Lai wrote:
> Nah, he'd probably plead insanity or something like that.. I remmeber
> vaguely of a case that happened a while's ago where a convicted computer
> cracker pleaded insanity or something because the psychatrist had diagnosed
> him as being addicted to computers or something to that effect..
i don't know if he will plead insanity, but his therepist is quoted in
several ap articles as saying that mitnick is a "sad, lonely, angry,
isolated, boy". so his therepist will play a major role in the court
case. lets hope cnn covers this one, and not oj.
edicius (tom sullivan)
email - e...@crow.cybercom.com
our first amendment is a right - free mitnick
Benard Aart Mesander
Why does it rely on /.rhosts? I believe the CERT announcement
mentioned hijacking existing TCP connections. If there was a TCP
connection into the target machine (an administrative machine of some
sort?) from anywhere, wouldn't it be possible to send text over the
TCP connection with this sort of attack? And why only get in as root?
On many systems, getting in as nonpriv'd account like bin or daemon is
sufficient to break root trivially. Or even getting in with the userid
of someone who is known to su to root. These can be obtained with
systems in /etc/hosts.equiv. I think the bad idea is IP based access
control - it is not limited to /.rhosts.
If you're thinking of the attack I think you're thinking of, it not
only requires a root /.rhosts, but also the host mentioned in the rhosts
must be down, because if you just forge packets from some random host,
the random host will sent a TCP reset...
--
%!Ben Mesander oink This is not official USGS policy, etc.
newpath 288 396 216 0 360 arc 288 612 moveto 288 180 lineto 288 396
moveto 136 244 lineto 288 396 moveto 440 244 lineto 36 setlinewidth
stroke showpage
Edicius
> no cameras in federal court.
isn't oj in federal court?
Bob Surenko
>isn't oj in federal court?
>
Hope not, murder is not a federal crime.
--------------------------------------------------------
- Bob Surenko sur...@fred.net
- http://www.fred.net/surenko/ finger for PGP key
--------------------------------------------------------
Charles Manson
They caught him by basicly; using a bi-directional antenae and probablaby
some software that was written, it really isn't very difficult but is
very time lengthening. If Kevin was more concerneed aobut his safety, and
not sloppy, he himself would of used a bi-directional antanae to send the
rf signals to other cell sites, taht would have slowed the
authorites...another option would have been to penatrate w/ the cellular
switch, or if he was on a dms implemented tactics that the dms provieds
w/ wireless communications....later..
CM
Michael Andrew Iverson
|> Graham Toal (gt...@gtoal.com) wrote:
|>
|> : I think the real story here that's gone uncommented is Shimomura...
<...>
|> : with those in the first place. Markoff mentioned that Shimomura
|> : did security consulting work for the NSA. (Which also strikes me
|> : as weird because I thought he was a Japanese national, and that
|> : we foreigners had a snowball's chance in hell of ever working for
|> : the NSA...) I think there's a whole angle to this story that's
|> : still to come out.
<...>
|> Also, I'm sure that Shimomura would have encrypted such sensitive
|> files, was Mitnick monitoring his keystrokes?
|>
The file he had probably weren't sensitive. Governments tend to be
very paranoid about where sensitive files are. He probably had a grant
from the NSA to provide an unclassified report on cellular phone
security.
Mike
Richie Lai
: In article <3i41op$9...@news.primenet.com>, aus...@primenet.com (Ronald
: Austin) wrote:
: It was really stupid of Mitnick to resume cracker activities while a
: fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
: so he could insult Tsutomu? He must be sick (so addicted to computer
: breakins, he can't stop himself even when it's in his self-interest to
: refrain). It's just not worth it.
Nah, he'd probably plead insanity or something like that.. I remmeber
vaguely of a case that happened a while's ago where a convicted computer
cracker pleaded insanity or something because the psychatrist had diagnosed
him as being addicted to computers or something to that effect..
-Richie
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
primary: ind0...@pegasus.cc.ucf | Walking into the future holding
other: l...@gate.net | the past's hand will hide the present
r...@peace.engr.ucf.edu | --
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Lee Silverman
> |> Also, I'm sure that Shimomura would have encrypted such sensitive
> |> files, was Mitnick monitoring his keystrokes?
> very paranoid about where sensitive files are. He probably had a grant
> from the NSA to provide an unclassified report on cellular phone
> security.
I believe that if the documents were classified, they would not
be allowed on *any* networked computer, behind a firewall or not.
I would also venture to guess that most classified documents are military
or otherwise national-security related. I can't see how cellular
telephone switching information would be related to national security --
if it were then all the cellular techs who worked on it would need a
security clearance.
--
Lee Silverman, Brown class of '94, Brown GeoPhysics ScM '95
Email to: Lee_Si...@brown.edu
Phish-Net Archivist: phish-a...@phish.net
"Nonsense - you only say it's impossible because nobody's ever done it."
Charlie Mingo
wrote:
> mi...@panix.com "Charlie Mingo" writes:
>
> > Everyone agrees that Mitnick appears not to have -used- the credit card
> > numbers, but he took them and kept them. I believe they will
> > substantially enhance his sentence under the federal guidelines (because
> > they make his crimes ones of significant financial gain).
>
> Uh, where is the 'significant financial gain' if he didn't use them?
You can sell them on the street. He knew they were quite valuable when he
took them. Even if each stolen number were only worth a hundred dollars
or so, 20K numbers works out to millions of dollars.
Charlie Mingo
> Most crimes are committed by people who are not expecting to get caught,
> whether it be burglary, murder or hacking. This is why deterrents don't work.
They may not -expect- to get caught, but they know the risks. Mitnick had
been caught and punished a number of times before.
> Regarding Mitnick being tracked down - a report on CNN said he was operating
> from a pick up truck with a cellphone.
The reports I saw said he was in his apartment; indeed, that is how they
tarcked him down to his apartment -- by following the cellular signal.
> If it was a cellphone, how difficult are these to track down? Do you need a
> scanner that follows the channels with a directional aerial? Or can it be
> done from the base stations by measuring timing differences?
Tsutomu had a scanning device, with a directional antenna, hooked up to a
notebook. He managed to locate the building the signal was coming from,
but he couldn't find the exact room. The FBI came in with better
equipment, found the room, and got a warrent to enter.
> And if it is this easy,
> why aren't the phone companies cracking down on cloned cellphones?
Mitnick was an easy target because (i) he stayed in one place, (ii) he
stayed on lines for hours at a time, and (iii) he called in at the same
time every day. Even so, it took Tsutomu over a month to track him down.
> One last question - any ideas on what sort of prison will Mitnick end up in?
Last time he was in federal prison, it was Lompoc, a minimum-security
facility in California, where white-coller felons like Mikken and Boesky
served their time. Its tennis courts and campus-like atmoshpere have
given it the nickname "Club Fed."
I suspect that this time he will be at a higher-security, lower-amenity
facility. If nothing else, because he will be doing a much longer
sentence that the one-year he got last time.
Charlie Mingo
> Is it true Mitnick hacked Shimomura's home computer? I find this
> difficult to believe, given Shimomura's talents noted in this thread.
He did it. Shimomura apparently accorded special access to certain
trusted hosts, and Mitnick impersonated such a host.
> Also, I'm sure that Shimomura would have encrypted such sensitive
> files, was Mitnick monitoring his keystrokes?
I think the files we are talking about are rather big, and also Shimomura
may have been actively working on and/or using them, so some of them may
have to have been left decrypted.
Charlie Mingo
(Richie Lai) wrote:
> Nah, he'd probably plead insanity or something like that.. I remmeber
> vaguely of a case that happened a while's ago where a convicted computer
> cracker pleaded insanity or something because the psychatrist had diagnosed
> him as being addicted to computers or something to that effect..
Addiction is not a defense.
There was a brief time (in the late 60's) that an "irresistable impulse"
could be used to support an insanity plea in the federal courts, but they
quickly returned to more traditional tests of insanity (some form of
inability to tell right from wrong).
Charlie Mingo
> On Mon, 20 Feb 1995, Charlie Mingo wrote:
>
> > no cameras in federal court.
>
> isn't oj in federal court?
heavens no!
california state court. los angeles county superior court, to be precise.
plain ordinary murder isn't even a federal crime.
murdering (say) a mail-carrier would be.
Mike Kenney
Benard Aart Mesander <b...@piglet.cr.usgs.gov> wrote:
>In article <3i9fl4$d...@nntp1.u.washington.edu> mi...@wavelet.apl.washington.edu (Mike Kenney) writes:
>
> Don't forget, this "trick" relied on the target machine having a root
> account with a .rhosts file ... IMHO a very bad idea. Did Netcom make
> this sloppy mistake as well?
>
>Why does it rely on /.rhosts? I believe the CERT announcement
>mentioned hijacking existing TCP connections. If there was a TCP
>connection into the target machine (an administrative machine of some
>sort?) from anywhere, wouldn't it be possible to send text over the
>TCP connection with this sort of attack? And why only get in as root?
>On many systems, getting in as nonpriv'd account like bin or daemon is
>sufficient to break root trivially. Or even getting in with the userid
>of someone who is known to su to root. These can be obtained with
>systems in /etc/hosts.equiv. I think the bad idea is IP based access
>control - it is not limited to /.rhosts.
No, hijacking an existing connection would be much more difficult (for one
thing you need to be able to monitor the local net and if you could do
that you could just grab passwords).
The attack on Shimomura's machine involved a spoof in which a single rsh
command was issued:
echo + + >> /.rhosts
To run rsh as root requires that /.rhosts exist and contain the name of the
remote host (the host being spoofed).
>
>If you're thinking of the attack I think you're thinking of, it not
>only requires a root /.rhosts, but also the host mentioned in the rhosts
>must be down, because if you just forge packets from some random host,
>the random host will sent a TCP reset...
Not if the host being spoofed is "busy". If you read Shimomura's account of
attack, you will see that the host being spoofed was flooded with TCP
connection requests from a non-existent host. This filled the connection
queue ... in this state, the host will not generate resets.
--
Mike Kenney
mi...@apl.washington.edu
Charlie Mingo
mi...@wavelet.apl.washington.edu (Mike Kenney) wrote:
> If you read Shimomura's account of
> attack, you will see that the host being spoofed was flooded with TCP
> connection requests from a non-existent host.
Where was that published?
Charlie Mingo
> I want to know what he [Tsutomu] was doing
> with those in the first place.
Tsutomu is a security researcher at SDSC, and one of the things he
investigates is the security (or lack thereof) in the cellular phone
system. He testified before Congress on this subject in mid-1993. He is
a recognized authority.
> Shimomura
> did security consulting work for the NSA. (Which also strikes me
> as weird because I thought he was a Japanese national, and that
> we foreigners had a snowball's chance in hell of ever working for
> the NSA...)
I think most (but not all) foreigners would have trouble getting security
clearance, but there are things the NSA does that would not require formal
clearance. Investigating cellular phone security would be one, since it
is not a national security issue.
Charlie Mingo
Robertson) wrote:
> US national consultants WITH security clearances aren't even given full
> run of the mill.
Sure hope not: Aldrich Ames was a US national (and a full-time employee)
with full clearence.
I believe the concept of limiting access on a need-to-know basis is called
"compartmentalized information," although Ames demonstrated that the CIA's
compartments were rather leaky.
Charlie Mingo
Austin) wrote:
> Do you suppose Shimomura's boss, who valued the cell software at
> $500,000 to 1,000,000 would put the same price on Crack, BruteForce,
> CrackerJack, etc? I bet he would if that's what was needed in an
> affadavit to motivate the court.
The valuation may easily have been determined by calculating how much time
Tsutomu had spent developing it. That's a pretty normal way to value
custom-developed software which is not available on the market.
For example, if you ask NASA to tell you how much the software on the
Space Shuttle is worth, they will tell you how much it cost them to
develop.
> Now, how about if you helped produce the Crack software so that a
> friend could SELL it to hackers and others?
No evidence that the San Diego Supercomputing Center supports itself by
selling cracking tools. On the contrary, it gets federal funding.
Charlie Mingo
Edicius <e...@crow.cybercom.com> wrote:
> lets hope cnn covers this one, and not oj.
no cameras in federal court.
C.Bird
I think the case refers to a English cracker, Paul (?) Bedworth
who was tried along with two partners for a series of breaks
using academic sites as the jumping off points. The other two
individuals pleaded guilty to offences under the Computer
Misuse act in the UK, but Bedworth put up a _sucessful_ defence
that he was suffering from an addiction to hacking that made
him do it, even though he knew it be wrong and illegal
If anyone really wants, I'll try to look out some references
to the case, and the aquittal. It has certainly worried
some police officers in the field, as to whether it has
set a precedent that will make prosecution much harder.
--
| Charles Bird Email : c.b...@umds.ac.uk |
| IPG, Anatomy, UMDS WWW: http://www-ipg.umds.ac.uk/ |
| Guy's Hospital Campus Voice : +44 171-955 5000 x 3149 |
| London UK SE1 9RT ** #include <disclaimer.h> ** |
Michael Andrew Iverson
|>
|> On Mon, 20 Feb 1995, Charlie Mingo wrote:
|>
|> > no cameras in federal court.
|>
|> isn't oj in federal court?
|>
Mark Horn
>I don't quite understand all the fuss about credit card numbers. At the end
>of the day, they still need your signature. I someone uses my credit card
>details fraudulently and I have not signed the sales receipt then surely I am
>not liable for any loss.
Gary Barnes <g...@aber.ac.uk> wrote:
>And what about mail order? Purchasing by phone?
Well, if someone uses my credit card for a purchase that I didn't authorize, I
call up my credit card company and say, "Hey, I didn't buy this!" and my
credit card company goes and tries to verify with the company that put the
charge on the card. If that company can pruduce proper records (e.g. a copy
of a receipt with my signature on it), and delivers them to my credit card
company, my credit card company will either verify those records and allow the
charge against me, or deny the records and remove the charge.
In any case, if a sale is made with my credit card number, someone is going to
pay for the service/product that was sold. It's either going to be me, or the
company that sold the service/product. This is independant of whether it's an
authorized use of my credit card number or not.
So the fuss about credit card numbers is not just to protect me from the loss
of my credit card number. It's to protect the businesses that accept credit
cards from the loss of my credit card number, too.
--
Mark Horn (sparkie)
ho...@mickey.jsc.nasa.gov
Charlie Mingo
L Heil) wrote:
> Mitnick himself used that defense in his last court appearance. It
> worked, sparing him some heavy jail time under the condition that he seek
> treatment and therapy for his addiction.
There is a big difference between using addiction as a defense to the
charges (impossible) and using addiction as grounds for leniency in
sentencing (possible).
In any case, the power of a federal judge to show leniency has been
substantially reduced by the federal sentencing guidelines, which require
judges to apply a formula to arrive at a narrow sentencing range
(typically +/- 5% of some number of months). Parole is eliminated, and
time off for good behavior is strictly limited.
In Mitnick's case, the formula will point to a high sentence because (i)
this would be his third (at least) felony conviction, and (ii) the stolen
credit card numbers greatly increase his presumed financial gain from his
actions.
Bruce Miller
where I used to live. He was living there under a different name. I
know this from the 40-pages of info faxed to me, including the search
warrant and the testimony of cellular fraud investigators.
Ryan L Heil
Mitnick himself used that defense in his last court appearance. It
worked, sparing him some heavy jail time under the condition that he seek
year, reportedly not _touching_ a computer during that time (another
condition of his probation). But then, one day he vanished into the
underground, and began hacking again. The rest is recent history.
RLH
--
"In what distant sweeps or skies | Ryan L. Heil
Burnt the fire of thine eyes? | rh...@mail.sas.upenn.edu
On what wings dare he aspire? | rh...@marlton.1dc.com
What the hand dare seize the fire?" | - William Blake 1793(1794) -
Gary Barnes
Paul Howes <spx...@astro.cf.ac.uk> wrote:
:In article 2...@eskimo.com, mik...@eskimo.com (Mike Anderson) writes:
:>
:> It's a little unnerving, knowing that someone can get into a company as
:> card # by voice to a number of online services for billing purposes, and
:> I'd hate to think THAT info could easily hacked.
:
:I don't quite understand all the fuss about credit card numbers. At the end
:details fraudulently and I have not signed the sales receipt then surely I am
:not liable for any loss.
And what about mail order? Purchasing by phone?
Gaz
--
/\./\ g...@aber.ac.uk (Gary "Wolf" Barnes)
( - - ) Lister: Oh F*** I've missed my line. 15000... [To filmcrew:] Yeah?
\ " / 15000 Geegooks and closing.
~~~ Kryten: Now I've missed mine!
The R R M Tweek
>
>On Mon, 20 Feb 1995, Charlie Mingo wrote:
>
>> no cameras in federal court.
>
>isn't oj in federal court?
Nope... In fact, very few cases of murder are handled in the Federal
Courts... and when they are... the charge isn't usually called murder.
--
tw...@ccnet.com tw...@tweekco.ness.com WW4Net-1@11551 DoD #MCMLX N6QYA
**** Regarding the Internet><WWIVNet gateway and other assorted stuff: ****
http://www.io.com/user/tweek/ tw...@io.com IM: Michael D. Maxfield
Paul Howes
>
> It's a little unnerving, knowing that someone can get into a company as
> big as Netcom and grab customer data like that. I've given my credit
> card # by voice to a number of online services for billing purposes, and
> I'd hate to think THAT info could easily hacked.
>
I don't quite understand all the fuss about credit card numbers. At the end
of the day, they still need your signature. I someone uses my credit card
details fraudulently and I have not signed the sales receipt then surely I am
not liable for any loss.
Another point, every time I have ever made a credit card transaction, someone
gets a copy of all my credit card details. My credit card number is hardly
a great secret.
Paul Howes.
Greg Schreurs
year
Greg
peter honeyman
|> The NYT gives you the facts; you are free to draw your own conclusions.
as a long-time reader of the nyt, i suggest that you have things
reversed. the nyt gives you their conclusions. you are free to
try to infer the facts.
peter
Riku Saikkonen
>Benard Aart Mesander <b...@piglet.cr.usgs.gov> wrote:
>The attack on Shimomura's machine involved a spoof in which a single rsh
>command was issued:
> echo + + >> /.rhosts
>To run rsh as root requires that /.rhosts exist and contain the name of the
>remote host (the host being spoofed).
But how could that command be issued? Spoofing a trusted machine? Having a
trusted (esp. ~root/.rhosts-trusted) machine outside one's local network
(assuming that a firewall filters out packets coming from the `wrong side')
is pretty unwise, I'd say.
Which brings me to a more general topic... Why use .rhosts at all since it's
so insecure? Is it so much bother to type a password every now and then
(it's not _that_ often that you need to login to another machine, especially
a priviledged account...)?
Would it be a good idea to recompile rlogind (and the other r*ds) with
reading of .rhosts removed?
>>If you're thinking of the attack I think you're thinking of, it not
>>only requires a root /.rhosts, but also the host mentioned in the rhosts
>>must be down, because if you just forge packets from some random host,
>>the random host will sent a TCP reset...
>Not if the host being spoofed is "busy". If you read Shimomura's account of
Or if the spoofer also spoofs an ICMP Redirect to the machine redirecting
the packets to the spoofer's machine (or somewhere else)...
By the way, ICMP Redirect (and ICMP Network Unreachable) is another
`protocol' which authentificates by the source IP address...
--
-=- Rjs -=- r...@spider.compart.fi - IRC: Rjs
"Well, dearest friend, the tree grows best in the land of its sires;
but for you in all the lands of the West there will ever be a welcome."
- J.R.R. Tolkien
Mike Dell
>In article <3i78k5$9...@sct1.sct.fr>, how...@world-net.sct.fr wrote:
>The reports I saw said he was in his apartment; indeed, that is how they
>tarcked him down to his apartment -- by following the cellular signal.
>
>> If it was a cellphone, how difficult are these to track down? Do you need a
>> scanner that follows the channels with a directional aerial? Or can it be
>> done from the base stations by measuring timing differences?
>
>Tsutomu had a scanning device, with a directional antenna, hooked up to a
>notebook. He managed to locate the building the signal was coming from,
>but he couldn't find the exact room. The FBI came in with better
>equipment, found the room, and got a warrent to enter.
Isn't it highly illegal to receive cellular frequenties in the United
States? I thought it was even illegal to own a scanner which has
the possibility to receive these frequencies.
It seems like a strange coincidence that a computer-expert also has knowledge
of directional antennas and that he has time, money and enough motivation to
play around for a few months.
--
M.N. Dell Home-phone : +31 3434 56478
P.O. Box 134 University : +31 30 539209
3956 ZT Leersum The Netherlands Internet : mnd...@cs.ruu.nl
--
Lewis De Payne
: Matthew Osborne (m...@pineapple.apmaths.uwo.ca) wrote:
: : Mike Anderson (mik...@eskimo.com) wrote:
: : : Yesterday's NY Times article mentioned Kevin Mitnick had grabbed
: : : approximately 20,000 credit card numbers belonging to customers of
: : : Netcom. Anybody know how he did it?
: : WHo says he did it?
:
: Netcom and the FBI.
I just got word from my friends at the Injustice Department that the
FBI is continuing very tight surveillance of certain individuals, as
well as following up on leads. I want to personally thank my friend
Ted Gunderson for this tip.
--
"Mum's the word" - Justin Petersen || cc: Kennie G. McGuire, SA, FBI, LA CA
"Did you use SAS?" - Terry Atchley || Kathleen "Hottub" Carson, SA, FBI
"I am not a crook" - Richard Nixon || Behave - or I'll tell Janet Reno!
Sean Donelan
> I don't quite understand all the fuss about credit card numbers. At the end
> of the day, they still need your signature. I someone uses my credit card
> details fraudulently and I have not signed the sales receipt then surely I am
> not liable for any loss.
Different countries have different rules. In the US the basic rule is you
are only liable for the first $50 for charges made without your actual, or
apparent authorization. Your signature is just one of several methods that
can be used to show authorization.
> Another point, every time I have ever made a credit card transaction, someone
> gets a copy of all my credit card details. My credit card number is hardly
> a great secret.
People have this strange, almost instinctive reaction to this. You are
correct that your credit card number is hardly a great secret. Most credit
card security is based on the physical card, not the secrecy of the number.
You could find lots of credit card numbers just by looking through the
trash dumpsters behind any large shopping mall. Yet people don't get
that upset about the failure of shopping malls to put padlocks on their
dumpsters. But NETCOM is taken to task for their poor security. I really
disliked the spin in their public statements (much like Intel's public
statements on the Pentium flaws).
--
Sean Donelan, Data Research Associates, Inc, St. Louis, MO
Affiliation given for identification not representation
cjohn mace
I have been trying to read that story for days, but the sensationalism
makes me sick, every time I pick it up. :-(
> peter
cjohn mace
cjm...@amoco.com
Mike Kenney
Riku Saikkonen <r...@spider.compart.fi> wrote:
>Mike Kenney (mi...@wavelet.apl.washington.edu) wrote:
>>Benard Aart Mesander <b...@piglet.cr.usgs.gov> wrote:
>>The attack on Shimomura's machine involved a spoof in which a single rsh
>>command was issued:
>> echo + + >> /.rhosts
>>To run rsh as root requires that /.rhosts exist and contain the name of the
>>remote host (the host being spoofed).
>
>But how could that command be issued? Spoofing a trusted machine? Having a
>trusted (esp. ~root/.rhosts-trusted) machine outside one's local network
>(assuming that a firewall filters out packets coming from the `wrong side')
>is pretty unwise, I'd say.
The trusted machine was on the local net and it was spoofed.
>
>Which brings me to a more general topic... Why use .rhosts at all since it's
>so insecure? Is it so much bother to type a password every now and then
>(it's not _that_ often that you need to login to another machine, especially
>a priviledged account...)?
As with most security decisions, it comes down to convenience vs. risk
When dealing with a set of trusted hosts on a local net it's probably ok
for users to use ~/.rhosts ... provided you are running relatively
secure systems (ie impossible for a user to become root).
The root account, however, should never use .rhosts (IMHO).
>
>Would it be a good idea to recompile rlogind (and the other r*ds) with
>reading of .rhosts removed?
See above.
The quickest way to deal with the IP spoofing attack is to change the
ISN generation algorithm in the kernel ... there are various ways to
do this and they've all been argued to death in this and other groups :-)
Looks like this change has already been made in Linux ... one of the many
benefits of freely available source code :-)
Of course, these changes are only a stopgap measure until IP authentication
is ready.
>
>>>If you're thinking of the attack I think you're thinking of, it not
>>>only requires a root /.rhosts, but also the host mentioned in the rhosts
>>>must be down, because if you just forge packets from some random host,
>>>the random host will sent a TCP reset...
>>Not if the host being spoofed is "busy". If you read Shimomura's account of
>
>Or if the spoofer also spoofs an ICMP Redirect to the machine redirecting
>the packets to the spoofer's machine (or somewhere else)...
>
>By the way, ICMP Redirect (and ICMP Network Unreachable) is another
>`protocol' which authentificates by the source IP address...
Don't forget about Source Routing ... this can be squashed by tcp_wrappers.
--
Mike Kenney
mi...@apl.washington.edu
Charles Patisaul
>Isn't it highly illegal to receive cellular frequenties in the United
>States?
It is illegal. The cellular industry wanted to claim that calls
made on their phones were private. Rather than spend time and energy on
encryption or other methods of making their calls private, they "legislated"
privacy. So they can say it's private, because you aren't allowed to listen.
>I thought it was even illegal to own a scanner which has
>the possibility to receive these frequencies.
If it is, it's surely a farce. At one time or another, virtually
all households in the USA have had a device which could receive these
frequencies.
All you have to do to intercept cell phone is:
1) Own an oldish television set.
2) Hook up a UHF antenna.
3) Tune around channel 80ish UHF (not the cable versions) until
you hear people talking.
This is for informational purposes only, actually doing the above
would be illegal and could be punishable under federal law.
--
Charles E. Patisaul cha...@vulture.ksc.nasa.gov NASA KSC, Florida USA
Peter Dordal
[re: using IP spoofing to execute "echo + + >>/.rhosts"]
: But how could that command be issued? Spoofing a trusted machine? Having a
: trusted (esp. ~root/.rhosts-trusted) machine outside one's local network
: (assuming that a firewall filters out packets coming from the `wrong side')
: is pretty unwise, I'd say.
IP spoofing doesn't require this. Two local machines, A and B, might
trust each other vi /.rhosts. Then an outside machine K can come
along and send to A the following, *while appearing to be from B*:
echo K root >> /.rhosts
This can be done even if A and B are behind some kinds of firewalls.
A trusts B, and this command *appears* to be from B, and so A does it.
*Now* K can rlogin to A directly, as K is now trusted by A.
: Which brings me to a more general topic... Why use .rhosts at all since it's
: so insecure? Is it so much bother to type a password every now and then
: (it's not _that_ often that you need to login to another machine, especially
: a priviledged account...)?
Because passwords are usually sent as cleartext, and thus can be
(and often are) lifted for later use by others.
True story: It has been widely reported that one of Loyola University's
hosts was the source of the initial Shimomura attack. That particular
host, apollo, I do not have anything to do with. However,
last October I did change the root password on another host here
on the same Ethernet segment as apollo. Within *two hours*
someone logged in from imag.inria.fr, and used this new password.
We were quite startled. Insufficiently startled, though,
as it turned out.
: Would it be a good idea to recompile rlogind (and the other r*ds) with
: reading of .rhosts removed?
Yes, although installation of S/Key would be Even Better.
David Miller
: Charlie Mingo (mi...@panix.com) wrote:
: : In article <3i41op$9...@news.primenet.com>, aus...@primenet.com (Ronald
: : Austin) wrote:
: : It was really stupid of Mitnick to resume cracker activities while a
: : fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
: : so he could insult Tsutomu? He must be sick (so addicted to computer
: : breakins, he can't stop himself even when it's in his self-interest to
: : refrain). It's just not worth it.
: Nah, he'd probably plead insanity or something like that.. I remmeber
: vaguely of a case that happened a while's ago where a convicted computer
: cracker pleaded insanity or something because the psychatrist had diagnosed
: him as being addicted to computers or something to that effect..
He could try to be declared disabled. If alcoholics and drug abusers can
be declared disabled and given social security disabilities checks,
surely Mitnick can portray hacking as an addiction:(
: -Richie
: --
: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
: primary: ind0...@pegasus.cc.ucf | Walking into the future holding
: other: l...@gate.net | the past's hand will hide the present
: r...@peace.engr.ucf.edu | --
: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
--
David Miller Usual disclaimers apply
Maine State Government
Rob J. Nauta
-> What he did: he broke into and trashed shimomura's computer (stealing many
-> programs). He broke into and trashed the well (doing a lot of damage even
-> before he finally started erasing things that didn't belong to him). He
-> broke into netcom and stole 20,000 credit card numbers.
You're a clueless lamer that doesnt know the facts. Better read Emmanuel
Goldstein's postings of the affidavid.
Basically, Kevin Mitnick stored a lot of files he got everywhere on an
account on the Well. The Well itself wasnt compromised. WHen they noticed
the excessive diskspace used by that user, they found out the account was
hacked. They traced connections to among others netcom, and one of the
files was netcom's 20.000 cc numbers file. 2600 has warned a few times
that this file was easily obtainable, even in the fall 1994 2600 there is
an article about it. Another 2600 has a comment from a netcom system admin
that there are no security problems, while in fact they have massive
problems. Funnily enough they never reported the theft of the file when
the Well informed them, when the FBI came for cooperation to set up netcom
to trap him they didn't, when he was arrested they didn't, only when some
police men came with that file later, they admitted it was theirs and
then they still didnt feel the need to report the theft. So blaming K.M.
for stealing it when netcom left it on their system for anyone to grab
is shooting off his mouth.
I didnt hear anywhere that he thrashed anything. Maybe that is your
imagination ?
Rob
--
-=*=- | Stichting Internet Access Eindhoven (IAE) public access UNIX
Rob J. Nauta | Phone: 040-438330 (voice), 040-439436 (16 data lines)
r...@iaehv.nl | Send mail to 'in...@iaehv.nl' with subject 'infosheet' for
-=*=- | more info, or log in as 'new' or 'info'.
Rob J. Nauta
>In <mingo-20029...@mingo.dialup.access.net> mi...@panix.com (Charlie Mingo) writes:
->> If it was a cellphone, how difficult are these to track down? Do you need a
->> scanner that follows the channels with a directional aerial? Or can it be
->> done from the base stations by measuring timing differences?
->
->Tsutomu had a scanning device, with a directional antenna, hooked up to a
->notebook. He managed to locate the building the signal was coming from,
->but he couldn't find the exact room. The FBI came in with better
->equipment, found the room, and got a warrent to enter.
>Isn't it highly illegal to receive cellular frequenties in the United
>States? I thought it was even illegal to own a scanner which has
>the possibility to receive these frequencies.
Yes it was Mitnick's downfall to hack with a cellular phone against
someone who's an expert in this field. I remember an article on alt.2600
where E.Goldstein describes Tsutomu as someone on both sides, someone who
would attend hacker conferences and demonstrate how to transform an OKI
into a cellular scanning, and listening to calls on a P.A. system. He
managed to set up a cellular scanner and obtained Mitnick phone's ID
number which he then used to track him.
The way that Tsutomu went after Mitnick ruthlessly, with illegal cellular
equipment, listening in on all cellular calls in thye area to find him,
and to track him almost to his appartment might get this charge dropped
and Tsutomu reprimanded by the court.
>It seems like a strange coincidence that a computer-expert also has knowledge
>of directional antennas and that he has time, money and enough motivation to
>play around for a few months.
Better get some background information before you assume that someone who
has computer knowledge cannot have any expertise in
>--
>M.N. Dell Home-phone : +31 3434 56478
>P.O. Box 134 University : +31 30 539209
>3956 ZT Leersum The Netherlands Internet : mnd...@cs.ruu.nl
>--
Greg Limes
In article <1995Feb21.1...@cm.cf.ac.uk> spx...@astro.cf.ac.uk (Paul Howes) writes:
| I don't quite understand all the fuss about credit card numbers. At the end
| of the day, they still need your signature. I someone uses my credit card
| details fraudulently and I have not signed the sales receipt then surely I am
| not liable for any loss.
Actually, if the data file contained the information that Netcom would
normally use to set up a billing (netcom login name, credit card
number and expiration date) then anyone with that information could
charge things to that account.
Of course, when you get your credit card statement, you probably would
notice the charges, call the company and get them "taken care of," and
at some point the investigation might make its way back to whoever
benefitted from the original fraudulant charge.
In the process, you may have to change the account number; and if its
the card you were going to put the netcom automatic billing onto, it
may have other automatic billings on it ... all in all, this becomes a
huge pain in the tail.
I went through this last september when my wallet was stolen,
including the credit card that I was using at the time for automatic
billings for my account at Netcom, along with other auto-billings. I
am fortunate, I guess, that I told netcom to forget about a new credit
card number and just send me the bills...
(ps, around here, your liability is limited to $50 if you report a
stolen credit card in a timely fashion; not quite the same as no
liability at all, but close enough)
--
-- Greg Limes li...@3do.com, li...@netcom.com
"Your reality check is in the E-mail"
Not speaking for my employer, of course
PGP key available on request
Marcus J. Ranum
> It is illegal. The cellular industry wanted to claim that calls
>made on their phones were private. Rather than spend time and energy on
>encryption or other methods of making their calls private, they "legislated"
>privacy. So they can say it's private, because you aren't allowed to listen.
Let's be a bit more accurate, shall we?
The cellular industry couldn't possibly deploy phones that had
good or even adequate encryption. Haven't you been reading the news
about Clipper and Digital Telephony?? I believe that the last serious
proposal for anything like "encryption" for cell-phones boiled down
to something ridiculous like Xoring everything with some per-session
key. Largely because law enforcement couldn't countenance the idea
of having something hard to listen into. After all "legislated" privacy
is much easier to take away than real privacy, whether you're a "Good
guy" or a "Bad guy."
mjr.
j...@asdi.saic.com
|> Richie Lai (ind0...@pegasus.cc.ucf.edu) wrote:
|> : Charlie Mingo (mi...@panix.com) wrote:
|> : : In article <3i41op$9...@news.primenet.com>, aus...@primenet.com (Ronald
|> : : Austin) wrote:
|>
|> : : It was really stupid of Mitnick to resume cracker activities while a
|> : : fugitive. Now he's going to go away for DECADES, and and FOR WHAT? Just
|> : : so he could insult Tsutomu? He must be sick (so addicted to computer
|> : : breakins, he can't stop himself even when it's in his self-interest to
|> : : refrain). It's just not worth it.
|>
|> : Nah, he'd probably plead insanity or something like that.. I remmeber
|> : vaguely of a case that happened a while's ago where a convicted computer
|> : cracker pleaded insanity or something because the psychatrist had diagnosed
|> : him as being addicted to computers or something to that effect..
|>
|>
|> He could try to be declared disabled. If alcoholics and drug abusers can
|> be declared disabled and given social security disabilities checks,
|> surely Mitnick can portray hacking as an addiction:(
it's all I have), this is exactly what the SOB's psychiatrist (or is it
"counsellor"?) is positioning for. I can't decide who's more contemptible,
Mitnick or the quacks trying to make excuses for him. "Help me, I'm
_addicted_ to hacking! I have a _disease_! I don't belong in _prison_ -
send me to a group counselling home!" What a load of crap!!!
--
__
/ / \
/ / /
/ / / /
/_____/ /____/
Ade Barkah
: The Well itself wasnt compromised. When they noticed the excessive
: diskspace used by that user, they found out the account was
: hacked.
The above statements contradict each other.
Vin McLellan
> The way that Tsutomu went after Mitnick ruthlessly, with illegal cellular
> equipment, listening in on all cellular calls in thye area to find him,
> and to track him almost to his appartment might get this charge dropped
> and Tsutomu reprimanded by the court.
Bullshit piles to an astonishing depth around this subject. Now, I
don't really _know_ that Shimomura managed to stay within the law, but
then I do know that the several people who declare that he did don't know
the facts either.
It has been reported Shimomura worked closely with the fbi and Justice
Dept. officials. I presume neither he nor his associates are dumb.
Anyone involved in this case knew it would be meticulously reviewed -- in
court, in the press, in books in multiple languages -- and illegal and
criminal acts would be documented and pinned to whatever fool tried to use
them.
There is plenty of slack in the current law to track Mitnick without
going beyond the law.
_vin
--
Vin McLellan+The Privacy Guild+<v...@shore.net>+Technical Translators' Guild = MULTI-LINGUAL tech writers, hw/sw engineers, Ph.ds: * BICULTURAL TRANSLATORS FOR HIRE * (617) 884-5546
Bob Witham Jr.
> So blaming K.M.
>for stealing it when netcom left it on their system for anyone to grab
>is shooting off his mouth.
So, you you wouldn't blame someone for stealing, say, your car right? After
all, you do leave it in your driveway for anyone to grab. Better yet, you
leave your TV right in your house for anyone to grab.
Get real. It is against the law (at least in Maine).
From Title 17-A of MRSA
"A person is guilty of criminal invasion of computer privacy if the person
intentionally accesses any computer resource knowing that the person is not
authorized to do so" (computer resource being defined as both the system and
files, so unauthorized logins are included here).
"A person is guilty of aggravated criminal invasion of computer privacy if the
person:
Intentionally makes an unauthorized copy of any computer program, computer
software or computer information, knowing that the person is not authorized to
do so information, knowing that the person is not authorized to do so."
In order to have this stand up in court though, you should have a notice
posted after users log on indicating that they are using a system of xxx
company, and that by continuing to log on, they are representing themselves to
be employees or authorized agents of xxx company, and if not they should log
off immediately.
Bob Witham
Information Systems Security Analyst
Bureau of Information Services
State of Maine
Travis Kuhn
No they don't.
Perhaps if "that user" was root, then yes. A few user accounts on a
"normal" unix box doesn't compromise it.
------------------------------------------------------------------------------
Travis Kuhn Clark College, Vancouver, Washington | PGP key
tr...@clark.edu TIP#316 Play paintball! Fence! | available
"But now I refuse to obey." -- EMACS "?" -- ed | upon request.
Kevin A. Smith
: In article <3ig230$1cf...@spider.compart.fi>,
: See above.
Why not just do what Disney does, PGP before the IP level? (which
also is convieniently before the clipper chip)
Kevin Smith
Sys Admin
Warner Brothers Imaging Technologies
ksm...@cinenet.net
Rob J. Nauta
There is a big difference between a user's account being compromised and
the Well itself being compromised. Mitnick didnt have root on the Well
alledgedly, he just used some accounts there for storage.
rob
Bruce Gingery
(Kevin A. Smith) writes:
[earlier quotes omitted]
}~ Why not just do what Disney does, PGP before the IP level? (which
}~ also is convieniently before the clipper chip)
}~
}~ Kevin Smith, Sys Admin
}~ Warner Brothers Imaging Technologies
}~ ksm...@cinenet.net
PNI TransSLIP for NEXTSTEP has hooks for exactly this.
It creates a virtual network interface at the kernel
level, allowing all kinds of encapsulations and manipulations
before it reaches the device level - which can be Ether /
ISDN / Serial ... whatever.
Essentially, it carries forward the Mach design paradigm
of moving everything OUT of the kernel that doesn't have to
be there.
Good job, Louis Mamakos!
+-+
Bruce Gingery Total System Software Cheyenne, WY USA
We do consulting over Internet. E-Mail
t...@TotSysSoft.com for quotes or more info.
NEXT IN LINE magazine staff technical writer
Bruce Gingery <bgin...@Wyoming.COM> OR <br...@TotSysSoft.com>
Multimedia: NeXTmail(tm) preferred MIME-mail welcome
Charlie Mingo
> The way that Tsutomu went after Mitnick ruthlessly, with illegal cellular
> equipment, listening in on all cellular calls in thye area to find him,
> and to track him almost to his appartment might get this charge dropped
> and Tsutomu reprimanded by the court.
I think you fail to understand that it is legal in the United States to
trace and eavesdrop on phone calls (cellular or landline) IF you first
obtain a search warrant. Otherwise, police would never be able to tap any
phone. I'm willing to bet that Netherlands police can legally eavesdrop
with a warrant as well.
You will probably not be surprised to learn that Tsutomu et al had a
warrant (this isn't his first investigation of computer crackers). The
needed the warrant before the telephone company would trace the calls to
netcom. It was issued by a US magistrate in California.
BTW: mere possession of cellular scanners isn't illegal in itself, just
manufacture or sale.
Charlie Mingo
> Mitnick didnt have root on the Well
> alledgedly, he just used some accounts there for storage.
If Mitnick didn't have root privs on the Well, how did he delete their
accounting system? Ordinary users aren't allowed to do that.
Also, if you break into a computer on which you do not have a legitimate
account, you have compromised that computer. For one thing, Mitnick was
stealing computer time (for which the Well normally charges several
dollars an hour).
Ade Barkah
: : The Well itself wasnt compromised. When they noticed the excessive
: : diskspace used by that user, they found out the account was
: : hacked.
: >The above statements contradict each other.
: There is a big difference between a user's account being compromised and
: the Well itself being compromised. Mitnick didnt have root on the Well
: alledgedly, he just used some accounts there for storage.
Well, we maintain system security for the users... so if the
user accounts are compromised to begin with, whether or not
the intruder had root privileges is academic.
-Ade Barkah
--
Head of Development
Renaissance Knowledge Systems
Englewood, Colorado
Charlie Mingo
(Robear) wrote:
> I thought it was only illegal to *eavesdrop* on these frequencies.
> Besides, they had the cooperation of the cellular phone company,
> which is the owner (or lessee) of the frequencies. So this should
> be okay in this circumstance, otherwise how could the police and
> feds do it at all?
The police and feds get a search warrant, the same as when they eavesdrop
(wiretap) on a non-cellular phone. The co-operation of the phone company
is irrelevent.
jschn...@jschneider.whc.net
>for stealing it when netcom left it on their system for anyone to grab
>is shooting off his mouth.
And leaving my money on my desk in a public building means it's OK to
steal it? The moral values of anyone who thinks it's OK to take something
because it's easy are questionable at best.
Mitnick is a criminal, and belongs behind bars. It's that simple.
------------------------------------------------------
Jon Schneider via OS/2's IAK
El Paso, TX
Home : jschn...@jschneider.whc.net
Work : je...@chevron.com
------------------------------------------------------
Frithiof Jensen
> The cellular industry couldn't possibly deploy phones that had
>good or even adequate encryption. Haven't you been reading the news
>about Clipper and Digital Telephony??
It is pretty hard cracking a GSM phone. The more interesting aspect of GSM
is that every time one move from on zone to the next, the 'phone calls the
exchange and registers itself, thus letting the exchange know where it is!
In a larger city, the cell sites may be as close as 200 m, which will give
the police a good lock on the "nasty drug-dealing scum" who bought a cell-
phone *because of* the encryption.
so there.
===============================================================================
The above article is the personal view of the poster and should not be
considered as an official comment from the JET Joint Undertaking
===============================================================================
Riku Saikkonen
>Riku Saikkonen (r...@spider.compart.fi) wrote:
>[re: using IP spoofing to execute "echo + + >>/.rhosts"]
>: But how could that command be issued? Spoofing a trusted machine? Having a
>: trusted (esp. ~root/.rhosts-trusted) machine outside one's local network
>: (assuming that a firewall filters out packets coming from the `wrong side')
>: is pretty unwise, I'd say.
>IP spoofing doesn't require this. Two local machines, A and B, might
>trust each other vi /.rhosts. Then an outside machine K can come
>along and send to A the following, *while appearing to be from B*:
How could it appear to be from B if the firewall filters out packets coming
from the outside with a local address (see the assumption up there)?
>: Which brings me to a more general topic... Why use .rhosts at all since it's
>: so insecure? Is it so much bother to type a password every now and then
>Because passwords are usually sent as cleartext, and thus can be
>(and often are) lifted for later use by others.
Well, just cleartext passwords are better in terms of security than
cleartext passwords _and_ .rhosts...
But I agree, encrypted telnet is the way to go in the long run.
--
-=- Rjs -=- r...@spider.compart.fi - IRC: Rjs
"It is useless to meet revenge with revenge: it will heal nothing."
- J.R.R. Tolkien
Daniel Dillon
Not only is it illegal to listen to cellular phone conversations, but it
recently became illegal to listen to even cordless phone conversations.
People can't seem to figure out that their phone conversations are not
private when they are broadcast, so legislation makes it illegal to
listen. This therefore INSURES the privacy of any private conversations
that you wish to broadcast for all to hear. Now that it is illegal,
noone will listen to these secret/private conversations over public
frequencies.
It is a fact that it is illegal to monitor both cordless and cellular calls.
It is NOT a fact that people will stop monitoring these frequencies.
I condone nothing illegal. I post just to inform of the cordless & cell law.
Charlie Mingo
> Basically, Kevin Mitnick stored a lot of files he got everywhere on an
> account on the Well. The Well itself wasnt compromised. WHen they noticed
> the excessive diskspace used by that user, they found out the account was
> hacked.
First, how do you reconcile the statement "The Well itself wasn't
compromised" and the statement "the [Well] account was hacked." As I see
it, when he hacked that account, he compromised the Well.
Secondly, the Well itself has stated that all their accounting records
were deleted by Mitnick. Even if this act were inadvertent, it shows that
Mitnick had the power to delete files he did not own, which also indicates
he had compromised the Well.
> I didnt hear anywhere that he thrashed anything. Maybe that is your
> imagination ?
Nope; the Well's account of his attack on them was reported in the New
York Times (and elsewhere).
Charlie Mingo
> >: The Well itself wasnt compromised. When they noticed the excessive
> >: diskspace used by that user, they found out the account was
> >: hacked.
> >
> >The above statements contradict each other.
>
> No they don't.
>
> Perhaps if "that user" was root, then yes. A few user accounts on a
> "normal" unix box doesn't compromise it.
I doubt anyone who runs a public-access unix system (like the Well) would
agree with you.
Mitnick was stealing computer time, thereby either defrauding the Well or
the legitimate owner of the account he hacked. Since the Well charges
something like $3/hour, I expect Mitnick stole many hundreds of dollars of
services.
BTW: Mitnick had the power to delete the accounting system files, so he
very likely did have root privs. Ordinary users can't delete files they
don't own.
Steve Devore
>Not only is it illegal to listen to cellular phone conversations, but it
>recently became illegal to listen to even cordless phone conversations.
>People can't seem to figure out that their phone conversations are not
>private when they are broadcast, so legislation makes it illegal to
>listen. This therefore INSURES the privacy of any private conversations
>that you wish to broadcast for all to hear. Now that it is illegal,
>noone will listen to these secret/private conversations over public
>frequencies.
By what law? Most of the cordless phones use the same frequency as baby
monitors and walkie-talkies. Unless you can site the particular law I
think you got your facts mixed up.
Steve Devore
Charlie Mingo
Dillon) wrote:
> It is a fact that it is illegal to monitor both cordless and cellular calls.
Under what law? The federal statute specifically excludes
the radio portion of a cordless telephone communication that
is transmitted between the cordless telephone hadnset and
the base unit.
18 USC 2510(12)(A).
jac...@ibm.net
>By what law? Most of the cordless phones use the same frequency as baby
>monitors and walkie-talkies. Unless you can site the particular law I
>think you got your facts mixed up.
Sorry Steve, but the original poster was right. It is technically illegal to
listen to either cellular or cordless phone calls. The fact that the particular
equipment that you mentioned operates in the same bandwidth does not
change the law. The last few paragraphs of the previous posters comment
made the point quite clear that there is a BIG difference between the law
and the reality.
I can't give you the statute, but I am an avid radiophile and the change in
legislation made many of the high end scanner manufacturers change their
receivers so that they would no longer work in these bandwidths. (The
older models are quiet popular now! :) )
Charlie Mingo
> >By what law? Most of the cordless phones use the same frequency as baby
> >monitors and walkie-talkies. Unless you can site the particular law I
> >think you got your facts mixed up.
>
> Sorry Steve, but the original poster was right. It is technically illegal to
> listen to either cellular or cordless phone calls.
>
> I can't give you the statute, but I am an avid radiophile and the change in
> legislation made many of the high end scanner manufacturers change their
> receivers so that they would no longer work in these bandwidths.
(i) The scanner legislation prohibited the manufacture or sale of
scanners that could intercept cellular (not cordless) calls. It
said nothing about their use (as that is covered by the wiretapping
statute).
(ii) The federal wiretapping statute specifically exempts:
the radio portion of a cordless telephone communication that
is transmitted between the cordless telephone handset and
the base unit.
18 USC 2510(12)(A).
If there is some other statute, I would be interested in hearing about
it. It appears to me that you may be the victim of the hyperbole that is
too frequently found in "radiophile" newsgroups.
Ade Barkah
: In article <3j1p6r$c...@magma.Mines.Colorado.EDU>,
: Ade Barkah <mba...@teton.Mines.Colorado.EDU> wrote:
: >Rob J. Nauta (r...@iaehv.IAEhv.nl) wrote:
: >
: >: The Well itself wasnt compromised. When they noticed the excessive
: >: diskspace used by that user, they found out the account was
: >: hacked.
: >
: >The above statements contradict each other.
: No they don't.
: Perhaps if "that user" was root, then yes. A few user accounts on a
: "normal" unix box doesn't compromise it.
Very funny. If any of my employees share that opinion they would
cease to have a job.
`Uh, our machine integrity is not compromized... we just have
a few hacked accounts here and there...'
Karl Strickland
> In article <3j1p6r$c...@magma.Mines.Colorado.EDU>,
> Ade Barkah <mba...@teton.Mines.Colorado.EDU> wrote:
> >Rob J. Nauta (r...@iaehv.IAEhv.nl) wrote:
> >
> >: The Well itself wasnt compromised. When they noticed the excessive
> >: diskspace used by that user, they found out the account was
> >: hacked.
> >
> >The above statements contradict each other.
>
> No they don't.
>
bollox
> Perhaps if "that user" was root, then yes. A few user accounts on a
> "normal" unix box doesn't compromise it.
wrong
--
------------------------------------------+-----------------------------------
Posted using GNUS 4.1 on FreeBSD | Karl Strickland
PGP 2.3a Public Key Available. | Internet: ka...@bagpuss.demon.co.uk
"VI. THE SHELL" - BSD PS2:1-9 :-) |
MYNOTT S T
: It is pretty hard cracking a GSM phone. The more interesting aspect of GSM
: is that every time one move from on zone to the next, the 'phone calls the
: exchange and registers itself, thus letting the exchange know where it is!
Uh? But all cellphones including analog (TACS/AMPS) do this..?
--
Steve # S.T.M...@city.ac.uk | dou...@gnu.ai.mit.edu
The Dalai Lama walks up to a hot dog vendor and says,
"Make me one with everything."
Nick Barron
In article <mingo-20029...@mingo.dialup.access.net> mi...@panix.com (Charlie Mingo) writes:
> Addiction is not a defense.
Not in the US maybe, but it has been used succesfully as a defence in the
UK, for Paul Bedford IIRC.
Jeff Levenglick
: In article <3j7oiq$a...@clark.edu> tr...@clark.edu (Travis Kuhn) writes:
: > In article <3j1p6r$c...@magma.Mines.Colorado.EDU>,
: > Ade Barkah <mba...@teton.Mines.Colorado.EDU> wrote:
: > >Rob J. Nauta (r...@iaehv.IAEhv.nl) wrote:
: > >
: > >: The Well itself wasnt compromised. When they noticed the excessive
: > >: diskspace used by that user, they found out the account was
: > >: hacked.
: > >
: > >The above statements contradict each other.
: >
: > No they don't.
: >
: bollox
: > Perhaps if "that user" was root, then yes. A few user accounts on a
: > "normal" unix box doesn't compromise it.
: wrong
wrong is right! First off, to say that The Well was not compromised is
foolish. If they were not, then how did he get on in the first place?
It is plain to see that the security they used was not good enough to
keep him (or anybody else, are you sure there are not any more hacked
accounts?) out. Also, they noticed alot of disk space used? I thought
he was at this for 2 years, how long was he on The Well before they
spotted him?
As for a user account not compromising the system. That person is now
in your system, they are not on the "outside" trying to get in. (where
your security could prevent them from getting in). If the person was
smart enough to hack an account, it is not hard at all to find and
hack the password file and give yourself superuser access.
The Well, Netcom and others will keep saying that he did not do anything
to them, look at it from their point of view, the P.R. view. If people
knew the real damage, those companies could go under.
(How does one copy 20,000 credit card numbers and not have a high
security account so any logs of this are taken out).
Think about it, the time and size of this file(s) would have set something
off, no? (time to copy)
jeff
Josh Renzema
> : >The above statements contradict each other.
>
> : No they don't.
>
> : Perhaps if "that user" was root, then yes. A few user accounts on a
> : "normal" unix box doesn't compromise it.
>
> Very funny. If any of my employees share that opinion they would
> cease to have a job.
>
> `Uh, our machine integrity is not compromized... we just have
> a few hacked accounts here and there...'
It is simply two different way of looking at security - you are looking
at it from the paranoid angle, while the other poster is looking at it
from an open angle. I personally agree with the other poster. If a
machine with a few hundred accounts has one ore two of them cracked, will
it be that big of a deal? I don't think so. If the root account is
cracked, that is an entirely different story...
Cheers!
Josh
-------------------------------------------------------------------------------
What we leave behind is less important than how we lived. -- Jean-Luc Picard
-------------------------------------------------------------------------------
Josh Renzema Student: renz...@kutztown.edu
P.O. Box 24 Internet Specialist: jo...@news.jobweb.org
Maxatawny, PA 19538 Private Life: mren...@fast.net
(610) 868-1421 x15 work
(610) 868-0208 fax
Charlie Mingo
je...@sunshine.ps.atl.sita.int (Jeff Levenglick) wrote:
>The Well, Netcom and others will keep saying that he did not do anything
>to them, look at it from their point of view, the P.R. view. If people
>knew the real damage, those companies could go under.
The Well does NOT say that Mitnick "did not do anything." On the
contrary, they say he almost put them out of business when he deleted all
their accounting records. They faced a real moral dilemma as to whether
to shut him down when they first discovered him (thus alerting him that he
was under observation) or wait for the feds to arrest him.
I would think Well users would appreciate management's honesty.
Brian Davis
Distribution:
Charlie Mingo (mi...@panix.com) wrote:
: In article <3jg4n9$s...@garuda.csulb.edu>, ddi...@csulb.edu (Daniel
: Dillon) wrote:
: > It is a fact that it is illegal to monitor both cordless and
cellular calls.
: Under what law? The federal statute specifically excludes
: the radio portion of a cordless telephone communication that
: is transmitted between the cordless telephone hadnset and
: the base unit.
: 18 USC 2510(12)(A).
It was recently (last October, I think) amended. Now you need a Title
III wiretap order to intercept lawfully the transmission between the
cordless handset and the base unit.
EBD
--
Not a lawyer on the Net, although I play one in real life.
**********************************************************
Flame way! I get treated worse in person every day!!